Quantum Cryptography, How It Works and How It Differs From Post-Quantum

Quantum cryptography secures communication using the laws of physics rather than the difficulty of a mathematical puzzle. Its main tool is quantum key distribution, which lets two people share a secret key with a guarantee no classical method offers, that any eavesdropper trying to intercept it leaves an unmistakable trace. It is one of the very few quantum technologies already deployed commercially.

The distinction that matters most is between quantum cryptography and post-quantum cryptography. They are two defences with similar names. They work in completely different ways. One is hardware that uses light to share keys over a dedicated link, and the other is software that runs new mathematics on the computers already in service.

Security from physics rather than from hard arithmetic

Ordinary cryptography keeps secrets by relying on mathematical problems that are hard to solve, such as factoring a large number into its two prime divisors. Quantum cryptography grounds its security instead in the measured behaviour of individual quantum particles, usually single photons of light. The guarantee that follows does not depend on how much computing power an attacker can bring to bear.

In practice one technique dominates the field, quantum key distribution, which uses those quantum signals to hand two distant parties a shared string of random bits. That string is then used as the key for a conventional cipher, almost always AES, which does the actual work of scrambling the messages. Quantum cryptography therefore does not usually encrypt your data at all. It solves the narrower and older problem of agreeing on a key that nobody else can know. That boundary is where most of the confusion about the technology begins.

Alice and Bob build a shared key from random choices

The founding protocol is known as BB84, after Charles Bennett and Gilles Brassard, who set it out in a conference paper in 1984. The sender, traditionally called Alice, generates a random bit and then picks at random one of two ways of encoding it onto a photon, which physicists call a basis. The receiver, Bob, has no idea which basis she chose, so he measures each arriving photon in a basis he also picks at random.

Roughly half the time Bob guesses the same basis Alice used, and his result then matches her bit reliably. The other half of the time his result is random noise carrying no information. Afterwards the two compare which bases they used over an ordinary public channel, never the bit values, and discard every position where the bases disagreed. This step is called sifting. It gives an outsider nothing, because knowing that both used the same basis in a given position says nothing about whether the bit there was a zero or a one.

The raw key is still not usable, because real equipment introduces errors even when nobody is listening. Two classical stages fix that. Error correction reconciles the differences between Alice’s copy and Bob’s, and privacy amplification then hashes the result down to a shorter string that any eavesdropper knows almost nothing about. That shrinkage is the price of the guarantee.

Eavesdropping leaves a trace in the error rate

Two results in quantum mechanics do the real work here. The first is the no-cloning theorem, proved by William Wootters and Wojciech Zurek in a 1982 paper in Nature, which says an unknown quantum state cannot be copied. An eavesdropper therefore cannot duplicate each photon, keep a copy for later analysis and pass the original along untouched.

The second is that measuring a quantum system generally disturbs it. An eavesdropper, traditionally called Eve, must measure a photon to learn anything. She does not know which basis Alice used. Half her guesses are therefore wrong, and each wrong guess randomises the photon she forwards to Bob.

That leaves a signature Alice and Bob can look for, so they publicly sacrifice a random sample of their sifted key and compare it bit for bit. That yields the quantum bit error rate. A simple intercept-and-resend attack on every photon pushes that rate to about 25 per cent. Security proofs for BB84 set a threshold near 11 per cent, above which no safe key can be distilled and the two parties discard everything.

This is a different security model from anything in classical cryptography. A conventional ciphertext can be recorded today and attacked for decades, whereas a quantum key that was successfully intercepted is simply never used. The eavesdropper is not merely defeated but detected.

Post-quantum cryptography is software, quantum cryptography is hardware

This is the confusion the whole field trips over. Quantum cryptography, in the form of quantum key distribution, is a hardware technology that uses the physics of light to share keys over dedicated fibre or satellite links. Post-quantum cryptography is something entirely different, and it is ordinary software running new mathematical algorithms that are believed to resist attack even by a large quantum computer.

The names invite the mistake, so hold on to one contrast. The post-quantum kind does not involve a quantum computer. It does not need one, either to run it or to break it, and it is classical software that can ship in a browser update to a billion devices. Quantum key distribution needs photon sources, single-photon detectors and an unbroken optical path between the two endpoints.

They also protect different things. The software route replaces the vulnerable public-key algorithms wholesale, covering both key agreement and the digital signatures that authenticate software updates and website certificates. Quantum key distribution addresses only key agreement and offers nothing for signatures, so it can never be a complete replacement for what it is sometimes marketed against.

The two are not rivals. They are answers to different questions. Our guide to post-quantum cryptography companies covers the vendors on the software side, and the explainer on post-quantum cryptography goes deeper into the mathematics. The dedicated guide to quantum key distribution sets out the physics in more detail.

Three FIPS documents, final since August 2024

Because the two technologies are so often muddled, it helps to know exactly what the software side now consists of. On 13 August 2024 the United States National Institute of Standards and Technology published its first three post-quantum standards as final documents. Each carries a FIPS number, the US government’s formal standard designation, and each names one algorithm. The first is FIPS 203, the Module-Lattice-Based Key-Encapsulation Mechanism Standard, which specifies ML-KEM and derives from the submission known as CRYSTALS-Kyber. The second is FIPS 204, the Module-Lattice-Based Digital Signature Standard, which specifies ML-DSA and derives from CRYSTALS-Dilithium.

The third, FIPS 205, is the Stateless Hash-Based Digital Signature Standard and specifies SLH-DSA, which grew out of SPHINCS+. It is slower and produces much larger signatures than ML-DSA, and it exists for a deliberate reason. ML-KEM and ML-DSA both rest on structured lattice problems, so one mathematical breakthrough could weaken both at once, whereas SLH-DSA relies only on hash functions and would fail independently.

Two further pieces remain unfinished. Vendors sometimes describe them as though they were done. FN-DSA, the signature scheme based on the Falcon submission, has been announced as FIPS 206, and NIST still listed it as coming soon in August 2026. HQC is a code-based key encapsulation mechanism, chosen in March 2025 as a mathematically different backup to ML-KEM. It has no FIPS number yet, and NIST said when it made the selection that it expected a draft in about a year and a final standard in 2027. A separate track for additional signature schemes moved nine candidates into a third round in May 2026.

That gives a useful test. It applies to any product claim you meet, because as of August 2026 a vendor citing a FIPS number above 205 is describing a document NIST has not yet published. Our guide on how to prepare for quantum computing sets out the migration deadlines governments have attached to these standards.

Later protocols each closed a specific weakness

Every protocol that followed BB84 went after a particular hole in the last one. In 1991 Artur Ekert proposed a scheme, now usually called E91, in which Alice and Bob each receive one half of an entangled pair and test the correlations between their measurements. Security there comes from the violation of a Bell inequality, a statistical test that no classical correlation can pass, so the guarantee rests on a checkable experimental fact. The explainers on BB84 and E91 work through both in more detail.

The next problem was the transmitter. Real ones do not emit single photons, so practical systems use laser pulses dimmed until they usually hold one photon or none. Occasionally such a pulse holds two identical photons. An eavesdropper can siphon off the spare and learn part of the key undetected. Decoy-state methods, introduced in the mid 2000s, defeat this by randomly varying pulse intensity, and virtually every serious deployment now uses them.

Attacks then moved to the receiver, because detectors turned out to be the softest part of the system. Measurement-device-independent quantum key distribution, proposed by Hoi-Kwong Lo, Marcos Curty and Bing Qi in 2012, removes that whole class of attack by having both parties send photons to an untrusted central station. Device-independent schemes assume even less about the equipment, at a severe cost in key rate.

The advance that changed the distance limit is twin-field quantum key distribution, proposed in 2018 by Marco Lucamarini, Zhiliang Yuan, James Dynes and Andrew Shields, then at Toshiba Research Europe in Cambridge. Both parties send weak pulses to a central point where the two are interfered. That changes how the key rate falls with distance. In practice that roughly doubles the reach of a single span of fibre. Experiments have since carried keys hundreds of kilometres without any trusted intermediate node.

Banks, city networks and China already run links

Unlike general-purpose quantum computing, quantum key distribution is a shipping product rather than a laboratory promise. The Swiss company ID Quantique, based in Geneva, was founded in 2001 and has sold commercial quantum key distribution systems since the mid-2000s, and Toshiba now lists three quantum key distribution products of its own. A number of telecommunications operators sell or trial comparable equipment.

Metropolitan and national testbeds followed. Each of the well known ones has a published paper behind it rather than only a press release. The European SECOQC project ran a trusted-repeater network in Vienna. The consortium demonstrated it publicly in October 2008. A Japanese-led consortium then reported a field test of the Tokyo QKD Network in 2011, with NEC, NTT, Mitsubishi Electric and Toshiba among the contributors. Toshiba and the University of Cambridge later described the Cambridge quantum network carrying keys on fibre already loaded with ordinary data traffic. Telefonica with the Universidad Politecnica de Madrid and the IMDEA Software Institute reported the Madrid Quantum Communication Infrastructure in 2021. The European Union is meanwhile building EuroQCI, a quantum communication network spanning its member states, while several banks run production links between nearby data centres over fibre they control. Those are the conditions under which the technology looks strongest, short distances and a single owner at both ends.

The most ambitious deployment is in China. A fibre backbone of more than two thousand kilometres links metropolitan networks in Beijing, Jinan, Hefei and Shanghai. The Micius satellite, launched in 2016, sent keys from orbit to the ground at kilohertz rates over distances up to 1,200 kilometres, which no fibre link can approach. A 2021 paper in Nature described joining the two into an integrated network reaching some 4,600 kilometres.

Real hardware, not the physics, is where the attacks land

The security proofs describe an idealised protocol. Real hardware is never ideal. The gap has been exploited repeatedly, most famously by Lars Lydersen, Vadim Makarov and colleagues, who in 2010 took full control of the detectors in two commercial quantum cryptography systems in Nature Photonics. One of the two systems was built by ID Quantique and the other by MagiQ Technologies. They shone bright light at the detectors to force them into a classical mode the attacker controlled. The physics was never wrong, and the devices simply did not behave as the proof assumed.

Vendors patched that attack and researchers found others, which is how the security of any real system develops. Quantum key distribution offers information-theoretic security for an idealised device, meaning security no amount of computing can break, and implementation-dependent security for the box you can buy. Hardware certification also remains immature next to the scrutiny classical cryptographic modules receive.

Distance is the other hard limit. It comes from physics rather than engineering. Photons are absorbed in fibre, and because they cannot be copied they cannot be amplified the way a classical optical signal is. Beyond a few hundred kilometres the key rate collapses, so long links must be assembled from shorter ones joined by trusted relay nodes.

That word trusted is doing a great deal of work. At each relay the key is decrypted and re-encrypted, so it exists in plain form inside the node and anyone controlling that site can read it. A long backbone built this way is not end-to-end quantum secure in the way a single short link is, and genuine end-to-end security awaits practical quantum repeaters, which remain a laboratory technology.

Security agencies do not recommend it for general use

Given how well the physics works, it may be surprising that major security agencies do not recommend quantum key distribution for general use. The United States National Security Agency sets out five limitations and says that, unless they are overcome, it does not support quantum key distribution in national security systems. Nor, on the same condition, does it anticipate certifying such products for those customers. The United Kingdom’s National Cyber Security Centre is blunter, stating in its quantum networking technologies paper of August 2025 that it will not support the use of QKD for government or military applications.

European agencies have converged on the same view. The French, German, Dutch and Swedish cyber and communications security agencies published a joint position paper on quantum key distribution on 26 January 2024. It says Due to current and inherent limitations, QKD can however currently only be used in practice in some niche use cases, and that QKD is not yet sufficiently mature from a security perspective. Its conclusion names migration to post-quantum cryptography, paired with symmetric or classical public-key methods, as the clear priority.

Their reasoning is practical rather than sceptical about the science. The technology needs special-purpose hardware and dedicated fibre, it is limited in distance, and it offers nothing for authentication or signatures. It also depends on a classical channel that must itself be secured by conventional cryptography before the quantum link can start. That last point surprises people most, because it means a quantum link cannot bootstrap trust on its own. A link authenticated with a pre-shared secret merely moves the problem to how that secret was distributed.

None of that makes quantum cryptography a dead end. It is a deployed technology. It suits a small number of high-value links where the operator controls both endpoints and the distance is short. The research programme behind repeaters and device-independent protocols is serious work. It is simply not the answer to the harvest now, decrypt later problem for the internet at large, which is a software problem with a software fix. For the wider picture, see our guide to quantum computing.

Cost, not physics, decides who deploys a link

The physics of quantum key distribution is settled, and the economics decide whether anyone deploys it. A link needs dedicated hardware at each end, and in most designs it needs a fibre that carries the quantum signal and very little else. That second requirement is the expensive one.

Two buildings in the same city can be linked, while two cities on different continents cannot be linked directly at all. The organisations that have deployed quantum key distribution mostly have a short, high-value link and a reason to own the fibre in between. That describes central banks, some government departments and a few pairs of data centres. It describes almost nobody else.

Set that against the alternative and the asymmetry is stark. Post-quantum cryptography is a software change deployed over the network an organisation already has, and it costs what an upgrade costs. This is a procurement argument rather than a physics one, and it is the practical reason standards bodies point at algorithms for general use.

Satellites clear the loss problem and pass overhead only briefly

If loss in fibre is the barrier, one way around it is to send the photons through space instead. Most of that path is near-vacuum. The atmosphere only has to be crossed twice. China demonstrated this with the Micius satellite. It distributed entangled photons to ground stations separated by more than a thousand kilometres. It also supported an intercontinental key exchange reported in Physical Review Letters in 2018.

The demonstration was genuine and its limits are sharp. A satellite in low orbit passes over a given ground station briefly and only at night. Cloud stops the link entirely. The key rate is small next to what a fibre link manages over a short distance, so it proves the approach works rather than that it is ready to carry ordinary traffic.

Several national programmes have followed. The case for them is strategic more than commercial. A country that wants key distribution independent of anyone else’s infrastructure has a reason to build one, which is a different argument from a bank deciding how to protect a transaction. Reading satellite results as a sign that quantum key distribution is about to become general infrastructure mistakes what is being demonstrated.

The other route around the distance limit is the quantum repeater, a device that would extend a link without measuring the signal in between. Working repeaters need quantum memories good enough to hold entanglement while the next segment is established, and that remains a laboratory problem.

Dropping trust in the hardware costs almost all the key rate

Device-independent quantum key distribution removes the assumption that the equipment behaves as its specification says. The two parties do not trust the hardware. They run a statistical test on their results, of the kind used to test Bell inequalities. Security then follows from passing the test rather than from any claim about the box, so the key holds even if an adversary built the equipment.

The catch is that the test is demanding. It requires detection efficiencies and entanglement quality far beyond what a commercial link provides, and the first convincing demonstrations came only recently and over short distances at very low key rates. It is the theoretically satisfying answer, and it is not a product anyone can buy today.

The intermediate position, sometimes called measurement-device-independent, gives up less. It removes the assumption about the detectors, which is where the demonstrated attacks have concentrated, while still trusting the sources. That trade has been implemented in real networks, and the field moves this way, by closing the loophole that has been exploited rather than every loophole at once.

Running both is possible, and the migration still comes first

Coverage of this subject tends to be framed as a contest. That framing is misleading. The two things protect against different failures. Post-quantum cryptography protects against an adversary with a quantum computer and a mathematical breakthrough, and it fails if someone finds an efficient attack on the chosen problem. Quantum key distribution protects against an adversary with unlimited computing power and fails if the hardware is not what the proof assumed.

An organisation that needs both can have both. A key produced by a quantum link can be combined with one agreed through a post-quantum algorithm, so an attacker has to defeat the physics and the mathematics together. That combination is used in a small number of high-assurance settings, and it costs what having two systems costs.

For everyone else the sequencing is what matters rather than the choice. The migration to post-quantum algorithms applies to every system that uses public-key cryptography, which is nearly all of them, and governments have published timetables for it, binding on their own agencies first. Quantum key distribution applies to a specific link and is a decision that can wait, so treating the two as alternatives usually means delaying the urgent one to consider the optional one.

Frequently asked questions