Quantum in Telecom, Sorted by Who Owns the Decision

A handset powers on at an airport gate in a country its owner has never visited. Before any call is placed, the device hides its permanent subscriber identifier and sends the concealed version to the visited network, which passes it home to be unwrapped and checked. In 5G that concealment step uses elliptic-curve cryptography, either Curve25519 or NIST P-256, depending on which profile the home operator configured. Anyone with a receiver at the gate can record the exchange. The recording is not exotic and it is not expensive. It is simply stored until the mathematics changes.

That is one transaction, on one interface, in one generation of mobile network. A national operator runs cryptographic dependencies across radio, transport, core, roaming interconnect, provisioning, billing and customer premises equipment, and almost all of them rest on the same two hard problems: integer factoring and discrete logarithms. Both fall to a quantum algorithm published in 1994.

That is one of three things people mean when they say quantum in telecom, and it is the only one with dates attached. This guide separates the three, gives each its own deadline, and ends with what an operator has to be able to do internally rather than what it has to buy.

Three technologies, one word

The confusion isn’t the reader’s fault. Three unrelated bodies of engineering share a prefix, and vendor marketing rarely helps.

Post-quantum cryptography (PQC) is ordinary software. It is a set of new mathematical problems, chosen because no efficient quantum algorithm is known against them, packaged as replacements for RSA and elliptic-curve cryptography. PQC runs on the processors an operator already owns. No new hardware, no new physics. The work is inventory, upgrade and testing, at the scale of a national network.

Quantum key distribution (QKD) and quantum random number generation (QRNG) are hardware. QKD uses the physics of single photons to establish a shared secret between two endpoints in a way that reveals interception. QRNG uses a quantum process to produce randomness that is not the output of an algorithm. Both are commercially available today, and both solve narrower problems than their marketing suggests.

Quantum computing applied to network problems is a research programme. The idea is that certain optimisation and detection problems in radio and transport networks might be solved better on quantum hardware than on classical machines. Nobody has demonstrated a durable advantage on a production-scale telecom problem yet.

Grouping these three under one budget line is the most common planning error we see. They have different owners, different timescales, and different failure modes if you get them wrong. PQC delivered late is a compliance and confidentiality failure. QKD bought early is a stranded asset. Quantum optimisation ignored is a missed option, and options are cheap to keep open.

The work with a deadline

Peter Shor’s 1994 algorithm breaks RSA, Diffie-Hellman and elliptic-curve cryptography, given a machine large enough and stable enough to run it. Such a machine is usually called a cryptographically relevant quantum computer, or CRQC. None exists in public. Symmetric cryptography is far less affected: AES-256 remains sound, and the best-known quantum attack against symmetric ciphers offers a quadratic speed-up that stronger key lengths absorb.

What has moved is not the machine but the estimate of how big it needs to be. In 2019, Craig Gidney and Martin Ekerå put the cost of factoring RSA-2048 at roughly 20 million noisy qubits running for eight hours. Later work has revised that figure downward substantially, more than once, each time through better algorithms and better error-correction accounting rather than through faster hardware progress. Resource estimates are a moving figure, and a migration plan pinned to a single published number is pinned to something that changes.

This is why the deadlines in force are regulatory rather than technical. The United States National Security Agency’s CNSA 2.0 suite sets a phased sequence for national security systems, beginning with software and firmware signing, with the full transition of national security systems targeted for 2035. In the European Union, the coordinated implementation roadmap published by the NIS Cooperation Group in 2025 asks member states to begin migration by the end of 2026 and to complete high-risk use cases by the end of 2030. Operators serving government customers inherit these dates through contracts, whether or not their own regulator has spoken.

The standards are settled enough to build against. In August 2024 NIST published three: ML-KEM for key establishment (FIPS 203, developed from CRYSTALS-Kyber), ML-DSA for digital signatures (FIPS 204, from CRYSTALS-Dilithium), and SLH-DSA for hash-based signatures (FIPS 205, from SPHINCS+). A fourth signature scheme, FN-DSA, is in draft. In March 2025 NIST selected HQC as a backup key-encapsulation mechanism built on different mathematics, insurance against a future break in the lattice family, with the standard itself still to be drafted. The current status of every one of these is on the NIST post-quantum cryptography project page.

Two deadlines, not one

Confidentiality and authentication fail on different schedules, and conflating them produces a migration plan that sequences the wrong things first.

Encrypted traffic captured today can be stored and decrypted the day a CRQC exists. This is harvest now, decrypt later, and it means the effective deadline for any confidentiality mechanism is today minus the sensitivity lifetime of what it protects. Subscriber identity concealment falls here. So does lawful intercept transport, backhaul IPsec, and any inter-operator link carrying signalling that reveals subscriber location or behaviour. If the content still has value in 2040, today’s capture already puts it past its confidentiality deadline.

Signatures work the other way. A forged signature has no retroactive power, so authentication does not carry a harvest risk. What it carries instead is device lifetime. Remote SIM provisioning uses elliptic-curve signatures to authenticate profile downloads. A cellular module shipped into a smart meter or an industrial sensor in 2027 may still be authenticating firmware in 2045, using whatever key algorithms its secure element supports. Changing that after shipment is often impossible. For the signing side of the estate, the deadline is set by the procurement calendar, not by the threat.

We teach these two deadlines separately for a reason. Teams that learn only the harvest story protect their transport links and ship another decade of unupgradeable devices.

What an operator inventory actually finds

The inventory is the part organisations underestimate, and it is the part with no shortcut. In a mobile network the quantum-vulnerable list reaches at least: subscriber identity concealment on the radio interface, remote SIM provisioning and eSIM profile signing, IPsec on backhaul and on the interfaces between radio and core, TLS on the service-based interfaces inside the 5G core, roaming interconnect protection between operators, MACsec and optical-layer encryption on transport, the operator’s own certificate authorities and hardware security modules, code signing for base station and router firmware, over-the-air update channels for handsets and customer premises equipment, VPN concentrators serving enterprise customers, and the certificates in every management plane that engineering built quietly over twenty years.

Two things reliably surprise people. The first is how much cryptography sits in equipment the operator does not control and cannot patch, which converts a security project into a vendor management project. The second is that nobody owns the list. Crypto is embedded in products bought by ten different teams across three decades, and the security function has never held a complete register of it.

Performance is a network engineering problem

The new algorithms are bigger. An X25519 public key is 32 bytes. An ML-KEM-768 encapsulation key is 1,184 bytes and its ciphertext is 1,088 bytes. An ECDSA P-256 signature is 64 bytes; an ML-DSA-65 signature is roughly 3,309 bytes.

Those numbers are trivial on a data centre link and non-trivial almost everywhere else in a telecom network. They change handshake sizes on constrained radio bearers, they interact with fragmentation, they consume storage on secure elements with fixed capacity, and they add computation on devices with fixed power budgets. Hybrid modes, which run a classical and a post-quantum algorithm together so that the connection stays secure if either survives, add both sets of bytes. This is where a PQC programme stops being a security exercise and becomes a network engineering exercise, and it is why the testing phase in every serious operator plan is longer than the deployment phase.

Crypto-agility is an architecture decision

The transition will happen more than once. HQC exists precisely because the lattice family might break. Parameter sets will be revised. Some deployed algorithm will eventually be deprecated on short notice.

The industry’s word for building so that the next change is cheaper is crypto-agility: designing systems so an algorithm can be swapped without redesigning the protocol, the storage format, or the product. Its practical prerequisite is a cryptographic bill of materials (CBOM), a machine-readable register of which algorithms, key lengths, certificates and libraries are in use in which components, maintained the way a software bill of materials is maintained.

There is a useful precedent, and it is not comforting. The weakness in the SHA-1 hash function was published in 2005. Certificate authorities agreed to stop issuing SHA-1 certificates in 2016 and browsers began rejecting them in 2017. That is eleven years for one hash function, in one industry, with a single visible enforcement point in the browser. PQC touches more algorithms, more protocols, and equipment with no browser to draw the line. Operators who start with the register rather than with a product purchase are the ones who finish. The PQC Framework sets out migration methodology in more detail than a single article can.

The GSMA has run a post-quantum taskforce for the sector since 2022, which is the natural place to look for telecom-specific guidance rather than general enterprise advice.

The work with a business case to prove

QKD is real physics and real hardware, and it answers a narrower question than most executive summaries imply.

Here is the mechanism in plain terms. Two endpoints are connected by an optical fibre. One sends single photons, each encoded in one of several quantum states. Measuring a quantum state disturbs it, so an interceptor who reads the photons in transit introduces errors the two endpoints can detect by comparing a sample of their results over a public channel. If the error rate is low enough, they keep the remaining bits as a shared secret key. That key then encrypts data using conventional symmetric cryptography, over the ordinary network.

So QKD distributes keys. It doesn’t transmit data, and it doesn’t replace encryption. It replaces one function that PQC also replaces, and it comes with constraints PQC does not have.

Photons cannot be amplified without being measured, so range is limited to something on the order of 100 km in deployed fibre. Longer links need trusted nodes: intermediate sites that receive a key, decrypt it and re-encrypt it onward. Every trusted node is a place where the key exists in classical form, which means the physics guarantee stops at the node and starts again on the other side. Quantum repeaters would remove that compromise by extending entanglement without measurement, and they depend on quantum memory that is not yet a product. QKD is also point-to-point, needs either dark fibre or careful wavelength planning to coexist with live traffic, and requires an authenticated classical channel alongside the quantum one, which itself must be secured by pre-shared keys or by post-quantum algorithms.

Several national security agencies have looked at this and reached the same conclusion for general use. The NSA does not support QKD for national security systems and points to PQC instead, citing the special hardware requirement, the trusted-node problem, the difficulty of validating implementations, and the risk of side-channel attacks against detectors. The UK’s National Cyber Security Centre gives comparable advice, and European agencies have published joint positions in the same direction.

Set against that, sustained public investment continues. China operates a quantum backbone between Beijing and Shanghai on the order of 2,000 km, and demonstrated a satellite-relayed quantum-encrypted video conference between Vienna and Beijing using the Micius satellite. The European Union is building EuroQCI as terrestrial and satellite infrastructure across member states. South Korea has funded national deployment. BT and Toshiba have operated a commercial quantum-secured metro network in London. These programmes are driven substantially by sovereignty, by the wish to hold a security capability that does not depend on the continued soundness of any published algorithm.

For a commercial operator the case closes in a small number of situations, and it is worth being specific about which. A short metro link between two sites the operator owns, where dark fibre already exists and the trusted-node problem does not arise. A customer with a sovereignty requirement written into a contract, typically government or defence. Participation in a nationally funded programme where the capital cost is shared. Outside those, PQC does the same job over the existing network at software cost.

The quieter cousin

A quantum random number generator (QRNG) produces randomness by measuring a quantum process, rather than by running a deterministic algorithm from a seed. Weak randomness has caused real key-generation failures, and QRNG chips are now cheap enough to embed in handsets. SK Telecom has shipped consumer devices with one.

QRNG is genuinely useful and genuinely modest. It improves one input to cryptography. It does not make anything quantum-safe, and a handset with a QRNG chip and an elliptic-curve-only secure element is not protected against a CRQC. Marketing in this segment blurs the two constantly, and procurement teams are the ones who have to hold the line.

The work that is still a research programme

Running a network is a long sequence of optimisation problems. Where to place cells, how to assign frequencies and physical cell identifiers so neighbours do not collide, how to schedule users across time and frequency, how to set antenna weights in a massive MIMO array, how to route and protect traffic across a transport network under failure scenarios. Most of these are combinatorial, and most are solved in production by heuristics that find a good answer quickly rather than the best answer eventually.

Quantum optimisation proposes a different way of searching. Problems are rewritten as quadratic unconstrained binary optimisation (QUBO) models, where finding the answer means finding the lowest-energy configuration of a system of binary variables, and quantum hardware searches that space using effects with no classical equivalent. Published work has mapped several telecom problems this way, including detection of overlapping signals in multi-user MIMO and decoding of LDPC error-correcting codes, both on quantum annealers.

Current hardware is described as NISQ, noisy intermediate-scale quantum: enough qubits to be interesting, not enough error correction to run long computations reliably. Problem sizes that fit are far below production scale, and translating a real network problem into a form the hardware accepts often costs more than the solve. Nothing in this area is procurement-ready.

That doesn’t make it worthless to an operator, because the cost of keeping the option open is small. What it requires is discipline about what a pilot is for. A pilot that produces a result is worth less than a pilot that produces a comparison, and the comparison has to be honest in four respects. The classical baseline must be tuned by someone who wants it to win, not a textbook implementation left at default settings. The problem instance must be large enough that the operator would care about the answer. The timing must be end-to-end, including problem formulation, embedding onto the hardware, queue time and readout, rather than the solver’s internal clock. And the cost must include the engineering time to maintain the formulation as the network changes.

Teams that set those four conditions before the pilot get a decision at the end of it. Teams that don’t get a slide.

The longer horizon

Beyond key distribution, the ambition is to move quantum states themselves between distant nodes, using entanglement rather than trusted relays. That would allow quantum processors in different locations to work as one machine, and would support distributed sensing arrays with sensitivity no single instrument can reach. The enabling technologies are quantum repeaters and quantum memory, both at laboratory stage.

Two things follow for operators. Fibre, ducts, exchange buildings and satellite capacity are the physical substrate of any such network, and telecom companies own them. And the applications of a full quantum network beyond secure key exchange are still being worked out, which is the ordinary condition of a new network technology rather than a sign of weakness. Planning horizons here are measured in decades, and the appropriate posture is a watching brief with one named person, not a programme.

Reading a quantum announcement

Most of the quantum news that reaches an executive inbox arrives as a vendor press release or a conference keynote. Seven questions separate a result from an announcement.

1. Announced or demonstrated. A roadmap milestone, a funding round and a shipped system are three different things. Roadmaps slip and are revised in place.
2. Physical or logical qubits. A physical qubit is a piece of hardware with a high error rate. A logical qubit is an error-corrected abstraction built from many physical ones, and current error-correction schemes need hundreds to thousands of physical qubits per logical qubit. A headline counting physical qubits and an estimate counting logical qubits are not comparable, and treating them as the same number is the single most common misreading in quantum coverage.
3. Laboratory fibre or deployed fibre. A QKD result over a spool of fibre on a bench does not survive temperature swings, splices, bends and the vibration of a real duct. Ask whether the link ran on installed infrastructure, and whether it shared that fibre with live traffic or needed a dedicated strand.
4. Trusted nodes in the distance figure. A quoted link distance that spans several hundred kilometres almost always includes relay sites. Ask how many, and who controls them.
5. The classical baseline. For any claimed optimisation advantage, ask what it was compared against, who wrote that comparison, and how hard they tried.
6. Keys or data. Quantum-secured usually means the keys were exchanged quantum-mechanically and the data was encrypted with AES, as normal. That is a real security property, and it is not the same as the whole link being quantum.
7. Who paid and who measured. Vendor-run benchmarks on vendor hardware are a starting point for a conversation, not a result.

Who in the organisation needs to know what

Quantum work fails on staffing more often than on technology, and it fails in a specific pattern: one enthusiast, usually in the CTO office, who understands everything and can’t get a purchase order signed.

The board and executive committee need enough to make two decisions correctly: which of the three programmes has a deadline, and what happens to the operator’s contracts if the deadline passes. Nothing further.

The security function needs depth on PQC. The migration is theirs, and it is a multi-year programme with an inventory phase, a vendor phase, a testing phase and a long tail of equipment nobody can patch.

Network and security architects need to hold both PQC and QKD well enough to say where each applies, and to defend that judgement to a customer who has read a press release.

Procurement and vendor management need the questions in the previous section in a form they can put into a request for proposal. Contract language written now determines whether the equipment bought in 2027 can be upgraded in 2032, and that is the cheapest control available to an operator today.

Radio and transport engineering need the byte-size arithmetic, because the performance consequences land on their interfaces.

Product and marketing need enough to avoid claiming a network is quantum-safe on the strength of a QRNG chip, which is a regulatory exposure as much as a reputational one.

That mapping is what we mean by capability rather than technology. An operator doesn’t buy its way out of this. It builds a shared vocabulary across six functions that do not usually read the same documents, so that the architect, the buyer and the person signing the risk acceptance are describing the same thing.

Building the capability

The three programmes in this guide need three different responses. Post-quantum cryptography needs a funded migration with an owner and a register, starting with the inventory. QKD needs a business case tested against the specific conditions where it closes. Quantum optimisation needs one informed person and a pilot designed to produce a comparison.

All three need people inside the organisation who can tell the difference without calling a vendor. That is what our training is built to produce: structured, vendor-neutral programs that take security architects, network engineers, procurement teams and executives through post-quantum migration, quantum communications and the underlying technology, at the depth each role requires.

Browse the certification programs at Quantum Academy. For deeper technical background on the algorithms and the threat model, PostQuantum.com is the reference we point learners toward, and QuantumCareers.com maps how these skills develop into roles.