Quantum 101: QKD vs PQC — The Encryption Civil War

The UK’s National Cyber Security Centre has said it will not support quantum key distribution (“QKD”) for government or military use. The UK also launched two QKD satellites in the past 6 months.

That is not a typo. It is the cleanest way to show you that the world’s security agencies genuinely disagree about how to survive quantum computers—and that the disagreement is expensive, geopolitical and mostly happening out of public view.

Here is the setup. Somewhere between 2030 and 2035, a quantum computer may become powerful enough to break the encryption protecting almost everything you do online. There are two rival plans to stop that. One rewrites the maths. One rewrites the physics. Governments have picked different sides, spent billions accordingly and are now partially incompatible with each other.

The problem: today’s encryption has an expiry date

Almost every secure connection you make including logging into your bank, buying something online or sending an encrypted message starts with the same problem:

How can two people who have never met create a shared secret while communicating over a channel that someone else may be watching?

The usual answer is public-key cryptography. Each side has a public key that anyone can see and a private key that only its owner knows. The public key works like an open padlock: anyone can use it to protect information for you, but only your private key can unlock it.

Systems such as RSA and elliptic-curve cryptography make this possible using mathematical problems that are easy to perform in one direction but extremely difficult to reverse.

• With RSA, for example, multiplying two enormous secret prime numbers is easy. But starting with the result and discovering those original primes would take an ordinary computer an impractically long time.
• Elliptic-curve systems use different maths, but rely on the same basic idea: moving forward is easy; working backwards to recover the secret is extremely hard.

That difficulty is what protects the private key. It is not a law of nature, though. Modern encryption is ultimately a bet that attackers do not have a computer capable of reversing the maths fast enough.

In 1994, Peter Shor showed that a sufficiently powerful quantum computer could reverse both the RSA and elliptic-curve problems efficiently. That would not merely make these systems weaker. It would allow an attacker to reconstruct private keys from public information and break the security they provide.

Love this explanatory video of Shor’s algorithm, quick and effective.

This creates two urgent problems.

“Q-Day” is now a real planning deadline. Nobody knows exactly when a cryptographically useful quantum computer will arrive, but many governments and security organisations are preparing around the 2030–2035 period.

Sensitive information can be stolen before Q-Day arrives. An attacker can record encrypted traffic today, store it, and decrypt it later once the necessary quantum computer exists. This is called harvest now, decrypt later. Anything that must remain secret for many years—state documents, health records, commercial secrets or confidential sources—may therefore already be at risk.

That leaves two main ways to prepare.

Plan A: Rewrite the maths

Post-Quantum Cryptography

PQC is not quantum anything. That name confuses everyone. It is ordinary software running on ordinary computers, using different maths problems—ones that quantum computers are not known to be good at.

RSA’s weakness is that factoring has a quantum shortcut. So cryptographers went looking for problems with no known shortcut.

The winner was lattice-based cryptography. Here is the intuition without the algebra. Picture an infinite grid of points stretching in every direction—not a neat square grid, but a skewed one, in hundreds of dimensions. Now someone gives you a random point floating in that space and asks: which grid point is nearest?

In two or three dimensions, trivial. In 500 dimensions, with a deliberately awkward description of the grid, it is monstrously hard—and crucially, quantum computers do not appear to help. Shor’s algorithm has no purchase on it.

In August 2024, after an eight-year open competition, the US National Institute of Standards and Technology, or NIST, published the first three standards:

Two more are in flight: HQC, selected in March 2025 as a backup key-exchange algorithm built on error-correcting codes rather than lattices, and FIPS 206, based on FALCON, which is still in development.

The reason for the duplication matters. ML-KEM and ML-DSA are both lattice-based. If someone ever finds a crack in lattice maths, both fall at once. SLH-DSA and HQC rest on completely different foundations. They are the insurance policy.

The key property of PQC: it is a software update. No new hardware, no new cables, no satellites. You swap the algorithm and carry on. That is why it scales, and it is the single most important fact in this entire debate.

Plan B: Rewrite the physics

Quantum Key Distribution takes the opposite approach. Instead of finding a harder sum, it stops relying on sums at all.

The idea comes from a 1984 protocol by Charles Bennett and Gilles Brassard called BB84. Here is how it works, step by step.

Step 1: Alice creates random bits

Alice generates a random sequence of 0s and 1s, such as:

1 0 1 1 0 0 1 0

These bits will eventually become part of the secret key.

Step 2: Alice encodes each bit onto a photon

Alice sends Bob one photon for each bit. She encodes the bit using the photon’s polarisation, which you can think of as the direction in which the light is oriented.

For every photon, she randomly chooses one of two encoding systems, or bases:

• Straight basis: horizontal or vertical
• Diagonal basis: tilted one way or the other

The same bit can therefore be represented differently depending on which basis she chooses.

Step 3: Bob measures each photon

Bob receives the photons, but he does not know which basis Alice used for each one. He therefore chooses a basis at random before measuring each photon.

• When Bob chooses the same basis as Alice, he reads the correct bit.
• When he chooses the wrong basis, the result is random and cannot be trusted.

Step 4: They compare their bases

After all the photons have been measured, Alice and Bob talk over a normal public channel. They reveal which bases they used, but they do not reveal the actual bits. They keep only the results where they used the same basis and discard the rest. The remaining bits should match on both sides.

This gives them a shared raw key.

Step 5: They check for eavesdropping

Alice and Bob publicly compare a small sample of the bits they kept. Those revealed bits are then discarded and cannot be used in the final key.

• If the sample contains very few errors, they continue.
• If the error rate is unusually high, they assume someone may have interfered and throw the whole key away.

Step 6: Why an eavesdropper creates errors

Suppose Eve intercepts the photons. She does not know which basis Alice used, so she must guess. When she chooses the wrong basis, measuring the photon changes its quantum state.

Eve then has to send a replacement photon to Bob. Because some of her guesses were wrong, some of Bob’s results will also be wrong.

That disturbance appears as extra errors when Alice and Bob compare their sample.

Step 7: They create the final secret key

If the error rate is acceptable, Alice and Bob correct any remaining differences and shorten the raw key to remove any information Eve might have gained.

They now share the same final secret key, which can be used with ordinary encryption to protect their messages.

The key idea is simple:

Alice and Bob do not send a finished secret key through the network. They create it together from quantum measurements, and anyone who tries to read the photons leaves detectable evidence.

There is a second flavour, entanglement-based QKD, including BBM92, based on Artur Ekert’s 1991 idea, where a source sends one half of an entangled photon pair to each party. The correlations between their measurements produce the key, and a Bell test can certify that the physics was genuine.

The claimed prize: information-theoretic security. RSA is secure because breaking it is hard. QKD is secure because breaking it would require breaking quantum mechanics. No amount of future computing power touches it.

The catch QKD cannot escape

QKD can help Alice and Bob create a secret key without revealing it to an eavesdropper. But it does not automatically prove that Alice is really talking to Bob.

That creates a serious problem. An attacker could intercept the connection before the exchange begins, pretend to be Bob when talking to Alice, and pretend to be Alice when talking to Bob. The attacker could then run two separate QKD exchanges—one with each person—without either side realising they are not communicating directly.

This is called a man-in-the-middle attack.

Preventing it requires authentication: a separate way for Alice and Bob to verify each other’s identities. QKD cannot provide that by itself, so real systems must add another security method on top.

That usually means either:

• using a secret key that Alice and Bob already shared in advance, or
• using digital signatures, including post-quantum cryptography.

The first option partly recreates the original problem: how do you securely share the authentication key in the first place? The second means QKD still depends on PQC for part of the connection.

For example, a 14-node QKD network in Jinan, China, replaced its pre-shared-key authentication with lattice-based post-quantum signatures in 2021.

So QKD and PQC are not always true competitors. QKD can protect the process of creating a key, while PQC can verify who is taking part. In practice, the two can work together.

Same threat, different jobs

The argument gets muddled because PQC and QKD are built for different jobs.

PQC is the universal replacement. It can replace RSA and ECC across web browsing, VPNs, messaging, banking, software updates, device identity, code signing and TLS certificates. Its main advantage is scale: billions of devices can be upgraded largely through software.

QKD is a specialist layer for a small number of extremely sensitive connections. It makes the most sense for bank-to-bank links, government facilities, power-grid networks, data-centre connections and military communications—places where both ends of the link are controlled, dedicated hardware is affordable and the information is valuable enough to justify the extra cost.

The strongest argument for QKD is defence in depth. If every system relies on lattice-based cryptography and that mathematics later proves vulnerable, the whole security layer could fail at once. QKD adds protection based on physics, so it would fail for different reasons. This is broadly the European position: deploy PQC everywhere, then add QKD to selected critical links.

QKD systems also often include quantum random number generation, or QRNG. Encryption depends on strong random numbers when creating keys, and quantum processes can produce randomness that is genuinely unpredictable. It is less dramatic than QKD, but may be more immediately useful.

The builders: Who is betting on what?

The commercial landscape splits into five main layers: PQC inside mass-market platforms, migration and orchestration software, secure chips and embedded systems, QKD hardware, and the telecom or government infrastructure connecting everything together.

PQC Ecosystem

QKD & Network Ecosystem

Public Programmes & Standards

Where the magic breaks

What holds QKD back

Distance. Single photons are absorbed as they travel through fibre, and loss rises quickly with distance. Quantum signals cannot simply be amplified because amplification would require copying them, so practical fibre-based QKD is usually limited to around 100 kilometres.

Trusted nodes. Longer networks need relay stations that receive and pass on keys. Because those relays may see the keys in usable form, each becomes a point of trust and a target.

No practical quantum repeaters yet. The ideal solution would extend entanglement without measuring it, but that requires reliable quantum memory, which remains a research problem.

Imperfect hardware leaks. BB84 may be secure in theory, but real systems have been attacked through detector blinding, Trojan-horse reflections, multi-photon pulses and detector saturation. Individual flaws can be patched, but quantum physics does not remove ordinary engineering risk.

Cost, speed and authentication. QKD needs specialised hardware, managed fibre and maintenance, while producing keys at relatively low rates. It therefore suits only a small number of highly sensitive links—and still needs a separate method to verify who is at the other end.

And it still does not authenticate.

What holds PQC back

Larger keys and signatures. ML-KEM and ML-DSA use more data than RSA and ECC. That is manageable for servers, but harder for satellites, smartcards and IoT devices with limited memory, power and processing capacity.

Younger mathematics. RSA has faced public scrutiny since 1977. Some late-stage post-quantum candidates have already failed: Rainbow was broken in 53 hours on a laptop in February 2022, and SIKE in about an hour on an older CPU five months later. Both were defeated with classical maths after years of review. The final standards were unaffected, but the lesson remains: “no known attack” does not mean “no attack exists.”

Migration is enormous. RSA and ECC are buried across firmware, legacy software, certificates, supply chains and devices that may never be updated. Many organisations do not even know everywhere they are used.

That is why roadmaps focus on crypto-agility: making algorithms replaceable through configuration rather than requiring a complete rebuild.

The encryption civil war

The NSA draws a line

The US National Security Agency will not certify QKD for national-security systems. It considers PQC cheaper, easier to maintain and more complete. QKD needs specialist hardware, relies on trusted relays, solves only key distribution and can be disabled simply by cutting the fibre. The NSA says it does not expect to approve QKD unless these limitations are overcome.

The UK agrees, then launches QKD satellites

The UK’s NCSC is even more direct: it will not support QKD for government or military use and does not treat it as evidence of security under its Cyber Assessment Framework. Its roadmap is entirely PQC-based: discovery by 2028, priority upgrades by 2031 and full migration by 2035.

Yet UK research councils launched SpeQtre in November 2025 and SPOQC in March 2026. The contradiction is understandable: the NCSC governs operational security, while research agencies preserve sovereign capability in a technology other countries are deploying. Still, the message is clear—the UK is hedging.

Europe builds a second layer

The EU is moving in the opposite direction. All 27 member states participate in EuroQCI, EAGLE-1 is in development, NOSTRADAMUS is building a certification system, and the €10.6 billion IRIS² constellation is being designed to support quantum-secure communications.

Europe officially calls this a hybrid approach. PQC remains the baseline, while QKD becomes an additional defence layer for selected critical infrastructure—not a replacement.

China deploys first

China has largely settled the debate through deployment: more than 3,000 kilometres of QKD backbone, over 150 industrial users, including banks and power grids, two satellites, an intercontinental demonstration with South Africa and a publicly listed national champion.

The architecture may not prove optimal, but China is gaining real operational experience while others are still debating.

The governance problem

PQC and QKD require different procurement rules, certification systems and assumptions about the threat timeline. The International Institute for Strategic Studies warned in April 2026 that this divergence could become structural, leaving allied countries with quantum-safe infrastructure that does not interoperate.

The proposed fixes are unglamorous but important: mutual recognition between ETSI and ISO/IEC certification, plus shared rules for auditing trusted QKD nodes.

What the debate is really about

Calling this a fight between “unbreakable physics” and “unproven maths” misses the point. The two approaches fail differently.

• PQC fails if its mathematical assumptions are broken.
• QKD fails if the hardware leaks or a trusted relay is compromised.
• QKD cannot authenticate users by itself; PQC includes signature schemes that can.
• Serious deployments increasingly combine both.

The real question is therefore not which technology is better. It is:

Is QKD’s extra assurance worth the cost and complexity when PQC must be deployed anyway?

The NSA and NCSC say no. Brussels and Beijing say yes. Nobody has been proven right yet.

What to watch before Q-Day

Deadlines are now legally real. On 22 June 2026, the US signed Executive Order 14412, “Securing the Nation Against Advanced Cryptographic Attacks.” Federal high-value systems must migrate to post-quantum key establishment by 31 December 2030 and post-quantum signatures by 31 December 2031—pulled forward from the previous 2035 target. Federal contractors face a 2030 compliance deadline through new procurement rules. The Department of War published its own aligned strategy the following day.

Contractor rules are the sleeper item. The Federal Acquisition Regulatory Council has 180 days from the order to publish a proposed rule. Once PQC compliance appears in acquisition terms, it stops being a security conversation and becomes a procurement one—which is how these transitions actually happen.

Watch the certification fights. ETSI versus ISO/IEC JTC 3 on QKD equipment, and whether the EU’s NOSTRADAMUS testing programme at Ispra produces a certification regime anyone outside Europe recognises. The EU Quantum Act is taking shape in parallel.

EAGLE-1. Launch is slated for February 2027 on a Vega C, followed by six months of commissioning. It has slipped repeatedly—originally targeted as early as late 2024—so treat the date as a target, not a fact. If it flies and works, Europe’s bet looks smarter. If it slips again, the sceptics get louder.

Watch the UK satellites report back. SPOQC’s first full quantum-communication experiments were expected in the second half of 2026. Real key rates from orbit would move the argument from theory to numbers.

Another Rainbow. If a standardised PQC algorithm is broken—or even meaningfully weakened—the entire “just use maths” position changes overnight, and the hedge-with-physics camp is vindicated. This is low probability and enormous consequence, which is precisely why HQC and SLH-DSA exist.

Cloudflare’s dashboard. Not glamorous, but it is the single best real-time indicator of how the PQC migration is actually going. More than 65% of human traffic and climbing.