Quantum key distribution (QKD) uses quantum physics to share an encryption key so that eavesdropping can be detected. It needs dedicated hardware, covers only key exchange, and does not authenticate the parties. Government guidance generally favors post-quantum cryptography, which runs as ordinary software, as the main defense against quantum computers.
How does QKD work in plain terms?
Two parties send information encoded in quantum states, usually single photons over fibre or free space. Measuring a quantum state disturbs it. If an eavesdropper tries to read the photons, the error rate rises, and the parties can see it and throw the key away.
What you get is a shared secret key with a physical argument for its security. The UK National Cyber Security Centre (NCSC) describes this as provable security in the sense that, given a model of operation, there is a set of guarantees the system upholds, underpinned by the laws of physics.
That key is then used with a normal symmetric cipher to protect the actual traffic. QKD replaces the key exchange step, nothing more.
What does QKD not do?
The NCSC points out that exchanging keys is only one of the steps in secure communication. You also need authentication, meaning proof of who is on the other end. QKD does not provide it, and neither does any other quantum technique.
So a QKD link needs another way to authenticate. There are two options in the NCSC analysis. One is to use post-quantum cryptography (PQC) for authentication. The other is to use symmetric keys that are shared in advance. The second can work in controlled environments, but the NCSC notes it does not scale well because those keys must be distributed and managed.
Add to that the engineering cost. QKD needs specialised optical equipment and often trusted relay nodes for long distances. The NCSC also notes that combining quantum and classical components makes systems more complex and harder to secure against well resourced attackers.
What are agencies actually recommending?
The NCSC says it will not support QKD for government or military applications, and it recommends PQC as the main mitigation against the threat from quantum computers. For other sectors it advises against relying on QKD alone for generating and distributing keys.
NIST has finalized its first post-quantum standards: FIPS 203 (ML-KEM, for key establishment), FIPS 204 (ML-DSA, for digital signatures) and FIPS 205 (SLH-DSA, a hash-based signature scheme). NIST's project page says organizations should begin migrating to quantum-resistant cryptography, identify where vulnerable algorithms are used, and plan to replace or update them.
Is there any place where QKD makes sense?
Possibly in narrow, controlled settings: a fixed point-to-point fibre link between two sites you control, where you can use pre-shared authentication keys and the operator accepts the added hardware. Research networks and pilots exist for that reason. For a typical company moving data across the internet, cloud services and mobile devices, QKD does not fit, because those paths run through hardware you do not own.
Why does the timing matter?
The usual argument for acting now is "harvest now, decrypt later": an adversary records encrypted traffic today and decrypts it once a capable quantum computer exists. That risk applies mainly to data that must stay secret for many years, such as health records, state secrets or long term intellectual property. Short lived data, like a one-time login code, is much less exposed. Because migration of cryptography takes years in large organizations, starting an inventory now is cheap insurance, whether or not anyone ever buys a QKD link.
How to check or apply this
- List where your systems use public-key cryptography: TLS, VPNs, code signing, SSH, document signing, key wrapping.
- Record algorithm, key size, owner and replacement difficulty for each use. This is a cryptographic inventory.
- Rank by how long the protected data must stay secret. Data needed for decades is at risk first, because it can be recorded today and decrypted later.
- Ask each vendor for a PQC roadmap and test support for ML-KEM in the protocols you use.
- If someone proposes QKD, ask how authentication works, what equipment sits between the endpoints, and what happens when a relay node is compromised.
Quick check
Does QKD make encryption unbreakable?
No. It gives strong guarantees for key exchange under a stated model, but authentication, the physical implementation and the surrounding systems can all be attacked.
Do I need QKD to be safe from quantum computers?
No. The mainstream path is migrating to the NIST post-quantum algorithms, which run on existing hardware.
Sources
Last reviewed: 18 October 2026.
