PQC and QKD: Two different routes to quantum-safe security

Quantum computing may eventually undermine some of the public-key cryptography that protects today’s digital communications.

Preparing for that risk means understanding two often-confused approaches: post-quantum cryptography (PQC) and quantum key distribution (QKD). They address related problems, but they work in fundamentally different ways.

PQC uses mathematical algorithms designed to resist attacks from both classical and quantum computers. It can protect functions such as establishing encryption keys and creating digital signatures, and can often be introduced through software or firmware updates to existing systems.

In August 2024, the US National Institute of Standards and Technology (NIST) finalised its first set of PQC standards, marking a pivotal moment in the field.

This standardisation marked the culmination of an eight-year process involving an international competition to evaluate and select cryptographic algorithms capable of withstanding attacks from both classical and quantum computers.

The three algorithms are designed to provide protection against both classical and quantum attacks and include:

• ML-KEM (based on CRYSTALS-Kyber) for general encryption
• ML-DSA (based on CRYSTALS-Dilithium) for digital signatures
• SLH-DSA (based on SPHINCS+) also for digital signatures

These standards now give organisations a practical basis for beginning that transition.

QKD uses quantum physics to generate and distribute encryption keys between communicating parties. In principle, attempts to intercept the quantum signals used to share a key can be detected.

In an August 2025 document, the UK's National Cyber Security Centre (NCSC) described QKD as a mechanism that provides "provable security" underpinned by the laws of physics, with guarantees against eavesdropping within a defined model of operation.

However, the NCSC cautioned that distributing cryptographic keys is only one part of securing communications. Another essential requirement is authentication and establishing the identity of the parties communicating. QKD does not provide this, nor do other quantum techniques.

In practice, this means QKD is not a replacement for all cryptography. While it can help secure key distribution, other mechanisms are still needed to handle authentication and functions such as digital signatures.

The case for starting now is not that Q-Day – the point at which a sufficiently capable quantum computer could break vulnerable cryptography – is certain to arrive on a particular date, but that encrypted information stolen today could be stored and decrypted later – a threat commonly called ‘harvest now, decrypt later’ (HNDL).

A recent G7 call to action urged organisations to treat the quantum threat as requiring near-term preparation and recommends taking stock of cryptographic assets and planning a phased, risk-based transition.

For most businesses, PQC is the broad migration priority. The NCSC has explicitly backed this approach, describing PQC as "the best mitigation to the threat to cryptography from quantum computers" and recommending it as the primary means of addressing the risk.

The NCSC identified two possible approaches to protecting communications against quantum threats. The first is to use PQC to provide authentication. As well as offering authentication, PQC algorithms include mechanisms for agreeing cryptographic keys, making them suitable for integration into existing security protocols and widely used libraries.

The second is to deploy QKD alongside symmetric-key authentication and pre-shared keys. However, the NCSC said this approach is only practical in certain controlled environments, as distributing and managing the authentication keys makes systems difficult to scale and manage.

For most organisations, the practical starting point for a PQC transition involves three key steps:

1.  Identify where vulnerable cryptography is used
2.  Prioritise long-lived sensitive data
3.  Build systems with quantum-safe encryption that can adapt as PQC standards and threats evolve

As Shahram Mossayebi, co-founder of Crypto Quantique, told Infosecurity: “Right now, starting a PQC transition means a huge pain to go through the whole infrastructure, all your code lines.”

He argued that crypto agility – the ability to change cryptography without rebuilding systems – is essential to avoiding repeated, disruptive migrations.

The NCSC's position also raises questions about the additional complexity involved in deploying QKD. It warned that integrating quantum and classical components, particularly when combining specialised hardware with existing networking infrastructure, can introduce additional cybersecurity risks.

Its position on deployment is particularly clear: the NCSC said it would not support QKD for government or military applications, maintaining that PQC is the best mitigation against the quantum threat.

For other sectors, it advised organisations not to rely solely on QKD to generate and distribute cryptographic keys. Those considering the technology should ensure that robust quantum-resistant authentication mechanisms are implemented alongside it and take appropriate steps to manage the additional cybersecurity risks.

As organisations prepare for the quantum era, the debate between PQC and QKD should not be framed as a choice between competing technologies.

Instead, the focus should be on identifying which approaches can realistically be deployed at scale while reducing both current and future cryptographic risk.

Ultimately, organisations that start preparing now will be best placed to protect long-lived data, minimise disruption and adapt to future advances in quantum computing, regardless of exactly when a large-scale quantum threat materialises.

Enjoyed this article? Make sure to share it!

Looking for something else?