PQC vs QKD — New Maths or New Physics? — Quantum-Safe: Readiness Assessment

Two very different ideas are often bundled together under the phrase quantum-safe security. Post-quantum cryptography (PQC) replaces vulnerable algorithms with new mathematical ones that run on ordinary computers. Quantum key distribution (QKD) uses quantum physics and special optical hardware to share keys across a physical link. Both are serious fields. They are not interchangeable, and for most organisations the practical path is PQC.

Start with the split

PQC is cryptography built from mathematical problems that are believed to be hard for both classical computers and future quantum computers. The important practical point is that PQC is software-friendly. It can run on the servers, laptops, phones, network appliances, smart cards, and cloud systems organisations already operate, subject to normal performance testing and integration work.

QKD is not a new algorithm in the same sense. It is a way of distributing secret keys using the quantum behaviour of light, usually photons travelling through optical fibre or sometimes free space. Its promise is that an eavesdropper who measures the quantum states will disturb them, and that disturbance can be detected.

That difference drives everything else. PQC is mainly a migration of algorithms, protocols, certificates, libraries, and products. QKD is an infrastructure project involving devices, fibre paths, optical loss budgets, operational sites, and physical trust boundaries.

📌

The useful question. When someone says quantum-safe, ask whether they mean new mathematics in software or new physics in dedicated hardware.

PQC replaces algorithms in software; QKD builds physical key-distribution infrastructure.

What PQC actually gives you

PQC is the direct replacement path for the public-key cryptography that quantum computers threaten. That includes key establishment, where two parties agree on shared secret material, and digital signatures, where one party proves who signed a message, certificate, software update, or transaction.

The United States National Institute of Standards and Technology (NIST) has standardised a first set of PQC algorithms. Module-Lattice Key-Encapsulation Mechanism (ML-KEM) is used for key establishment. Module-Lattice Digital Signature Algorithm (ML-DSA) and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA) are used for digital signatures.

These algorithms are not magic shields. They still need correct implementations, sound protocols, good randomness, lifecycle management, and careful rollout. But they fit the way modern security is already deployed: through cryptographic libraries, application updates, certificate infrastructure, identity systems, browsers, operating systems, hardware security modules, and network protocols.

Use ML-KEM-style mechanisms to replace vulnerable key exchange based on Rivest-Shamir-Adleman (RSA) or elliptic-curve cryptography.
Use ML-DSA or SLH-DSA-style mechanisms where quantum-resistant signatures are needed.
Plan for hybrid deployments where a classical algorithm and a PQC algorithm are combined during transition.
Measure packet sizes, certificate sizes, handshake behaviour, latency, and compatibility before production rollout.

NIST standardised one key-establishment algorithm and two signature algorithms.

What QKD actually does

QKD addresses one narrower problem: how two endpoints can establish shared secret key material across a link while detecting certain forms of eavesdropping on the quantum channel. The most famous idea is simple to state but subtle in detail: measuring an unknown quantum state changes it, so passive copying is not available in the ordinary classical sense.

A QKD system normally uses two channels. One is a quantum channel, often an optical fibre carrying faint pulses or single photons. The other is an ordinary authenticated classical channel used for coordination, error correction, and privacy amplification. That word authenticated matters. Without authentication, an attacker could stand between the endpoints and impersonate each side.

This means QKD does not remove the need for cryptography. It still needs authentication, and authentication is usually provided by pre-shared secrets or digital signatures. In a quantum-safe design, those signatures or authentication mechanisms still have to be safe against quantum attack.

⚠️

Keys are not identity. QKD can help distribute secret keys on a link, but it does not by itself sign software, authenticate websites, or prove organisational identity.

The engineering limits of QKD

QKD has real engineering constraints because quantum states are fragile. Optical loss increases with distance. Unlike ordinary optical networking, unknown quantum states cannot simply be copied and amplified along the way, because that would break the quantum property the system relies on.

For longer terrestrial paths, QKD networks often use trusted relay nodes. Each shorter QKD link creates key material between neighbours, and the relay helps move key material onward. The relay must be trusted because key material is exposed inside that node or can be derived there by design. A compromised relay or relay site can defeat the end-to-end trust goal.

There are research and commercial efforts involving satellites, free-space optics, and more advanced quantum networking ideas. Those may matter for specialised deployments. They do not change the near-term decision for most enterprises: QKD is not something you push as a patch to every browser, phone, application programming interface, remote worker, or software supply-chain process.

It needs special QKD devices at both ends of the link.
It usually needs dedicated or carefully engineered optical paths.
It is constrained by distance and optical loss.
It may need trusted relays, which reintroduce trust in intermediate sites.
It adds capital cost, operational complexity, monitoring, maintenance, and physical security requirements.
It solves key distribution, not the wider set of authentication and signature problems.

⚠️

The relay problem. If a long QKD path depends on trusted relays, every relay becomes part of the security boundary.

Distance limits force QKD to hop through relays that must be trusted with key material.

Why signatures change the answer

The quantum threat is not only about encrypted traffic being recorded today and decrypted later. It is also about future attackers forging digital signatures if today’s signature schemes become breakable. Signatures sit underneath public key infrastructure, code signing, firmware updates, identity federation, document signing, payment messages, and many machine-to-machine trust systems.

QKD does not solve that class of problem. It does not tell a browser that a certificate belongs to a real domain. It does not prove that a software update came from the vendor. It does not sign a container image, a legal instruction, or a device attestation. For those jobs, you need signature algorithms and a trust model.

PQC covers both sides of the public-key migration: key establishment and signatures. That is one reason standards bodies and security agencies treat it as the mainstream route. A quantum-safe estate cannot be built from key distribution alone.

What the agencies and standards bodies are saying

The United States National Security Agency (NSA), the United Kingdom National Cyber Security Centre (NCSC), and other public authorities have been cautious about QKD as a general replacement for current cryptography. Their guidance points most organisations toward PQC because it is standards-based, deployable across existing digital systems, and addresses both key establishment and signatures.

This does not mean QKD is fake or useless. The European Telecommunications Standards Institute (ETSI) and others publish QKD specifications, and there are credible niche deployments. A fixed link between two secure government sites, a defence facility, or two bank data centres may justify dedicated hardware and fibre if the threat model, cost, operations, and trust assumptions all line up.

The important word is complement. Even where QKD is used, it normally complements conventional and post-quantum cryptography rather than replacing it. The QKD link still needs authentication, systems still need signatures, and the wider estate still needs a migration plan.

✅

Mainstream path. For general quantum-safe migration, the agency consensus is to prioritise PQC rather than QKD.

How to make the real-world decision

For a leader, architect, or security practitioner, the decision should not begin with whether a technology sounds quantum. It should begin with the assets and threat model. What data must remain confidential for ten, twenty, or thirty years? Which systems rely on RSA or elliptic-curve cryptography? Which signatures would be dangerous if forged in the future? Which vendors and managed services control the cryptography?

If the problem is broad enterprise readiness, internet-facing services, cloud workloads, identity, certificates, software signing, virtual private networks, messaging, application programming interfaces, or device fleets, PQC is the right starting point. The work is discovery, prioritisation, testing, crypto-agility, procurement pressure, and staged rollout.

If the problem is a small number of fixed, ultra-high-value, point-to-point links where dedicated fibre and secure facilities already exist, QKD may be worth assessing as an additional layer. Even then, ask who operates each endpoint and relay, how authentication is handled, how keys enter applications, how failures are managed, and what PQC migration is still required.

The simplest test remains useful: are you buying mathematics that can be deployed through normal technology refresh, or physics that must be built into a physical path? For almost everyone trying to become quantum-safe, the first answer matters more.

Inventory cryptography before buying quantum-branded controls.
Prioritise systems with long-lived confidential data and high-value signatures.
Adopt standards-based PQC where products and protocols support it.
Keep QKD on the table only for rare fixed links with a justified physical-security case.
Require every proposal to explain authentication, operations, relays, failure modes, and interoperability.

Key takeaways

PQC is new mathematics designed to resist quantum attack and run on existing computing platforms.
QKD is new physics for distributing keys over specialised optical links, not a drop-in software upgrade.
QKD addresses key distribution only; it does not replace quantum-safe digital signatures or authentication.
Distance, cost, dedicated hardware, fibre engineering, and trusted relays make QKD a niche option.
Agencies such as the NSA and NCSC recommend PQC as the mainstream route for quantum-safe migration.
For most organisations, the practical question is not quantum or not, but software-deployable maths or specialised physical infrastructure.

Broad enterprise readiness starts with PQC; fixed ultra-high-value links may add QKD.

Glossary

Post-quantum cryptography: Post-quantum cryptography is a family of cryptographic algorithms designed to resist attacks by both classical and future quantum computers.
Quantum key distribution: Quantum key distribution is a method for sharing secret key material using quantum properties of light and specialised hardware.
ML-KEM: Module-Lattice Key-Encapsulation Mechanism is a NIST-standardised post-quantum method for establishing shared secret keys.
ML-DSA: Module-Lattice Digital Signature Algorithm is a NIST-standardised post-quantum digital signature algorithm.
SLH-DSA: Stateless Hash-Based Digital Signature Algorithm is a NIST-standardised post-quantum digital signature algorithm based on hash functions.
Photon: A photon is a particle of light whose quantum state can be used in QKD systems.
Trusted relay: A trusted relay is an intermediate QKD node that must be trusted because key material is exposed or recoverable there.
Digital signature: A digital signature is a cryptographic proof that a message, certificate, transaction, or software artefact came from a holder of a private signing key.
Crypto-agility: Crypto-agility is the ability to find, replace, test, and operate cryptographic algorithms without redesigning an entire system.