Quantum key distribution: sharing secret keys with light

Quantum key distribution, or QKD, is a way for two parties to agree a secret key using light. The key is a long string of random numbers that both sides then use to scramble their messages with ordinary encryption. What makes QKD different is what it is designed to catch: if someone tries to observe or tamper with the key in transit, the two parties should be alerted. Today's public-key methods rely on mathematical problems that a future large-scale quantum computer may be able to solve, so QKD is an attempt to base security on physics instead (NCSC, 2020). It is a specialised tool with real limits, not a general replacement for encryption.

How it works

One party encodes random bits in very weak pulses of light and the other measures them. The UK National Cyber Security Centre (NCSC) describes QKD as a way to agree a shared secret key that an adversary cannot observe or tamper with without alerting the two parties (NCSC, 2020). Scarani and colleagues describe QKD as creating a secret key between partners who share a quantum channel and a classical channel that is authenticated, meaning each message is checked to come from the claimed sender (Scarani and colleagues, 2009). The light carries the key material. The authenticated channel carries the checking messages. The key is then used with ordinary encryption to protect the messages themselves.

What it protects against, and what it does not

What it protects. Scarani and colleagues write that the key's security can, in principle, be guaranteed without any restriction on an eavesdropper's power. That is a claim about the theory. Whether real equipment meets the theory is a separate question, covered under "Real equipment" below.

What it does not protect.

• Identity. QKD protocols do not provide authentication, so the NCSC says they are open to man-in-the-middle attacks. In its position paper of 24 March 2020, the NCSC says QKD protocols must be deployed alongside cryptographic mechanisms that ensure authentication, and that those mechanisms must also be secure against the quantum threat (NCSC, 2020).
• Messages. QKD creates a key. On its own it does not encrypt anything.
• Real equipment. Whether real devices behave like the models used to prove security is an open question. The Scarani review presents the theory used to assess security for the main experimental platforms, but none of the sources cited here measures device risk.

How it differs from post-quantum cryptography

Post-quantum cryptography (PQC) is a different answer to the same worry. It replaces today's public-key methods with new mathematical algorithms that run on ordinary computers and are designed to resist quantum attacks. NIST, a US government standards body, released its first three finalised PQC standards on 13 August 2024: FIPS 203 (ML-KEM) for general encryption, and FIPS 204 (ML-DSA) and FIPS 205 (SLH-DSA) for digital signatures. NIST's lead on the project encouraged system administrators to start integrating them immediately, because full integration will take time (NIST, 2024).

The practical difference is deployment. The NCSC's 2020 paper says quantum-safe algorithms can run on today's classical computers and, unlike QKD, do not require dedicated or specialist hardware (NCSC, 2020). That paper was written while the NIST standards were still in development. A 2025 peer-reviewed paper by Aquina and colleagues in EPJ Quantum Technology evaluates real-world QKD use cases and compares QKD with PQC for each, considering implementation complexity, scalability and long-term security. The abstract does not give a single overall verdict; it discusses which use cases QKD is suited for (Aquina and colleagues, 2025).

What has been demonstrated

These are experiments, not services.

• Satellite to ground, 2017. Liao and colleagues launched a low-Earth-orbit satellite and reported decoy-state QKD from the satellite to the ground, with a kilohertz key rate over distances of up to 1,200 km (Liao and colleagues, Nature, 2017; preprint on arXiv). The published abstract says this key rate is around 20 orders of magnitude greater than would be expected using optical fibre of the same length. The preprint states the fibre comparison assumes a loss of 0.2 dB per km. This is the authors' own calculated comparison, not a side-by-side fibre test.
• Fibre over 1,002 km, 2023. Liu and colleagues reported twin-field QKD over 1,002 km of fibre, published in Physical Review Letters on 25 May 2023. They report a secure key rate of 9.53 × 10^-12 per pulse over 1,002 km in the asymptotic regime, and 8.75 × 10^-12 per pulse at 952 km with finite-size effects included (Liu and colleagues, 2023). These figures are per pulse. The abstract does not convert them into bits per second, so they show that the link works, not that it is practical.
• Two quantum nodes, 2024 (networking, not QKD). Stolk and colleagues linked two solid-state qubit nodes 10 km apart through a midpoint station, over 25 km of deployed fibre. For fully heralded delivery, the entangled states reached a fidelity of 0.534, at about 0.022 per second with a 15 ns photon acceptance window (Stolk and colleagues, 2024, Science Advances).

Positions and disputes

• UK government guidance (NCSC, 24 March 2020): the NCSC "does not endorse the use of QKD for any government or military applications", and cautions against sole reliance on QKD for business-critical networks, especially in Critical National Infrastructure sectors. It says the best mitigation against the quantum threat is quantum-safe cryptography. The paper gives no figures for cost, distance or key rate (NCSC, 2020).
• UK government guidance (NCSC, 20 March 2025): the NCSC's PQC migration timelines ask organisations to define migration goals, complete discovery and build an initial plan by 2028, carry out early, highest-priority migration by 2031, and complete migration of all systems, services and products by 2035. The guidance does not mention QKD (NCSC, PQC timelines).
• Renner and Wolf, in a preprint posted on 27 July 2023, respond to what they describe as a recent NSA publication concluding that quantum cryptography is "not recommended for use". They argue that some of its points are unjustified and that others are problems now but can be expected to be resolved in the foreseeable future (Renner and Wolf, 2023). This summary is based on the preprint's abstract. We were not able to open the NSA document itself, so its exact wording and date are not given here.

Speculative uses

• Global networks by satellite. Liao and colleagues say their satellite link paves the way to global-scale quantum networks. That is the authors' expectation, not a demonstrated network.
• Hybrid systems. The NCSC advises any organisation considering QKD to use robust quantum-safe cryptography for authentication alongside it. How well such hybrid systems work in practice is not measured in the sources cited here.

Limits and open problems

• Distance. The Liu abstract notes that quantum signals cannot be amplified and that fibre loss grows exponentially with distance (Liu and colleagues, 2023). The 1,002 km result is one experimental link, not evidence that links of that length are practical.
• Integration. The NCSC says more research is needed to understand how QKD can be built into complex systems so that the whole system is secure. A national network would also need to decide how keys are handled at any relay points; the sources cited here do not answer that question.
• Devices and certification. Security depends on real equipment matching the theory, and the sources cited here do not show how that is certified at scale.
• Cost. The sources cited here give no cost figures for commercial QKD equipment.
• From lab link to national network. The experiments above are research links between two points. Running QKD across a country would mean many links, key management and ongoing certification. The sources cited here do not show that this has been done.

What to watch next

• Long-distance QKD results that report secure key rates per second, with the pulse rate and distance stated.
• Certified QKD equipment or standards, and any update to the NCSC's 2020 position or to NIST guidance on QKD.
• A peer-reviewed version of the Renner and Wolf paper, and any published response to the NSA position.
• Quantum repeater demonstrations that go beyond a single fibre span.