Quantum key distribution, or QKD, lets two parties build a shared encryption key from quantum states of light and detect an eavesdropper who measures those states on the way. Physicists have proved its main protocols secure against an attacker with unlimited computing power, a future quantum computer included, under assumptions they wrote into the proofs. Among them, the devices must behave as modeled. The two parties must also be able to authenticate each other’s messages over an ordinary channel.
The U.S. National Security Agency, or NSA, wrote in October 2026 that it does not recommend QKD for national security systems “unless several technical limitations are overcome.” The agency also wrote that “the actual security of a QKD system is limited by hardware and engineering designs.” The UK’s National Cyber Security Centre, or NCSC, and security agencies in France, Germany, the Netherlands, and Sweden have reached similar conclusions, as Quantum Observer reported when NSA rewrote its guidance.
Because QKD’s secrecy follows from physics only when its hardware matches its security proofs and its classical channel is authenticated, most security agencies treat it at most as a niche complement to post-quantum cryptography, not as a replacement for it.
Post-quantum cryptography, or PQC, is a family of public-key algorithms that run on ordinary computers and are designed to resist attacks by quantum computers. NIST published its first three PQC standards in August 2024.
In its final transition plan of October 27, 2026, NIST wrote that it “will deprecate quantum-vulnerable public-key cryptography after 2030” and disallow it after 2035. The agency applied that schedule to RSA, Diffie-Hellman, and elliptic-curve algorithms at 112 bits of security strength and above. For EdDSA, it set the threshold at 128 bits.
Federal agencies face earlier deadlines. Under Executive Order 14412 and OMB memorandum M-26-15, both issued in June 2026, agencies must move high-value assets and high-impact systems to post-quantum key establishment by December 31, 2030, and to post-quantum signatures by December 31, 2031, NIST wrote. Organizations that follow NIST face its dates whether or not they also buy QKD.
What QKD does and does not do
QKD produces symmetric keys, the secret values that conventional ciphers such as AES use to encrypt data. Operators feed QKD keys into those ciphers or, far more rarely, use them as a one-time pad, a key that is as long as the message and is used only once.
The two parties, conventionally named Alice and Bob, compare a random sample of their raw key over a public channel. An eavesdropper who measured the quantum states in transit raises the quantum bit error rate, or QBER, the share of bits on which Alice and Bob disagree. If the QBER exceeds a threshold, they discard the key. Otherwise they correct the remaining errors and apply privacy amplification, a hashing step that shortens the key until an eavesdropper’s possible knowledge of it is negligible.
Alice and Bob need a separate means of confirming who is at the other end of the link. “QKD does not provide authentication, nor do any other quantum techniques,” the NCSC wrote in August 2025. An attacker who could impersonate each party to the other could run one QKD session with Alice and a second with Bob, then read and relay every message. NSA wrote that QKD users therefore need “asymmetric cryptography or preplaced keys for authentication.”
Renato Renner and Ramona Wolf, physicists at ETH Zurich, argued in a 2023 preprint that a small shared secret, such as a short pre-shared key, is enough to authenticate a QKD link without computational assumptions. They added that ordinary public-key authentication also works if no one breaks it during the session. In their account, an attacker cannot simply store the messages and wait for more powerful computers. To learn the key, the attacker “would have to hack the authentication procedure in real-time,” they wrote.
QKD does not sign documents, protect stored data, or by itself authenticate the party at the other end of a connection. Each QKD link joins two endpoints that share a compatible optical path, in fiber or free space. A carrier can own the fiber, and routes longer than one link depend on relay sites that the users must trust. NSA warned that QKD’s sensitivity to eavesdropping “also increases the risk of denial-of-service attacks.”
How the protocol families work
Prepare-and-measure
Charles Bennett and Gilles Brassard proposed the first QKD protocol, BB84, in 1984. Alice encodes each bit in one of two sets of polarization states, called bases. Bob measures each photon in a basis he picks at random. The two keep only the bits where their bases matched, a step called sifting.
An eavesdropper who does not know the basis in advance disturbs some photons when measuring them. Alice and Bob then see those errors in the QBER.
Real transmitters use weak laser pulses that sometimes contain more than one photon. From such a pulse, an eavesdropper can split off and keep one photon while letting the others continue to Bob. In 2005, Hoi-Kwong Lo, Xiongfeng Ma, and Kai Chen showed that Alice can expose that attack by varying the intensity of her pulses at random, a technique called the decoy-state method.
Entanglement-based
In 1991, Artur Ekert proposed a protocol in which a source sends one photon of each entangled pair to Alice and the other to Bob. Measurements on entangled photons give correlated results even when the photons are far apart. Ekert proposed that Alice and Bob check those correlations with a test based on Bell’s theorem. An eavesdropper who intercepts the photons weakens the correlations that Alice and Bob test.
Device-independent QKD, an extension of Ekert’s idea in which users need no detailed model of their quantum devices but must still trust their random-number sources, their classical computers, and the isolation of their laboratories, remains a laboratory technique, as Quantum Observer explains in a companion analysis of measurement-device-independent designs.
Continuous-variable
Continuous-variable QKD, or CV-QKD, encodes key information in the amplitude and phase of ordinary laser light. Frédéric Grosshans and colleagues demonstrated the main scheme in 2003. Alice varies the amplitude and phase of each laser pulse at random, following a Gaussian distribution. Bob reads the pulses with homodyne detection, which measures the light against a reference laser instead of counting single photons.
The Technical University of Denmark, or DTU, said in July 2026 that the continuous-variable approach lets QKD in its new network operate “within existing fiber telecommunications networks without modification.”
Relay-based designs
In measurement-device-independent QKD, or MDI-QKD, Alice and Bob both send light to a relay that makes every measurement, so the users no longer have to trust any detector. With a variant called twin-field QKD, researchers have distributed key across 1,002 km of fiber spooled in a laboratory. The companion analysis covers what those designs remove and what they still assume.
Deployment requirements
An authenticated classical channel
Every QKD link runs beside a classical channel for basis choices, error-correction messages, and the settings for privacy amplification. Alice and Bob must authenticate every message on it.
With preplaced keys, someone has to install the first shared secret at each end before the link starts and again after any compromise. With signatures, the operator still runs a public-key infrastructure. Once quantum computers can break RSA, those signatures must resist quantum attacks. NIST standardized two such signature schemes, ML-DSA and SLH-DSA, formerly CRYSTALS-Dilithium and SPHINCS+, in August 2024.
Dedicated fiber or wavelengths
NSA wrote that QKD requires “dedicated fiber connections or free-space transmitters.” It added that QKD’s “hardware-based nature” hinders “future upgrades and security patches.” DTU, by contrast, described its continuous-variable network as running in existing telecom fiber. Where QKD shares a fiber with classical traffic, engineers have to keep light from the classical channels from swamping the far weaker quantum signal.
Trusted nodes
Light in fiber fades exponentially with distance, so every direct QKD link has a maximum length. In 2017, Stefano Pirandola and colleagues derived the highest key rate that two parties can obtain over a lossy channel without quantum repeaters. Over long fibers, that ceiling is proportional to the fraction of light that arrives.
Network builders bridge longer routes with trusted nodes, guarded stations where keys from one link are decrypted and re-encrypted for the next. Whoever controls a trusted node can read the keys that pass through it. NSA wrote that trusted relays increase “the costs for secure facilities” and “the risk of insider threats.”
In 2021, Yu-Ao Chen and colleagues in Jian-Wei Pan’s group at the University of Science and Technology of China, or USTC, described a trusted-relay network with more than 700 fiber QKD links covering more than 2,000 km on the ground. Two satellite-to-ground links joined it into a network that let users communicate across up to 4,600 km. Renner and Wolf wrote in 2023 that quantum repeaters, devices that would extend entanglement across long distances without exposing keys, “will replace” trusted relays “in the medium-term future.” They named a repeater’s need for quantum memory as the main obstacle.
Satellites
A satellite can link ground stations too far apart for any fiber route. In 2017, Sheng-Kai Liao, Pan, and colleagues reported “a kilohertz key rate from the satellite to the ground over a distance of up to 1,200 kilometres” with Micius, a Chinese research satellite. The rate was “around 20 orders of magnitudes greater than that expected using an optical fibre of the same length,” they wrote.
In a 2018 link between China and Austria, Liao and colleagues used Micius to establish one key with the Xinglong ground station in China and another with a station in Graz. The team then used the satellite as a trusted relay, so it held both keys, they reported in Physical Review Letters.
In 2025, Yang Li, Pan, and colleagues reported in Nature a microsatellite with a 23 kg payload that shared up to 1.07 million bits of secure key during a single pass. The team linked ground stations in China and South Africa more than 12,900 km apart.
Europe’s counterpart is further off. Alan Kurešević, managing director of SES Techcom, announced another delay to SES’s Eagle-1 QKD satellite at the EU Space Days conference in late May 2026, European Spaceflight reported in July. He said the payload’s technology was still posing challenges and that launch was now expected at the end of 2027 or early 2028.
SES has presented Eagle-1 as a demonstrator. In a November 2023 release, the company said the program would demonstrate the feasibility of QKD via satellite, enable next-generation cybersecurity for EU member states, and provide mission data for a future secure quantum communication infrastructure.
Demonstrated rates and distances
The table lists secret key rates over fiber as each team reported them. The teams differ in protocol, fiber, and setting. Four of the five accounted for finite-size effects, the statistical penalty of working with a finite number of pulses. Liu and colleagues gave an asymptotic rate, calculated as if the data were unlimited.
| Team and year | Protocol | Fiber and setting | Distance | Secret key rate |
|---|---|---|---|---|
| Li et al., 2023 | Prepare-and-measure, polarization encoding | Standard fiber, laboratory | 10 km | 115.8 Mbit/s, finite-size |
| Boaron et al., 2018 | Prepare-and-measure, time-bin, one decoy | Ultralow-loss fiber, laboratory | 405 km | 6.5 bit/s, finite-size |
| Zhang et al., 2020 | Continuous-variable | Ultralow-loss fiber, laboratory | 202.81 km | 6.214 bit/s, finite-size |
| Pittaluga et al., 2025 | Twin-field | Commercial network, Frankfurt to Kehl | 254 km | 110 bit/s, finite-size |
| Liu et al., 2023 | Twin-field | Ultralow-loss fiber on spools, laboratory | 1,002 km | 0.0034 bit/s, asymptotic |
Li and colleagues reported that they reached 115.8 Mbit/s with a multipixel superconducting nanowire detector, a type that works only at cryogenic temperatures. Liu and colleagues used superconducting nanowire detectors for the 1,002 km result as well.
Toshiba Europe researchers and their partners reported their field result over a working telecom network, using detectors that need no cryogenic cooling. At their 110 bit/s, a link would take about 2.3 seconds to produce one 256-bit AES key.
Implementation attacks
In 2010, Lars Lydersen, Vadim Makarov, and colleagues showed that an attacker could blind the detectors in two commercial QKD systems with tailored bright light and take remote control of them. The authors wrote that an eavesdropper could then “tracelessly acquire the full secret key.” The companion analysis describes those detector attacks and the relay-based designs that researchers built in response.
Transmitters leak as well. In September 2026, researchers led by Kejin Wei at Guangxi University reported in the peer-reviewed journal npj Quantum Information that silicon attenuators on chip-based QKD transmitters give off faint infrared light that an eavesdropper could separate from the key signal. In worst-case simulations described in their preprint, the authors calculated that the leak could shrink a standard link’s secure range from about 320 km to 19 km. They measured the light on fabricated chips but did not demonstrate an attack on a working link, as Quantum Observer reported.
Vendors answer such findings with countermeasures that evaluators then have to test. In a 2023 study in EPJ Quantum Technology, Polina Acheva, Konstantin Zaitsev, Makarov, and colleagues built an automated testbench for attacks that take control of detectors.
The team tested a detector with a basic countermeasure that monitored its average photocurrent. The countermeasure caught continuous blinding. A pulsed blinding attack, which the team ran by hand, evaded it and still allowed eavesdropping on the key.
NSA added a new argument in October 2026. “Changing environmental conditions and physical degradation can negatively affect operational security established at the time of certification,” the agency wrote.
Certification
Under the Common Criteria, the international scheme for security evaluations, accredited laboratories test a product against a protection profile, a catalog of security requirements for one class of products. ETSI published a protection profile for QKD, GS QKD 016 version 2.1.1, in January 2024. It covers “a pair of QKD modules operating a prepare and measure QKD protocol” joined by a point-to-point link.
Germany’s Federal Office for Information Security, or BSI, certified the profile as BSI-CC-PP-0120-2024 on January 18, 2024. Products evaluated against it must meet assurance level EAL4 augmented with AVA_VAN.5, the Common Criteria component for resistance to attackers with high attack potential, and ALC_DVS.2, a development-security requirement. Telekom Security wrote the profile for BSI over about two years, Deutsche Telekom said in February 2024.
The profile defines a prepare-and-measure protocol as one “in which one QKD module prepares quantum states and the other measures quantum states.” Designs in which a third station measures or emits the light, such as MDI-QKD and entanglement-based QKD, are outside its scope. On sec-certs.org, an index of Common Criteria certificates, the entry for the profile showed no certified product claiming conformance to it on November 12, 2026.
ISO and IEC published a second framework, ISO/IEC 23837, in 2023. Its second part defines evaluation and testing methods for QKD protocol implementations, quantum optical components, and the conventional network components of QKD modules.
National schemes run in parallel. In January 2025, ID Quantique, the Geneva QKD maker, said that South Korea’s National Intelligence Service had approved its Clavis XG system. The evaluation involved the National Security Research Institute and a Common Criteria certification body, according to the company. IonQ bought a controlling stake in ID Quantique in May 2025.
In the EU, the Nostradamus project has been building a test and evaluation infrastructure for QKD systems since January 2024.
Cost
Few QKD buyers publish prices. In October 2023, DTU awarded QTI, a company in Florence, a contract worth €831,900, excluding VAT, for QKD systems on the 200 km route between Odense and Copenhagen. DTU put the route’s attenuation at about 60 dB. It planned three to four trusted nodes and wrote that “fewer trusted nodes will be preferred.”
The award covers QKD systems for one route, with options for one more device and a software-defined networking service. That contract is separate from the CV-QKD network that DTU announced in July 2026. DTU named no equipment vendor when it announced that network.
Fiber, guarded sites for the trusted nodes, and the staff to run them are separate costs for any operator. NSA counted secure facilities among the costs that trusted relays add.
Renner and Wolf, who defend QKD, acknowledged part of the cost argument. They wrote that dedicated hardware is “one of the main reasons why QKD is not widely usable today.” They also wrote that quantum networks “will most likely remain more expensive” than classical infrastructure.
Vendors ship post-quantum algorithms as software and firmware updates to protocols that organizations already run. In a joint position paper of January 2024, the French, German, Dutch, and Swedish agencies wrote that post-quantum cryptography “can be implemented on classical hardware” and deployed in existing communication infrastructure.
Where agencies stand
NSA does not recommend QKD for national security systems unless the technical limitations it lists are overcome. The NCSC wrote that it “will not support the use of QKD for government or military applications.”
France’s ANSSI, Germany’s BSI, and the national communications security agencies of the Netherlands and Sweden wrote in that paper that “QKD can in practice only be considered for some niche use cases.” They added that “QKD is not yet sufficiently mature from a security perspective.” Singapore’s Cyber Security Agency wrote in July 2026 that QKD “is not a replacement for PQC,” as Quantum Observer reported.
South Korea’s National Intelligence Service has gone the other way and approved QKD equipment for national and public institutions. Quantum Observer sets out each country’s position in its analysis of why governments split on QKD.
The European Commission is building EuroQCI with all 27 member states. DTU and its QCI.DK partners put a CV-QKD network into operation in Denmark on July 2, 2026. DTU said the network will connect four ministries and a government agency among its 10 locations. France, Germany, the Netherlands, and Sweden take part in EuroQCI, although their own security agencies see QKD as suitable only for niche uses.
The case for QKD
Renner and Wolf made the case for QKD in a 2023 preprint that answered NSA’s 2020 objections point by point. They wrote that some of NSA’s points “are unjustified” and that others “are problematic now but can be expected to be resolved in the foreseeable future.”
They wrote that QKD offers “everlasting security.” By that they meant that a key exchanged today stays secret whatever future computers or mathematicians can do, provided the link was authenticated during the session. A PQC key exchange recorded today stays secret only as long as the mathematical problem behind it stays hard.
Renner and Wolf conceded that QKD implementations remain vulnerable. They named semi-device-independent and device-independent designs as the remedy and noted that the parameters achieved in experiments were “still far from practical values.” They concluded that combining QKD with PQC “currently offers the most secure approach to data encryption.”
PQC has an implementation gap of its own. ML-KEM, formerly CRYSTALS-Kyber, is the key-encapsulation standard NIST published in 2024. In an August 2026 preprint, the researcher Bhabani Sankar Das described recovering 98.0% to 98.5% of a reused ML-KEM private key’s secret coefficients in tests, by exploiting flawed checks in shipped wolfSSL code. wolfSSL had already fixed the flaws in version 5.9.2, as Quantum Observer reported.
Where QKD fits
QKD fits a small number of fixed, high-value links in which one operator controls both ends and has a suitable optical path between them, such as a pair of data centers or government sites. Web sessions, signed software updates, and connections to arbitrary parties across the internet need authentication, signatures, and reach that QKD does not provide.
What would change this assessment
A vendor could answer part of the agencies’ implementation objection for one QKD product by obtaining an independent laboratory’s certificate for it against the ETSI profile or ISO/IEC 23837 and publishing the evaluation report. NSA’s October 2026 statement no longer contains its 2020 sentence saying it did not anticipate certifying or approving QKD products for national security customers, Quantum Observer found when it compared the two texts.
Working quantum repeaters on a deployed route would remove the need for trusted nodes and much of their cost. Certified products built on measurement-device-independent or device-independent designs would shrink the hardware assumptions that the agencies cite. A practical attack on the lattice problems behind ML-KEM would raise the value of keys whose secrecy does not depend on mathematics.
If none of those happens, QKD will stay what the agencies already call it, a tool for a few links that adds to post-quantum cryptography and does not replace it.
