QKD Is Dead Long Live PQC

QKD Is Dead. Long Live PQC.

Why national cybersecurity needs deployable cryptography, not quantum infrastructure

For years, quantum key distribution (QKD) has been marketed as the ultimate answer to the coming quantum threat: a communications technology whose security is supposedly guaranteed by the laws of physics. The proposition is seductive. If measuring a quantum state disturbs it, then an eavesdropper can be detected; if an eavesdropper can be detected, a secret key can be exchanged securely. From that elegant physical insight has grown an expensive vision of national quantum networks, dedicated optical links, trusted relay stations and ambitious deployment roadmaps. But the crucial question is not whether quantum mechanics is correct. It is whether QKD is a practical, complete, secure and economically defensible way to protect modern communications. On that test, QKD fails.

The central confusion is between a beautiful scientific protocol and an operational security system. QKD does not encrypt a message, authenticate a user, verify a digital signature or secure an application. It distributes cryptographic key material. The actual data still needs conventional encryption, and the participants must already possess a trustworthy method to authenticate the classical communications used during key exchange. Without authentication, a man-in-the-middle adversary can impersonate each endpoint. Thus the celebrated quantum solution begins by depending on a classical security problem that it does not itself solve. If we must deploy cryptographic authentication anyway, why construct an elaborate parallel physical infrastructure merely to distribute keys?

Then comes distance. Photons are lost in optical fiber, and practical QKD links face a difficult trade-off between distance, noise and secret-key generation rate. Network proposals frequently introduce trusted relay nodes at intervals dictated by the optical technology and operating conditions—often on the order of tens to roughly a hundred kilometres in conventional deployments. Those nodes must be physically protected and operationally trusted because they may handle key material. Every additional site adds cost, maintenance, insider-threat exposure and another potential point of compromise. A network sold as eliminating trust instead redistributes trust across a chain of specialized facilities.

Long-haul links compound the problem. Depending on the system and distance, usable secret-key rates can fall dramatically, sometimes into the kilobit-per-second range or lower. This is not necessarily insufficient for refreshing symmetric encryption keys, but it sharply limits the case for QKD as a flexible, high-capacity, general-purpose networking technology. Conventional networks already span continents, cross cloud providers, support mobile users and change topology dynamically. A cryptographic upgrade should fit those networks. QKD asks the networks to be rebuilt around the cryptography.

Its signature security feature also carries an operational weakness. QKD protocols are designed to notice disturbances that could indicate interception. But disturbances can arise from malicious interference as well as ordinary imperfections. An attacker who cannot steal a key may still be able to interrupt key establishment by degrading the quantum channel. Detection of tampering is not the same as continuity of service. For military command networks, financial infrastructure and emergency communications, availability is itself a security requirement. A system that is unusually sensitive to physical disruption creates an attractive denial-of-service target.

Nor does a proof about an idealized quantum protocol establish the security of the box installed in a rack. Real transmitters, photon sources, detectors, timing circuits, calibration procedures, firmware and control interfaces are imperfect. Researchers have demonstrated classes of implementation attacks against practical QKD designs, including detector manipulation and timing-related exploits. It would be inaccurate to claim that every individual device has been breached; the more consequential point is that physical implementations require painstaking validation and cannot inherit unconditional security from theory. Once security depends on engineering details, the promise of protection simply “guaranteed by physics” becomes dangerously misleading.

These are not objections confined to academic debate. The United States National Security Agency has explicitly advised against QKD for National Security Systems unless its limitations are overcome. It identifies incomplete functionality, special-purpose hardware, infrastructure and insider risks, difficulty validating actual devices, and denial-of-service exposure. Its conclusion is unmistakable: post-quantum cryptography is more cost-effective and easier to maintain, and the agency does not anticipate approving QKD products for those systems under present conditions. The NSA reaffirmed this position in an October 2026 explanation. The United Kingdom’s National Cyber Security Centre likewise does not endorse QKD for government or military applications. NATO’s published position, cited in the accompanying policy material, similarly directs quantum-safe migration toward post-quantum cryptography rather than QKD.

Post-quantum cryptography (PQC) solves the problem in the place where the problem actually lives: the software and protocols that already secure digital society. Instead of assuming that factoring or discrete logarithms will remain hard for quantum computers, PQC employs mathematical constructions believed to resist both classical and quantum attacks. It can be incorporated into existing applications, communications stacks, identity systems, hardware security modules and network equipment. It supports the wider cryptographic requirements that QKD does not address on its own, including key establishment and digital signatures. Crucially, it can be rolled out, tested, patched and replaced without installing an entirely new optical network.

The standardization process has moved beyond speculation. The US National Institute of Standards and Technology has published its initial post-quantum standards, including ML-KEM for key establishment and ML-DSA and SLH-DSA for signatures. No cryptographic design should be treated as eternally invulnerable, and PQC migration still demands disciplined implementation, interoperability testing and crypto-agility. But those are familiar engineering tasks, not a mandate to lay dedicated fibers, build secure relay rooms and operate fragile photon-level apparatus across a nation. The question for governments is no longer whether to wait for quantum-safe cryptography to become real. It is how quickly they can inventory vulnerable systems and migrate.

This distinction matters wherever governments, enterprises and critical-infrastructure operators must choose how to spend limited cybersecurity budgets. Every dollar committed to an ambitious QKD deployment is a dollar that cannot be spent on cryptographic inventories, standards-compliant migration, secure implementations, workforce training, independent testing and protection against “harvest now, decrypt later” attacks. QKD research can still have scientific value, particularly for future quantum networks. But scientific promise is not a sufficient reason to present it as the principal answer to the immediate challenge of quantum-era cybersecurity.

The question for every proposed QKD programme should therefore be simple: what operational security capability does it deliver that standards-based PQC cannot provide more cheaply, more broadly and sooner? Any credible answer must account for authentication, trusted relays, key rates, implementation vulnerabilities, denial-of-service exposure, lifecycle costs and integration with existing networks. Impressive distance records, expensive demonstrations and decade-long roadmaps are no substitute for measurable protection. Cybersecurity investment should be judged by the security it delivers to people, institutions and critical systems—not by the novelty of the underlying physics or the scale of the budget.

The quantum threat is real enough to require action now. That makes it even less defensible to confuse technological spectacle with practical protection. QKD has an important place in the history of quantum information science, and perhaps in specialized future architectures. It should not be mistaken for a scalable national cybersecurity strategy. For securing the digital systems we use today against the quantum computers of tomorrow, the strategic choice is clear: stop treating QKD as the destination. Accelerate the transition to post-quantum cryptography. QKD is dead as the default answer. Long live PQC.

Sources and further reading

NSA, Quantum Key Distribution and Quantum Cryptography — https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/

NSA, Quantum Cryptographic Solutions are Limited Compared to Post-Quantum Algorithms (2026) — https://www.nsa.gov/Cybersecurity/Post-Quantum-Cryptography-Resource-Hub/Article-Display/Article/4616320/quantum-cryptographic-solutions-are-limited-compared-to-post-quantum-algorithms/

NATO position on QKD (BSI-hosted document) — https://www.bsi.bund.de/SharedDocs/Downloads/EN/BSI/Crypto/NATO_Position-QKD.html?nn=916626

UK NCSC, Quantum Security Technologies — https://www.ncsc.gov.uk/paper/quantum-security-technologies

NIST, What Is Post-Quantum Cryptography? — https://www.nist.gov/cybersecurity-and-privacy/what-post-quantum-cryptography