Marin Ivezic
Somewhere between the pilot press release and the procurement meeting, a quantum link stops being physics and becomes an asset on a network diagram. It arrives as a pair of appliances, a dedicated fiber, an interface that hands symmetric keys to equipment you already operate, and a set of claims about what an attacker can no longer do. The engineering question at that point is where the trust boundaries sit, how many of them there are, and who owns each one. Standard single-mode fiber absorbs light at roughly 0.2 decibels per kilometer at telecom wavelengths, and that one number ends up driving more of the security architecture than any protocol choice.
This is a guide to that architecture for people who will have to defend it. We are not going to work through the physics of every protocol. We are going to work through the trust model, because that is what changes when a quantum link goes into a network, and it is the part that vendor material tends to compress into a single sentence.
What the physics gives you
Classical networks carry bits, and a bit has a definite value that anyone with access to the medium can read and copy without leaving a trace. Quantum networks carry qubits, which are physical systems (usually single photons) prepared in states that have no classical equivalent, and which cannot be read without being changed. That second property is the useful one. It has a formal name, the no-cloning theorem, and a practical consequence: there is no way to make a faithful copy of an unknown quantum state, so there is no way to tap the channel, keep a copy, and pass the original along untouched.
Quantum key distribution, or QKD, is the application built directly on that consequence. Two endpoints exchange quantum states over a fiber or a free-space path, compare a sample of their results over an ordinary internet connection, and derive shared random bits. If someone has interfered with the quantum channel, the interference shows up as a higher error rate in the sample, and the endpoints discard the material rather than using it. The output is symmetric key material and nothing else. QKD doesn’t carry data, doesn’t authenticate anyone, and doesn’t sign anything.
The security claim attached to that key material is worth stating precisely, because it is stronger than what classical cryptography offers and narrower than the marketing suggests. Classical key exchange is computationally secure: breaking it requires solving a mathematical problem that we believe is hard, and that belief could turn out to be wrong. QKD keys are described as information-theoretically secure, meaning the guarantee comes from the properties of the channel rather than from an assumption about the attacker’s computing power. An adversary with unlimited computation still cannot reconstruct the key from what crossed the wire.
That guarantee holds for an idealized system. Every gap between the idealization and the equipment in your rack is where the rest of this article lives.
The trust boundary moves down the fiber
Photon loss is exponential in distance, and lost photons cannot be amplified back. A classical optical amplifier works by making more light, which is exactly the copying operation that quantum states forbid. The practical result is that a direct QKD link runs out somewhere in the range of 100 to 150 km of fiber before the usable key rate collapses toward zero.
Long networks get built anyway, and today they get built with trusted nodes. A trusted node is an intermediate site that terminates one QKD link, holds the resulting key in classical memory, terminates a second QKD link to the next site, and re-encrypts the key for the onward hop. The Beijing to Shanghai backbone, roughly 2,000 km of fiber, works this way. So does most of what is currently described as a national quantum network.
From a security architect’s chair, that mechanism looks different. At every trusted node, the key exists as ordinary bits in ordinary memory, on a device in a building owned by someone. The physics-based guarantee applies to each fiber segment individually. It doesn’t apply end to end. A ten-hop trusted-node path is nine additional sites whose physical security, personnel vetting, patch state, and legal jurisdiction now sit inside your key’s protection boundary.
This should feel familiar, because the industry has already learned this lesson once in a different vocabulary. Through the 1990s and 2000s, plenty of organizations treated a leased line between two facilities as inherently private and skipped link-layer encryption on the reasoning that the circuit was theirs. The disclosures of the following decade about fiber interception ended that assumption, and encrypting your own dark fiber (unlit fiber leased or owned outright, with no carrier equipment on it) became ordinary practice rather than paranoia. A trusted-node quantum network reproduces the same structure the industry just spent twenty years learning to distrust: a chain of intermediate sites that must be believed. The difference is that the sites now hold your keys in the clear rather than your traffic.
Trusted-node networks are a specific architecture with a specific and countable set of trust assumptions rather than a security failure, and those assumptions belong in the risk register alongside everything else. Where we see teams get into difficulty is when a diagram shows two endpoints and a green line, and the nine buildings in between never make it into the review.
Four attack surfaces that survive the physics
The no-cloning theorem constrains what an attacker can do to a photon in transit. It says nothing about what an attacker can do to the equipment at either end. Germany’s Federal Office for Information Security has published a study cataloguing implementation attacks against QKD systems, and the catalogue is long enough to make the point on its own: the theoretical guarantee and the deployed product are different objects.
Four families are worth knowing by name.
Detector blinding. Single-photon detectors can be driven out of their quantum operating regime by a bright continuous light. Once blinded, a detector responds to classical light pulses in a predictable way, and an attacker who controls those responses can force the receiver to record whatever outcomes the attacker wants. Lydersen and colleagues, writing in Nature Photonics in 2010, demonstrated full key recovery against two commercial systems this way, without leaving the higher error rate that the protocol relies on for detection.
Trojan-horse attacks. An attacker injects light into the sender’s equipment through the same fiber that carries the outgoing photons, and reads the reflections to learn how the internal modulators were set. Nothing about the quantum channel is broken. The attacker simply reads the transmitter’s configuration through an unintended optical path.
Imperfect sources. Real transmitters occasionally emit more than one photon in a pulse. An attacker who can split off the extra photon learns key material without disturbing what the receiver sees. This one has a mature countermeasure, the decoy-state method, in which the sender randomly varies pulse intensity so that photon-splitting shows up in the statistics. The countermeasure is standard in serious equipment, and it is worth confirming rather than assuming.
The classical control plane. Every QKD system runs software. It has a management interface, a firmware update path, an authentication mechanism for the classical channel, and log output. All of that is attackable using techniques the security team already knows. The most economical attack on a quantum-secured link is almost never optical.
Each of the optical attacks has known mitigations, and vendors have been closing them for over a decade. The point is not that QKD equipment is fragile. The point is that the threat model shifts rather than shrinking: an attacker who cannot break the mathematics goes after the hardware, and the skills required to evaluate that hardware are not the skills most security teams currently have on staff. That gap is one of the reasons this material sits in an engineering curriculum rather than an awareness deck.
The authentication dependency
The quantum channel needs a classical channel running alongside it, for sifting, error correction, and privacy amplification. That classical channel has to be authenticated. If an attacker can modify those messages, they can run a machine-in-the-middle attack and the quantum channel won’t notice, because from each endpoint’s perspective the protocol completed normally with a legitimate-looking partner.
So QKD requires authentication that it cannot itself provide. In practice this means a pre-shared secret installed out of band at both ends, refreshed from the generated key material afterwards, or a public-key signature scheme. The pre-shared route works and it scales badly: every pair of endpoints needs a secret delivered by some trustworthy human process, which is the key distribution problem that QKD was supposed to solve, now relocated to a courier.
The signature route works and it means the security of the deployment rests on a classical signature algorithm. Should that algorithm be a post-quantum one, such as ML-DSA (formerly CRYSTALS-Dilithium), the deployment now depends on exactly the kind of computational hardness assumption that QKD was chosen to avoid. That is a defensible design. It’s not the design most people think they are buying.
This is one of the technical limitations that national agencies have cited when declining to recommend QKD for their own highest-assurance traffic. The United States’ National Security Agency has published its reasoning in its guidance on quantum key distribution and quantum cryptography, the United Kingdom’s National Cyber Security Centre set out a position in its whitepaper Quantum security technologies advising against QKD for government and critical national infrastructure use, and France’s ANSSI, in its position paper on post-quantum cryptography, treats QKD as a defence-in-depth measure to be layered on top of post-quantum algorithms rather than as a replacement for them. Reasonable people disagree with these positions, and several European programmes are building quantum networks anyway. An engineer evaluating a proposal should know that the disagreement exists and should be able to say which side of it the proposal sits on.
Keying a real link
Apologies in advance, this next section is the least exciting part of any quantum network, and it is where most of the security actually gets decided.
Take a concrete case: two data centers 60 km apart, connected by leased dark fiber, carrying a 10 Gbit/s replication channel that the organization wants protected against harvest-now-decrypt-later collection. The proposal is a QKD pair feeding the existing link encryptors.
Start with the arithmetic on the key rate. Commercial systems deliver key material in the kilobit to low-megabit per second range over metro distances, with the rate falling sharply as distance grows. One-time pad encryption, the scheme that gives you an information-theoretic guarantee on the data itself, consumes key at the same rate as the data. Protecting 10 Gbit/s with a one-time pad would need 10 Gbit/s of key, which is four orders of magnitude beyond what the link produces. So the one-time pad is out, and it was always out for anything resembling production traffic.
What the link can do is feed AES-256. A 256-bit key consumed once per second is 256 bits per second, and even a modest QKD link can supply hundreds of tunnels at that rekeying interval with room to spare. The security argument becomes: the symmetric algorithm is already considered quantum-resistant at 256-bit key length, and the key delivery no longer depends on a public-key exchange that a future quantum computer could attack retroactively. That is a real and defensible benefit, and it is a much narrower claim than “unhackable.”
Then trace the key through the system. Keys leave the QKD appliances and are made available to consuming applications through a delivery interface, typically the REST-based API standardized by the European Telecommunications Standards Institute (ETSI). In most deployments a key management system (KMS) sits between the two, requesting keys, tracking key identifiers so that both ends consume the matching key, holding a buffer, and handing material to the encryptors. Every hop in that chain is classical software handling raw key material. The KMS is now one of the most sensitive systems you operate, and it deserves the same treatment as a hardware security module: hardened build, restricted management network, tamper-evident logging, and an owner.
Now ask the failure question, which is the one that matters most. The quantum channel degrades. A construction crew disturbs the fiber, the temperature swings, alignment drifts, or someone is actively interfering. The error rate rises, the system correctly refuses to generate key, and the buffer starts to drain. What do the encryptors do when the key pool empties?
There are three possible answers and only two of them are acceptable. The link can drop, which is honest and expensive. The link can continue on the last good key, which is a documented and bounded risk if the interval is short and the policy is explicit. Or the link can fall back silently to classically negotiated keys, which means an attacker’s optimal strategy is simply to degrade the fiber until the quantum protection turns itself off without anyone noticing. Whether that fallback exists, whether it alerts, and who has authority to approve it should be settled in the design review rather than discovered during an incident.
What changes when repeaters arrive
Everything above describes prepare-and-measure QKD with trusted relays, which is the technology available for purchase today. The research trajectory heads somewhere different, and the difference is worth understanding because it removes the trust problem rather than managing it.
Entanglement is a correlation between two quantum systems that is stronger than anything classical physics allows: measurements on the two halves come out correlated in ways that no shared random data could reproduce. Two nodes holding halves of an entangled pair share a resource, not a message.
That resource enables quantum teleportation, which transfers a qubit’s state from one node to another without the qubit crossing the intervening fiber. The sender performs a joint measurement on their qubit and their half of the entangled pair, sends the two-bit result over an ordinary classical channel, and the receiver applies a correction to their half. No matter travels, no signal outruns light, and the classical message is useless on its own.
It also enables entanglement swapping, where a middle node holding entanglement with each of two neighbors performs a measurement that leaves those two neighbors entangled with each other, and drops itself out of the picture. Chain enough of these together, with quantum memory to hold states while other links complete, and you have a quantum repeater: a device that extends entanglement across distance without ever holding the key in readable form. The trusted node disappears, and with it the nine buildings.
Repeaters are not a product. They are a laboratory result. The Delft group at QuTech demonstrated entanglement across three nodes in 2021, reported by Pompili and colleagues in Science, and teleportation between non-neighbouring nodes in 2022, reported by Hermans and colleagues in Nature, across metres rather than kilometres. Satellites currently do the long-distance work instead: China’s Micius satellite distributed entangled photon pairs to ground stations 1,200 km apart in 2017, reported by Yin and colleagues in Science, and supported an intercontinental key exchange for a Beijing to Vienna video call the same year.
Entanglement also underpins two protocol families that remove trust assumptions from the endpoints. Measurement-device-independent QKD, or MDI-QKD, moves the detectors to an untrusted middle node, which makes detector attacks such as blinding irrelevant to the security of the final key. Device-independent QKD, or DI-QKD, goes further and certifies security from the measured strength of the correlations themselves, so that even a compromised device cannot produce a key that passes the test. Both have been demonstrated in laboratories. Neither is something you can procure.
For a security professional, the practical takeaway is a timing one. If a proposal’s security case depends on repeaters, MDI, or DI, it is a research collaboration and should be governed as one. If it depends on prepare-and-measure QKD with trusted relays, it is a product deployment, and the trust boundary section above is the review.
Where PQC does the work
Post-quantum cryptography is the other answer to the same threat, and the two are frequently presented as rivals when their coverage barely overlaps.
PQC means classical algorithms, running on ordinary processors, designed so that no efficient quantum attack is known against them. NIST standardized the first set in 2024: ML-KEM (formerly CRYSTALS-Kyber) for key establishment, ML-DSA and SLH-DSA (formerly SPHINCS+) for signatures, with FN-DSA (formerly FALCON) following. These deploy as software and firmware updates, they work between any two endpoints with an internet connection, and they cover digital signatures, code signing, certificate hierarchies, and device authentication.
QKD covers none of that. It produces symmetric key material between two physically connected locations, and its security rests on channel properties rather than on mathematical assumptions.
Set the two side by side and the division is clear enough. Every organization needs a PQC migration, because signatures and certificates and TLS are everywhere and only algorithms can address them at that scale. A small number of organizations, on a small number of fixed high-value links, may also have a case for a quantum-keyed channel as an additional layer. The proposals we would treat sceptically are the ones offering QKD as an alternative to the migration work, because the migration work covers ground that no quantum link reaches.
Where both are in play, the sensible construction is a hybrid one: combine a PQC-derived secret with a QKD-derived secret using a key derivation function, so the resulting key is at least as strong as the stronger of the two inputs. A flaw in a lattice assumption doesn’t break the link, and neither does a flaw in a detector. That construction requires a KMS that understands both sources, which is another reason the key management layer deserves the attention.
Questions worth asking before you sign
Five questions separate a serious proposal from a demonstration dressed as one.
How many trusted nodes are on the path, who operates each one, and what is the physical and personnel security at each site? Is the classical channel authenticated with pre-shared keys or with signatures, and if signatures, which algorithm? What happens to the protected traffic when the key pool empties, and does that fallback generate an alert? Which known implementation attacks has the equipment been evaluated against, by whom, and is the report available? And what does the deployment cover that a PQC migration would not have covered on its own?
A vendor who answers all five without difficulty is worth the meeting. One who treats the third or fourth question as an implementation detail is selling a physics result rather than a security control.
Going deeper
Quantum networking sits awkwardly in most security teams, because evaluating it needs optical engineering, key management practice, and cryptographic protocol analysis at the same time, and those three rarely live in one person. That combination is the whole design brief for the network engineering path in our certification portfolio, which works through trust models, key delivery interfaces, implementation attacks, and hybrid key derivation as engineering practice rather than as physics appreciation. You can see the current programs and the assessment structure at quantumacademy.com/.
For the algorithm side of the same problem, the migration methodology at pqcframework.org covers inventory and crypto-agility work that runs in parallel with anything described here. And the longer technical treatment of quantum networking, including the protocol detail we skipped, is on PostQuantum.com.