Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

arXiv:1801.01710

On the Resilience of a QKD Key Synchronization Protocol for IPsec

Stefan Marksteiner, Benjamin Rainer, Oliver Maurhart

Published Jan 5, 2018• 2 citations
arXivHTMLPDF

Abstract

This paper presents a practical solution to the problem of limited bandwidth in Quantum Key Distribution (QKD)- secured communication through using rapidly rekeyed Internet Protocol security (IPsec) links. QKD is a cutting-edge security technology that provides mathematically proven security by using quantum physical effects and information theoretical axioms to generate a guaranteed non-disclosed stream of encryption keys. Although it has been a field of theoretical research for some time, it has only been producing market-ready solutions for a short period of time. The downside of this technology is that its key generation rate is only around 52,000 key bits per second over a distance of 50 km. As this rate limits the data throughput to the same rate, it is substandard for normal modern communications, especially for securely interconnecting networks. IPsec, on the other hand, is a well-known security protocol that uses classical encryption and is capable of exactly creating site-to-site virtual private networks. This paper presents a solution that combines the performance advantages of IPsec with QKD. The combination sacrifices only a small portion of QKD security by using the generated keys a limited number of times instead of just once. As a part of this, the solution answers the question of how many data bits per key bit make sensible upper and lower boundaries to yield high performance while maintaining high security. While previous approaches complement the Internet Key Exchange protocol (IKE), this approach simplifies the implementation with a new key synchronization concept, proposing a lightweight protocol that uses relatively few, slim control messages and sparse acknowledgement. Furthermore, it provides a Linux-based module for the AIT QKD software using the Netlink XFRM Application Programmers Interface to feed the quantum key to the IP***ABSTRACT TRUNCATED TO 1920 CHARS***

DOI
10.48550/arxiv.1801.01710

Related papers

IPSeQ: A Security-Enhanced IPSec Protocol Integrated with Quantum Key Distribution

Xumin Gao, Kaiping Xue, Jian Li +5 more

IPSec is a widely used network security protocol that plays a crucial role in providing secure transmission channels in the current Internet. However, the advent of quantum computing poses unprecedented challenges to the security of traditional cryptographic methods, including those used in IPSec. Fortunately, quantum key distribution (QKD) offers a theoretically unbreakable method for exchanging keys between two communicating parties. To address the security threats posed by quantum computing, we propose IPSeQ, a security-enhanced IPSec protocol that integrates QKD into its design. Specifically, IPSeQ leverages quantum keys to strengthen key negotiation, authentication, and data encryption processes. To achieve rapid key updates while ensuring transmission efficiency and key synchronization, IPSeQ introduces a sliding window-based dynamic key updating mechanism. Experiments conducted with real QKD devices demonstrate that our proposed mechanism can improve throughput by more than 50 percent compared to traditional schemes, particularly at higher quantum key generation rates. Additionally, IPSeQ effectively maintains robust data transmission in scenarios where quantum keys are scarce (e.g., when the key generation rate is less than 10 kb/s).

IEEE Communications Magazine•Mar 12, 2025•7 citations

Quantum resistant software Defined-Networking IPsec, enabling ITS communication over IP networks on real telco infrastructures

Rubén B. Méndez, Jaime S. Buruaga, Juan Pedro Brito Méndez +3 more

The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.

Computer Networks•Mar 4, 2026•2 citations

Schemes of IPsec integrated with quantum key distribution

Chun-Hui 春辉 Zhang 张, Wen-Xuan Zhang, Xing-Yu Zhou +4 more

Abstract With the rapid advancement of quantum computing, traditional security protocols based on classical encryption algorithms are increasingly vulnerable to potential quantum attacks. The current IPsec protocol, which relies on classical cryptographic methods, is insufficient to withstand such threats, thereby compromising the security of long-term data transmission. To address this issue, we propose integrating quantum key distribution (QKD) into the internet protocol security (IPsec) protocol, thereby enhancing its resilience against quantum computing attacks. Here, two schemes that merge QKD-generated keys with classical cryptographic keys are designed to enhance both security and stability. Furthermore, we conduct a comprehensive evaluation of the performance of various QKD protocols implemented with the scheme, along with an assessment of its overall efficacy across a topological network configuration. This approach not only ensures secure data transmission in the era of quantum computing but also highlights the potential application value of integrating QKD with IPsec, providing valuable insights for the design and implementation of future quantum-secure communication systems.

Chinese Physics B•Jan 4, 2026•0 citations

KEY MANAGEMENT OF QUANTUM GENERATED KEYS IN IPSEC

Andreas Neppach, Christian Pfaffel-Janser, Ilse Wimberger +4 more

This paper presents a key management approach for quantum generated keys and its integration into the IPsec/IKE protocol. The solution is used in a security gateway that integrates quantum key distribution (QKD) and IPsec as a system-on-chip solution. The QKD acquisition module and the IPsec part of this prototype are implemented in hardware to provide a high level of integration as well as high encryption throughput. To make use of these fast encryption capabilities, a flexible key management approach is necessary to provide keys just in time. Thus, the presented key management approach focuses on an efficient key update mechanism and minimizes the communication overhead. Furthermore, the presented approach is a first step to integrate QKD solutions into real-world commercial applications using standardized interfaces.

International Conference on Security and Cryptography•Jan 1, 2008•15 citations

IKE for IPsec with QKD

Rodney Van Meter, Shota Nagayama

Quantum Key Distribution (QKD) is a mechanism for creating shared, secret, random bits. This document describes extensions to the IKEv2 protocol to use random bits created via QKD as keys for IPsec. The Diffie-Hellman key agreement mechanism is replaced with QKD. The use of QKD-generated keys with standard IPsec will extend the lifetime of privacy guarantees for IPsec-protected data: future technological advances that break Diffie-Hellman key exchange will not disclose data until such time as the encryption algorithm used for the IPsec tunnel is broken.

•Oct 27, 2014•1 citation

Overview of Quantum Key Distribution Technique within IPsec Architecture

Emir Dervisevic, Miralem Mehić

Quantum Key Distribution (QKD) is an approach for establishing symmetrical binary keys between distant users in an information-theoretically secure way. In this paper we provide an overview of existing solutions that integrate QKD within the most popular architecture for establishing secure communications in modern IP (Internet Protocol) networks - IPsec (Internet Protocol security). The provided overview can be used to further design the integration of QKD within the IPsec architecture striving for a standardized solution.

arXiv:2112.13105•Dec 24, 2021•8 citations
This paper presents a practical solution to the problem of limited bandwidth in Quantum Key Distribution (QKD)- secured communication through using rapidly rekeyed Internet Protocol security (IPsec) links. QKD is a cutting-edge security technology that provides mathematically proven security by using quantum physical effects and information theoretical axioms to generate a guaranteed non-disclosed stream of encryption keys. Although it has been a field of theoretical research for some time, it has only been producing market-ready solutions for a short period of time. The downside of this technology is that its key generation rate is only around 52,000 key bits per second over a distance of 50 km. As this rate limits the data throughput to the same rate, it is substandard for normal modern communications, especially for securely interconnecting networks. IPsec, on the other hand, is a well-known security protocol that uses classical encryption and is capable of exactly creating site-to-site virtual private networks. This paper presents a solution that combines the performance advantages of IPsec with QKD. The combination sacrifices only a small portion of QKD security by using the generated keys a limited number of times instead of just once. As a part of this, the solution answers the question of how many data bits per key bit make sensible upper and lower boundaries to yield high performance while maintaining high security. While previous approaches complement the Internet Key Exchange protocol (IKE), this approach simplifies the implementation with a new key synchronization concept, proposing a lightweight protocol that uses relatively few, slim control messages and sparse acknowledgement. Furthermore, it provides a Linux-based module for the AIT QKD software using the Netlink XFRM Application Programmers Interface to feed the quantum key to the IPABSTRACT TRUNCATED TO 1920 CHARS
IPSec is a widely used network security protocol that plays a crucial role in providing secure transmission channels in the current Internet. However, the advent of quantum computing poses unprecedented challenges to the security of traditional cryptographic methods, including those used in IPSec. Fortunately, quantum key distribution (QKD) offers a theoretically unbreakable method for exchanging keys between two communicating parties. To address the security threats posed by quantum computing, we propose IPSeQ, a security-enhanced IPSec protocol that integrates QKD into its design. Specifically, IPSeQ leverages quantum keys to strengthen key negotiation, authentication, and data encryption processes. To achieve rapid key updates while ensuring transmission efficiency and key synchronization, IPSeQ introduces a sliding window-based dynamic key updating mechanism. Experiments conducted with real QKD devices demonstrate that our proposed mechanism can improve throughput by more than 50 percent compared to traditional schemes, particularly at higher quantum key generation rates. Additionally, IPSeQ effectively maintains robust data transmission in scenarios where quantum keys are scarce (e.g., when the key generation rate is less than 10 kb/s).
The growing dependence on digital communications underscores the need to protect data as it travels through the network. Internet Protocol Security (IPsec) plays a central role, providing a robust framework to ensure the confidentiality, integrity, and authenticity of transmitted data. However, advances in Quantum Computing pose a significant threat to current public-key cryptographic schemes by enabling efficient solutions to factoring and discrete logarithm problems. A promising solution also arises from the quantum domain. Quantum Key Distribution (QKD) provides a security layer immune to any computational attacks, whether quantum or classical. While the rapid adoption of quantum-safe technologies is highly desirable, it is equally important to ensure the resilience of existing trusted infrastructures, as the introduction of novel technologies may also entail unforeseen challenges. Enabling an evolutionary path that brings our current security infrastructure to a quantum-safe one, protected against both present and future threats, is thus very important. This work proposes a solution that integrates emerging quantum technologies into the existing security and communications infrastructure to ensure long-term protection. We focus on IPsec —one of the most widely deployed security protocols— and combine it with Software-Defined Networking (SDN) and QKD to construct a novel network security infrastructure that is resilient against both classical and quantum computational threats. Building upon recent standardization initiatives and operational tools for QKD integration, we demonstrate advanced capabilities -including rekeying and secure key transport- on a field deployed QKD network operating within a shared quantum-classical production infrastructure.
Abstract With the rapid advancement of quantum computing, traditional security protocols based on classical encryption algorithms are increasingly vulnerable to potential quantum attacks. The current IPsec protocol, which relies on classical cryptographic methods, is insufficient to withstand such threats, thereby compromising the security of long-term data transmission. To address this issue, we propose integrating quantum key distribution (QKD) into the internet protocol security (IPsec) protocol, thereby enhancing its resilience against quantum computing attacks. Here, two schemes that merge QKD-generated keys with classical cryptographic keys are designed to enhance both security and stability. Furthermore, we conduct a comprehensive evaluation of the performance of various QKD protocols implemented with the scheme, along with an assessment of its overall efficacy across a topological network configuration. This approach not only ensures secure data transmission in the era of quantum computing but also highlights the potential application value of integrating QKD with IPsec, providing valuable insights for the design and implementation of future quantum-secure communication systems.
This paper presents a key management approach for quantum generated keys and its integration into the IPsec/IKE protocol. The solution is used in a security gateway that integrates quantum key distribution (QKD) and IPsec as a system-on-chip solution. The QKD acquisition module and the IPsec part of this prototype are implemented in hardware to provide a high level of integration as well as high encryption throughput. To make use of these fast encryption capabilities, a flexible key management approach is necessary to provide keys just in time. Thus, the presented key management approach focuses on an efficient key update mechanism and minimizes the communication overhead. Furthermore, the presented approach is a first step to integrate QKD solutions into real-world commercial applications using standardized interfaces.
Quantum Key Distribution (QKD) is a mechanism for creating shared, secret, random bits. This document describes extensions to the IKEv2 protocol to use random bits created via QKD as keys for IPsec. The Diffie-Hellman key agreement mechanism is replaced with QKD. The use of QKD-generated keys with standard IPsec will extend the lifetime of privacy guarantees for IPsec-protected data: future technological advances that break Diffie-Hellman key exchange will not disclose data until such time as the encryption algorithm used for the IPsec tunnel is broken.
Quantum Key Distribution (QKD) is an approach for establishing symmetrical binary keys between distant users in an information-theoretically secure way. In this paper we provide an overview of existing solutions that integrate QKD within the most popular architecture for establishing secure communications in modern IP (Internet Protocol) networks - IPsec (Internet Protocol security). The provided overview can be used to further design the integration of QKD within the IPsec architecture striving for a standardized solution.