International Conference on Transparent Optical Networks
A unified Cryptographic Framework for the Distribution of Quantum-Generated Keys
David Soler, Iván Cillero, Francisco Javier Novoa, Carlos Dafonte, Pedro Otero-García, David Pérez-Castro, Ana Fernández Vilas, Manuel Fernández‐Veiga, Rebeca P. Dı́az Redondo
This work aims to make quantum-generated keys accessible to end users and integrate them into practical applications, enabling end-to-end secure communication across multiple interfaces. QKD and PQC are strategically implemented at various communication points to establish a unified, quantum-resistant cryptographic framework. QRNGs are central to this approach, generating high-entropy quantum keys and enabling their secure distribution without requiring specialised hardware. To address these objectives, an Entropy-as-a-Service architecture is introduced, providing end users with efficient and secure access to quantum key material. As a case study, this architecture is integrated into a group messaging application, showcasing its practicality and relevance for everyday communications.
This work aims to make quantum-generated keys accessible to end users and integrate them into practical applications, enabling end-to-end secure communication across multiple interfaces. QKD and PQC are strategically implemented at various communication points to establish a unified, quantum-resistant cryptographic framework. QRNGs are central to this approach, generating high-entropy quantum keys and enabling their secure distribution without requiring specialised hardware. To address these objectives, an Entropy-as-a-Service architecture is introduced, providing end users with efficient and secure access to quantum key material. As a case study, this architecture is integrated into a group messaging application, showcasing its practicality and relevance for everyday communications.
Quantum-Safe Networks (QSNs) use quantum key distribution (QKD) to deliver keys generated using a Quantum Random Number Generator (QRNG) to consumers at scale. In practice, prevailing Quantum-Key-as-a-Service (QKaaS) offerings still assume that each consumer site deploys on-premise QKD hardware, creating cost and feasibility barriers that limit adoption. Although ETSI GS QKD 014 standardizes APIs for key retrieval between Secure Application Entities (SAEs) and Key Management Entities (KMEs), it does not address key delivery across untrusted classical networks to consumers without local QKD devices. We close this gap with a gateway architecture that transparently secures ETSI-compliant QKD APIs using Post-Quantum Cryptography (PQC)—applying PQC signatures and key-encapsulation mechanisms end-to-end—without requiring changes to existing devices or software. The design supports cryptographic agility, enabling runtime selection and rotation among standardized PQC schemes. Evaluations on both simulated QKD environments and production-grade hardware show minimal overhead (≈1.3×–1.5× versus baseline) and robust scaling across concurrent connections and multiple consumer sites, extending the reach of QSNs beyond premises equipped with QKD while preserving end-to-end quantum-safe guarantees. Overall, this paper equips practitioners with a systematized view of PQC–QKD integration in QSNs, with an actionable gateway blueprint for extending QSNs without the need for on-premise QKD deployments.
As quantum technologies advance, the security of popular cryptographic protocols becomes more threatened by the capabilities of Cryptographically Relevant Quantum Computers (CRQCs). In this scenario, Post-Quantum Cryptography (PQC) has become a potential solution to prolong the life of existing Public Key Infrastructure (PKI) systems. However, PQC protocols depend on high-quality randomness for key generation and encapsulation procedures, with the quality of the entropy source potentially having a profound impact on the security of the overall system. In this work, we demonstrate a proof-of-concept enabling the incorporation of Quantum Random Number Generation (QRNG) devices within communication networks using PQC-based Transport Layer Security (TLS).Using open-source cryptographic libraries and commercial QRNG hardware, we demonstrate their use as entropy sources via an Entropy-as-a-Service (EaaS) model. We highlight two particular use cases: a fully virtualized private PKI network and a connection to an external PQC-enabled server. Experimental results show that EaaS QRNG enables real-time entropy monitoring and quality assessment in cryptographic management systems, with negligible impact on TLS handshake time.
Quantum secure communication technology, grounded in the principles of quantum mechanics, has revolutionized traditional cryptographic methods, which predominantly rely on mathematical algorithms and logical transformations. Quantum key distribution (QKD) facilitates the secure sharing of symmetric keys between legitimate parties, ensuring the integrity and confidentiality of information in communication channels. Among various QKD schemes, continuous variable quantum key distribution (CV-QKD) has emerged as a viable alternative to the more established discrete variable quantum key distribution (DV-QKD). CV-QKD boasts several advantages, including straightforward deployment, reduced operational costs, and stable signal quality, positioning it as a significant component of the quantum communication landscape. Quantum noise stream cipher (QNSC) represents a technique that employs redundant data streams to encrypt plaintext. Notably, QNSC shares structural similarities with the optical path used in quantum key distribution, allowing for compatibility with existing QKD infrastructure. Furthermore, the keys generated through quantum key distribution ensure absolute security, enabling them to substitute the data streams produced by pseudo-random sequences traditionally used in classical encryption schemes. This substitution enhances the overall security framework of the quantum noise stream encryption approach. The quantum access network (QAN) extends quantum key distribution capabilities from point-to-point connections to point-to-multipoint configurations, thereby becoming an essential component of contemporary network architectures. By interlinking multiple end users with a network backbone, quantum access networks can seamlessly integrate with quantum key distribution protocols. This integration offers a cost-effective and scalable solution for user access to the network. Extensive experimental verifications have demonstrated the viability of downstream access networks, indicating that the merging of quantum access network structures with quantum stream encryption technologies can yield a comprehensive quantum experimental platform. On this platform, security keys are derived through quantum key distribution, which subsequently facilitates the encryption of plaintext information. Notably, experimental validations involving eight users have been successfully executed on this platform, underscoring its practical applicability and effectiveness.
Quantum key distribution (QKD) is a promising technique for addressing quantum threats. To enable easy-to-use cryptographic services based on QKD, we designed a cryptosystem that integrates classical cryptographic systems with key generation and distribution using a QKD network. The proposed cryptosystem comprises a centrally deployed cryptography management service platform and distributed key management systems. The paper presents the functional modules, main processes, interface design, and security requirements of the cryptosystem. This cryptosystem provides a secure and efficient way to offer cryptographic services for various business applications, such as identity authentication, application authorization and point-to-point or group session key distribution. By integrating QKD with classical cryptosystems, this approach can improve the security of traditional cryptographic systems by using the random and unconditionally secure keys generated by QKD. Furthermore, combining QKD with classical cryptographic systems can enhance the scalability of QKD and provide more efficient and cost-effective solutions for large-scale cryptographic services.
With the advent of quantum computing, classical cryptographic techniques—such as those underpinning Transport Layer Security (TLS)—are becoming increasingly vulnerable. Although post-quantum cryptographic algorithms are being developed, their long-term security remains uncertain. Quantum Key Distribution (QKD) offers a fundamentally different approach to key exchange and secure communication, as it bases security on the physics of quantum information rather than computational difficulty. This paper presents a practical simulation framework that integrates QKD-derived keys into the TLS protocol using the Pre-Shared Key (PSK) mode. The system employs a layered QKD architecture, implemented using QuNetSim, to generate and manage quantum keys, which are then distributed through a centralized Key Management Server (KMS). The proposed approach demonstrates how quantum-generated keys can be seamlessly integrated into the TLS protocol to enhance resilience against quantum attacks, providing a viable pathway toward post-quantum-secure communication.
One of the solutions to the problem of secure communication is the Quantum Random Number Generators (QRNGs) which generate true randomness based on quantum mechanical principles.QRNGs are different from conventional pseudo random number generator in that they use quantum uncertainty to generate outputs which are very unpredictable.This work attempts to examine different QRNG architectures, study the possible integration of cryptographic frameworks with these architectures and highlight potential vulnerabilities in the integration of cryptographic frameworks with QRNG architectures.Post-processing techniques, i.e.Zero-Phase Component Analysis (ZPCA) and neural network based techniques are also studied to increase entropy and suppress environmental noise in QRNG systems.Key findings show that system jitter models based QRNG architectures are more scalable and less expensive for use in real world applications.Additionally, incorporating cryptographic protocols with the QRNGs endows them with the ability to resist quantum threats, and hence, provide better key distribution in the secure IoT communication frameworks.However, as security problems such as side channel attacks and hardware manipulation are still big issues.It also points out some of the emerging research trends including hybrid QRNG architectures, i.e., QRNG with classical PRNG to increase the entropy rate.As such, the proposed methodologies attempt to enhance QRNG scalability, security, and energy efficiency in cloud infrastructures, in mobile systems and in critical security environments.The advancement of these technologies will assume a crucial function in the advancement of quantum-safe frames for current advanced computerized foundation.