This work presents a dual-link hybrid cryptographic architecture combining post-quantum cryptography (PQC) with Quantum Key Distribution (QKD) for secure classical channel authentication and key establishment. The first link targets resource-constrained aerial or mobile scenarios, using ASCON-80pq for authentication with session keys established via ML-KEM-768. A proof-of-concept free-space implementation demonstrates the feasibility of this lightweight solution. The second link focuses on terrestrial fiber networks, employing ContinuousVariable QKD (CV-QKD) for key distribution, Kyber-based authentication, and AES-256-GCM encryption within a TLS context. Designed under composable security principles, the architecture supports integration into dynamic network environments such as SDN and multi-tenant infrastructures. Experimental results highlight key performance indicators including energy consumption, authentication latency, and resilience to attacks. The work demonstrates the practicality of hybrid PQC–QKD systems for civilian and defense use, advancing readiness of dual-use quantum-safe communications.
This work presents a dual-link hybrid cryptographic architecture combining post-quantum cryptography (PQC) with Quantum Key Distribution (QKD) for secure classical channel authentication and key establishment. The first link targets resource-constrained aerial or mobile scenarios, using ASCON-80pq for authentication with session keys established via ML-KEM-768. A proof-of-concept free-space implementation demonstrates the feasibility of this lightweight solution. The second link focuses on terrestrial fiber networks, employing ContinuousVariable QKD (CV-QKD) for key distribution, Kyber-based authentication, and AES-256-GCM encryption within a TLS context. Designed under composable security principles, the architecture supports integration into dynamic network environments such as SDN and multi-tenant infrastructures. Experimental results highlight key performance indicators including energy consumption, authentication latency, and resilience to attacks. The work demonstrates the practicality of hybrid PQC–QKD systems for civilian and defense use, advancing readiness of dual-use quantum-safe communications.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
The fast development of cyber communications, multimedia distribution, remote working have promoted the demand to transmit sensitive information through secure means in both the public and the private networks. The advent of massive quantum computers is rendering traditional cryptographic algorithms like RSA and Elliptic Curve Cryptography (ECC) insecure because they can crack the classical public-key algorithms like the Shor and Grover algorithms. This brings an immediate need of hybrid cryptographic systems, which integrate classical, quantum, and post-quantum algorithms to provide confidentiality, integrity, authentication, and future security beyond the quantum threat horizon.The paper is a proposal of a Hybrid Quantum-Post-Quantum Cryptographic Framework of transmitting files safely. It starts by aggregating files, which is a process to compress several files, images, videos, and multimedia files that users have chosen into one file to minimize redundancy and ease encryption. The AES-256 encrypted file is in GCM mode and provides confidentiality and integrity of the compressed file.The dual-layer mechanism ensures key establishment security. To begin with, Quantum Key Distribution (QKD) based on the protocols of BB84/E91 allows the Sender and the Receiver to generate a Quantum Secret Key (QSK) by exchanging quantum bits in quantum channel. Constant monitoring of the error rate facilitates automatic eavesdropping detection, and guarantees the keys generation is made when the conditions are secure, as well as the safeguarding of interception and man-in-the-middle attacks.A post-quantum layer is provided to ensure long-term security against quantum cryptanalysis, which uses Kyber, a NIST-approved lattice-based Key Encapsulation Mechanism (KEM). The Receiver creates a key pair of Kyber and disseminates the public key to the Sender. By using encapsulation, the Sender gets a PQC ciphertext and a Shared Secret (SS), with decapsulation on the Receiver side giving ensure that only participants of good faith get the same secret value.The hybridization phase consists of combining the QSK of QKD and SS of Kyber with the help of HKDF-SHA256 to obtain a Final Wrap Key (FWK). AES-GCM encrypts the key of file encryption by wrapping it with FWK which allows a secure and authenticated transfer of the key. The Sender sends four messages: encrypted file, Kyber ciphertext, wrapped AES key and the initialisation vector. At Receiver end, FWK is calculated once again with the help of QSK and SS so that the original data can be decrypted with the help of AES key.The suggested framework provides a defense-in-depth solution based on the combination of quantum security, post-quantum resilience and authenticated symmetric encryption. It can be analyzed that there is a strong resistance to classical and quantum adversaries, scalability, and compatibility with the existing communication networks. This renders the model to be appropriate to secure government communication, military systems, data exchange in healthcare environments, cloud storage and financial infrastructures. Keywords— Quantum Key Distribution (QKD), Post-Quantum Cryptography (PQC), Kyber,Key Encapsulation Mechanism (KEM), HKDF-SHA256, Quantum Secret Key (QSK), GCM Mode.
This paper presents a vendor-agnostic architecture for secure pre-shared key (PSK) exchange between Quantum Key Distribution (QKD) nodes, leveraging post-quantum cryptography (PQC) tools. The proposed system combines PQC-OpenVPN and OQS-OpenSSH with USB mass storage emulation and single-board computers (SBCs) to automate the transfer of initial authentication secrets. This design significantly reduces manual intervention and mitigates risks associated with physical key handling. The solution was experimentally validated on IDQ Clavis3 and Cerberis3 devices and is broadly applicable to other QKD platforms that support only USB-based key input. Integration of lattice-based algorithms such as Kyber, Dilithium, and ML-DSA enables encapsulation and authentication of quantum-safe keys. Furthermore, a layered design using VPN and SSH channels provides robust cryptographic isolation for authentication material in transit. The work contributes a reproducible and cost-effective testbed for post-quantum hardened QKD deployments and demonstrates the practical feasibility of combining PQC mechanisms with QKD systems to enhance trust in future quantum-safe infrastructures.
The advent of quantum computing imposes unprecedented risks on conventional cryptosystems, necessitating novel secure communication strategies. This work presents a modular, hybrid, and adaptive protocol that integrates Quantum Key Distribution (QKD) with Post-Quantum Cryptography (PQC) to maintain continuous, Quantum-Safe Key Exchanges, even under adverse network conditions that typically hinder the state-of-the-art QKD-based methods. At its core are specialized Crypto-Machines, which incorporate QKD Nodes compliant with ETSI-14 standards and modular PQC components, thereby supporting seamless transitions among lattice-, hash-, or code-based schemes. A signed, Quantum-Resistant, HOTP-based mechanism ensures robust mutual authentication. When QKD utilization becomes infeasible—due to, for example, fiber tampering—the protocol dynamically shifts to PQC, safeguarding ongoing communications. Once a key is established, AES-256-GCM encryption provides strong data confidentiality. Simulations have been conducted with the SeQUeNCe toolkit to demonstrate the protocol’s adaptability and resilience. The results show how Crypto-Machines are able to provide QKD exchanges under favorable network conditions while also being able to fall-back to PQC-based approaches with a minimal impact on the performance. Hence, the proposed stack allows operators to maintain Quantum-Proof Key Exchanges where current state-of-the-art solutions are impaired by a low-quality network connection, and thereby offering a forward-looking security framework suited to the quantum era
The existence of quantum computing presents an existential threat to the traditional cryptographic algorithms, and there is a need to create communication mechanisms that are fundamentally secure. In this regard, the concept of Quantum Key Distribution (QKD) provides information-theoretic security, which is founded on quantum mechanics. Nevertheless, conventional QKD protocols have serious shortcomings such as lack of distance in communication, vulnerability to side-channel attacks, and inability to support the large-scale heterogeneous network. We suggest that HQNet-QKD a Hybrid Quantum Key Distribution framework can help solve these issues by offering a more secure, scalable and future-proof key exchange framework in hybrid classical-quantum networks. To support multi-layered security, the proposed architecture is a network ensuring the smoothness of decoy-state BB84, Measurement-Device-Independent QKD (MDI-QKD), entanglement/twin-field-based QKD with verifiable Secret Sharing (VSS) and Post-Quantum Cryptography (PQC). It provides a complete methodology such as system architecture, mathematical modeling, and end-to-end key synthesis. When used over a distance of 300 km, simulation and testing have shown that HQNet-QKD can achieve up to2.7×higher secret key rate (SKR) than conventional methods, secret communication at 700 km and resilience to both quantum and classical attacks more than 96%. In addition, the framework guarantees forward secrecy, detector-side immunity, contextbound key derivation, and composability and thus resistant to current and future adversaries. It has a low-computational overhead modular design, making it trivial to deploy in a real world, in applications like quantum-secured 5G backbones, cloud data centers, critical infrastructure, and satellite-based communication systems. The findings make HQNet-QKD a new generation solution to quantum-safe secure communication and the first step towards the implementation of the quantum internet.
The threat quantum computers pose to classical public-key cryptography motivates the deployment of quantum-safe communication for critical infrastructure such as healthcare, finance, and energy systems. Quantum key distribution (QKD) and post-quantum cryptography (PQC) offer complementary security guarantees, information-theoretic key exchange and quantum-resistant end-to-end authentication that can be combined in a layered architecture. Here, we demonstrate a field-deployed quantum-secure network integrating entanglement-based QKD with end-to-end PQC over 140 km of installed fiber in Thuringia, Germany, connecting a rural health kiosk to a university hospital via a trusted-node architecture comprising heterogeneous underground and aerial fiber links. Unlike conventional deployments that rely on a dedicated key management system to forward keys to applications, our architecture injects QKD keys directly into standard Linux-based VPN tunnels between adjacent nodes, while PQC secures the communication end-to-end, remaining fully compatible with existing infrastructure and software. Polarization-entangled photon pairs were generated at 810 nm and 1550 nm, with the telecom photon transmitted over deployed fiber. Active polarization stabilization and dispersion compensation preserve the entanglement and enable 22 days of continuous, fully autonomous operation, further underscoring the technological maturity of entanglement-based QKD approaches in a real-world fiber environment. Although the two deployed links were operated during separate rather than concurrent periods, the predominantly aerial link exhibited markedly greater instability, with QBER variations most strongly correlated with wind speed. The generated keys secured a telemedicine proof-of-concept without modifying existing medical systems, demonstrating a practical framework for quantum-safe critical infrastructures.