QKD and PQC: Two Routes to Quantum-Safety
There are two fundamentally different technical paths to defending against a cryptographically relevant quantum computer. QKD (Quantum Key Distribution) draws its security from the laws of physics, while PQC (Post-Quantum Cryptography) draws it from mathematical problems believed hard even for quantum machines. They are not interchangeable, and most organizations should treat PQC as the deployable mainstream while viewing QKD as a situational backstop.
What QKD is
QKD uses quantum-mechanical properties — the no-cloning theorem and the uncertainty principle — to distribute symmetric keys between two endpoints over a dedicated optical or fiber channel. Any eavesdropper who measures the quantum states unavoidably disturbs them, so interception is detectable. In principle this delivers information-theoretic, physical-layer security for the key-distribution step itself, independent of any computational assumption. In idealized models, QKD can offer information-theoretic security for key distribution. In practice, its security also depends on device assumptions, implementation countermeasures, authentication, key management, and network architecture such as trusted relays.
The practical limits are significant:
- Distance and rate. Photon loss caps usable range and throughput; long links require trusted relays or satellites.
- Dedicated hardware. QKD needs special transmitters, detectors and optical paths — it cannot run as software over the public Internet.
- Cost and reach. Higher capital cost and narrow deployment footprint relative to ordinary networking.
- Integration. Hard to slot into existing application and protocol stacks.
- No authentication. QKD distributes keys but does not authenticate the endpoints. Without a classical or PQC authentication layer it is exposed to a man-in-the-middle attack — so PQC remains necessary even alongside QKD.
China holds notable leadership in this field, including the Jinan and Beijing metropolitan QKD networks, the Micius satellite-based key distribution, and record-setting terrestrial fiber links.
What PQC is
PQC replaces quantum-vulnerable public-key algorithms with new ones whose security rests on hard mathematical structures — lattices, hash functions and error-correcting codes. Because PQC is pure software, it is compatible with existing cryptographic stacks, low in cost, and broadly deployable across servers, endpoints, browsers and embedded devices. This is why PQC is the mainstream industrialization choice today.
Side-by-side comparison
| Dimension | QKD | PQC |
|---|---|---|
| Security basis | Quantum physics (no-cloning, uncertainty) | Hard math problems (lattice / hash / code) |
| Security model | Information-theoretic / physical-layer (key step) | Computational, quantum-resistant assumptions |
| Hardware | Dedicated quantum optics required | Runs on existing general hardware |
| Cost | High capital and operating cost | Low — software upgrade |
| Integration | Hard; needs dedicated links | Drops into current crypto stacks |
| Authentication | Not provided — needs classical/PQC auth | Provides signatures and authentication |
| Best fit | Niche ultra-high-assurance dedicated links | General-purpose, broad deployment now |
What the standards bodies recommend
For general-purpose network migration, NIST, the UK NCSC and France ANSSI emphasize a PQC route built on software and protocol-stack upgrades; QKD is generally positioned as a complement for specific high-assurance dedicated links rather than a general-purpose replacement. This orientation stems from QKD's cost, distance and integration limits and — critically — its lack of built-in authentication. QKD is positioned for narrow ultra-high-assurance dedicated links such as certain government and military backbones, where dedicated infrastructure is already justified.
A complementary, not competitive, view
The synthesized industry report frames the relationship as complementary: "QKD as backstop, PQC accelerating." PQC carries the immediate, broad migration; QKD provides an additional physical-layer hedge where the assurance level warrants it. The report anticipates future convergence — quantum-communication networks integrated with PQC for key distribution and authentication, hybrid network architectures, and a re-architecture of identity for a quantum-comms world.
Related reading: Harvest Now, Decrypt Later (HNDL), Hybrid cryptography, Telecom & quantum networks, and China overview.
Standards & references
- 安全牛《后量子密码安全能力构建技术指南（2025版）》— "QKD做后盾 PQC加速跑" (industry report, synthesized; not quoted verbatim).
- CISA/NSA/NIST — Quantum-Readiness: Migration to PQC (Aug 2023)
- ETSI — Quantum-Safe Cryptography
- NIST — Post-Quantum Cryptography project
- Resources — full standards register
QKD 与 PQC 双路线
应对具备密码破解能力的量子计算机，存在两条本质不同的技术路线。QKD（量子密钥分发）的安全性来自物理定律，PQC（后量子密码）的安全性来自即便量子机器也难以求解的数学难题。二者并非可互换的等价物——多数机构应将 PQC 视为可落地的主流路线，而把 QKD 当作因地制宜的后盾。
QKD 是什么
QKD 利用量子力学特性——不可克隆定理与测不准原理——在两个端点之间经由专用光纤或光通道分发对称密钥。任何窃听者一旦测量量子态便不可避免地对其造成扰动，因此窃听可被检测。原理上，这为密钥分发这一步本身提供了信息论层面、物理层级的安全，不依赖任何计算假设。在理想模型下，QKD 可以为密钥分发提供信息论安全性。但在实际系统中，其安全性还依赖设备假设、实现防护、认证机制、密钥管理以及可信中继等网络架构因素。
但其工程局限不容忽视：
- 距离与速率。光子损耗限制了可用距离与吞吐；长距离链路需依赖可信中继或卫星。
- 专用硬件。QKD 需要专门的发射端、探测器与光路，无法作为软件跑在公共互联网上。
- 成本与覆盖。相较普通网络，资本投入更高，部署面更窄。
- 集成难度。难以嵌入现有的应用与协议栈。
- 不提供身份认证。QKD 只分发密钥，不认证端点身份。若缺少经典或 PQC 的认证层，便暴露于中间人攻击之下——因此即便部署了 QKD，PQC 依然不可或缺。
中国在该领域具备显著领先，包括济南与北京城域 QKD 网络、墨子号卫星密钥分发，以及创纪录的地面光纤链路。
PQC 是什么
PQC 以新算法替换易受量子攻击的公钥算法，其安全性建立在难解的数学结构之上——格、哈希函数与纠错码。由于 PQC 是纯软件，它兼容现有密码栈，成本低，可在服务器、终端、浏览器与嵌入式设备上广泛部署。这正是当下 PQC 成为产业化主流选择的原因。
逐项对比
| 维度 | QKD | PQC |
|---|---|---|
| 安全基础 | 量子物理（不可克隆 测不准） | 数学难题（格 / 哈希 / 码） |
| 安全模型 | 信息论 / 物理层（密钥步骤） | 计算性 抗量子假设 |
| 硬件 | 需专用量子光学设备 | 跑在现有通用硬件上 |
| 成本 | 资本与运维成本高 | 低——软件升级 |
| 集成 | 困难 需专用链路 | 可直接嵌入现有密码栈 |
| 身份认证 | 不提供 需经典/PQC 认证 | 提供签名与认证 |
| 最佳场景 | 小众的超高保障专用链路 | 通用 当下即可广泛部署 |
标准机构的建议
在通用网络迁移场景中，NIST、英国 NCSC 与法国 ANSSI 等机构更强调基于软件和协议栈升级的 PQC 路线；QKD 通常被定位为特定高保障专用链路的补充，而非通用替代方案。这一取向源于 QKD 的成本、距离与集成局限，以及——尤为关键的——缺乏内建身份认证。QKD 被定位于狭窄的超高保障专用链路，例如某些政府与军事骨干网，这类场景本就具备部署专用基础设施的合理性。
互补而非竞争
综合的行业报告将二者关系定位为互补："QKD做后盾 PQC加速跑"。PQC 承担即时、广泛的迁移，QKD 则在保障级别有需要时提供额外的物理层对冲。报告预判未来将走向融合——量子通信网络与 PQC 结合完成密钥分发与认证、混合网络架构，以及面向量子通信世界的身份体系重构。
延伸阅读：先收集、后解密（Harvest Now, Decrypt Later, HNDL）、混合密码、电信与量子网络，以及 中国概览。
标准与参考
- 安全牛《后量子密码安全能力构建技术指南（2025版）》——"QKD做后盾 PQC加速跑"（行业报告，综合改写，非逐字引用）。
- CISA/NSA/NIST — Quantum-Readiness: Migration to PQC（2023年8月）
- ETSI — Quantum-Safe Cryptography
- NIST — Post-Quantum Cryptography 项目
- 资源链接 — 完整标准登记册