What Is Quantum Key Distribution (QKD)

Introduction

In January 2018, researchers held a 75-minute video call between Beijing and Vienna. The encryption keys came from a satellite passing overhead, linking two ground stations 7,600 km apart. No mathematical problem protected those keys. Physics did.

That link used quantum key distribution (QKD), a way to share secret keys by sending single particles of light. If anyone measures those particles in transit, the measurement changes them. The change shows up as errors in the key, and both sides discard it. Eavesdropping stops being invisible.

Yet the US National Security Agency states it “does not support the usage of QKD” in national security systems. The UK’s National Cyber Security Centre says it “does not endorse the use of QKD for any government or military applications.” Two of the world’s most capable signals intelligence agencies have declined a technology that physics calls unbreakable.

Both positions are correct. The theory is sound. The boxes you can actually buy are much harder to trust. This article covers how QKD works, where it earns its price tag, and why the agencies said no.

What Is Quantum Key Distribution?

Quantum key distribution is a method for two parties to agree on a shared secret key by exchanging quantum states, usually the polarization of single photons. It solves one narrow problem: getting identical random bits into two places without an eavesdropper learning them.

QKD does not encrypt your data. It produces key material. You still feed that key into a conventional cipher such as AES-256 to protect the traffic itself.

Its security rests on two physical facts. The no-cloning theorem says an unknown quantum state cannot be copied perfectly. And measuring a quantum state disturbs it, so observation always leaves a trace.

Together those rules give QKD a property no algorithm has. A classical key exchange is secure because a math problem is hard to solve. QKD is secure because copying the key is physically impossible, and attempting it leaves evidence.

That difference matters for the “harvest now, decrypt later” threat. An attacker who records a Diffie-Hellman handshake today might break it in twenty years. An attacker cannot record photons for later, because there is nothing to store. Conventional key exchange gets a similar but weaker guarantee from perfect forward secrecy, which limits the damage rather than preventing the recording.

Two protocol families dominate. BB84, published by Charles Bennett and Gilles Brassard in 1984, encodes each bit in the polarization of one photon. E91, proposed by Artur Ekert in 1991, distributes entangled photon pairs and derives its security from tests of Bell’s inequality.

How Quantum Key Distribution Works

BB84 is the clearest way to see the mechanism. Picture Alice sending and Bob receiving, over an optical fiber or a free-space laser link.

1. Alice picks random bits and random bases. A basis is the orientation she uses to encode a bit. Think of it as choosing between a straight ruler and a diagonal one. She sends each bit as a single photon polarized to match both choices.
2. Bob measures with his own random bases. He does not know what Alice chose. When his basis matches hers, he reads the bit correctly. When it does not, his result is random noise.
3. Both sides compare bases in the open. Over an ordinary internet connection they announce which basis they used for each photon, never the bit values. Every position where the bases disagreed is discarded. About half the photons survive this step, which is called sifting.
4. They spend part of the key to measure errors. They publicly compare a random sample of the surviving bits and count the mismatches. That ratio is the quantum bit error rate (QBER), and those sampled bits are then thrown away.
5. They compare the QBER against a threshold. Ordinary noise causes some errors with no attacker present. But an eavesdropper must also guess bases, and every wrong guess injects fresh errors. For BB84, a QBER above roughly 11% means the session is abandoned.
6. They run error correction and privacy amplification. Error correction reconciles the remaining mismatches. Privacy amplification then compresses the corrected bits through a hash function, shrinking the key until whatever partial knowledge an attacker might hold becomes negligible.
7. They authenticate every classical message. This is the step people forget. The public conversation in steps 3 through 6 must be authenticated, or an attacker simply impersonates each side to the other.

Step 7 is the crux of the NSA’s first objection. QKD is “only a partial solution” because it cannot bootstrap trust by itself. You need a pre-shared secret or a conventional signature algorithm to authenticate that classical channel. In practice, that means QKD leans on the same post-quantum cryptography it was supposed to make unnecessary.

VIDEO · READY 16:9

PLAY

How Quantum Key Distribution Works (BB84 & E91)

Quantum Key Distribution vs Post-Quantum Cryptography

These two technologies answer the same question — how do we stay safe once quantum computers arrive — with opposite strategies. QKD changes the physical layer. Post-quantum cryptography changes the math and leaves your network alone.

The last two rows drive most procurement decisions. A flaw in ML-KEM is a library upgrade. A flaw in a photon detector is a truck roll to every endpoint. That asymmetry is why the NSA calls mathematical cryptography “a more cost effective and easily maintained solution,” and why the practical starting point for most teams is a PQC migration checklist rather than a hardware purchase order.

Real-World Use Cases

Short, high-value metro links. The canton of Geneva has used QKD from ID Quantique to protect the transmission of election results between the counting centre and the government data centre since 2007. This is QKD’s ideal shape: two fixed endpoints, a few kilometres apart, over fiber the operator already controls, carrying data whose integrity is politically existential.

National and satellite backbones. China operates a roughly 2,000 km QKD backbone between Beijing and Shanghai, stitched together from dozens of trusted nodes — relay stations that decrypt and re-encrypt the key in the clear. The Micius satellite bypasses that limitation, distributing entangled photons to ground stations about 1,200 km apart and enabling the 7,600 km Beijing–Vienna key exchange from the introduction. Europe is building its own equivalent: the EuroQCI programme and the EAGLE-1 satellite, led by an SES consortium of 20 partners, with launch expected in late 2026 and three years of in-orbit validation to follow.

Feeding keys to ordinary applications. A QKD device is useless unless software can collect its keys. ETSI GS QKD 014, published in 2019, standardizes a REST API for exactly that: an application requests key material over HTTPS and receives it as JSON. That interface is what lets QKD hardware from Toshiba, ID Quantique or QuantumCTek supply keys to a VPN concentrator or a hardware security module without a bespoke integration for every vendor.

Common Mistakes to Avoid

Treating QKD as a replacement for TLS. It replaces one step of a key exchange, not a protocol stack. You still need certificates, cipher negotiation, session management and everything else in a TLS handshake.

Skipping the authentication requirement. An unauthenticated QKD link is trivially defeated by a physical man-in-the-middle who terminates the quantum channel on both sides. The NCSC is explicit that QKD needs “robust quantum-safe cryptographic mechanisms for authentication alongside them.”

Believing “unconditionally secure” describes the product you bought. It describes an idealized protocol. In 2010 researchers published a detector blinding attack in Nature Photonics that took full control of commercial QKD receivers using tailored bright illumination — extracting the entire key without raising the error rate. Photon-number-splitting attacks against imperfect single-photon sources drove a similar redesign, answered by decoy-state protocols. These are side-channel attacks on hardware, and the physics guarantee says nothing about them.

Assuming trusted nodes are trustworthy. Every relay on a long QKD backbone holds the key in plaintext. A 2,000 km link with 30 relays gives you 30 new places to be compromised, which is why the NSA counts insider threat as a QKD cost rather than a benefit.

Forgetting denial of service. Sensitivity to disturbance cuts both ways. An attacker who cannot read your key can still cut it off permanently by injecting noise into the fiber, and the protocol is designed to shut down when that happens.

Buying QKD instead of migrating to PQC. The quantum threat to your existing RSA and ECC keys is not waiting on a fiber build-out. Inventory your cryptography and plan the algorithm swap first; the physics can come later, if ever.

Getting Started With Quantum Key Distribution

For nearly every organization, the correct first move is not to deploy QKD. It is to understand where QKD would and would not help you, then act on the part that is urgent today.

1. Inventory the links you would even consider. QKD only applies where you own or lease dark fiber between two fixed sites under 200 km apart. If nothing in your estate matches that description, the evaluation is over.
2. Read the two national positions before the vendor deck. The NSA and NCSC papers listed below are short, free, and state the limitations more plainly than any procurement conversation will.
3. Fix the urgent problem first. Migrate your key exchanges and signatures to the NIST post-quantum standards. That work protects data you are transmitting right now, over networks you already have.
4. If you still need QKD, insist on interoperability and certification. Require ETSI GS QKD 014 support so you are not locked to one vendor, and ask what independent evaluation the hardware has passed against known detector attacks.
5. Plan the key lifecycle around it. QKD changes how keys arrive, not how they are stored, used or retired. The same discipline described in encryption key rotation still applies once the photons have done their job.

Quantum key distribution is real, deployed, and genuinely unlike anything classical cryptography can offer. It is also expensive, short-range, and dependent on conventional cryptography for the one thing it cannot do itself. Treat it as a specialist tool for a handful of links, not a strategy.

To go deeper, read our guide to post-quantum cryptography and the NIST standards, or see how RSA vs ECC compares the algorithms that quantum computers will eventually break.