Quantum key distribution networks offer secure communication by leveraging quantum physical principles. However, their current solutions and standards are rigid, and do not incorporate the principle of cryptographic agility. In this paper we present a functional framework of agility that is applicable to hardware specific functions as well as software and we extend its applicability beyond cryptography. We explore how this framework can be applied to different layers of abstractions in a generalized quantum key distribution network. Using this framework, we construct examples of how hardware can be modified to make various components in a quantum key distribution network agile and identify general strategies to achieve agility. We explore how other physical layer security protocols beyond traditional quantum key distribution can be integrated into an agile generalized quantum key distribution network.
Quantum key distribution networks offer secure communication by leveraging quantum physical principles. However, their current solutions and standards are rigid, and do not incorporate the principle of cryptographic agility. In this paper we present a functional framework of agility that is applicable to hardware specific functions as well as software and we extend its applicability beyond cryptography. We explore how this framework can be applied to different layers of abstractions in a generalized quantum key distribution network. Using this framework, we construct examples of how hardware can be modified to make various components in a quantum key distribution network agile and identify general strategies to achieve agility. We explore how other physical layer security protocols beyond traditional quantum key distribution can be integrated into an agile generalized quantum key distribution network.
The transition towards quantum-safe secure communications requires current network infrastructures to support the coexistence of multiple cryptographic technologies. In this context, crypto-agility becomes a key requirement, enabling the coordinated use of Quantum Key Distribution (QKD), PostQuantum Cryptography (PQC), and classical cryptographic mechanisms during a progressive migration process. This paper presents a general, standards-based architecture for crypto-agile IPsec service provisioning in Software-Defined Networking (SDN) environments. The proposal combines modular functional blocks that support the integration of QKD-, PQC-, and classical-derived key material under a common operational framework. The architecture builds on existing specifications, including RFC 9061 and ETSI GS QKD 004. Rather thanfocusing on implementation details or performance evaluation, this work describes the needs addressed by the architecture, its main components, and the operational workflows supporting secure tunnel establishment, rekeying, and attestation-related actions.
The transition towards quantum-safe secure communications requires current network infrastructures to support the coexistence of multiple cryptographic technologies. In this context, crypto-agility becomes a key requirement, enabling the coordinated use of Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), and classical cryptographic mechanisms during a progressive migration process. This paper presents a general, standards-based architecture for crypto-agile IPsec service provisioning in Software-Defined Networking (SDN) environments. The proposal combines modular functional blocks that support the integration of QKD-, PQC-,and classical-derived key material under a common operational framework. The architecture builds on existing specifications, including RFC 9061 and ETSI GS QKD 004. Rather than focusing on implementation details or performance evaluation, this work describes the needs addressed by the architecture, its main components, and the operational workflows supporting secure tunnel establishment, rekeying, and attestation-related actions.
The emergence of quantum computing poses a threat to classical cryptography algorithms, necessitating a shift to quantum secure cryptography. Hybrid protocols combining at least one classical and one quantum-resistant cryptographic algorithm are becoming the standard for securing communications. In this work, we present our novel solution for integrating three different cryptographic assumptions (two of them quantumresistant) into hybrid network security protocols, ensuring that three different cryptographic assumptions must be broken before the protocol becomes vulnerable. Our solution allows for a seamless integration of classical and post-quantum (PQ) cryptography, and quantum key distribution (QKD) into existing network security protocols (e.g., TLS, IPsec) without any major modifications to the protocols themselves. This crypto-agility ensures the mitigation of some of the most well known challenges of both PQ cryptography and QKD. Our findings demonstrate the feasibility of such triple-hybrid network security protocols, showing non-substantial decrease in performance and almost no added packet overhead compared to state of the art protocols. In exchange, we pave the way towards next generation networks where the potential of new quantum-resistant cryptographic schemes can be leveraged in a dynamic and agile fashion, thus fostering a new era of unbreakable communication systems.
Quantum Key Distribution (QKD) is one of the major cryptographic solutions to tackle the security threats associated to future computational advances, in particular those coming from quantum computing. At the most simple level, QKD can be seen as a highly secure source of symmetric secret keys in two separated places. Nonetheless, the lack of standardization and the strong requirements from the physical layer makes this technology very difficult to integrate in existing infrastructure.However, the success of QKD networks radically depends on the degree in which they can be adopted in the existing infrastructure, and it is a must that it happens via standard protocols and interfaces. The flexibility of novel network paradigms, like Software-Defined Networking (SDN), allows for a faster adoption of new concepts, hardware and services in telecommunications networks. This paradigm can be used for quantum communications, allowing for a fast and scalable deployment of quantum technologies and services in the telecommunications network to a degree that was simply impossible in previous schemes, where the different network devices and their connections should be modified, one by one, to create a quantum communications channel.This tutorial provides an introduction to existing QKD technologies and networks, followed by a descriptive explanation on how SDN principles can be utilized to abstract and integrate QKD systems as part of the network management. This will help to reduce the time-to-market for quantum technologies, and also will make quantum cryptography available as a service to be capitalized by the network operators.
Quantum computing threatens classical cryptography, which has prompted the creation of post-quantum cryptography (PQC) and quantum key distribution (QKD). Hybrid cryptography integrates classical, post-quantum, and quantum techniques for achieving multi-layer security and smooth migration towards quantum-safe infrastructures. In this paper, practical deployment patterns, the employment of cryptographic agility, and integration of PQC with QKD are presented with emphasis on hybrid methods as a key strategy for quantum-secure communication.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability