curviocheerdck Contact the editors

Section II · Quantum Technology

Quantum Communication and Post-Quantum Cryptography

Two responses to the prospect of a cryptographically relevant quantum computer are compared: distributing keys with photons, and replacing the underlying mathematics.

Scope and methodology

This section compares quantum key distribution (QKD) over optical fibre and satellite links with post-quantum cryptography (PQC) as standardised by the United States National Institute of Standards and Technology. Comparison is made on security assumption, operating range, key or data rate, infrastructure requirement, authentication dependency, unit cost and deployment status. Sources are journal articles, standards documents and government technical guidance.

The cryptanalytic threat

Shor's 1994 algorithm factors integers and computes discrete logarithms in polynomial time on a quantum computer, breaking RSA, Diffie–Hellman and elliptic-curve schemes that secure most present-day communication.1 Resource estimates have fallen steadily. Gidney and Ekerå calculated in 2021 that RSA-2048 could be factored in about eight hours with 20 million noisy physical qubits;2 a 2025 revision reduced the requirement to under one million qubits running for less than a week.3 No machine of that size exists, but data recorded today and decrypted later remains exposed, which is the rationale for migration before the capability arrives.

Quantum key distribution protocols

The BB84 protocol of Bennett and Brassard encodes key bits in the polarisation of single photons; an eavesdropper who measures a photon disturbs its state and is detected through the error rate.4 Practical systems use attenuated laser pulses with decoy states to defeat photon-number-splitting attacks, and measurement-device-independent variants to remove detector side channels. Because photons are lost exponentially in fibre, the achievable key rate falls with distance and repeaterless protocols face a fundamental rate–distance bound. Twin-field QKD circumvents that bound by interfering weak pulses at a central untrusted node, scaling as the square root of channel transmittance rather than linearly.5 Twin-field links have been demonstrated over 1,000 km of ultra-low-loss fibre, though at key rates of only a few bits per second.

Commercial metropolitan systems deliver 1 to 10 kilobits per second of secret key over 50 to 100 km of dark fibre, sufficient to refresh symmetric keys for encryptors but not to encrypt traffic directly by one-time pad. Hardware from ID Quantique and Toshiba is priced in the range of EUR 50,000 to 150,000 per link pair, excluding the dedicated fibre.

Rack-mounted optical equipment with bundled fibre patch cables of the kind used at a quantum key distribution node
Fig. 1. Fibre patch infrastructure at a network node. QKD transmitters and receivers occupy standard rack units but require dark fibre or dedicated wavelength channels.

Fibre backbones and satellite links

China's Micius satellite distributed keys between ground stations 1,200 km apart in 2017, exceeding the practical fibre limit by an order of magnitude.6 By 2021 the satellite link had been integrated with a 2,000 km Beijing–Shanghai fibre backbone comprising more than 700 fibre QKD links and two satellite ground stations, forming a 4,600 km network serving about 150 users.7 The European Union's EuroQCI programme and the United Kingdom–Singapore SpeQtral partnership pursue similar architectures. Every such network relies on trusted relay nodes at which keys exist in classical form; a true quantum repeater, which would preserve entanglement across nodes without exposing the key, requires quantum memories that remain a laboratory technology.

Post-quantum cryptography standards

On 13 August 2024 NIST published three Federal Information Processing Standards: FIPS 203 (ML-KEM, derived from CRYSTALS-Kyber) for key encapsulation, FIPS 204 (ML-DSA, from CRYSTALS-Dilithium) for signatures, and FIPS 205 (SLH-DSA, from SPHINCS+) as a hash-based signature alternative.8 A fourth key-encapsulation scheme, HQC, was selected in March 2025 as a code-based backup with a different mathematical foundation. The schemes run on existing hardware; their cost is bandwidth. An ML-KEM-768 public key occupies 1,184 bytes against 32 bytes for X25519, and an ML-DSA-65 signature occupies 3,309 bytes against 64 for Ed25519.

Deployment has been rapid. Major browsers and content delivery networks negotiate hybrid X25519MLKEM768 key exchange by default; Apple's iMessage PQ3 and the Signal protocol's PQXDH incorporate ML-KEM. The United States National Security Agency's CNSA 2.0 suite requires PQC in national security systems on a schedule running from 2025 to 2033.9

Comparative register

Table 1. Quantum key distribution and post-quantum cryptography compared.
BasisQuantum key distributionPost-quantum cryptography
Security assumptionLaws of quantum mechanics; correctness of device modelHardness of lattice, hash or code problems
Range50 – 100 km fibre per hop; 1,200 km via satelliteUnlimited; any IP path
Rate1 – 10 kbit/s key at metropolitan distanceLine rate; overhead of 1 – 4 kB per handshake
InfrastructureDark fibre, single-photon detectors, trusted nodesSoftware update
AuthenticationRequires pre-shared key or classical signaturesProvided by ML-DSA / SLH-DSA
Unit costEUR 50,000 – 150,000 per link pairNegligible per endpoint
StatusNational pilots; niche commercial linksStandardised 2024; deployed in browsers and messaging

Assessment

The United Kingdom's National Cyber Security Centre and the United States National Security Agency both advise that QKD is not endorsed for government or national security systems, citing its dependence on trusted nodes, specialised hardware, and the absence of a solution to authentication, and recommend PQC as the primary mitigation.10

  • QKD offers a security argument grounded in physics rather than computational hardness, and is deployable now over metropolitan fibre; it is expensive, range-limited and dependent on trusted relays.
  • PQC is deployable in software at negligible cost and is already protecting most web traffic; its security rests on problems that have received less cryptanalytic scrutiny than RSA, as the 2022 break of the SIKE candidate illustrated.

The two approaches are complementary rather than competing: PQC for authentication and general key exchange, QKD for a limited set of fixed high-value links where fibre is available and the trusted-node model is acceptable. The register treats a functioning quantum repeater network as an open research problem without a stated schedule.

References

  1. Shor, P. W. "Polynomial-Time Algorithms for Prime Factorization and Discrete Logarithms on a Quantum Computer." SIAM Journal on Computing 26, 1484–1509 (1997); preprint arXiv:quant-ph/9508027. ↩
  2. Gidney, C. and Ekerå, M. "How to factor 2048 bit RSA integers in 8 hours using 20 million noisy qubits." Quantum 5, 433 (2021). doi:10.22331/q-2021-04-15-433 ↩
  3. Gidney, C. "How to factor 2048 bit RSA integers with less than a million noisy qubits." Preprint arXiv:2505.15917 (2025). ↩
  4. Bennett, C. H. and Brassard, G. "Quantum cryptography: Public key distribution and coin tossing." Theoretical Computer Science 560, 7–11 (2014), reprinting the 1984 conference paper. doi:10.1016/j.tcs.2014.05.025 ↩
  5. Lucamarini, M., Yuan, Z. L., Dynes, J. F. and Shields, A. J. "Overcoming the rate–distance limit of quantum key distribution without quantum repeaters." Nature 557, 400–403 (2018). doi:10.1038/s41586-018-0066-6 ↩
  6. Liao, S.-K. et al. "Satellite-to-ground quantum key distribution." Nature 549, 43–47 (2017). doi:10.1038/nature23655 ↩
  7. Chen, Y.-A. et al. "An integrated space-to-ground quantum communication network over 4,600 kilometres." Nature 589, 214–219 (2021). doi:10.1038/s41586-020-03093-8 ↩
  8. National Institute of Standards and Technology. FIPS 203, Module-Lattice-Based Key-Encapsulation Mechanism Standard (2024). csrc.nist.gov/pubs/fips/203/final; see also FIPS 204 and FIPS 205 at the same repository. ↩
  9. National Security Agency. "Announcing the Commercial National Security Algorithm Suite 2.0." Cybersecurity Advisory (2022). media.defense.gov ↩
  10. National Cyber Security Centre. "Quantum security technologies." White paper (2020). ncsc.gov.uk/whitepaper/quantum-security-technologies ↩