up:: Quantum-Native Security MOC

QKD vs QRNG

QKD and QRNG are both quantum technologies sold into security budgets, and they solve unrelated problems at different layers. QRNG is an entropy source that produces unpredictable bits inside one device. QKD is a key-agreement mechanism that transports a shared secret between two endpoints over a dedicated quantum channel.

The confusion is commercially convenient and technically costly, because the two carry entirely different deployment constraints, validation paths and positions from national security agencies.

The short version:

• QRNG generates, QKD transports. One feeds randomness into the key-generation stack. The other agrees a key between two parties across a link.
• QRNG needs no second party and QKD needs a dedicated channel. A QRNG drops into a single rack. QKD requires purpose-built photon hardware and dedicated fiber or free-space optics at both ends.
• QKD provides no authentication of its own, so it always has to be paired with classical or post-quantum authentication to prevent a man-in-the-middle.
• Neither is a post-quantum solution. The quantum threat lives at the algorithm layer, and standardized PQC is the substrate. QRNG improves entropy quality underneath it, and QKD is a niche key-agreement tool beside it.
• The agency positions differ sharply. QRNG is validated as an ordinary entropy source under NIST SP 800-90B, while NSA, NCSC, ANSSI and BSI have all published against relying on QKD for government and high-assurance use.

Think of a locksmith’s workshop. One machine cuts keys from genuinely unpredictable blanks, so no two come out alike and nobody can guess the next cut, and it sits on a bench and serves whoever walks in. The other is an armored courier route between two specific buildings, with its own road, its own vehicles, and a guarantee that any interference with a delivery is detectable. Both are real capabilities, and a building that buys the courier route has done nothing about the quality of its key blanks, while a building that buys the cutting machine has done nothing about how keys reach the other site.

What is the difference between QKD and QRNG?

The difference is function and layer. A QRNG is a component that produces raw entropy, feeding the same random-bit-generator stack every cryptographic key already depends on. QKD is a protocol plus dedicated hardware that establishes a shared symmetric key between two named endpoints, with the property that eavesdropping on the quantum channel is detectable.

That difference cascades. QKD inherits four constraints from having a counterparty: a distance limit, a dedicated channel, a jamming surface and an authentication gap. A QRNG carries none of them, because it operates as a standalone component that communicates with nobody.

What is QRNG?

Quantum random number generation is the production of random bits by measuring a quantum physical process whose outcome is fundamentally unpredictable, such as which way a single photon reflects off a beam splitter, the amplitude of vacuum noise in a laser, or a photon arrival time. It is an entropy source, and it occupies the entropy-source slot in the NIST random-bit-generation stack, where SP 800-90B governs the entropy source, SP 800-90A the deterministic generator it seeds, and SP 800-90C how they combine.

Its validation path awards no credit for being quantum. SP 800-90B is source-agnostic and requires tester access to the raw unconditioned noise, a documented entropy model justifying the claimed min-entropy, an estimation track for whether samples are independent and identically distributed, and continuous health tests in the field. That standard measures output rather than trusting physics because real quantum devices carry classical imperfections including detector dead time, afterpulsing, bias, drift, temperature dependence and detector-coupled correlations.

Source: NIST SP 800-90B, January 2018, csrc.nist.gov; NIST Random Bit Generation project, csrc.nist.gov.

What is QKD?

Quantum key distribution establishes a shared secret key between two endpoints over a quantum channel, with security resting on the physical property that measuring a quantum state disturbs it, so an eavesdropper is detectable rather than merely computationally excluded.

Its constraints are physical. NSA enumerates five in published guidance: it is only a partial solution because it agrees keys without authenticating, it needs special-purpose equipment that cannot be delivered in software, it raises infrastructure cost and insider-threat risk through the trusted-relay model, securing and validating a fielded device is hard, and it raises denial-of-service risk because the same sensitivity that catches an eavesdropper makes the link easy to disrupt.

Source: NSA Cybersecurity, “Quantum Key Distribution (QKD) and Quantum Cryptography (QC)“.

QKD vs QRNG at a glance

Dimension	QRNG	QKD
Function	Generates random bits as an entropy source	Distributes a shared secret key between 2 parties
Layer it operates at	Underneath key generation, feeding the random-bit-generator stack	Key agreement, alongside or in place of a classical key exchange
Second party required	None. It is a local component	Yes, and both endpoints need matching hardware
Topology	A device in a rack	A point-to-point link
Range constraint	None, effectively	Roughly 100 to a few hundred kilometers of commercial fiber before the key rate collapses, bounded by the repeaterless secret-key capacity
Extending range	Not applicable	Trusted nodes, where every relay decrypts and re-encrypts the key and must be fully trusted
Hardware	A commercial module, widely available	Purpose-built photon hardware plus dedicated fiber or free-space optics
Provides authentication	Not applicable, since there are no parties	No. It always needs separate classical or post-quantum authentication
Denial-of-service exposure	Not a channel, so not applicable	High. Jamming the channel stops the key flowing
Validation path	NIST SP 800-90B entropy-source validation, source-agnostic	No comparable general certification path, and NSA does not anticipate certifying QKD products for national security systems
Deployable today	Yes, mature commercial products	Niche and constrained
Relation to PQC	Complementary. Supplies entropy that PQC key generation consumes	Adjacent. Standardized PQC is the substrate; QKD is a specialized tool
Does it address the quantum threat	No. Improving randomness leaves quantum-vulnerable algorithms exactly as vulnerable	Only for the key-agreement step on a link it covers, and it authenticates nothing
Agency position	Treated as one entropy source among many, judged on its SP 800-90B validation	NSA, NCSC, ANSSI and BSI have all published against relying on it for government or high-assurance use

How do they actually differ?

1. One has a counterparty problem and the other does not. Every QKD constraint follows from the fact that it moves a secret between two places: distance limits, dedicated channels, trusted relays, jamming exposure and the authentication gap all exist because there is a link. A QRNG communicates with nobody, which is why it deploys like an ordinary hardware component.

2. The distance limit is physical rather than engineering-solvable today. Photon loss in optical fiber grows exponentially with length, and single photons cannot be amplified without destroying their quantum state, so the usable key rate falls off steeply. The ceiling is set by the repeaterless secret-key-capacity bound. Newer protocols push it, with twin-field QKD reaching past 800 kilometers in laboratory and field work, and those remain specialized demonstrations rather than commodity infrastructure.

3. The trusted-node workaround reintroduces the problem QKD’s pitch removes. Chaining links through intermediate trusted nodes means the key is decrypted and re-encrypted at each one, so every relay sees it in the clear. A continental QKD backbone is only as secure as its most-compromised relay, which is why NSA flags this as both a cost and an insider-threat driver. The clean fix, a quantum repeater, does not exist as deployable infrastructure.

4. Their trust models are validated differently. A QRNG earns trust by passing the same source-agnostic entropy validation a classical hardware generator passes, measured on its actual output. QKD’s real security depends on the hardware and engineering rather than on physics alone, and confirming a fielded device meets the theoretical guarantee is a significant challenge NSA names explicitly.

5. Only one of them is straightforwardly buyable and useful today. QRNG is a mature commercial product category that slots into an existing stack, and the question about any given unit is whether it holds an SP 800-90B entropy-source validation. QKD requires new physical infrastructure and carries published guidance against it from the NSA, the UK NCSC, and a joint position paper by BSI with ANSSI (France), NLNCSA (Netherlands) and the Swedish NCSA.

Sources for items 4 and 5: NIST, “Recommendation for the Entropy Sources Used for Random Bit Generation,” SP 800-90B, January 2018, csrc.nist.gov, for the entropy-source validation path; UK NCSC, “Quantum security technologies”, and BSI with ANSSI, NLNCSA and the Swedish NCSA, “Position Paper on Quantum Key Distribution”, for the agency positions, quoted in full further down this note.

Sources for items 1 to 3: S. Pirandola, R. Laurenza, C. Ottaviani, L. Banchi, “Fundamental limits of repeaterless quantum communications,” Nature Communications 8, 15043 (2017); H.-K. Lo, M. Curty, B. Qi, “Measurement-Device-Independent Quantum Key Distribution,” Physical Review Letters 108, 130503 (2012); twin-field QKD 833.8 km fiber record, Nature Photonics 16, 154 (2022).

Where do they agree?

1. Both rest on genuine quantum physics. QRNG uses the indeterminacy of a quantum measurement outcome, and QKD uses the disturbance a measurement causes. Neither is marketing dressed as physics, and the criticisms of each are about engineering and deployment rather than about the underlying science.

2. Neither addresses why the post-quantum migration is happening. The migration exists because Shor’s algorithm breaks RSA and ECC, and the fix is replacing those algorithms. Better randomness does not un-break them, and a QKD link on one route does nothing for the rest of an estate.

3. Both are judged on the implementation rather than on the label. A quantum label with no SP 800-90B validation behind it tells you about the marketing rather than the bits, and a QKD deployment’s security depends on the fielded hardware rather than on the theorem.

4. Both still need the surrounding cryptography. A QRNG feeds a deterministic generator that feeds a key derivation function. A QKD link still needs an authentication layer, a symmetric cipher to consume its keys, and ordinary key management around it.

5. Both are recorded as components rather than as quantum-safety milestones. A QRNG appears in a CBOM as one entropy source among many, and a QKD link appears as one key-agreement mechanism covering specific endpoints.

Where does each genuinely fit?

QRNG fits wherever entropy quality is worth improving and the unit carries a validation. Every post-quantum algorithm needs high-quality randomness for key generation, and ML-DSA in its randomized signing mode needs it for signing. A QRNG is a legitimate way to supply that entropy, in the same way an SP 800-90B-validated classical source is, and buying one is a separate decision from the algorithm migration.

QKD fits in a narrow band worth naming precisely. Point-to-point links of bounded distance between two facilities under one organization’s physical control, where the operator owns and secures both endpoints and the fiber. Use cases with a genuine information-theoretic requirement for the key-agreement step, where the threat model legitimately reaches beyond any computational assumption and the data must stay confidential effectively forever. Environments where the specialist hardware, dedicated fiber, denial-of-service exposure and separate authentication overhead are all acceptable and budgeted.

Neither substitutes for the migration. For general-purpose key establishment over routed networks, the vast majority of enterprise and cloud systems, and anything that cannot deploy its own optics, standardized PQC provides the protection at software cost with no new hardware.

What do the national authorities actually say?

The positions are public and they diverge by technology. QRNG is treated as an entropy source and judged by validation rather than by any special quantum status. QKD has drawn explicit published guidance from four authorities.

1. NSA states that QKD’s limitations make it impractical for national-security-system operational networks, and that it “does not support the usage of QKD or QC to protect communications in National Security Systems, and does not anticipate certifying or approving any QKD or QC security products for usage by NSS customers unless these limitations are overcome.”
2. UK NCSC states it will not endorse QKD for government or military use and advises that other organizations should not rely on it as their sole means of generating and distributing keys, with the central objection that QKD provides no authentication and needs specialist hardware.
3. ANSSI, BSI, the Netherlands’ NLNCSA and Sweden’s national authority published a joint position concluding that QKD currently applies only to certain niche use cases, and that for the vast majority of situations where classical key agreement is used today it is not a practical option.

Source: UK NCSC, “Quantum security technologies”; ANSSI, BSI, NLNCSA and Swedish NCSA, “Position Paper on Quantum Key Distribution”.

Why do people confuse them?

Because both carry the word quantum into a security conversation, and both are sold by overlapping vendors into the same budget line at the same moment. A buyer who has just been told that quantum computers threaten encryption hears quantum in a product name as an answer to that threat, and neither product is one.

The distinction that resolves it is the question each answers. QRNG answers “where do my random bits come from.” QKD answers “how does a key get from here to there.” The post-quantum migration answers “which algorithms do I replace,” and only the third question is the reason the migration exists.

Common misconceptions

1. “QRNG and QKD are the same technology.” One generates entropy locally with no counterparty, and the other distributes a key between 2 endpoints over dedicated hardware. They share a physical principle and nothing about deployment.

2. “Buying a QRNG makes us quantum-safe.” Improving randomness leaves every quantum-vulnerable algorithm exactly as vulnerable. The threat is at the algorithm layer, and entropy quality sits underneath it.

3. “QKD is unbreakable, so it replaces PQC.” QKD agrees keys and authenticates nothing, needs dedicated hardware, is distance-limited, is easy to jam, and relies on trusted relays that see the key in the clear. Four national authorities have published against relying on it for high-assurance use.

4. “A quantum label means the randomness is certified.” SP 800-90B is source-agnostic and awards no credit for a quantum noise source. Real quantum devices ship measurable bias and correlation from classical imperfections, which is why min-entropy is estimated conservatively from measured raw output.

5. “QKD’s physics guarantee carries over to the deployment.” Real security depends on the fielded hardware and engineering rather than on physics alone, and NSA names validating that as a significant challenge.

6. “Neither is worth anything.” Both are genuine technologies. QRNG is a legitimate entropy source that deploys today, and QKD has a real niche where an information-theoretic key-agreement requirement and full physical control of both endpoints coincide.

Questions people ask

Which one do I actually need? Most organizations need neither to complete a post-quantum migration. A QRNG is a reasonable entropy-quality improvement if the unit holds an SP 800-90B validation. QKD is worth considering only for point-to-point links between facilities you physically control, with a genuine information-theoretic requirement.

Does a QRNG protect me from quantum computers? No. Quantum computers break asymmetric algorithms through Shor’s algorithm, and randomness quality is a separate layer. A QRNG is complementary to the migration rather than part of it.

Does QKD replace ML-KEM? No. QKD covers key agreement on a specific link, authenticates nothing on its own, reaches only the endpoints it spans, and produces no signatures. Standardized PQC is the substrate for the transition.

Why does QKD have a distance limit? Photon loss in fiber grows exponentially with length, and single photons cannot be amplified without destroying their quantum state, so the key rate collapses. Commercial fiber QKD reaches roughly 100 to a few hundred kilometers without intermediate help.

What is a trusted node and why does it matter? It is an intermediate relay used to extend QKD beyond its physical range, and it decrypts and re-encrypts the key, so it sees the key in the clear. That reintroduces exactly the trust-in-intermediaries problem the physics argument was meant to remove.

How do I evaluate a QRNG product? Ask for the SP 800-90B entropy-source validation and the entropy model behind the claimed min-entropy. The validation requires raw unconditioned noise access, an IID estimation track and continuous field health tests, and it treats quantum and classical sources identically.

Do the post-quantum algorithms need a QRNG? They need high-quality randomness, which an SP 800-90B-validated classical source supplies just as well. ML-KEM key generation and ML-DSA randomized signing both consume entropy, and the source can be quantum or classical.

Has QKD improved recently? Yes, in range. Measurement-device-independent QKD removes detector-side vulnerabilities, and twin-field QKD has reached past 800 kilometers of fiber. Both remain specialized demonstrations rather than commodity infrastructure and neither changes the authentication gap or the hardware requirement.

Should either appear in my cryptographic inventory? Yes, as components. A QRNG is recorded as one entropy source among many, and a QKD link as one key-agreement mechanism covering named endpoints, rather than either being logged as a step toward being quantum-safe.

---

The map is free and I keep it that way. When the question becomes whether either of these belongs in a specific architecture, and what it would actually cover, that’s the work I do at LaMarr Labs.

Go deeper

• Quantum Key Distribution (QKD) and Quantum Random Number Generation (QRNG) for each technology in full
• QKD vs PQC for the comparison that decides a migration strategy
• The Three QKD Questions for evaluating a QKD proposal
• CSPRNG and DRBG for the stack a QRNG feeds
• Quantum-Native Security MOC for the whole quantum-native picture
• Is anyone selling me something I dont need for the buyer’s view

Last verified 2026-08-10 · Maintained by Addie LaMarr, LaMarr Labs.