up:: Quantum-Native Security MOC

The Three QKD Questions

The three QKD questions are a set of three questions to ask any vendor who pitches quantum key distribution as the thing that makes your post-quantum migration unnecessary, and each one has its answer key built in: (1) “Does this authenticate the endpoints, or do I still need PQC to do that?” (you still need PQC) · (2) “What’s the maximum distance, and does connecting my actual sites require trusted nodes that see my key in the clear?” (for any real deployment, yes) · (3) “What published assurance standard has this been evaluated against, and can I see the certificate?” (a Protection Profile exists; almost no product holds a certificate against it).

The physics behind QKD is real and genuinely elegant, so the questions never argue with the physics. They test the three engineering realities the physics was never designed to cover, which is exactly where NSA, the UK’s NCSC, and France’s ANSSI with Germany’s BSI landed when every one of them looked at QKD and reached for PQC instead.

The short version:

• Question 1 checks authentication: QKD agrees a key but cannot prove who sits at the other end of the fiber, so it always needs a separate authentication layer, and the quantum-safe version of that layer is the PQC signature QKD was pitched as replacing.
• Question 2 checks scale: the physics guarantee holds for a single point-to-point link of roughly 100 to a few hundred kilometers, and spanning your real sites today means chaining “trusted nodes” that decrypt and re-encrypt your key at every hop, in equipment you may not own.
• Question 3 checks assurance: a published Common Criteria Protection Profile for QKD now exists (ETSI GS QKD 016), so the question has a checkable answer and a vendor without a certificate is offering its own assertion, while your encrypted-data problem has finalized NIST standards (ML-KEM, ML-DSA, SLH-DSA).
• These are QKD-specific questions for a QKD pitch. They sit apart from the general vendor-claims checklist you run on any cryptographic product, and they exist because QKD gets sold on a physics promise the other three questions on that general list never surface.
• The strongest evidence you have is that the agencies whose entire job is protecting the most sensitive communications on earth published their answers first: NSA does not support QKD for National Security Systems, NCSC will not endorse it for government or military use, and ANSSI and BSI call it a niche technology.
• Ask question 3 first when you want the meeting over fastest, and reserve the full three when you want to understand exactly where the physics stops and the marketing starts.

Picture a vendor selling you an armored courier who can carry a sealed letter down one specific hallway and prove nobody read it in transit. The courier is genuinely clever in that one corridor. The three questions are the three things you’d ask before wiring your whole business around him: can he confirm the person receiving the letter is actually your colleague and not an impostor in the same uniform (no, that’s a separate job), can he reach your office across the city or does he hand the letter to a chain of other couriers who each open and reseal it (a chain, and each one reads it), and is there any independent body that certifies couriers like him to the standard you’d need (not yet). The courier stays useful in his one hallway. He is not the postal system for your company.

The framework

For any QKD pitch, ask three questions in order, each phrased so the answer does the work:

1. “Does this authenticate the endpoints, or do I still need PQC to do that?” QKD establishes a shared key with whoever is at the far end of the fiber. It has no way to prove who that is. Authentication is a separate primitive, and the quantum-safe version of it is a PQC digital signature. So the answer is that you still need PQC, which means the product being sold as your alternative is actually a customer of the thing it was supposed to replace.
2. “What’s the maximum distance, and does connecting my actual sites require trusted nodes that see my key in the clear?” The physics guarantee holds over one direct optical link, roughly 100 to a few hundred kilometers. Beyond that, a fielded QKD network chains intermediate relays, and at each relay the key is decrypted and re-encrypted, so it sits in the clear at every hop. For any deployment that spans real corporate geography, the answer is yes, there are trusted nodes, and the unbreakable-physics promise evaporates at the first one.
3. “What published assurance standard has this product been evaluated against, and can I see the certificate?” Your finalized PQC standards let you hold a product to a published bar. QKD now has one too: ETSI GS QKD 016 is a Common Criteria Protection Profile for a pair of prepare-and-measure QKD modules, requiring EAL4 augmented with AVA_VAN.5 and ALC_DVS.2. So the question has a right answer, and a vendor who cannot produce a certificate against it is asking you to accept their own word about their own hardware.

When the framework applies: any time a vendor, a board member, or a headline frames QKD as a replacement for the PQC migration, or frames “guaranteed by physics” as a reason to skip the software transition. The three questions read one pitch and return a verdict on whether QKD belongs anywhere in your estate.

When it does not apply as a rejection: when the buyer already knows QKD is a niche component and is scoping it for a genuine point-to-point, information-theoretic use case (covered under where the questions break). There the three questions still get asked, and the answers simply come back better. The framework is a truth test, not a blanket no.

Where it stops. These questions tell you whether a QKD pitch is honest and whether QKD fits the shape of your problem. Mapping which of your links could ever justify it, pricing the dedicated optics and the separate authentication layer against the PQC path, and sequencing any of it against your own data’s shelf life is estate-specific work that starts where the questions end.

Question	The answer	The mechanism underneath	What a real answer sounds like
Does this authenticate the endpoints, or do I still need PQC?	You still need PQC	QKD agrees a key but cannot establish identity, so a man-in-the-middle who splices the fiber agrees keys with you just as happily as your own data center; stopping that takes a separate authenticated channel, and the quantum-safe form is a PQC signature	”It handles key agreement; you authenticate the channel separately, and yes, the quantum-safe way to do that is a PQC signature such as ML-DSA.”
What’s the maximum distance, and do trusted nodes see my key in the clear?	For any real deployment, yes	Single photons cannot be amplified without destroying the quantum state, so range caps near 100 to a few hundred km per link (the PLOB bound); spanning farther chains trusted nodes that decrypt and re-encrypt the key at each hop	”Point-to-point reach is a few hundred kilometers; connecting sites past that uses trusted-node relays, and each relay holds the key in plaintext.”
What published assurance standard has it been evaluated against, and where is the certificate?	Usually no certificate	A Protection Profile exists (ETSI GS QKD 016, EAL4 augmented with AVA_VAN.5 and ALC_DVS.2), and ISO/IEC 23837 defines the evaluation methods, so the bar is published. Very few products have completed evaluation, and NSA has said separately that it does not anticipate approving QKD for National Security Systems	”There’s a published Protection Profile now, so show me the certificate number and the scheme that issued it. Designed-to-conform and certified are different claims.”

Does QKD authenticate the endpoints, or do you still need PQC?

You still need PQC, and this is the question that reframes the entire pitch, because it converts QKD from an alternative into a dependency. QKD agrees on a shared key with whoever is physically at the other end of the fiber. Proving that the other end is your own facility rather than an attacker who spliced into the line is a completely different job called authentication, and QKD has none of its own.

The mechanism is worth stating precisely, because it is a pedant magnet. QKD’s security rests on two facts of quantum physics: an unknown quantum state cannot be copied (the no-cloning theorem) and measuring a quantum state disturbs it. Together they let the two endpoints detect an eavesdropper who tries to read the key in transit. Neither fact says anything about who the two endpoints are.

An adversary who cuts the fiber and inserts themselves as a relay does not passively eavesdrop, so no-cloning never triggers; they simply run one QKD session with you and another with your real destination, learning both keys. To stop that, the classical processing channel QKD depends on has to be authenticated separately, either with an information-theoretic message-authentication code keyed by a pre-shared secret, or with public-key or PQC authentication.

Source: overview of QKD’s authentication dependency, from Quantum Key Distribution (QKD), derived from C. H. Bennett and G. Brassard, “Quantum cryptography, Public key distribution and coin tossing,” Proc. IEEE Int. Conf. Computers, Systems and Signal Processing, 1984.

For any organization not distributing pre-shared secrets by courier, the practical authentication layer is a PQC signature, ML-DSA or SLH-DSA. The UK’s NCSC makes the point as its central technical objection: QKD provides no authentication and therefore always has to be paired with quantum-resistant authentication, and unlike PQC it also needs specialist hardware to do its one job.

Source: UK NCSC, “Quantum security technologies,” ncsc.gov.uk.

So the box sold as the reason to cancel your PQC migration turns out to assume that migration already happened. It sits on top of PQC rather than in place of it. That single fact is usually enough to move QKD from the “strategic decision” column to the “specialized component” column in any board conversation.

What’s the maximum distance, and do trusted nodes see your key in the clear?

For any deployment that spans real corporate geography, the answer is yes, there are trusted nodes, and each one holds your key in plaintext. The unbreakable-physics guarantee holds for exactly one thing: a single, direct, point-to-point optical link. Stretch past that and the guarantee quietly leaves the room.

The distance limit is hard physics, not an engineering gap that a better product closes. Photon loss in optical fiber grows exponentially with length, and because QKD depends on single photons that cannot be amplified without destroying their quantum state, the usable key rate collapses as the link gets longer.

What fixes that ceiling is the repeaterless secret-key-capacity bound, the PLOB bound, which sets the maximum key rate achievable over a lossy channel with no repeater. The bound is written against the channel’s transmissivity, so it caps the rate at any distance rather than naming a cutoff distance of its own. The roughly 100-to-a-few-hundred-kilometer figure used throughout this note is the practical reach of fielded systems, not a number the bound states: the Thuringia telemedicine network below runs over about 140 km of installed fiber, and the 833.8 km twin-field result is a laboratory record.

Source: S. Pirandola, R. Laurenza, C. Ottaviani, L. Banchi, “Fundamental limits of repeaterless quantum communications,” Nature Communications 8, 15043 (2017), for the rate bound: the “secret-key capacity of the lossy channel is the maximum rate achievable by any optical implementation of QKD.”

To go farther today, a QKD network chains multiple links through intermediate stops the industry calls trusted nodes. Here is what “trusted node” actually means, and it is the part vendor slides tend to skate past: at every one of those stops, the key is decrypted and re-encrypted. It sits in the clear, in equipment you may not own, at every hop along the route. The whole promise was that nobody can touch your key. The reality, past a single link, is that every relay operator between your two sites can, so a continental QKD backbone is only as secure as its most-compromised relay. NSA flags this as both an infrastructure-cost driver and an insider-threat driver in its published guidance.

Source: NSA Cybersecurity, “Quantum Key Distribution (QKD) and Quantum Cryptography (QC),” nsa.gov, infrastructure-cost and insider-threat limitation.

The clean fix would be a quantum repeater that extends the key across links without ever exposing it. A practical, deployable quantum repeater does not yet exist; it remains research-grade. Newer protocols such as measurement-device-independent QKD and twin-field QKD push the range and narrow the trusted-node problem on long links, with a twin-field fiber record past 800 kilometers in the lab, but those are specialized demonstrations rather than commodity infrastructure, and they do not change the foundational facts that QKD is point-to-point, needs separate authentication, and runs on dedicated hardware.

Source: TF-QKD 833.8 km fiber record, Nature Photonics 16, 154 (2022).

Until recently this section could only argue the point from physics and from agency guidance. A 2026 field deployment now supplies the worked example, and it comes from a team that includes the equipment vendor. A German consortium ran entanglement-based QKD across 140 kilometers of installed telecom fiber in Thuringia, connecting a rural health kiosk at Sundhausen to the University Hospital Jena in order to secure a telemedicine session. The route required two intermediate trusted nodes, at Erfurt and at the Fraunhofer institute in Jena, and the paper states it plainly: the two end nodes run the application and a post-quantum daemon, while the two intermediate nodes act as trusted relays.

The end-to-end protection of the medical data came from the post-quantum layer running between the endpoints, which passed through both relays unopened. That is the layered pattern working exactly as the physics predicts: quantum key distribution secured each hop, and software secured the distance.

Two details from the same deployment are worth carrying into any procurement conversation. The two links were operated in separate periods rather than concurrently, so the full 140-kilometer path was never held end to end for the 22 days of autonomous operation the abstract reports. And one segment, between the Fraunhofer node and the hospital, ran on previously generated keys drawn from a local keystore because the live hardware was unavailable, which is a materially different control from the one on the architecture diagram.

Source: V. Dosan, P. Spooren, S. Moeckel et al., “Secure Medical Data Transmission Using Quantum Key Distribution and Post-Quantum Cryptography in Real-World Fiber Networks,” arXiv:2608.18869, preprint. Commercial-interest disclosure: six of the thirteen authors are affiliated with Quantum Optics Jena GmbH, a vendor of the deployed equipment class. The findings cited here run against that interest, which is why they carry.

The net effect is a guarantee that protects the one link you probably don’t need it on and dissolves on the long routes where you would.

What published assurance standard has a QKD product been evaluated against?

There is a published bar now, and this question turns “unbreakable” from a property into something a buyer can check. When a vendor says a product is secure, the professional follow-up is always the same: evaluated against what, by whom, and where is the certificate. For your encrypted-data problem the answer is concrete, because the finalized NIST standards give you a published bar. For QKD the answer used to be that no bar existed. That changed.

ISO/IEC 23837 defines the requirements and the test methods. Published in 2023 in two parts, it specifies security functional requirements for QKD modules covering the conventional network components, the quantum optical components, and the implementation of the QKD protocols, plus the evaluation activities for testing them. The quantum optical coverage is the part that matters, because conventional module validation such as FIPS 140-3 has no vocabulary for a single-photon source or a detector.

Source: ISO/IEC, “ISO/IEC 23837-1:2023” and “ISO/IEC 23837-2:2023”.

ETSI GS QKD 016 is a Common Criteria Protection Profile for QKD. Published as V1.1.1 in April 2023 and revised to V2.1.1 in January 2024, it covers a pair of QKD modules running a prepare-and-measure protocol that together form a complete system over a point-to-point link, and its scope runs from the physical implementation through to the output of final secret keys. A Protection Profile is a community-written requirement set, which is stronger evidence than a vendor writing its own security claims and being measured against those. The assurance package it requires is EAL4 augmented with AVA_VAN.5 and ALC_DVS.2: high-attack-potential vulnerability analysis, plus development and manufacturing security at the vendor’s own site.

Source: ETSI, “GS QKD 016 V2.1.1 (2024-01)“.

So the question gets sharper rather than softer. Ask for the certificate number and the national scheme that issued it, then check it, exactly as the vendor-claims checklist does for post-quantum products. Three things separate a real answer from a good-sounding one. Designed-to-conform is a different claim from evaluated. The Protection Profile covers prepare-and-measure architectures, so a continuous-variable, measurement-device-independent, or twin-field product has no community profile to claim and can only offer a self-authored security target. And very few products have completed evaluation, so “no certificate yet” is the common and accurate answer, which is fine when a vendor says it plainly and a problem when the pitch says “unbreakable” instead.

The underlying difficulty the standards were built to address is still real. QKD security depends on the hardware and the engineering, not on the physics alone. The physics guarantee applies to an idealized protocol with idealized components, and real systems use imperfect sources, imperfect detectors, and real optics. That gap is where the actual attacks on deployed QKD systems have lived. NSA records that “the specific hardware used to perform QKD can introduce vulnerabilities, resulting in several well-publicized attacks on commercial QKD systems,” and it is why the agency states it does not anticipate certifying or approving any QKD product for National Security Systems unless these limitations are overcome. A Protection Profile gives evaluators a way to probe that gap; it does not close it, and NSA’s position is unchanged.

Source: NSA Cybersecurity, “Quantum Key Distribution (QKD) and Quantum Cryptography (QC),” nsa.gov.

What do the national security agencies say about QKD?

They say, in three jurisdictions and one voice, that standardized PQC carries the transition and QKD stays niche. This is the evidence layer that makes the three questions land, because it means the buyer is not taking one advisor’s read against a vendor’s; they are standing with the organizations whose entire job is protecting the most sensitive communications there are. Each position is scoped precisely below, because overstating them is the fastest way to lose the room to a well-prepared vendor.

Agency	Jurisdiction	Position, exactly	Source
NSA	United States	Does not support the use of QKD or QC to protect communications in National Security Systems, and does not anticipate certifying or approving any such product for NSS use unless the limitations are overcome; treats quantum-resistant (PQC) cryptography as the more cost-effective and maintainable path	nsa.gov
NCSC	United Kingdom	Will not endorse QKD for government or military use, and advises that QKD should not be solely relied upon for generating and distributing keys; recommends PQC as the primary mitigation to the quantum threat	ncsc.gov.uk
ANSSI and BSI (with NLNCSA and Sweden’s NCSA)	France, Germany, Netherlands, Sweden	Joint position paper concludes QKD currently applies only to certain niche use cases and is not a practical option for the vast majority of situations where classical key agreement is used today; shared priority is migration to PQC	bsi.bund.de

The verbatim NSA line is the one to carry into a meeting, because it is unambiguous: “NSA does not support the usage of QKD or QC to protect communications in National Security Systems, and does not anticipate certifying or approving any QKD or QC security products for usage by NSS customers unless these limitations are overcome.”

Source: NSA Cybersecurity, “Quantum Key Distribution (QKD) and Quantum Cryptography (QC),” nsa.gov.

The scope discipline matters. None of these agencies has banned QKD universally or declared the physics fake. NSA and NCSC decline it for their own high-assurance systems and decline to certify it; ANSSI and BSI call it niche and impractical for general use. Every one of them recommends PQC as the substrate for the transition. Stated that way, the positions are unimpeachable, and a vendor cannot reframe them as agencies “not understanding the technology,” because the agencies concede the physics and reject the deployment on engineering grounds, which is precisely what the three questions surface.

What does a QKD pitch look like run through the three questions?

Run them end to end on a realistic pitch, the kind that reaches a board through a vendor deck: “Our quantum key distribution platform secures your communications with keys protected by the laws of physics, not breakable mathematics. Any eavesdropper is detected instantly. This is genuinely unbreakable encryption, and it makes the disruptive post-quantum software migration everyone is worried about unnecessary for your organization.”

Question 1, authentication. “Does this authenticate the endpoints, or do we still need PQC to do that?” The platform detects an eavesdropper on the line, and it cannot confirm the endpoint on the other side of the line is actually your data center. That is authentication, and QKD has none of its own. To stop a man-in-the-middle who splices the fiber, you bolt on a PQC signature layer. So the deck’s claim that the platform makes the PQC migration unnecessary is backwards: the platform depends on the very PQC signatures it was pitched as replacing.

Question 2, distance and trusted nodes. “What’s the maximum distance, and does connecting our actual sites require trusted nodes that see the key in the clear?” The physics guarantee covers one direct link of a few hundred kilometers. Your offices are not a few hundred kilometers apart on dedicated fiber you own; they are continents apart on routed networks. Connecting them means trusted-node relays, and every relay decrypts and re-encrypts your key, holding it in plaintext. The “instantly detects any eavesdropper” promise covers the single hop where it is least useful and lapses on the long routes where it would actually matter.

Question 3, assurance. “What published assurance standard has this been evaluated against, and can I see the certificate?” A Protection Profile exists, so there is a bar. The pitch offers no certificate against it, which leaves “genuinely unbreakable” as the vendor’s assertion about their own hardware. Meanwhile the “disruptive migration” the deck dismisses has finalized NIST standards a buyer can demand compliance with.

The output, in one meeting: the physics in the deck is real, and none of the deck’s three business claims survives contact. The platform does not replace PQC (it needs PQC), does not scale to your estate without exposing your keys at every relay, and cannot be certified to any government bar today. QKD leaves the “cancel the migration” conversation and enters the “specialized component we might scope for one link someday” conversation, which is where the agencies already put it.

Common misconceptions

• “Guaranteed by physics means guaranteed, full stop.” The guarantee is real and narrow. It covers detecting an eavesdropper on a single point-to-point link, and it says nothing about authentication, nothing about scale, and nothing about the imperfections in real hardware, which is exactly where the actual attacks on deployed QKD systems live. A narrow true guarantee gets marketed as a total one.
• “QKD and PQC are two flavors of the same quantum-safe thing, so buying either checks the box.” They are different categories solving the same threat by opposite means, and only one of them is a general answer. Conflating them under a single “quantum-safe” label is how a point-to-point hardware product gets sold as a substitute for a software migration across a routed estate. QKD is quantum-native hardware for key agreement on dedicated optics; PQC is standardized math that authenticates and runs everywhere.
• “QKD replaces the PQC migration.” It depends on PQC, because it agrees a key without proving identity and so leans on the very PQC signatures it was pitched as replacing, and it runs only on dedicated point-to-point optics rather than the routed networks that carry the overwhelming majority of enterprise, cloud, and internet traffic. QKD is a specialized component that assumes your migration already happened.
• “QKD stops harvest-now-decrypt-later, so it solves our long-lived-data problem.” HNDL threatens data flowing over ordinary routed networks, and that is precisely the traffic QKD’s point-to-point optics cannot reach. Buying a QKD link for two facilities does nothing for the thousands of connections harvesting actually threatens; PQC and hybrid key exchange are the answer for that data. QKD addresses harvesting only on the specific links it can physically serve.
• “There are no known attacks, so QKD is unbreakable in practice.” NSA records “several well-publicized attacks on commercial QKD systems,” introduced by the specific hardware, even while the underlying protocol is provably secure in theory. Security depends on the engineering of the specific device, which is why validating a fielded system is hard and why the agencies stay cautious.
• “The agencies just don’t understand the technology.” The agencies concede the physics and reject the deployment on engineering grounds, which is the opposite of not understanding it. NSA enumerates five specific limitations, from the authentication gap to the trusted-node insider risk to the denial-of-service exposure, and each is an engineering fact rather than a misunderstanding.

Pro tips

1. Ask question 3 first when you want the meeting over fastest. Authentication and distance both invite a vendor to explain, and the explanations can eat a meeting. “Can I see the certificate against ETSI GS QKD 016?” has a short answer, and naming the specific Protection Profile shows the room you know the bar exists, so a vendor cannot fill the silence with why certification is hard. Lead with it when the goal is a decision; walk all three in order when the goal is to teach the room why.
2. When a vendor pitches “hybrid QKD plus PQC,” ask what the QKD layer adds that PQC lacks. This is the sharpest follow-up, because the answer is usually “information-theoretic key agreement on this one link,” which is only valuable if you actually have an adversary beyond every computational assumption on that exact link. If the answer is instead “defense in depth” or “belt and suspenders,” you are paying for dedicated optics and a second failure mode (the denial-of-service exposure QKD carries and PQC does not) to protect a key exchange that PQC already protects. Make the vendor name the specific threat only QKD’s layer removes; a hybrid that cannot name it is PQC plus expensive hardware.
3. Separate the two things a denial-of-service answer hides. The same sensitivity that catches an eavesdropper lets an attacker jam the link and stop the key from flowing, so a QKD link fails closed under a jam that a PQC connection shrugs off. If availability matters on the link in question, the physics that provides the security also provides a single-link kill switch, and that belongs in the tradeoff.
4. Ask which target the “unbreakable” claim protects, data or trust. QKD does key agreement only. It never signs anything, so the entire authentication and certificate half of the quantum transition is a PQC job no matter how much QKD you buy. A vendor implying QKD covers your signing keys or your PKI has wandered outside what the box does.
5. Write the three answers into the risk record as findings, not as a rejected option. “QKD evaluated; needs PQC for authentication, needs trusted nodes past one link, no certificate produced against the published Protection Profile” is a dated, sourced finding a board can act on. Leaving it as “we looked at QKD and passed” invites the same vendor back next quarter to the same meeting.
6. Keep the physics concession in your own mouth first. The rejection lands harder when you open by granting that the physics is real and elegant, because it removes the vendor’s best rhetorical move, reframing you as a skeptic who doesn’t get quantum. You concede the physics, then ask the three engineering questions the physics doesn’t touch, exactly as the agencies did.

Where do the three questions break?

The questions have honest limits, and naming them is what keeps the framework from being an anti-QKD reflex:

1. A genuine point-to-point, dedicated-fiber, no-trusted-node deployment changes the answers, not the questions. When an operator controls both endpoints and the fiber over a bounded distance, with no intermediate relays, question 2’s trusted-node problem simply does not arise, and the physics guarantee applies cleanly to that one link. The questions still get asked; question 2 comes back “single link, no trusted nodes, within range,” and that is a legitimate pass. Research and metro links, and a small number of state-secret and intelligence channels, are the examples.
2. The information-theoretic requirement is real for a narrow band. Question 1 still returns “you need PQC for authentication” even there, but if a use case genuinely has adversaries beyond any computational assumption and data that must stay confidential effectively forever, the key-agreement step has a real reason to want physics rather than math. That band is narrow, and it is where the agencies say QKD earns its place. The framework’s job in that band is to confirm the buyer actually has that requirement rather than a vendor’s suggestion of one.
3. Question 3 already changed once, exactly as designed. Earlier versions of this framework answered it “there isn’t one.” ETSI published a Common Criteria Protection Profile for QKD in April 2023 and revised it in January 2024, so the question now has a real answer and the framework absorbed it without changing shape. Expect it to move again as products complete evaluation. The question is durable; the answer carries a verified date for exactly that reason.
4. The questions test QKD, not the whole quantum-communications field. Quantum random number generation, quantum sensing, and future quantum-network research are separate technologies with their own merits, and a vendor bundling them into a QKD pitch is a reason to unbundle, not a reason to run these three questions against the bundle.

How do you use the three questions in a boardroom?

Deploy them in the meeting where the QKD box lands, and use them to make yourself the person who priced the technology rather than the person who said no. When a vendor or a director frames QKD as the way to skip the migration, grant the physics out loud first, then walk the three questions, and let each honest answer reposition the technology on its own.

Carry three one-line landings for the follow-through. For authentication: “it agrees a key but can’t prove who’s on the other end, so it needs a PQC signature to stop a man-in-the-middle, which makes it a customer of the migration, not a replacement for it.” For distance: “the physics holds for one link of a few hundred kilometers; connecting our real sites uses relays that hold our key in the clear at every hop.” For assurance: “there is a published Protection Profile for QKD now, so we can ask for a certificate against it, and our data problem has finalized NIST standards we can demand.”

Then close with the evidence that outranks any advisor in the room: NSA won’t use it for national security systems, NCSC won’t endorse it for government or military use, and ANSSI and BSI call it niche, and all three chose PQC. Every piece of that is checkable from public agency guidance, which is what makes it survive a vendor’s rebuttal.

The result is that QKD gets sorted correctly, into a specialized component you might scope for a specific link someday, and off the critical path of the transition, in the same meeting, without anyone needing to relitigate quantum mechanics.

Questions people ask

Are these the same questions I’d ask any security vendor? No, and that distinction is the point. A general vendor-claims checklist asks about validation, roadmaps, and support for any cryptographic product. The three QKD questions are specific to QKD, because QKD is uniquely sold on a physics promise that the general questions never surface, so they target authentication, distance and trusted nodes, and the missing assurance standard, the three places that promise quietly stops covering you.

If QKD is so limited, why do serious national labs and telecoms build it? Because in a genuine point-to-point deployment with controlled endpoints and a real information-theoretic requirement, physics-based key agreement is a legitimate thing to want, and research into quantum networks is worth doing. The limitation is not that QKD is useless; it is that it is a narrow tool being marketed as a general one. The questions separate the two.

Does QKD replace my PQC migration? No. QKD cannot authenticate, cannot run over routed networks, and needs dedicated hardware at both ends of every link, so it cannot carry an organization’s general cryptography. For nearly every system you run, PQC is the answer, and QKD at most complements it on a specific link. That is the consistent position across NSA, NCSC, and ANSSI.

What is a “trusted node” and why does it matter so much? It is an intermediate relay used to extend QKD past the distance one link can cover, and at each one your key is decrypted and re-encrypted, so it sits in plaintext in that equipment. It matters because QKD’s entire selling point is that nobody can touch your key, and the trusted-node model reintroduces exactly the trust-in-intermediaries problem the physics was supposed to remove, which is why NSA lists it as both a cost and an insider-threat driver.

Isn’t “guaranteed by the laws of physics” stronger than “believed hard for a computer”? For the one thing QKD’s physics covers, detecting an eavesdropper on a single link, it is a genuinely different and strong guarantee. The catch is that the guarantee is narrow and assumes ideal hardware, while the real attacks target the imperfect hardware, and the guarantee covers neither authentication nor scale. PQC’s computational assumption, by contrast, protects authentication, runs everywhere, and comes with a certification you can demand today.

How far can QKD actually reach? Commercial fiber QKD runs point-to-point over roughly 100 to a few hundred kilometers before the key rate collapses, a limit fixed by photon loss and the repeaterless PLOB bound. Laboratory twin-field protocols have pushed past 800 kilometers, but those are demonstrations rather than commodity deployments, and real long-distance QKD still relies on trusted relays or satellites.

Has a real QKD system ever been broken? Yes. NSA’s public position states that “the specific hardware used to perform QKD can introduce vulnerabilities, resulting in several well-publicized attacks on commercial QKD systems,” even though the underlying protocol is provably secure in theory. That gap between the ideal protocol and the physical device is precisely why NSA calls validating a fielded system a significant challenge, and why question 3 has no reassuring answer yet.

Can QKD and PQC be used together? In the narrow settings where QKD fits, yes, and they are complementary there rather than competing, because a QKD deployment still needs authentication and PQC signatures are the natural way to provide it. Outside that band, PQC does the whole job on its own, and adding QKD adds hardware, a denial-of-service exposure, and cost without adding protection PQC lacks. That is what the “hybrid QKD plus PQC” follow-up in the pro tips is designed to test.

---

Everything here is the map, given freely, and the three questions are yours to run on the next box a vendor sets on the table. The version quantified against your own estate, whether any link you operate could ever justify QKD and what the PQC path costs against it, is the work I do. Request the workshop.

Last verified 2026-07-26 · Updated 2026-08-27 · Maintained by Addie LaMarr, LaMarr Labs.