The cybersecurity agencies of France, Germany, the Netherlands, and Sweden have jointly cast doubt on the practical value of quantum key distribution (QKD), stating it is not viable for most current applications. Despite significant investment and claims of high levels of security, the agencies find QKD “not yet sufficiently mature from a security perspective.” Instead, the authorities prioritize migration to post-quantum cryptography and symmetric keying as more urgent solutions for securing key establishment against evolving quantum computing threats. This assessment signals a shift in focus away from QKD as a near-term solution for widespread cybersecurity needs.
Quantum Threat to Current Cryptography
The potential for future large-scale quantum computers to compromise current public-key cryptography is driving a search for alternative security measures, but the path forward is not straightforward. Adversarial actors anticipating this shift are already considering a strategy, stockpiling encrypted communications to exploit future decryption capabilities, a threat that demands proactive mitigation. To counter this, cybersecurity agencies are increasingly focused on solutions beyond quantum key distribution (QKD), prioritizing methods more readily deployable in the near term.
One viable approach involves using pre-shared symmetric keys alongside classically secure public-key cryptography where feasible, offering a transitional security layer. Alternatively, the development of post-quantum cryptography, designed to resist attacks from both classical and quantum computers, is gaining momentum. This field has undergone rigorous standardization processes and ISO certification, signaling a growing confidence in its potential.
The term now encompasses both post-quantum cryptography and QKD, though the agencies’ recent assessments suggest a clear preference for the former. This assessment stems from both technological limitations and practical implementation challenges, as detailed in reports from organizations like the German Federal Office for Information Security (BSI). Technical hurdles for QKD include the difficulty of achieving long-distance, trusted-node-free key distribution; research published in npj Quantum Inf demonstrated that such systems are currently unattainable with existing technology.
Implementation attacks, such as those exploiting side-channel vulnerabilities, pose a significant threat. The BSI has published studies detailing these attacks, highlighting the need for robust security evaluations before widespread deployment. These vulnerabilities, combined with the complexity of QKD systems, contribute to the agencies’ conclusion that the technology is not yet ready for most applications. The Swedish National Cyber Security Agency (NCSA) echoes this sentiment, emphasizing the importance of a comprehensive mitigation strategy. M.
Ekerå, of the Swedish NCSA and Armed Forces, presented a keynote address at the NATO IST-SET-198 Symposium outlining this approach, and further detailed advice on mitigating the quantum threat at an ESA workshop. These presentations highlighted the need to move beyond solely focusing on QKD and to embrace a layered security approach.
This prioritization is reflected in guidance documents like the, CWI, and AIVD’s PQC Migration Handbook, which provides practical advice for organizations transitioning to quantum-resistant algorithms. These initiatives demonstrate a clear shift in focus towards solutions that are considered more viable and urgent in the face of the evolving quantum threat, effectively signaling a diminished role for QKD in the immediate future.
QKD Protocol Mechanics & Key Agreement
QKD systems currently require pre-shared secret keys or post-quantum signature schemes to authenticate messages exchanged over classical channels, a dependency that complicates practical deployment. This prerequisite means secure key distribution must occur before QKD can even begin, introducing an initial security challenge for establishing the initial shared secret. Consequently, organizations must establish and periodically renew these keys through separate, secure means before implementing a QKD protocol.
The agencies emphasize that even identifying appropriate use cases for QKD requires further investigation, noting that current and inherent limitations restrict its application to niche scenarios. For the vast majority of situations where classical key agreement schemes function effectively, QKD is not currently a viable alternative. This assessment stems from the need for robust security proofs that accurately reflect real-world conditions, a standard not yet consistently met in the field.
A security proof, while theoretical, must relate to actual implementation to be meaningful, and all protocol aspects must be rigorously formalised to avoid errors. Commercially deployed QKD protocols have previously lacked sufficient security proofs, later revealing vulnerabilities, highlighting the critical need for thorough evaluation. Over the past years, research into QKD security proofs has advanced significantly, but to the best of the agencies’ knowledge, no cohesive and comprehensive security proof exists for a practically relevant protocol that satisfies the requirements for rigorous validation.
The agencies point to the need for standardized QKD protocols and related standards, alongside robust evaluation methodologies, to address these challenges. Authentication mechanisms within QKD protocols can use symmetric message authentication with pre-shared keys, or alternatively, employ post-quantum signature schemes with a public-key infrastructure. The choice of method impacts the overall system complexity and security profile.
The agencies also define security as ensuring that only the communicating parties can access the plaintext of exchanged messages. These definitions highlight the fundamental requirements for any secure communication system, including those using QKD. The agencies’ position is clear: while QKD holds potential, significant work remains to address security concerns and practical limitations before it can be widely adopted as a solution for key establishment.
Theoretical Security vs. Practical QKD Implementations
The theoretical foundation of quantum key distribution (QKD) rests on principles of quantum physics, offering security independent of computational hardness assumptions, a contrast to conventional public-key cryptography, but translating that theory into reliable practice presents significant challenges. While QKD protocols, in theory, remain secure even with future algorithmic breakthroughs or computationally unbounded attackers, achieving this security in real-world implementations is far more complex. Any deviation from the idealized theoretical model introduces vulnerabilities, and several QKD systems have already been compromised through attacks exploiting physical properties of the devices used.
Security proofs for QKD, though advancing, require precise mathematical models reflecting realistic conditions to be meaningful, and a comprehensive formalization of all protocol aspects is essential to avoid gaps or errors. Currently, no QKD protocol has undergone a standardized evaluation process, hindering confidence in its security claims.
The agencies emphasize that a standardized protocol must be widely accessible for scrutiny by experts, and that rigorous security proofs need to quantify the level of security achievable under realistic conditions. This need for standardized protocols extends beyond the theoretical. Robust evaluation criteria and methodologies are essential to assess the physical security of QKD devices against a broad range of potential attacks. Extending QKD’s reach also introduces practical limitations.
Fiber-based QKD, while effective over shorter distances, necessitates trusted nodes for longer-range communication, compromising end-to-end security. Quantum repeaters, a potential solution, remain largely theoretical, and satellite-based QKD, while offering greater range, suffers from limited availability due to weather conditions and relies on satellites functioning as trusted nodes, adding substantial cost. Even with these advancements, the key rate achievable with current satellite implementations is constrained, limiting practical application.
The reliance on classical cryptography for peer authentication within QKD systems introduces another layer of complexity. The agencies note that in these cases, the authentication relies on the security of the post-quantum scheme. Given these limitations, the agencies find QKD unsuitable for most practical applications at present.
Implementation is only justifiable in scenarios with specific, high security requirements where less expensive options are not feasible. This assessment does not dismiss the potential of QKD entirely, but rather highlights the significant hurdles that must be overcome before it can be widely deployed as a secure communication solution.
Technological Limitations of Current QKD Systems
Current quantum key distribution systems are constrained to niche applications, as widespread implementation mirroring existing classical key agreement schemes remains impractical, according to a recent assessment. The technology’s reliance on specialised hardware, including single-photon sources and detectors, introduces significant costs that preclude its use in most scenarios, as acquiring and maintaining these systems over their lifecycle is currently very large.
Distance limitations further restrict QKD’s practical reach. Signal loss in fibre-optic cables increases exponentially with distance, currently preventing reliable quantum state transmission beyond a few hundred kilometres. Commercial QKD systems typically achieve around one hundred kilometres of secure transmission, a constraint that necessitates the use of trusted nodes for longer distances, a practice that introduces new vulnerabilities.
Bernhard Huttner and colleagues demonstrated in 2022 that long-range QKD without these trusted nodes is not possible with current technology, highlighting a fundamental hurdle to scalability. Even with advancements in repeaters or satellite-based systems, achieving a sufficient key rate remains a challenge. The security of QKD implementations is also not absolute, despite claims to the contrary. Rigorous evaluation is required to assure the security of concrete systems, as assertions of “absolute” or security do not apply to real-world deployments.
Developing robust standards and evaluation methodologies for physical attacks against QKD systems remains a significant undertaking. A lot more work is required to build sufficient confidence in QKD protocols and in QKD devices that implement such protocols, including but not limited to work on protocol standards, on other QKD-related standards, on security proofs and on evaluation methodologies.
Despite these hurdles, research on QKD should continue to investigate potential avenues for overcoming current limitations and exploring its utility in other applications, acknowledging that the underlying technology may offer benefits beyond secure communication, German Federal Office for Information Security says. “Due to current and inherent limitations, QKD can however currently only be used in practice in some niche use cases,” the assessment concludes, reinforcing the need for a pragmatic approach to quantum-safe cryptography.
Post-Quantum Cryptography as a Priority Solution
Despite ongoing development, Quantum Key Distribution (QKD) is currently impractical for most existing secure communication networks, according to leading European cybersecurity agencies. Unlike post-quantum cryptography, QKD necessitates specialized hardware, single-photon sources and detectors, which introduces significant costs associated with both acquisition and long-term maintenance of a QKD system or network. Post-quantum cryptography, conversely, can be implemented on existing classical hardware, offering a more readily deployable solution with advanced standardization of schemes and integration into existing protocols.
This prioritization of post-quantum cryptography extends to hybrid solutions combining it with traditional symmetric keying or classically secure public-key cryptography. Symmetric cryptography, where the same key encrypts and decrypts data, remains a viable option, particularly when paired with the longer-term security offered by post-quantum algorithms. The agencies define symmetric cryptography as a form of encryption where the same key is used for all operations, noting its utility in both confidentiality and message authentication.
A one-time pad, a symmetric encryption scheme providing perfect secrecy, is rarely used due to its requirement for unique, lengthy keys for each encryption. The agencies’ stance reflects a broader understanding of the practical limitations inherent in QKD. The technology’s reliance on specialized hardware creates a barrier to entry, while the complexities of implementation and maintenance contribute to substantial financial burdens. Post-quantum cryptography, defined as public-key cryptographic mechanisms secure against both classical and quantum computers, offers a more accessible path toward quantum-safe cryptography, an umbrella term encompassing both QKD and post-quantum approaches.
The evaluation also highlights the fundamental differences between QKD and post-quantum cryptography, noting that QKD’s security relies on quantum-physical phenomena and distinct implementation methods. While QKD exploits the laws of physics for secure key agreement, post-quantum cryptography focuses on mathematical problems believed to be intractable for quantum computers.
A signature scheme, a form of public-key cryptography used for authenticating messages, is one example of a cryptographic tool being adapted for the post-quantum era. The agencies’ position, detailed in their 2023 publication ANSSI: Should Quantum Key Distribution be Used for Secure Communications?, highlights a pragmatic approach to securing communications in the face of evolving quantum threats.
See today’s quantum computing news on Quantum Zeitgeist for the latest breakthroughs in qubits, hardware, algorithms, and industry deals.
