Cryptography & Communication
Quantum Key Distribution
A method for two parties to share a secret key using quantum states of light, where any eavesdropping disturbs the states and is detected.
Definition
Quantum key distribution, or QKD, lets two people agree on a secret key that no one else knows, using single particles of light sent between them. Because measuring a quantum state changes it, anyone listening in leaves traces that the two parties can find by comparing a sample of their data. The key can then be used to encrypt messages with a standard cipher. QKD is among the most mature quantum technologies, with commercial products and national networks.
In depth
QKD differs from ordinary encryption in the source of its security. Standard public-key cryptography relies on mathematical problems that are believed to be hard, which Shor's algorithm would break. QKD relies on physical laws, so its security does not depend on assumptions about computing power. The catch is that real devices differ from ideal models: detectors can be blinded, sources can leak information about photon number, and attacks on commercial systems have been demonstrated. Practical protocols such as decoy-state BB84 and measurement-device-independent QKD close many of these loopholes.
Range and rate are the main limits. Photons are lost in fiber at about 0.2 decibels per kilometer, so key rates fall exponentially with distance, and direct fiber links reach a few hundred kilometers, with a record of around 400 kilometers in ultra-low-loss fiber. Twin-field protocols have reached about 1,000 kilometers in laboratory spools at very low rates. Longer distances use trusted relay nodes, as in China's Beijing to Shanghai backbone of more than 2,000 kilometers, or satellites, as with the Micius satellite, which demonstrated links of about 1,200 kilometers.
Policy views are divided. QKD products are certified under frameworks such as ETSI and ISO/IEC 23837, and the European Union is building a QKD infrastructure called EuroQCI. The U.S. National Security Agency and the UK National Cyber Security Centre, however, do not recommend QKD for most uses, favoring post-quantum cryptography, because QKD needs special hardware, point-to-point links, and separate authentication, and it addresses only key exchange.
Technical Definition
In prepare-and-measure protocols such as BB84, Alice sends photons in randomly chosen bases and Bob measures in random bases. They keep matching-basis results, estimate the quantum bit error rate on a sample, and if it is below a threshold of about 11 percent they apply error correction and privacy amplification to produce a shorter secret key. Security follows from the uncertainty principle and the no-cloning theorem, and it holds against adversaries with unlimited computing power if the implementation matches the model.
Visual Explanation: An Analogy
Imagine sending a series of sealed glass vials, each containing a fragile colored liquid that changes color if anyone opens and reseals it. If the vials arrive unchanged in the agreed proportion, nobody tampered with them, and the colors you agree on become your secret key.
Key facts
| Item | Detail |
|---|---|
| Best-known protocol | BB84, proposed in 1984 by Bennett and Brassard |
| Error threshold | About 11 percent for BB84 in the ideal single-photon case |
| Fiber range | A few hundred kilometers directly; about 400 km record in ultra-low-loss fiber |
| Networks | China's 2,000 km backbone, EuroQCI, and city networks in several countries |
| Agency view | NSA and NCSC prefer post-quantum cryptography over QKD for most uses |
Where the idea comes from
Wiesner's unpublished conjugate coding around 1970 inspired Bennett and Brassard's 1984 protocol, and Ekert proposed an entanglement-based version in 1991. The first prototype worked in 1989 over 32 centimeters, and commercial systems appeared in the 2000s.
Real-World Use Cases
- Securing links between government sites, data centers, and banks.
- Satellite-based key distribution across long distances.
- Providing keys for symmetric encryption and one-time pads.
- Research on quantum networks and device-independent security.
How it differs from related ideas
- QKD is based on physics, and post-quantum cryptography is based on mathematical hardness assumptions.
- QKD distributes keys, and it does not itself encrypt data or authenticate users.
- Classical key exchange can run over any network, while QKD needs a dedicated quantum channel.
Common Misconceptions
- QKD does not make communication unhackable. It protects the key exchange, and implementation flaws can be exploited.
- It does not transmit the message. It generates a shared key.
- It is not a replacement for post-quantum cryptography in most deployments.
Frequently asked questions
What is quantum key distribution?
A way of creating a shared secret key using quantum states, with eavesdropping detected through the disturbance it causes.
How far can QKD reach?
A few hundred kilometers in fiber without relays, and thousands of kilometers using trusted nodes or satellites.
Is QKD better than post-quantum cryptography?
They solve different problems. Many agencies recommend post-quantum cryptography for general use and QKD for specific high-assurance links.
Related Terms
Keep exploring
- Algorithm: BB84 Quantum Key Distribution
- Algorithm: E91 Quantum Key Distribution
- Algorithm: Device-Independent Quantum Key Distribution
- Hardware: IonQ Forte (and Forte Enterprise)
- Industry: Quantum Computing for Telecommunications
- Industry: Quantum Computing for Cybersecurity