Standardization bodies are releasing specifications that will help the adoption of Quantum Key Distribution (QKD) technology. The protocols standardized by the European Telecommunications Standards Institute (ETSI) make it possible to distribute keys to network elements operating at any layer of the protocol stack. On the other hand, the IETF released a standard mechanism to integrate post-quantum keys into IPSec. In this work, we introduce a new mechanism to provide QKD keys to IPSec endpoints. This solution was implemented in the PoliQI network at Politecnico di Milano. We also compare this solution to providing keys to applications with the same security level. We model the system using a Continuous-Time Markov Chain and conclude that the two approaches can secure a similar number of applications. Integration with the applications allows a finer control on whether to block new applications or drop rekeying requests. Integration with IPSec makes it easier to introduce QKD in an existing infrastructure.
Standardization bodies are releasing specifications that will help the adoption of Quantum Key Distribution (QKD) technology. The protocols standardized by the European Telecommunications Standards Institute (ETSI) make it possible to distribute keys to network elements operating at any layer of the protocol stack. On the other hand, the IETF released a standard mechanism to integrate post-quantum keys into IPSec. In this work, we introduce a new mechanism to provide QKD keys to IPSec endpoints. This solution was implemented in the PoliQI network at Politecnico di Milano. We also compare this solution to providing keys to applications with the same security level. We model the system using a Continuous-Time Markov Chain and conclude that the two approaches can secure a similar number of applications. Integration with the applications allows a finer control on whether to block new applications or drop rekeying requests. Integration with IPSec makes it easier to introduce QKD in an existing infrastructure.
This paper presents a key management approach for quantum generated keys and its integration into the IPsec/IKE protocol. The solution is used in a security gateway that integrates quantum key distribution (QKD) and IPsec as a system-on-chip solution. The QKD acquisition module and the IPsec part of this prototype are implemented in hardware to provide a high level of integration as well as high encryption throughput. To make use of these fast encryption capabilities, a flexible key management approach is necessary to provide keys just in time. Thus, the presented key management approach focuses on an efficient key update mechanism and minimizes the communication overhead. Furthermore, the presented approach is a first step to integrate QKD solutions into
real-world commercial applications using standardized interfaces.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
Quantum Key Distribution (QKD) is an approach for establishing symmetrical binary keys between distant users in an information-theoretically secure way. In this paper we provide an overview of existing solutions that integrate QKD within the most popular architecture for establishing secure communications in modern IP (Internet Protocol) networks - IPsec (Internet Protocol security). The provided overview can be used to further design the integration of QKD within the IPsec architecture striving for a standardized solution.
Quantum Key Distribution (QKD) promises information-theoretic security, yet integrating QKD into existing protocols like TLS remains challenging due to its fundamentally different operational model. In this paper, we propose a hybrid QKD-KEM protocol with two distinct integration approaches: a client-initiated flow compatible with both ETSI 004 and 014 specifications, and a server-initiated flow similar to existing work but limited to stateless ETSI 014 APIs. Unlike previous implementations, our work specifically addresses the integration of stateful QKD key exchange protocols (ETSI 004) which is essential for production QKD networks but has remained largely unexplored. By adapting OpenSSL’s provider infrastructure to accommodate QKD’s pre-distributed key model, we maintain compatibility with current TLS implementations while offering dual layers of security. Performance evaluations demonstrate the feasibility of our hybrid scheme with acceptable overhead, showing that robust security against quantum threats is achievable while addressing the unique requirements of different QKD API specifications.
Quantum Key Distribution (QKD) stands as a cornerstone in the realm of quantum communications, promising unparalleled security through the principles of quantum mechanics. However, the realization of QKD's full potential hinges not only on technological advancements but also on the establishment of robust standards governing its implementation. This paper presents a comprehensive analysis of the current landscape of QKD standards, highlighting existing gaps and charting a course towards their evolution. We begin by elucidating the foundational importance of standards in ensuring interoperability, reliability, and scalability within QKD Networks (QKDN). Despite the existence of several standardization efforts, such as those by the International Telecommunication Union (ITU) and the European Telecommunications Standards Institute (ETSI), significant gaps persist. Furthermore, we identify emerging challenges posed by the integration of QKD into existing classical communication infrastructures, as well as the advent of quantum networks comprising multiple QKD nodes. Addressing these challenges necessitates a concerted effort towards the refinement and expansion of QKD standards. To this end, we propose several key directions for the evolution of QKD standards. We also advocate further enhancing collaboration between academia, industry and standards bodies to streamline the standardization process and foster innovation. Finally, we underscore the critical role of standards in catalyzing the adoption of QKD technologies by industry stakeholders. Standards-compliant QKD solutions not only instill confidence among end users, but also facilitate seamless integration into existing communication infrastructures. In conclusion, this paper offers insights into the state-of-the-art, challenges, and future directions in QKD standardization, underlining its fundamental importance for the advancement of practical applications of quantum secure communication technologies.
Abstract With the rapid advancement of quantum computing, traditional security protocols based on classical encryption algorithms are increasingly vulnerable to potential quantum attacks. The current IPsec protocol, which relies on classical cryptographic methods, is insufficient to withstand such threats, thereby compromising the security of long-term data transmission. To address this issue, we propose integrating quantum key distribution (QKD) into the internet protocol security (IPsec) protocol, thereby enhancing its resilience against quantum computing attacks. Here, two schemes that merge QKD-generated keys with classical cryptographic keys are designed to enhance both security and stability. Furthermore, we conduct a comprehensive evaluation of the performance of various QKD protocols implemented with the scheme, along with an assessment of its overall efficacy across a topological network configuration. This approach not only ensures secure data transmission in the era of quantum computing but also highlights the potential application value of integrating QKD with IPsec, providing valuable insights for the design and implementation of future quantum-secure communication systems.