The U.S. National Security Agency (NSA) published a rewritten statement on quantum key distribution on October 1, 2026, and repeated the conclusion of its 2020 guidance. “As of June 2026, the National Security Agency (NSA) does not recommend using quantum key distribution (QKD) and quantum cryptography (QC) for securing the transmission of data in National Security Systems (NSS) unless several technical limitations are overcome,” the agency wrote.
In QKD, two parties build a shared secret key from quantum states of light sent over optical fiber or through free space, in a way designed to expose eavesdropping. National security systems are networks operated by or for U.S. agencies that carry classified information or support military and intelligence missions.
NSA gave QKD vendors and buyers of national security systems the same answer it gave in 2020, plus a new argument that the security a QKD system shows at certification can degrade during operation.
The statement is one of three articles, all dated October 1, on NSA’s Post-Quantum Cryptography Resource Hub for the Department of War, national security system operators, and defense industrial base organizations. The other two articles are introductions to post-quantum cryptography (PQC), algorithms designed to resist attacks by quantum computers. NSA did not explain why it dated its QKD position to June 2026.
The five limitations
NSA kept the five limitations it listed when it first shared its QKD guidance publicly in October 2020, in response to requests from mission customers. According to NSA, QKD does not authenticate the source of a transmission, so the two parties still need public-key cryptography or keys placed in advance.
QKD also requires dedicated fiber or free-space transmitters, hardware that the agency said is difficult to upgrade or patch. NSA wrote that QKD networks often require trusted relays. The agency said such relays raise the cost of secure facilities and the risk of insider threats. A trusted relay is an intermediate station that handles key material and must itself be guarded.
The agency also wrote that “the actual security of a QKD system is limited by hardware and engineering designs.” The sensitivity that lets QKD reveal an eavesdropper also “increases the risk of denial-of-service attacks,” NSA wrote.
Changes from 2020
In the first of two new passages, the agency wrote that “changing environmental conditions and physical degradation can negatively affect operational security established at the time of certification.” In the second, NSA placed the strongest uses of quantum cryptography in “a broader, fully-quantum network that may link quantum computers and quantum sensors” and described those uses as theoretical.
NSA also dropped several passages that appeared in its 2020 text. The new article has no counterpart to the 2020 sentence in which NSA said it “does not anticipate certifying or approving any QKD or QC security products for usage by NSS customers” unless the limitations are overcome.
NSA left out its 2020 statement that QKD “cannot be implemented in software or as a service on a network.” It no longer names vendors and the media as the source of claims that QKD’s security is guaranteed by the laws of physics. The 2020 page remains online with its original text.
NSA doubled its reference list from five papers to 10. Among the additions are a study of implementation attacks on QKD systems commissioned by Germany’s Federal Office for Information Security and a 2024 paper on preparing a commercial QKD system for certification. NSA also added two preprints from 2025 and 2026, research shared before peer review.
Rules for national security systems
NSA had already advised against QKD for national security systems in its FAQ on the Commercial National Security Algorithm Suite 2.0, or CNSA 2.0, the set of quantum-resistant algorithms it specifies for those systems. NSA last revised the FAQ in December 2024.
In the FAQ, NSA answered no when asked whether a QKD system can protect a national security system from a quantum computer. “NSS owners should not use or research QKD at this time without consulting NSA directly,” the agency wrote.
In an October 1 release linking to the hub, NSA said that under Committee on National Security Systems Policy 15, all new commercial national security systems must be able to support quantum-resistant algorithms starting in 2027. Legacy systems that cannot support them are to be phased out by 2030, the agency said. In the FAQ, NSA wrote that under the same policy, new acquisitions for national security systems must comply with CNSA 2.0 by January 1, 2027, except where noted.
Allied positions
Allied security agencies have reached similar conclusions about QKD for government systems. The UK’s National Cyber Security Centre “will not support the use of QKD for government or military applications,” the agency wrote in an August 2025 white paper.
In a January 2024 position paper, security agencies from France, Germany, the Netherlands, and Sweden concluded that QKD is suitable only for niche use cases and that deploying post-quantum cryptography should take priority. The European Commission, for its part, is working with all 27 EU member states on EuroQCI, a quantum communication infrastructure intended to offer operational QKD services.
Update, November 13, 2026: NSA published version 2.2 of the FAQ, dated October 13, 2026. Its answer on QKD is unchanged, and it restates the January 1, 2027 acquisition rule.
