Quantum Key Distribution, Read as a Security Control

The United States National Security Agency (NSA) does not support Quantum Key Distribution (QKD) for national security systems, and it has published its technical reasons. The United Kingdom’s National Cyber Security Centre (NCSC) reached a similar conclusion for critical national infrastructure. France’s ANSSI treats QKD as a defence-in-depth option to sit alongside conventional cryptography, never as a replacement for it. Meanwhile all 27 European Union member states have signed the EuroQCI declaration to build a continental quantum communication network, and China has run a quantum-secured fibre backbone between Beijing and Shanghai, roughly 2,000 km of it linked by 32 trusted nodes.

The agencies and the national programmes are answering different questions: whether QKD should be a default national policy, or whether it earns a place on one specific link belonging to one particular organisation. Most of the confusion we see in the classroom starts with that conflation.

What follows treats QKD the way you would treat any other control you were asked to approve. What is it on the diagram, what does it promise, what does it assume, how have real implementations been broken, and under what conditions does it deserve a line in the budget.

QKD on the Network Diagram

Start with the boundary, because the physics makes more sense once the box is drawn.

A QKD system is a pair of appliances sitting at two ends of an optical link. Two channels run between them. The quantum channel carries single photons or very weak laser pulses, and it is the part that does the physics. The classical channel carries ordinary digital messages, the housekeeping the protocol needs to turn raw detections into usable bits. The output is a stream of identical random bits held by both appliances and, if the protocol succeeded, by nobody else.

That output is the entire product. QKD generates key material. It does not encrypt anything, it does not sign anything, and it does not protect data sitting on a disk.

Everything downstream stays conventional. The bits are handed to a layer-2 encryptor, a VPN gateway, or a key management system, which uses them as AES keys in the normal way. ETSI’s GS QKD 014 specification defines a REST interface for that handoff, so an encryptor requests a key by identifier and receives it over a local, authenticated connection.

Here is the smallest deployment that makes sense. Two data centres 40 km apart, both owned by the same organisation, connected by dark fibre it already leases. One QKD appliance at each end. The quantum channel gets its own fibre pair or a dedicated wavelength, because single photons do not survive next to full-power telecom traffic without careful filtering. Keys are delivered into the Ethernet encryptors that are already there, refreshing every few seconds instead of every few hours.

In that example, the encryptors, the cipher, the certificates handling authentication, and the policy governing key custody and rotation all stayed the same. QKD replaced one function inside the cryptographic stack, key agreement, and only on a link where both endpoints belong to the same organisation.

That framing answers the first question a board tends to ask, which is whether QKD replaces the organisation’s cryptography. It replaces a component. The rest of the estate is untouched.

What the Physics Actually Promises

Two facts from quantum mechanics do the work.

The first is the no-cloning theorem, proved by Wootters and Zurek in 1982: an unknown quantum state cannot be copied. There is no quantum equivalent of a passive network tap, because there is nothing to duplicate without destroying. The second is that measuring a quantum state generally disturbs it. An eavesdropper who measures a photon in transit changes what the legitimate receiver sees.

BB84, published by Charles Bennett and Gilles Brassard in 1984, turns those two facts into a protocol. The sender transmits photons polarised in one of two bases, chosen at random. The receiver measures each arriving photon in a basis also chosen at random. Afterwards the two parties compare, over the classical channel, which bases they used, and they discard every case where the bases differed. They then sacrifice a sample of the surviving bits to estimate the error rate on the link. Above a threshold, they abort and try again. Below it, they run error correction, and then privacy amplification, which means hashing the shared string down to a shorter one about which any eavesdropper who partially listened knows effectively nothing.

The result is a key with information-theoretic security. That phrase has a precise meaning and it is the reason anyone bothers with QKD. A computationally secure system, which is every deployed public-key system today, is safe because breaking it requires more computation than an attacker can muster. RSA and elliptic-curve cryptography are secure in that sense, and Shor’s algorithm on a sufficiently large quantum computer removes the guarantee. Post-quantum cryptography (PQC), the family of classical algorithms NIST standardised in 2024 including ML-KEM for key encapsulation and ML-DSA for signatures, is also computationally secure, just built on mathematical problems with no known efficient quantum attack. Information-theoretic security is different in kind. It does not depend on how much computing power the attacker has, now or in fifty years.

Read the promise carefully, though, because it has three edges. It concerns the quantum channel, not the endpoints. It holds for the duration of a session, not for the lifetime of the link. And it holds given hardware that behaves the way the security proof assumes it does.

Each of the next three sections is one of those edges.

The Authentication Gap

QKD, on its own, has no idea who is at the other end.

The classical channel has to be authenticated. If it is not, an attacker sitting in the middle runs one QKD session with each party, ends up holding both keys, and relays traffic between them while the error rates on both links look perfectly healthy. The physics detected nothing, because nothing was eavesdropped. The protocol was simply run twice with the wrong counterparties.

So every real deployment needs an existing root of trust before the first photon moves. In practice that means one of two things. Either the two sites share a secret installed by courier or by hand at commissioning, or they authenticate with a signature scheme, in which case that scheme had better be quantum-safe, which today means ML-DSA or an equivalent.

QKD expands a small pre-shared secret into an unbounded stream of fresh keys, and each session’s key can also authenticate the next one. It is a key multiplier rather than a source of trust from nothing. An organisation that cannot reliably manage a couriered seed key between two of its own facilities is not ready to operate QKD, because that seed is inside the trust boundary along with the people and the procedures that placed it there.

This is also why the honest comparison is never “QKD versus PQC.” A QKD deployment contains PQC, or contains a manual key ceremony, and it always contains AES.

Implementation Is Where Security Gets Decided

The security proofs describe idealised devices. Real devices have been attacked, repeatedly, and the attacks have worked.

The best-known example is detector blinding, demonstrated by Lydersen and colleagues in 2010 against commercial systems. Shine a bright continuous light at the receiver’s single-photon detectors and they stop behaving as photon counters, switching into a classical mode where they respond only to strong pulses. An attacker can then measure the real photons, and send tailored bright pulses that force the receiver’s detectors to report exactly the outcomes the attacker chose. The error rate stays low. The legitimate parties see a clean link and derive a key the attacker also holds.

Other attacks exploit the light source. Practical systems use attenuated lasers rather than true single-photon emitters, so some pulses contain more than one photon, and an attacker can split one off and keep it. The countermeasure, decoy-state QKD, is now standard and works well, but it is a countermeasure, added after the vulnerability was understood. Trojan-horse attacks send light into the sender’s apparatus and read the reflection to learn the modulator settings. Denial of service is the easiest attack of all: absorb or scatter the quantum signal and the link stops producing keys. The attacker learns nothing and takes the service down anyway, which matters if the link carries anything time-sensitive.

None of these break physics. They exploit the gap between the device in the proof and the device in the rack, and that is a familiar gap to anyone who has read a firmware advisory.

Two protocol families respond directly. Measurement-device-independent QKD (MDI-QKD) removes trust in the detectors by having both parties send photons to an intermediate node that performs a joint measurement; even a fully malicious node learns nothing about the resulting key. Device-independent QKD (DI-QKD) goes further, deriving security from observed violations of Bell’s inequality rather than from any assumption about the internals of the equipment. MDI-QKD has been demonstrated over hundreds of kilometres of fibre. DI-QKD works in the laboratory at short range and low rates, and is not a procurement option today.

The practical instruction for a security professional is ordinary. Ask for evaluation evidence, not physics. ISO/IEC 23837 sets out security requirements and evaluation methods for QKD systems, and Common Criteria work builds on it. A vendor who answers a question about detector countermeasures by restating the no-cloning theorem has answered a different question.

Distance, Key Rates, and the Trusted Node

Loss in optical fibre is exponential in distance, and single photons cannot be amplified, because amplification is copying and copying is exactly what quantum mechanics forbids.

Practical fibre links run to roughly 100 km at useful key rates. Boaron and colleagues reported a working link over 421 km of ultra-low-loss fibre in 2018, using superconducting detectors held near absolute zero, and twin-field variants have since been pushed considerably further in laboratory conditions. Those are demonstrations, not products.

Key rates matter as much as distance, and they get less attention. A metro QKD link produces key material at rates measured in kilobits to megabits per second. That is generous for AES rekeying, where a 256-bit key every second is already aggressive. It is nowhere near enough for a one-time pad, the encryption scheme where the key must be as long as the message and which is the only construction that inherits QKD’s information-theoretic security end to end. At one megabit per second of key, you can one-time-pad one megabit per second of traffic. Vendors who describe their product as delivering unbreakable encryption are usually describing AES with frequent rekeying, which is a good thing to have and is not the same claim.

Beyond about 100 km, distance is bridged in one of two ways today. Satellites are one: China’s Micius spacecraft, launched in 2016, distributed entangled photons over 1,200 km to ground stations, and the integrated network reported in Nature in 2021 linked more than 150 users across 4,600 km by combining fibre and satellite segments.

The other way is the trusted node, and this is where security teams should slow down. A trusted node is a relay that runs QKD with the segment on each side, decrypts the key material arriving from one link, and re-encrypts it onto the next. The key exists in cleartext inside that relay. The Beijing-Shanghai backbone uses 32 of them. So a 2,000 km quantum-secured backbone offers information-theoretic security on each hop and offers, at the level of the whole path, exactly the security of its least well-guarded relay room. That is a physical security and personnel problem, not a cryptographic one, and it is a large part of why the calculation looks different for a state operating its own fibre than for a bank leasing capacity from a carrier.

Quantum repeaters would remove the trusted node by extending entanglement across segments without ever exposing the key. Laboratory demonstrations exist. Deployable repeaters do not, and no one should build a five-year plan on their arrival.

Why the Agencies Disagree

This is where the opening positions separate.

The NSA’s published position on QKD lists the practical limitations rather than disputing the physics: the requirement for special-purpose hardware, the point-to-point topology, the dependence on an authentication mechanism that QKD does not itself provide, the increased attack surface of a new class of appliance, and the cost relative to the alternative. The NCSC’s whitepaper on quantum security technologies reaches a comparable conclusion for critical national infrastructure and points readers toward post-quantum cryptography. ANSSI’s position is narrower and more permissive: QKD may add value as an additional layer on specific links, alongside conventional cryptography, and never on its own.

Set against that, the European Commission’s EuroQCI programme has commitment from every member state, and the funding lines are real. China’s national deployment is operational and carrying traffic.

These are not verdicts on the same question. The agency positions answer whether QKD should be the recommended default for securing government and national infrastructure communications at scale, where the honest answer is that PQC covers vastly more of the estate for vastly less money and disruption. The national programmes answer a different question, which mixes cryptography with industrial policy and sovereignty: whether a bloc wants domestic capability in quantum communication hardware, and whether it wants links whose security does not depend on any mathematical assumption at all.

Both answers can be right at once, and a security professional who can explain that in a meeting is more useful than one who has memorised either position.

The market rarely presents it that way. Most QKD marketing quotes the deployment figures without the agency positions, and most QKD scepticism quotes the agency positions without noticing that four governments are building anyway. Neither half is a briefing.

When QKD Earns Its Place

We teach this as a set of conditions, and the deal is that they are conjunctive. Every one has to hold.

• Both endpoints are yours. QKD secures a link, not a route across networks you do not control.
• The distance works. Under about 100 km on fibre you own or lease, or you accept trusted-node relays in facilities whose physical security you can actually attest to.
• The data has a long confidentiality horizon. Decades, not quarters. If the material loses value in three years, computational security is sufficient.
• There is a requirement naming it, whether regulatory, contractual, or sovereignty-driven. Assurance that no one asked for is hard to defend at renewal.
• The budget covers the whole thing, meaning appliances at both ends, dedicated fibre or wavelengths, integration with the encryptors, and the ongoing physical security of every node.
• PQC migration is already running. QKD protects key agreement on one link. It does nothing for your certificate hierarchy, your code signing, your firmware, your archives, or the several hundred other places cryptography lives in your estate.

Fail one of those and the answer for that link is PQC, delivered in software, at a fraction of the cost and effort.

The clearest genuine fits today share a shape: a small number of fixed, high-value, short-haul links between facilities under single ownership. Two data centres in one metro area. A headquarters and its disaster recovery site. A national laboratory and its ministry. Nothing about that shape resembles the general internet, and nothing about the roadmap suggests it will.

Where QKD Sits in a Quantum-Readiness Programme

Put it last, deliberately.

The work that has to happen regardless starts with a cryptographic inventory: where keys live, which algorithms are in use, which systems can be upgraded and which cannot, and how long each class of data must stay confidential. That last figure drives everything. Harvest now, decrypt later (HNDL) is the risk that an adversary records encrypted traffic today and decrypts it once a cryptographically relevant quantum computer exists, and it only bites data whose confidentiality horizon extends past that point.

Crypto-agility comes next, meaning the ability to change algorithms without redesigning the system around them. Then the PQC migration itself, prioritised by the inventory. The PQC Framework at pqcframework.org sets out that methodology in detail.

QKD enters as a per-link decision, made after the inventory exists, with a written threat model explaining what it adds over PQC on that specific link and who accepted the residual risks around authentication, trusted nodes, and availability. Made in that order, it is a defensible architectural choice. Made first, it is an expensive appliance protecting one path across an estate that has not been mapped.

For the underlying protocol detail, including entanglement-based schemes and the newer protocol families, PostQuantum.com carries a longer technical treatment in Quantum Key Distribution (QKD) for Cybersecurity Professionals.

Learning This Properly

Everything above is the assessment layer. Deploying or auditing a QKD link asks for more: how key delivery interfaces work in practice, how trusted-node architectures are designed and where their trust boundaries sit, how to specify authentication for the classical channel, and how to read a vendor’s evaluation evidence against the ISO/IEC requirements rather than against a physics claim.

That material sits in our quantum networking track, which covers quantum network architecture, QKD protocols and their deployment constraints, and the integration questions a security architect will actually face. Learners come to it from security and networking backgrounds rather than from physics, and the assessment is built around architectural judgement rather than protocol recall.

You can review the programs and access options at quantumacademy.com/. If the immediate need is migration planning rather than network design, start with the post-quantum cryptography path instead, since that is where the majority of the work sits for the majority of organisations.