Quantum key distribution (QKD) is a way for two remote parties to agree an encryption key using the properties of quantum mechanics, so that any attempt to observe or tamper with the key can be detected. It is not a general fix for quantum risk, and the UK's NCSC recommends quantum-safe cryptography as the preferred mitigation.
How is QKD different from post-quantum cryptography?
The NCSC describes QKD as a mechanism for agreeing encryption keys between remote parties, relying on quantum mechanics to ensure the key has not been observed or tampered with in transit. Its appeal is that its security properties are based on the laws of physics, not on the hardness of a mathematical problem that a future quantum computer might solve.
Post-quantum, or quantum-safe, cryptography takes the opposite route. These are new mathematical algorithms being standardized by bodies such as NIST that run on ordinary computers. The NCSC notes they do not require dedicated or specialist hardware, unlike QKD.
Why does the NCSC not recommend QKD?
Its white paper gives several reasons.
First, QKD protocols do not provide authentication. That leaves them open to a physical man in the middle attack, where an adversary agrees separate keys with each side while both believe they are talking to each other. So QKD must be deployed alongside cryptographic authentication, and that authentication must itself be quantum-safe. In other words, you still need post-quantum cryptography to use QKD safely.
Second, hardware. QKD needs specialized equipment, where quantum-safe algorithms run in software.
Third, scope. Agreeing keys is one of many jobs cryptography does, and QKD addresses that narrow job alone.
The conclusion is stated plainly. Given the specialized hardware requirements and the need for authentication in all use cases, the NCSC does not endorse QKD for any government or military applications, and cautions against sole reliance on it for business-critical networks, especially in critical national infrastructure. It advises that any organization considering QKD should ensure strong quantum-safe authentication is in place alongside it, and says its recommended mitigation against the quantum threat is quantum-safe cryptography. It also says a QKD system may not contribute to an assessment of principle B3.b, Data In Transit, in the NCSC Cyber Assessment Framework.
Is a quantum random number generator the same thing?
No. The same white paper treats quantum random number generation separately. A QRNG relies on quantum mechanics for its entropy and can generate random numbers at very high speed, but the NCSC says it provides no new mitigation against the quantum threat to traditional public key cryptography, and that the unpredictability is hard to realize in practice because the quantum source sits inside classical circuitry that adds noise.
A constructed example
A bank's network team is offered a QKD link between two data centers 40 kilometers apart. The sales material talks about "unbreakable" keys. The team writes down what the link would actually protect: the key exchange for one fiber path. It would not authenticate the endpoints, protect branch connections, or secure the application layer. They compare the cost and equipment against upgrading their existing TLS and VPN configurations to include NIST's post-quantum key establishment standard, which covers every connection and runs in software. They choose the second, and keep a note to revisit QKD if guidance changes.
How to check or apply this
- Write down the problem: which data needs long term confidentiality, and for how many years.
- Inventory where public key cryptography protects that data: TLS, VPNs, code signing, certificates.
- Plan migration to NIST's post-quantum standards, starting with key establishment for long lived data.
- If a vendor proposes QKD, ask how authentication is handled and whether that authentication is quantum-safe.
- Ask for the equipment lifecycle, the distance limits and what happens when a link fails.
- Check national guidance for your sector. The NCSC position is one view, and other agencies have published their own.
- Revisit the decision as standards and guidance change.
Quick check
Does QKD make encryption unbreakable?
No. It addresses key agreement only, and it needs separate authentication. The NCSC notes it is vulnerable to physical man in the middle attacks without it.
What does the NCSC recommend instead?
Quantum-safe cryptography: algorithms standardized by bodies such as NIST that run on classical computers without special hardware.
Sources
- UK NCSC: Quantum security technologies
- NIST FIPS 203: ML-KEM
- CISA: Post-Quantum Cryptography Initiative
Last reviewed: 18 October 2026.
