QKD vs PQC: Two Roads to Quantum Safety

By Taylor Thomas · 2026-08-30

The two technologies routinely offered as the answer to the quantum threat are not competitors so much as answers to different questions. Quantum key distribution uses physics to establish shared key material between two points. Post-quantum cryptography uses new mathematics to replace the algorithms a quantum computer would break. One demands new optical infrastructure; the other is largely a software migration on the network you already own.

The Problem Both Are Answering

Classical public-key cryptography — the RSA and elliptic-curve operations behind key exchange and digital signatures — rests on mathematical problems that a sufficiently capable quantum computer running Shor’s algorithm would solve efficiently. Symmetric encryption is far less exposed: Grover’s algorithm reduces the effective strength of a symmetric cipher by roughly half, which AES-256 absorbs. The exposure is therefore concentrated in public-key key establishment, not the bulk cipher — and it is present-tense, because recorded traffic could be decrypted once the capability exists.

What QKD Actually Does

QKD encodes key material in quantum states of light — typically single-photon-level pulses. The security argument rests on a property of quantum measurement: an eavesdropper cannot measure non-orthogonal quantum states without disturbing them, so — in a correctly implemented protocol, within its security model — interference on the quantum channel introduces detectable errors; practical systems have been attacked through implementation flaws the model does not cover. The endpoints compare a sample of their results and either distill a shared symmetric key or abort when the measured error rate is too high.

The constraints follow directly. An unknown quantum state cannot be perfectly copied or conventionally amplified with its encoded information intact — part of what constrains undetected interception, and what keeps QKD off ordinary packet-routed networks. It requires a specially engineered optical channel between the two parties: dedicated fiber, a wavelength sharing fiber with classical traffic, or free space. Photon loss limits distance, and covering longer terrestrial spans today means chaining trusted relay nodes, each of which sees the key in the clear and must be physically secured.

A subtler point matters more than the physics. QKD distributes keys; it does not establish who is at the far end. Unauthenticated, it is exposed to a machine-in-the-middle who runs QKD with each party separately, so authentication comes from outside the quantum channel — pre-shared symmetric keys or signatures — a mechanism QKD cannot supply itself. Choose a quantum-vulnerable classical signature for that job and a future adversary who can forge it can impersonate an endpoint from that point on — active attack, not retroactive decryption of past keys, but a quantum dependency where none was supposed to remain. A strong, randomly generated pre-shared key or a post-quantum signature avoids it; either way the reliance on conventional cryptography stands.

What PQC Actually Does

Post-quantum cryptography keeps the architecture and changes the mathematics. New algorithms built on problem families believed to resist quantum attack — lattice problems, among others — take over key establishment and signing. NIST has standardized concrete choices, notably ML-KEM for key establishment and ML-DSA for signatures — a common target to build against instead of a research menu.

Because these are ordinary algorithms running on ordinary CPUs, they slot into the protocols already in production. RFC 9370 lets IKEv2 carry the multiple key exchanges a hybrid needs, and the IETF has standardized hybrid key exchange for TLS 1.3, which mainstream implementations already deploy. The common pattern is hybrid: a classical and a post-quantum exchange run together, with the session key derived from both, so security holds if at least one component does. That hedge is what makes early adoption reasonable, though larger key shares can surface fragmentation and middlebox problems worth testing for.

The Deployment Question

The deployment asymmetry is stark. PQC is usually a software or firmware upgrade — some accelerators, HSMs, and constrained platforms will need replacing — it works over any routed path, protects one-to-many relationships like a web PKI, and scales because it is just cryptography. QKD needs new hardware at both ends and an engineered optical channel between them, works link by link over limited distance, and scales by adding physically secured relays.

This is why several national security agencies have published guidance favoring standards-based post-quantum cryptography over QKD for general-purpose protection, citing these same constraints. None of that discredits QKD’s real niche: a few fixed, extremely high-value links where a suitable optical path already exists and the threat model justifies the cost.

Where This Leaves an Engineer

For nearly every enterprise the plan is PQC, and the work is unglamorous. Inventory where public-key cryptography lives — VPN headends, TLS termination, the internal PKI, management-plane SSH. Classify data by how long it must remain secret, because that converts a future capability into a present deadline. Then favor platforms where changing algorithms is a configuration change, not a hardware replacement — crypto agility, the property worth buying, since the algorithm set will change again.

The exam already reflects this split: QKD is not a blueprint topic, but the SCOR 350-701 v2.0 exam topics name post-quantum cryptography among the cryptography components a candidate describes. The VPN side of the migration is covered in quantum-safe VPNs, and the handshake being modified is dissected in IKEv1 vs IKEv2. Understand that handshake in detail and a quantum-safe posture becomes an option you enable rather than a headline you fear. Start with the first lesson.

Frequently Asked Questions

Is QKD more secure than post-quantum cryptography?

They rest on different assumptions rather than different amounts of security. QKD's quantum transmission and eavesdropping detection derive from quantum physics — in a correctly implemented protocol, within its security model, atop an authenticated classical channel — while PQC is secured by mathematical problems believed to be hard for quantum computers. QKD's advantage is confined to key distribution; it cannot authenticate its own endpoints, so it does not remove the need for a separately established authentication mechanism — pre-shared symmetric keys, or signatures, which should themselves be quantum-safe.

Can QKD run over an existing enterprise network?

Not in the way ordinary protocols do. QKD needs a specially engineered optical channel between the two parties — dedicated fiber, a wavelength multiplexed onto shared fiber, or a free-space link — because the quantum states carrying the key cannot be amplified or routed like packets. Distance is limited by photon loss, and extending terrestrial reach in practice means trusted relay sites that must themselves be secured.

Which one should a network team plan around today?

PQC, for nearly every enterprise. It usually arrives as a software or firmware upgrade — though some crypto hardware will need replacing — it fits inside IKEv2 and TLS, and NIST has standardized concrete algorithms to build against. QKD remains a specialized option for a small number of fixed, high-value point-to-point links where the optical path and the budget both exist.