Authors - Rui Liu, Neng Zeng Abstract - The Bank for International Settlements' Project Leap Phase 2 trial demonstrated that post-quantum cryptography (PQC) can be functionally integrated into the Eurozone T2 real-time gross settlement (RTGS) system, reporting an average PQC signature verification time of ≈209.9 ms against ≈28.1 ms for the traditional baseline. The report, however, explicitly leaves two questions open for "future testing phases": how the observed timing translates into an SLA-aware deployment plan, and how the system should be architected for a migration-safe transition that NIST IR 8547 recommends but Leap did not test (hybrid signature, hybrid KEM, and a non-modifying deployment path on top of the existing ESMIG/NSP stack). This paper contributes the analytical answer to the first question and audits Leap's framework for the second. We adapt the classical TCP-style timeout bound to a closed-form Watchdog inequality Ttimeout ≥E[Tcompute] + 2 · TRTT + k · σjitter, derive a sensitivity table that maps the safety multiplier k to four financial-grade SLA tiers, and a closed-form capacity-planning bound whose ratio between asynchronous and synchronous throughput is parametric in the FPGA parallelism. We then audit the Leap report against its own admitted limitations on hybrid signature testing, hybrid KEM, and the "modified ESMIG connector" workaround, and we attach to each gap a bounded fix direction expressed entirely within the cost-model envelope. We complement the analysis with a formal EUF-CMA reduction sketch for the nested PQC–RSA signature (degrading gracefully under attacks on either layer) and a production-grade C empirical anchor on a single self-contained library (the LK LEGO PQC platform, native RSA, no OpenSSL): on a commodity x86-64 cloud VM, Dilithium-5 verify takes ≈0.71 ms at the median (σjitter ≈130 µs), the nested PQC–RSA verify 0.77 ms, and the hybrid ML-KEM-768 + RSA-2048-OAEP decapsulation 1.66 ms. These refine Leap's 209.9 ms PQC verify into a fast cryptographic core (0.34%) plus a slow protocol envelope (99.66%) and show both untested hybrid constructions fit inside a single-millisecond budget; a throughput cross-check (2115 verify/s single-core, 83% scaling at 2 threads) validates the independent-cycles assumption. The measured software-only path already meets the legacy 500 ms ceiling, so FPGA acceleration is an optional optimisation rather than a requirement. Production-grade RTGS measurements with HSM transport and full ISO 20022 parsing remain future work.
Open Zoom