What is the fundamental difference between QKD and post-quantum cryptography?

Post-quantum cryptography (PQC) replaces mathematically hard problems that quantum computers can solve — integer factoring, discrete logarithms — with problems believed to be hard even for quantum computers, such as lattice problems (ML-KEM) or hash collisions (SLH-DSA). Its security is computational: it assumes an adversary cannot perform certain calculations within a practical time. QKD, by contrast, derives its security from quantum mechanics itself — specifically the no-cloning theorem and the disturbance caused by measuring a quantum state. Any eavesdropper attempting to intercept photons on a QKD channel necessarily disturbs the quantum states and introduces detectable errors. QKD provides information-theoretic security against an adversary with unlimited computational power, including future quantum computers. PQC is much easier to deploy at scale and does not require specialized photonic hardware; QKD provides a categorically stronger security guarantee at the cost of physical channel requirements and limited range.

Why is free-space QKD particularly relevant for tactical military networks?

Tactical military networks frequently operate in environments where laying new fiber is operationally impractical — forward operating bases, mobile command posts, ship-to-shore links, and airborne assets. Free-space QKD transmits single photons through the atmosphere using collimated laser optics, requiring only line-of-sight between Alice and Bob terminals rather than a continuous fiber path. Ground-to-ground free-space QKD has been demonstrated at ranges up to approximately 1 km in daylight with background-rejection filters, and over tens of kilometers at night or via airborne relay. Drone-mounted QKD relay nodes extend this range by acting as trusted nodes at altitude, where atmospheric turbulence is lower and line-of-sight reach is much greater. The portability of free-space terminals — compact enough for vehicle or tripod mounting — makes them more operationally viable for tactical use than fixed fiber infrastructure.

What is a trusted node in QKD and what are its security implications?

A trusted node is an intermediate QKD relay point that terminates the quantum channel from one segment and originates a new quantum channel to the next. Because single photons cannot be amplified without destroying their quantum state (no-cloning theorem), QKD links are limited in range — roughly 100–150 km over low-loss fiber, less over free-space paths. Trusted nodes extend the network by decrypting key material at the relay, re-encrypting it classically for storage, then using the relay's outbound QKD link to forward the key material. The critical security implication is that a trusted node holds plaintext key material: if a trusted node is compromised, the attacker gains the keys for all QKD sessions passing through it. Trusted nodes are only 'trusted' in the organizational sense — they are not quantum-secure relays. Defense deployments must physically secure trusted nodes to the same standard as key management hardware (KMH), apply separation-of-duty controls to node access, and design network topology to minimize the number of trusted-node hops between the most sensitive endpoints.

How does QKD integrate with CNSA 2.0 and NSA requirements for national security systems?

NSA's CNSA 2.0 (September 2022) mandates specific post-quantum algorithms — ML-KEM-1024, ML-DSA, AES-256 — for National Security Systems and does not currently mandate QKD. NSA has stated that QKD alone is not sufficient to protect NSS traffic and that post-quantum cryptographic algorithms are the primary required mitigation. However, CNSA 2.0 is not in conflict with QKD: the two approaches are complementary. QKD can generate high-entropy key material that feeds into CNSA 2.0-compliant symmetric encryption (AES-256), providing an additional layer of key secrecy beyond what post-quantum key encapsulation mechanisms deliver. The recommended posture for NSS is to implement CNSA 2.0 algorithms as the baseline required by policy, and to add QKD as an additional key-material source for the highest-sensitivity links where the physics-based security guarantee justifies the deployment cost. NSA's guidance document on QKD (CSA-U-OO-800069-21) provides the authoritative position.

What are the realistic deployment constraints that prevent widespread tactical QKD adoption today?

Several hard physical and engineering constraints limit near-term tactical QKD adoption. Range is the most fundamental: current fiber QKD links are practical up to approximately 100 km without trusted-node repeaters; free-space links are limited to a few kilometers at ground level in daylight. Quantum repeaters — devices that extend QKD range without trusted-node security compromises — remain a research-stage technology, not a fielded product. Line-of-sight requirements for free-space QKD are absolute: terrain, structures, and vehicle movement break the link. Atmospheric conditions including rain, fog, and dust attenuate free-space photon paths, reducing key generation rates or interrupting links entirely. Key generation rate is another constraint: current commercial QKD systems generate symmetric key material at rates of kilobits per second to low megabits per second — adequate for key seeding and OTP communications, but insufficient to directly protect high-bandwidth ISR video streams. Finally, the hardware itself — single-photon sources, single-photon avalanche diode (SPAD) detectors, and polarization-maintaining optics — is expensive, fragile, and not yet miniaturized for dismounted soldier use. Realistic widespread tactical adoption is a 10–15 year horizon; near-term deployment is credible for fixed or semi-fixed strategic links.

Quantum key distribution for tactical military comms

Post-quantum cryptography replaces classical key exchange algorithms with mathematically harder problems. Quantum key distribution does something categorically different: it removes the computational assumption entirely. QKD distributes cryptographic key material over a quantum channel – typically a fiber or free-space optical path carrying individual photons – in a way that is provably detectable if an adversary intercepts it. The security guarantee comes from quantum mechanics, not from the presumed hardness of a mathematical problem. For military planners and INFOSEC officers facing a harvest-now-decrypt-later (HNDL) threat model, this distinction matters. Post-quantum algorithms provide computational security against future quantum computers; QKD provides information-theoretic security against any adversary, regardless of computational resources.

This article covers the physics and protocols behind QKD, how it compares to and complements post-quantum cryptography for defense applications, the specific engineering challenges of deploying QKD in tactical environments, and a realistic assessment of where QKD fits in a military communications architecture today and over the next decade.

QKD fundamentals: BB84 and E91

The two foundational QKD protocols that underpin nearly all deployed systems are BB84 and E91. Understanding their mechanics is essential for evaluating vendor claims and deployment constraints.

BB84

The BB84 protocol, published by Charles Bennett and Gilles Brassard in 1984, is the basis for most commercial QKD hardware. Alice (the sender) encodes random classical bits onto individual photons by selecting one of two conjugate polarization bases – rectilinear ({|0⟩, |1⟩}) and diagonal ({|+⟩, |-⟩}) – and encoding her bit value as the polarization state within the chosen basis. Bob (the receiver) independently and randomly selects a measurement basis for each photon. When Bob's chosen basis matches Alice's encoding basis, his measurement result is deterministic and matches Alice's bit. When the bases differ, Bob's result is random and the bit is discarded. After transmission, Alice and Bob exchange their basis choices (but not measurement results) over a public authenticated classical channel and keep only the bits where their bases agreed – the sifted key. The sifted key is then subjected to error correction and privacy amplification to produce a final, verifiable shared secret.

The security of BB84 rests on the no-cloning theorem: a quantum state cannot be copied without disturbing it. Any eavesdropper (Eve) who intercepts photons on the quantum channel must measure them, necessarily collapsing the quantum state before re-transmitting. This disturbance introduces errors in Bob's measurements that are detectable by Alice and Bob when they compare a random sample of their sifted key bits. The quantum bit error rate (QBER) – the fraction of sifted bits that disagree – is the primary security indicator: a QBER above approximately 11% (the BB84 security threshold) indicates that eavesdropping may have occurred and the key must be discarded.

E91

The E91 protocol, proposed by Artur Ekert in 1991, uses entangled photon pairs rather than prepared states. A source emits pairs of entangled photons – one to Alice, one to Bob. Alice and Bob independently measure their photons in randomly chosen bases. The correlations between their measurement results – tested via Bell inequality violations – certify both the shared key and the absence of eavesdropping. E91 is device-independent in principle: security can be certified without fully trusting the measurement devices, a significant advantage for high-assurance military applications where supply-chain integrity of QKD hardware is a concern. In practice, fully device-independent QKD remains experimentally challenging; current commercial E91-family systems are semi-device-independent, offering stronger security assumptions than prepare-and-measure BB84 at the cost of lower key generation rates and more demanding optical engineering.

QKD versus post-quantum cryptography: why both matter

A common misunderstanding in defense procurement is that QKD and post-quantum cryptography are alternatives competing for the same role. They are not. They address the quantum threat at different layers and with different security assumptions.

Post-quantum cryptography – specifically the CNSA 2.0 mandated algorithms ML-KEM-1024 for key establishment and ML-DSA for signatures – provides computational security. Its security holds if the underlying mathematical problem (Module Learning With Errors for ML-KEM) is hard for quantum computers. This assumption is well-founded: NIST's multi-year standardization process subjected these algorithms to extensive cryptanalysis, and no polynomial-time quantum algorithm is known for MLWE. But computational security is a conditional guarantee: it holds unless new cryptanalytic techniques emerge. History suggests that cryptographic algorithms are occasionally broken by advances in mathematics; the PQC algorithms are new enough that this risk, while manageable, is non-zero.

QKD provides unconditional security – security that holds even against an adversary with unlimited computational power, including a theoretical quantum computer of arbitrary size. The security proof requires only that quantum mechanics is correct and that the authenticated classical channel used for post-processing cannot be forged. For the highest-assurance military applications – strategic command links, nuclear command and control, intelligence source protection – this categorical difference in security level justifies the engineering cost and physical constraints of QKD deployment.

The recommended posture is layered: implement CNSA 2.0 post-quantum algorithms as the baseline required by NSS policy, and add QKD as an additional key-material source for the highest-sensitivity links. See our article on post-quantum cryptography for defense: CNSA 2.0 guide for the implementation details of the algorithmic layer.

Fiber versus free-space QKD for tactical use

QKD can be delivered over two physical channel types, each with distinct tactical implications.

Fiber QKD

Fiber QKD transmits photons over standard single-mode fiber, typically at telecom wavelengths (1310 nm or 1550 nm) where fiber attenuation is lowest. Deployed systems achieve secure key generation at distances up to approximately 100–150 km using current single-photon sources and superconducting nanowire single-photon detectors (SNSPDs) at the receiver. Beyond this range, photon loss degrades the signal-to-noise ratio below the threshold for secure key extraction. Fiber QKD key generation rates at short distances (under 20 km) can reach several megabits per second on current commercial hardware. At 100 km, rates drop to kilobits per second.

For tactical military use, fiber QKD is viable on fixed or semi-fixed links: headquarters-to-headquarters connections, links between a command post and a static forward element, or data center interconnects within a secure compound. It is not viable for links that require physically moving one endpoint – the fiber must follow. The requirement for a dedicated dark fiber strand (or at minimum a wavelength-division-multiplexed channel on existing fiber, with careful classical-quantum channel isolation to prevent Raman noise degrading the quantum channel) limits deployment to environments with existing fiber infrastructure or the engineering resources to install it.

Free-space QKD

Free-space QKD transmits photons through the atmosphere using collimated optical beams, requiring line-of-sight between Alice and Bob terminals. Compact terminals suitable for vehicle or tripod mounting have been demonstrated in operational-adjacent environments. Ground-level free-space links are constrained by several factors: atmospheric turbulence causes beam wander and reduces signal-to-noise; background photon noise (daylight) requires tight spectral and temporal filtering to isolate single photons from ambient light; weather – rain, fog, dust, and smoke – attenuates the photon path significantly, reducing key generation rate or interrupting the link entirely. Maximum practical ground-level free-space QKD distances are typically under 1 km in daylight with current hardware, extending to several kilometers at night or under low-turbulence conditions.

Airborne and satellite-based free-space QKD substantially extends range. China's Micius satellite demonstrated QKD over intercontinental distances via space. Military-relevant scenarios include drone-mounted QKD relay terminals providing trusted-node extension at altitude, where turbulence is lower and line-of-sight reach is much greater. A UAV at 500 m altitude can maintain free-space optical links with ground terminals at distances of 5–15 km depending on atmospheric conditions – a significant improvement over ground-level geometry and operationally useful for extending QKD reach between a command post and a forward element.

QRNG: quantum random number generators for key seeding

Quantum random number generators offer a lower-barrier entry point to quantum-physics-based cryptographic improvement that does not require free-space optics or fiber infrastructure. A QRNG generates true random numbers from an intrinsically quantum process – photon arrival-time jitter, vacuum fluctuation sampling, or similar – rather than from a deterministic mathematical algorithm seeded by environmental entropy (which is the architecture of most PRNG and DRBG constructions in fielded equipment).

The security relevance is subtle but real. Post-quantum algorithms such as ML-KEM rely on high-quality randomness for key generation: ML-KEM key pair generation uses a random seed, and the encapsulation operation generates a random message. If the random number generator has hidden structure – a weakness in the DRBG construction, an implementation flaw, or deliberate backdoor – the security of the post-quantum algorithm is degraded regardless of the mathematical hardness of the underlying problem. QRNG output has no mathematical structure that could be exploited; the randomness is certified by quantum physics rather than by the implementation quality of a software algorithm.

Several vendors offer PCIe and USB QRNG modules certified to FIPS 140-3 Level 2 and AIS 31 class P2. These devices output random bitstreams at rates of 1–4 Gbps, far exceeding the consumption rate of any key generation process. Replacing the DRBG seed source in your key management infrastructure with a QRNG module is operationally straightforward, has no range or line-of-sight constraints, and delivers a quantifiable improvement in the entropy quality of every cryptographic key generated downstream.

Trusted node architecture for extended range

The range limits of both fiber and free-space QKD require a trusted-node architecture for any network that extends beyond a single QKD link. A trusted node terminates the incoming quantum channel, stores the key material in classical form, and originates a new quantum channel on the outbound segment. End-to-end key distribution across multiple hops requires that each trusted node re-encrypts and forwards the key material, with the classical encryption protecting in-transit keys between nodes.

The security implication is critical: a trusted node holds plaintext key material for all QKD sessions passing through it. A compromised trusted node breaks the information-theoretic security guarantee for every session it relays. Trusted nodes must therefore be physically secured to key management hardware standards – tamper-evident enclosures, intrusion detection, separation-of-duty access controls, and a verified destruction capability if the node risks capture. In a tactical context, a trusted node at a command post that could be overrun requires the same destruction planning as an NSA-approved fill device.

Network topology design should minimize the number of trusted-node hops between the most sensitive endpoint pairs. A direct QKD link between two critical nodes – zero trusted nodes – provides full information-theoretic security. One trusted node introduces a single point of compromise. Each additional hop increases the attack surface. Designing the network to give the highest-priority links the fewest trusted-node hops is the primary QKD topology engineering decision.

Quantum repeaters – devices that extend QKD range without the security compromise of trusted nodes, using quantum memory and entanglement swapping – are an active research area and not yet available as fieldable products. Conservative planning should assume trusted-node architectures through at least 2030.

Integration with CNSA 2.0 and NSA requirements

NSA's CNSA 2.0 advisory (September 2022) does not mandate QKD for National Security Systems. NSA has explicitly stated, in its advisory on QKD (CSA-U-OO-800069-21), that QKD alone is insufficient to protect NSS traffic and that post-quantum cryptographic algorithms are the required primary mitigation. NSA's concerns about QKD include: the requirement for authenticated classical channels (which still require post-quantum authentication to resist quantum forgery attacks); trusted-node vulnerabilities; the immaturity of QKD hardware relative to software cryptographic implementations; and the difficulty of validating QKD security implementations to NSA Type 1 standards.

The practical integration model is therefore: CNSA 2.0 algorithms (ML-KEM-1024 for key establishment, ML-DSA for signatures, AES-256 for symmetric encryption) as the required policy baseline for all NSS links; QKD as an additional key-material source for the highest-classification links where the unconditional security guarantee is operationally justified and the physical constraints are manageable. QKD-derived key material can feed directly into AES-256 encryption as a one-time pad source for very-high-assurance links, or as a periodic key refresh supplement to the ML-KEM key exchange for links where key rotation rate matters.

For procurement officers, this means that QKD should be evaluated as a high-assurance supplement, not a replacement for CNSA 2.0-compliant cryptography. Any QKD product procured for NSS-adjacent use should be evaluated against ETSI GS QKD 011 (component security requirements) and ETSI GS QKD 016 (implementation security requirements), which are the closest available standards to a formal QKD security evaluation framework pending NSA-specific guidance. Read our companion article on quantum-resilient communications for battlefield networks for the broader post-quantum migration context in which QKD sits.

Deployment constraints and operational realities

A realistic assessment of current QKD for military use requires acknowledging constraints that vendor marketing materials often minimize.

Range. Fiber QKD is practical to approximately 100–150 km per hop without trusted nodes. Free-space ground-level QKD is practical to under 1 km in daylight. These constraints are fundamental physics, not engineering limitations to be solved by better hardware – photon loss in fiber follows the Beer-Lambert law; atmospheric turbulence and background noise are environment properties. Trusted nodes extend range but introduce security compromises as described above.

Key generation rate. Current commercial systems generate key material at rates ranging from kilobits per second (at long distances or under adverse conditions) to low megabits per second (at short distances in good conditions). This is adequate for key seeding and one-time pad communications on low-bandwidth links, but insufficient to directly protect high-bandwidth ISR video streams at rates of 1–100 Mbps. The practical model for high-bandwidth links is to use QKD to distribute symmetric master keys, which then seed AES-256 encryption for the data channel – not to use QKD key material directly as the data encryption keystream.

Line-of-sight dependency. Free-space QKD requires unobstructed line-of-sight. Terrain, buildings, vehicles, and vegetation break the link. Even temporary obstruction – a vehicle crossing the beam path – causes a QKD session interruption that requires re-authentication and re-establishment. For mobile tactical units, this constraint is severe.

Weather sensitivity. Rain, fog, smoke, and dust all attenuate free-space optical paths. Military operations frequently occur in adverse weather and in smoke from fires or obscurants. A QKD link that generates 1 Mbps of key material in clear conditions may generate near-zero key material in heavy rain or smoke. System designs must account for key buffer management during link outages.

Hardware maturity and supply chain. Single-photon sources, SPAD and SNSPD detectors, and precision polarization optics are specialized components not currently produced at high volume for defense use. Supply chain assurance – verifying that components have not been tampered with to introduce side-channel leakage or backdoors – is more difficult for photonic hardware than for software cryptographic implementations. NSA's concerns about QKD hardware supply chain are well-founded and not yet fully addressed by the available vendor ecosystem.

Realistic timeline for military adoption

Near-term (2026–2029): QKD is viable and worth evaluating for fixed or semi-fixed strategic links between headquarters elements where dark fiber exists or can be installed, range is within a single hop, and the classification of traffic justifies the hardware cost. QRNG adoption for key generation infrastructure is viable across the force immediately and should be treated as a standard infrastructure upgrade alongside CNSA 2.0 algorithm deployment.

Medium-term (2030–2034): Improvements in free-space QKD terminal miniaturization and in drone-relay architectures may make QKD viable for semi-mobile forward command post links. Trusted-node security practices will mature with operational experience. Quantum repeater research may produce early non-fieldable prototypes. The ETSI and eventually NSA QKD security evaluation frameworks should mature enough to support formal evaluation of vendor hardware.

Long-term (2035+): If quantum repeater technology matures to a fieldable product, the range and topology constraints of QKD relax substantially, and broader tactical deployment becomes credible. Until then, QKD deployment in tactical networks will remain constrained to the fixed and semi-fixed strategic link layer, with post-quantum cryptography carrying the HNDL protection burden for all mobile and extended-range links.

Corvus.Quantum delivers end-to-end encrypted communications for tactical networks – designed for air-gapped and contested environments where QKD integration matters. Whether you are evaluating QRNG-seeded key generation, planning trusted-node topology, or integrating QKD key material with CNSA 2.0-compliant encryption, Corvus.Quantum provides the cryptographic infrastructure layer that makes it operational.

Explore Corvus.Quantum →

Quantum key distribution for tactical military communications