QKD Isn’t a Replacement for PQC

Key generation and distribution is a major area of risk after cryptographically relevant quantum computers (CRQCs) become available. Symmetric encryption algorithms, like AES, are believed to be secure against quantum computers at adequate key lengths. However, the keys that they use are often created or distributed using classical public key cryptography, which is broken by Shor's algorithm.

Quantum key distribution (QKD) and post-quantum cryptography (PQC) algorithms like ML-KEM are both quantum-resistant ways to distribute symmetric encryption keys. While the two are often presented as alternatives to one another, they're actually complementary.

What is QKD?

QKD is a set of protocols designed to take advantage of the principles of quantum mechanics to implement secure key exchange. For example, BB84 has Alice encode bits in the polarization of a photon and send them to Bob for measurement. Since the polarization basis (vertical/horizontal or diagonal) is randomly chosen, it's only possible to accurately measure the encoded value if the correct basis is selected for measurement.

This design makes it possible to identify an eavesdropper within an authenticated session. If Eve intercepts Alice's photons, measures them, and sends her own photons to Bob, incorrect guesses about the basis used by Alice will introduce errors that Alice and Bob can detect.

Why QKD Doesn't Replace PQC

QKD is commonly marketed as an alternative to PQC that offers superior security. QKD's security model is based on quantum mechanics, while PQC algorithms like ML-KEM are based on the assumption that underlying mathematical problems are quantum-resistant.

However, QKD isn't a replacement for PQC on its own. Some of the main limitations include:

• Lack of Authentication: The goal of QKD is to enable someone to create a shared secret key with the recipient of the encoded photons. However, the protocol doesn't authenticate the identity of the party on the other end, leaving it vulnerable to on-path attacks. To mitigate this, QKD either needs an authenticated classical channel (which would be secured by PQC) or preshared keys.
• Distance Limits: QKD needs either a fiber channel or line-of-sight connectivity through free space. This imposes distance limitations that are most easily fixed by trusted relays, which break the protocol's physics-based security model. Additionally, the protocol requires specialized, dedicated hardware for security.
• Implementation Impacts Security: The physics-based security guarantees of QKD have important assumptions (single encoded photons, etc.). Commercial QKD hardware has been shown to be vulnerable to attacks that exploit flawed implementations.
• Denial of Service (DoS) Attacks: QKD has certain requirements, such as the ability to detect single photons. Bursts of light or eavesdropping (which introduces errors) can render the system unusable.

The Choice Between QKD and PQC

QKD can be a useful tool, and security agencies in several countries have identified it as a fit for certain use cases. However, its limitations have led to the NSA recommending against it for national security systems. The NCSC position and a joint paper by France's ANSSI, Germany's BSI, the National Communications Security Agency (NLNCSA), and the Swedish National Communications Security Authority of the Swedish Armed Forces advocate for the use of PQC as the primary choice for secure key exchange.

Since QKD isn't a primary solution to the quantum threat, it shouldn't replace an organization's quantum migration plan. Claims that it's quantum proof are likely exaggerated and should be met by the following four questions:

• How is the link authenticated? (ideally PQC)
• How many trusted relays are needed? (ideally zero)
• Who validated the hardware? (ideally a Common Criteria lab against ETSI QKD protection profile)
• How is it patched? (patching is hard but necessary)

At the end of the day, PQC is the right choice for most businesses. The "niche" use cases of QKD will be for dedicated, high-security, point-to-point links between sites.

Educational content, not legal, financial, investment, or professional security advice. Terms