Quantum Repeaters: What an Architect Needs to Know Before the Sales Call

Ask a network architect what a repeater does and the answer comes back in a second: it takes a weak signal, reads it, and sends out a strong one. That definition is correct, useful, and completely wrong for the thing called a quantum repeater. A quantum repeater doesn’t read anything. It can’t. The entire design exists because reading is forbidden.

This causes real confusion in procurement. An architect who assumes “repeater” means “amplifier for qubits” will ask the wrong questions of a vendor, won’t understand why the equipment needs a cryostat and a rack of lasers, and won’t be able to tell the difference between a product that solves the trust problem and a product that relabels it. That distinction decides whether the deployment gives you end-to-end security or a chain of buildings you have to guard.

This article works from the constraint outward. First, what physics forbids. Then the trick that gets around it. Then the component that makes the trick work in a real network, which turns out to be the hardest part. Then what is actually deployable today, and what to ask about it.

The problem an amplifier cannot solve

A qubit here is the unit of quantum information carried by a property of a single photon, usually its polarisation or its arrival-time bin. It is not a bit. A bit is 0 or 1; a qubit sits in a superposition of both until measured, and that superposition is the resource everything else is built on.

Two facts about photons in fiber. The first is ordinary engineering: fiber attenuates, at roughly 0.2 dB per kilometre at 1550 nm on a good span. Over 100 km that is about 20 dB, so roughly one photon in a hundred survives. Over 500 km, one in 10^10. For a classical link you compensate with amplification, because a classical pulse contains billions of photons and an amplifier can produce more of them.

The second fact is where it breaks. The no-cloning theorem says no device can make a perfect copy of an unknown quantum state. This is not an engineering limit that better components will fix; it follows from the linearity of quantum mechanics. And measurement is no escape route, because measuring a qubit collapses the superposition, giving you one classical outcome and destroying the state you were trying to preserve.

Put those together and the classical repeater is dead on arrival. Read-and-retransmit destroys the payload. Amplify-without-reading requires cloning. There’s no third option at the level of the individual photon.

This yields a hard ceiling on any direct link, known as the repeaterless bound: for a point-to-point quantum channel, the achievable rate falls off with the transmittance of the fiber, and no amount of clever protocol design escapes it. It is a statement about the channel, not about the equipment plugged into either end. Vendors who claim to beat it on a direct fiber run without an intermediate node are claiming something the physics doesn’t allow.

Every instinct from optical transport – regeneration, amplification, forward error correction on the wire – is unavailable. The solution has to come from somewhere else entirely.

Entanglement, stated as an engineer would state it

Here is the resource that replaces amplification.

Two particles are entangled when their measurement outcomes are correlated more strongly than any pre-arranged classical agreement could produce. Suppose Alice and Bob each hold one photon of an entangled pair. Alice measures her photon’s polarisation and gets a result that looks random. Bob measures his in the same basis and gets a result perfectly correlated with hers. Neither knew the answer in advance; the randomness is generated at measurement time, and it is the same randomness at both ends.

The temptation is to model this as a shared secret handed out in advance, like a pre-placed key. That model fails a specific experimental test. Choose measurement bases at random at each end, run many pairs, and compute the correlation statistics. Entangled pairs violate a Bell inequality – they produce correlations stronger than any shared-in-advance classical arrangement can produce, whatever that arrangement is. This is not interpretation; it is a measured number, and it matters practically, because it gives you a way to check that the entanglement you paid for is real.

Two consequences an architect should hold onto. Entanglement carries no message on its own: Alice cannot use it to send Bob a chosen bit, because her outcome is random. And it is a consumable. Measuring the pair uses it up. A quantum network is therefore not a pipe carrying traffic. It is a factory whose product is entangled pairs, delivered to endpoints, consumed on use, and continuously remanufactured. Capacity planning for such a network looks more like planning a production line than sizing a link.

The swap

Now the trick.

Suppose the distance from Alice to Bob is 200 km, too far to send a photon reliably. Put a node in the middle, call it Charlie, 100 km from each. Two separate entangled pairs get made. Particles A and B are entangled, with A at Alice and B at Charlie. Particles C and D are entangled, with C at Charlie and D at Bob. Each pair only had to survive 100 km, which is hard but achievable.

Charlie now holds B and C, which have never interacted and are not entangled with each other. He performs a joint measurement on them – a Bell state measurement, or BSM – that asks which of four possible joint states the pair is in, without asking what either particle is doing individually. That distinction is the whole point. The BSM extracts a relational answer and no individual information.

The result: A and D become entangled. Alice’s photon and Bob’s photon, which have never been in the same building, are now an entangled pair. The entanglement in the two short segments has been consumed to produce entanglement across the full 200 km. This is entanglement swapping, and it is the mechanism every repeater architecture is built on.

Two details matter for anyone designing around this. The BSM has four possible outcomes, and depending on which one occurs, Alice and Bob’s pair may need a known correction applied. Charlie has to tell them which outcome he got, over an ordinary classical channel. That message is called heralding, and it is why a quantum network always ships alongside a classical control network. Heralding travels at the speed of light in fiber and no faster, so entanglement swapping does not enable faster-than-light anything. The classical message is on the critical path for every hop.

The second detail: Charlie learns nothing about any key or message. His measurement outcome tells him which of four relationships holds between two particles whose individual states he never probed. He cannot reconstruct what Alice and Bob will later measure, because that outcome does not exist yet. Chain several Charlies and the property holds at every hop. This is the security claim, and it is worth stating precisely, because it is the thing trusted nodes cannot offer.

Why the memory is the hard part

The swap above assumed both segments have a live entangled pair at the same moment. In a real network they won’t.

Entanglement generation over fiber is probabilistic. You send photons, most are lost, occasionally an attempt succeeds and the heralding signal confirms it. Segment one might succeed on attempt 400. Segment two might succeed on attempt 12,000. If the pair from segment one has evaporated by then, there is nothing to swap and both attempts are wasted.

So the node needs to hold segment one’s entanglement while segment two keeps trying. That storage device is a quantum memory: hardware that holds a qubit in superposition, without measuring it, for long enough to be useful, and then releases it on demand into the swapping operation.

The performance requirement follows from the geometry. Over 100 km of fiber, light takes about 0.5 ms one way. Heralding is a round trip. So each attempt-and-confirm cycle costs on the order of a millisecond, and if segment two needs thousands of attempts, the memory must hold coherence for hundreds of milliseconds or more. Multi-hop chains push that further, because a node may wait on several downstream segments.

Four independent specifications have to be met at once, and this is what makes the memory the hard part:

• Coherence time. Long enough to cover the expected wait. Sub-millisecond memories are useless for inter-city spacing regardless of how good they are otherwise.
• Write and read efficiency. The fraction of incoming photons actually captured, and of stored qubits actually released. Every percentage point lost here multiplies across the chain.
• Fidelity retention. The stored state degrades. A memory that holds for a second but returns a badly degraded qubit has not solved the problem.
• Telecom wavelength compatibility. Most memory physics wants specific optical transitions in atoms or defect centres, and those wavelengths are usually nowhere near the 1550 nm band where fiber is transparent. Bridging that gap requires frequency conversion, and conversion is lossy.

No platform currently leads on all four. Trapped ions offer excellent coherence and require vacuum systems and lasers. Atomic ensembles are efficient and shorter-lived. Defect centres in diamond integrate reasonably with photonics and typically need cryogenic cooling. Rare-earth doped crystals show promise for multiplexing and also want cryogenics.

The architectural point: when a vendor quotes a memory specification, ask for all four numbers together, measured on the same device, in the same run. A world-record coherence time from one experiment and a world-record efficiency from another are not a product.

Fidelity, and why the chain degrades

Real entangled pairs are imperfect. Fidelity measures how close a real pair is to the ideal one, on a scale from 0 to 1. A pair at 0.95 is good; at 0.7 it may be useless for the application on top.

Every operation costs fidelity. The photon source produces imperfect pairs. Fiber transmission adds noise. Memory storage degrades the state. The BSM has gate errors. And crucially, when Charlie swaps two pairs of fidelity 0.9 each, the output is not 0.9 – it is worse, because both inputs’ errors propagate into the result. Chain ten hops and naive fidelity multiplication drives you well below anything usable.

Two families of countermeasure exist.

Entanglement purification spends multiple noisy pairs to make one better pair. Two nodes share several low-fidelity pairs, perform local operations on them, measure some, and compare notes over the classical channel. When the comparison comes out right, the surviving pair has higher fidelity than any input. When it comes out wrong, everything is discarded and the round is repeated. The cost is throughput and latency: you need several pairs to produce one, and you need round-trip classical communication to decide.

Quantum error correction at the node encodes the logical qubit across several physical qubits so that errors can be detected and corrected without measuring the logical state. This is faster in principle – the corrections happen locally, without waiting for a round trip – and it needs a small quantum processor at every repeater station. That is a much harder box to build than a memory.

These map onto what the literature calls repeater generations. First-generation designs use heralded entanglement and two-way purification: conceptually straightforward, latency-bound by the round trips. Second- and third-generation designs progressively replace two-way communication with error correction, reaching higher rates at the cost of far more sophisticated hardware per node. Every deployed and demonstrated repeater today is first-generation. Anything marketed as one-way or all-photonic is a research architecture, and asking a vendor which generation their roadmap targets is a fast way to calibrate how far out the product really is.

There is also a threshold to keep in view. For BB84-style key distribution, the commonly cited quantum bit error rate above which no secret key can be extracted sits near 11%, under specific assumptions about the protocol and the error model. Fidelity has to stay comfortably on the right side of whatever the equivalent threshold is for your application, at the end of the chain, not at the first hop.

The thing being sold today

Now the comparison that decides most procurement conversations, because a network can be built and running today without a single quantum repeater in it.

A trusted node network divides a long route into spans short enough for direct quantum key distribution – QKD, key agreement whose security rests on physics rather than on the difficulty of a mathematical problem. Alice runs QKD with node 1 and they share key K1. Node 1 runs QKD with node 2 and they share K2. And so on to Bob. To give Alice and Bob a common key, node 1 encrypts K1 under K2 and passes it along; each node decrypts and re-encrypts under the next link’s key. The key arrives at Bob intact.

It works. China’s Beijing-Shanghai backbone runs roughly 2,000 km on this model, with more than thirty relay stations spaced at intervals short enough for direct QKD; Chen and colleagues described the integrated network it anchors in Nature in 2021. Banks and government sites along the route exchange quantum-generated keys today.

And every one of those relay stations holds the key in the clear. That’s not a bug in the implementation; it is the architecture. The node has to decrypt to re-encrypt. Compromise any station and you have the key, silently, with nothing at either endpoint indicating that anything happened.

Set the two side by side.

	Trusted node	Quantum repeater
Node holds key material	Yes, in the clear	No, at any point
Compromise of a node	Silent key disclosure	Denial of service at worst
Physical security burden	Every station, continuously	Tamper-evidence, not secrecy
Distributes entanglement	No	Yes
Deployable now	Yes, commercially	No

The last two rows are the trade. A repeater node cannot leak the key because it never has it: it performs BSMs on qubits whose eventual measurement outcomes do not exist yet. The worst a compromised repeater achieves is disruption, and disruption is loud. Meanwhile the trusted node network can be bought, installed, and operated this year.

There is a second difference that gets less attention and matters for anything beyond key exchange. A trusted node cannot distribute entanglement, only keys, because it measures. So the applications that need entanglement itself – linking quantum processors, entanglement-based sensor arrays, distributed clock synchronisation – are not merely slower over a trusted node network. They are impossible on it. If a roadmap includes any of those, trusted nodes are not a stepping stone toward it.

The honest framing for an architect: trusted nodes convert an unsolved physics problem into a solved physical-security problem. That is a real engineering trade and sometimes the right one, on a route where you already control every building. It is the wrong one where you do not, and it should never be described as quantum-secure end to end, because it isn’t.

What has actually been demonstrated

Enough to establish that every required piece works. Not enough to buy a network.

The clearest single result for repeater purposes came from Innsbruck and Paris-Saclay in 2023. Krutyanskiy and colleagues, reporting a telecom-wavelength repeater node built on a trapped-ion processor in Physical Review Letters, combined the necessary functions in one apparatus: two trapped-ion nodes, 50 km of fiber between them, photons frequency-converted to the telecom band, states buffered in long-lived memory, and heralded entanglement swapping. The rate tells you where the field is. Successful heralded events arrived at fewer than one per thousand attempts, over a run of tens of minutes – and this is the result that ticked every box at once.

Around that, the supporting demonstrations. Delft built a three-node network in 2021, reported by Pompili and colleagues in Science, using nitrogen-vacancy centres in diamond, with the middle node performing entanglement swapping between the outer two – a genuine repeater topology, within a single campus. A team at USTC in China entangled two atomic-ensemble memories across 50 km of fiber in 2020, reported by Yu and colleagues in Nature, establishing that memory-to-memory entanglement at city scale is possible, though under laboratory fiber conditions. AWS and Harvard demonstrated entanglement between two silicon-vacancy memory nodes over deployed metropolitan fiber in the Boston area, roughly 35 km, reported by Knaut and colleagues in Nature in 2024, holding the state well beyond the round-trip time – which matters because deployed fiber under city streets behaves nothing like a spool on a bench. Argonne, Fermilab and their partners have run entanglement distribution and teleportation over installed fiber in the Chicago area under the Illinois Express Quantum Network programme, building out testbed infrastructure rather than one-off results.

Reading this as a portfolio: memory works, swapping works, telecom conversion works, deployed fiber works, and each has been shown in a different apparatus by a different group. Nobody has integrated all of them into a rack-mounted unit that runs unattended for a month. That integration, not any single physics breakthrough, is what stands between here and a product.

Two observations that should shape planning. Every demonstration above involves at most one swapping hop, and the multiplication of losses and infidelities across many hops is the unsolved scaling problem. And no result to date reports an end-to-end entanglement rate through a memory-based node that would support meaningful key generation at production volumes. Any vendor timeline should be read against those two facts.

Where this sits next to post-quantum cryptography

Architects encountering quantum networking usually arrive from post-quantum cryptography – PQC, the family of classical algorithms designed to resist attack by a quantum computer, standardised by NIST as ML-KEM for key encapsulation and ML-DSA, SLH-DSA and FN-DSA for signatures. The relationship between the two is frequently misstated in both directions.

PQC is software. It runs on the hardware you own, protects data at rest and in motion, secures code signing and firmware and certificates, and can be deployed across an enterprise starting now. It is the answer to the harvest-now-decrypt-later problem for essentially all traffic, and every organisation needs a migration plan for it.

Quantum networking is infrastructure. It delivers keys between two specific endpoints that both have quantum hardware and a fiber path between them. It does not sign anything, does not protect stored data, and does not scale to arbitrary endpoints. Its security argument is different in kind: physics rather than computational hardness, though in practice it rests on hardware behaving as specified, which is an assumption with its own history. QKD systems have been broken through implementation flaws – detector blinding attacks, where an eavesdropper uses bright light to force single-photon detectors into a classical mode and reads the key undetected, are the well-known example, and they required firmware and hardware changes to close.

So the two are not competitors and one does not wait on the other. A cryptographic bill of materials (CBOM) and a PQC migration plan are current work. Quantum networking is a capability question for a small number of specific high-value links, on a longer horizon, and any strategy that defers PQC migration because quantum networks are coming has the timelines backwards.

Questions to put to a vendor

These map directly onto everything above.

Is there a quantum memory in the node? If not, whatever is being sold is either a direct QKD link or a trusted-node relay. Both are legitimate products. Neither is a repeater, and the distinction determines who has to guard the building.

Does the intermediate node ever hold key material in the clear? The single question that separates the two architectures. Any answer other than a flat no means trusted-node physical security applies at every station on the route.

Four memory numbers, one device, one run. Coherence time, write efficiency, read efficiency, fidelity after storage. Specifications assembled from separate experiments describe a research programme, not a component.

What wavelength leaves the node, and where does conversion happen? If the memory doesn’t natively operate near 1550 nm, frequency conversion sits in the path and its loss belongs in your budget.

How many swapping hops have been demonstrated end to end, on deployed fiber? One hop in a lab is where the field is. Claims of many hops in the field need a citation.

What is the end-to-end entanglement or key rate at your quoted distance, over installed fiber, sustained? Peak rates from bench runs on spooled fiber do not survive contact with a real route.

Which repeater generation does the roadmap target, and when does two-way purification come out of the loop? This tells you whether the vendor is proposing to ship an achievable first-generation system or is selling a research architecture on a product timeline.

What is the classical control network, and how is it authenticated? Heralding runs over ordinary links. Those links carry synchronisation and success confirmations, they must be authenticated, and if that authentication uses classical public-key cryptography then part of the system’s trust chain is exactly what PQC exists to replace.

What happens under jamming? Bright light in the fiber shuts down single-photon reception, and no quantum property prevents it. Availability planning is classical work and needs a classical answer.

What to take away

A quantum repeater is not an amplifier and cannot be one, because no-cloning and measurement collapse remove both classical options. It works instead by manufacturing entanglement across short segments, storing it in quantum memory until neighbouring segments are ready, and fusing segments through Bell state measurements that consume the short pairs to produce a long one. The intermediate nodes never hold the key, which is the entire security argument and the reason repeaters differ from the trusted nodes deployed today.

The hard part is the memory, and it is hard along four axes simultaneously. The unsolved part is scaling: one swapping hop has been shown many ways, and long chains have not. And the technology sits alongside post-quantum cryptography rather than replacing it, on a longer timeline, for a narrower set of links.

An architect who holds those four points can read a vendor deck accurately, which is most of what is needed for the next several years.

Quantum Academy’s Certified Quantum Networking Associate (CQNA) program develops this material into working depth: entanglement distribution protocols, memory platform trade-offs, repeater architectures by generation, network topology and routing for entanglement, and the security analysis that distinguishes an end-to-end quantum link from a relay chain. It is built for architects and engineers who need to evaluate this technology rather than build it. Details at quantumacademy.com/.

For migration methodology on the post-quantum cryptography side, the PQC Framework covers inventory and transition planning. Deeper technical treatment of quantum networking topics is available at PostQuantum.com.