QKD vs post quantum cryptography where each one fits best

[Drifter]

TL;DR

• Post quantum cryptography (PQC) is software based public key cryptography that runs on existing hardware and networks
• Quantum key distribution (QKD) uses quantum states of light to establish shared keys and can reveal eavesdropping, but it needs specialised hardware and dedicated links
• In January 2024, France's ANSSI, Germany's BSI, the Netherlands NLNCSA and the Swedish Armed Forces jointly advised that PQC should be the priority and QKD has significant limitations
• The US NSA and the UK NCSC also recommend PQC as the primary defence and do not endorse QKD for general use
• QKD has niche roles in high security point to point links, research and future quantum networks, while PQC is the main road for almost everyone

Two answers to one problem

The quantum threat to public key cryptography has inspired two very different responses. One is to replace vulnerable algorithms with new mathematics that quantum computers are not known to break. That is post quantum cryptography, standardised by NIST in 2024 and now deployed widely. The other is to use quantum physics itself to distribute keys, an approach called quantum key distribution

Both are often described as quantum safe, and marketing material sometimes treats them as interchangeable. They are not. They work differently, cost differently, scale differently and suit very different situations. Understanding where each fits helps organisations spend money wisely and avoid confusion

This thread compares the two fairly. QKD is a fascinating technology with real scientific achievements behind it, and it deserves respect. It is also the subject of clear and consistent advice from national security agencies. The aim here is to explain that advice and show where each approach makes sense

How PQC works

Post quantum cryptography uses mathematical problems believed to be hard for both classical and quantum computers. ML-KEM and ML-DSA rely on problems involving structured lattices, while SLH-DSA relies on the security of hash functions and HQC on error correcting codes. These algorithms run as ordinary software on existing processors. They fit into existing protocols such as TLS, SSH and IPsec with modest changes

The great strength of PQC is deployability. It can be rolled out through software updates to billions of devices without new hardware or new cables. Browsers, operating systems, cloud services and libraries have done exactly that since 2024. PQC also handles both key establishment and digital signatures, covering the full range of public key uses

Its main limitation is that its security rests on mathematical assumptions. Cryptographers have studied lattice problems for decades, and NIST's process involved years of public analysis. Still, a future breakthrough cannot be ruled out entirely, which is why NIST standardised algorithms from different mathematical families and why many deployments use hybrids with classical algorithms. Crypto agility is the answer to that residual uncertainty

PQC also has practical costs, though smaller ones. Keys and signatures are larger, some protocols need adjustment, and implementations must resist side channel attacks. These are engineering problems with known solutions, and the first deployments have handled them well. Compared with installing new optical hardware, they are modest

How QKD works

Quantum key distribution sends individual photons, or very weak pulses of light, encoded in quantum states between two parties. Because measuring a quantum state disturbs it, an eavesdropper trying to intercept the photons introduces detectable errors. The parties compare a sample of their results over a classical channel to estimate the error rate. If it is low enough, they distil a shared secret key, and if it is too high, they abort

The best known protocol, BB84, was proposed by Charles Bennett and Gilles Brassard in 1984. Many variants have followed, including entanglement based protocols and measurement device independent schemes designed to resist certain hardware attacks. In theory, QKD offers security based on the laws of physics rather than computational assumptions. That theoretical promise is what makes it so appealing

QKD has achieved impressive milestones. China built a long QKD backbone between Beijing and Shanghai using trusted relay nodes, and its Micius satellite demonstrated satellite based QKD and entanglement distribution from 2016 onwards. Europe's EuroQCI initiative is building quantum communication infrastructure across member states, though its Eagle-1 satellite has faced delays, with reports in June 2026 suggesting launch no earlier than late 2027. Telecom operators in several countries have run metropolitan QKD trials

What the security agencies say

In January 2024, four European bodies published a joint position paper on QKD: France's ANSSI, Germany's BSI, the Netherlands National Communications Security Agency and the Swedish Armed Forces. They concluded that QKD has significant practical limitations, that it is not mature enough for most uses, and that PQC should be the priority for protecting against quantum threats. They acknowledged QKD's research value and its potential in niche cases. That paper is one of the clearest statements on the subject

The US NSA states that it does not support the use of QKD for securing national security systems unless its limitations are overcome, and recommends quantum resistant cryptography instead. The UK NCSC has similarly advised that it does not endorse QKD for government or military use and sees PQC as the better approach for most organisations. These positions come from agencies that operate some of the most sensitive networks in the world. Their consistency is notable

The agencies' concerns cluster around a few themes. QKD does not authenticate parties on its own, so it still needs classical or post quantum signatures or pre shared keys to stop man in the middle attacks. It works point to point over limited distances, typically up to roughly a hundred kilometres over fibre without trusted relays. Longer networks rely on trusted nodes, where keys exist in the clear and must be physically protected

Implementation security is another concern. Real QKD devices have been attacked through detector blinding, timing side channels and other hardware flaws, showing that theoretical security does not automatically carry over to physical equipment. Certification and validation of QKD hardware are less mature than for conventional cryptographic modules. Specialised hardware also brings cost, maintenance and supply chain considerations

Cost and practicality round out the picture. QKD systems require dedicated fibre or carefully engineered sharing, specialised transmitters and detectors, and ongoing maintenance by skilled staff. Key rates fall as distance grows, which limits how much traffic can be protected. For most organisations, those constraints outweigh the theoretical benefits

A side by side comparison

• Deployment: PQC is software on existing devices, QKD needs dedicated optical hardware and links
• Scope: PQC covers key exchange and signatures, QKD covers key exchange only and still needs authentication
• Distance: PQC works over any network including the internet, QKD is limited without trusted relays or satellites
• Security basis: PQC relies on mathematical hardness assumptions, QKD relies on physics but depends on implementation quality
• Maturity: PQC is standardised in FIPS 203, 204 and 205 and widely deployed, QKD standards and certification are still developing
• Cost: PQC adds little cost through updates, QKD requires significant capital and operating investment

Where PQC fits

For almost every organisation and every system, PQC is the right answer. Web traffic, email, messaging, VPNs, cloud services, mobile apps, payments, code signing, identity systems and IoT devices can all migrate through software and firmware updates. National timelines from the US, UK, EU, Canada, Japan and Australia are all built around PQC migration. Vendors, auditors and regulators expect it

PQC also fits the reality of modern networks. Traffic crosses many hops, providers and countries, and endpoints change constantly. A solution that runs on the endpoints themselves, regardless of the path in between, matches that reality. QKD's point to point nature does not

Where QKD may fit

QKD can make sense in narrow circumstances. A government or financial institution with fixed, high value links between a small number of sites, and the budget to install and maintain specialised equipment, may choose QKD as an additional layer alongside PQC. Some telecom operators offer QKD services for such customers. In these cases QKD is a defence in depth measure, not a replacement for PQC

Research and future quantum networks are another legitimate home for QKD. Experiments with QKD advance photonics, detectors, timing and network engineering that will matter for the broader quantum internet. Entanglement based networks may eventually support applications beyond key distribution. Funding QKD research is very different from recommending it for general security

Some organisations combine both, using QKD keys mixed with PQC derived keys so that an attacker would need to defeat both. That hybrid approach can satisfy cautious requirements in specialised settings. It inherits QKD's costs and constraints, however, so it remains niche. For most readers here, it is interesting background rather than a practical option

Guidance can evolve, of course. If future QKD systems overcome authentication, distance and certification limits, agencies may revisit their positions. The 2024 European paper acknowledged QKD's potential in the longer term. For now, however, the advice is clear and consistent

Questions to ask a QKD vendor

• How are parties authenticated, and is that authentication post quantum
• What distances and key rates are achieved on real deployed fibre
• Are trusted nodes used, and how are they physically protected
• What independent security evaluations or certifications exist for the hardware
• How does the product address detector and side channel attacks
• What happens when the quantum link fails or is disrupted

Common misunderstandings

One misunderstanding is that QKD is needed to defeat quantum computers. PQC already addresses the quantum threat to public key cryptography without new hardware. Another is that QKD is unbreakable in practice. Its theoretical security is strong, but real devices have had exploitable flaws, and it does not solve authentication on its own

A third misunderstanding is that quantum random number generators and QKD are the same thing. QRNGs simply generate random numbers from quantum processes, which can be useful for key generation but provide no key distribution. Products sometimes blur these categories in marketing. Clear terms help buyers avoid paying for the wrong thing

Closing thoughts

PQC and QKD are both products of remarkable scientific work, but they answer different needs. PQC is the practical, scalable foundation for protecting the world's communications against future quantum computers, and it is already deployed at enormous scale. QKD is a specialised tool with niche security roles and an important place in quantum networking research. Knowing the difference is one of the most useful things a Q-Day watcher can learn

If you have evaluated QKD equipment or run a QKD trial, your experience would be very welcome below. First hand reports help everyone judge vendor claims more fairly. Please include dates and the agency guidance you followed


Key references for citation

• ANSSI, BSI, NLNCSA and Swedish Armed Forces, Position Paper on Quantum Key Distribution, January 2024
• NSA, Quantum Key Distribution (QKD) and Quantum Cryptography (QC) guidance
• UK NCSC, Quantum security technologies white paper
• Bennett and Brassard, Quantum cryptography: public key distribution and coin tossing, 1984
• NIST FIPS 203, 204 and 205, August 2024