The future security of digital communications will increasingly rely on the integration of Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), indicating a necessary convergence rather than a competitive relationship between these two technologies. Following the publication of NIST FIPS 203, 204 and 205, the industry now possesses standardised algorithmic tools for migrating away from RSA and elliptic-curve cryptography (ECC). At the same time, for critical infrastructure facing “harvest-now, decrypt-later” adversaries, purely software-based measures provide only computational, not information-theoretic, security. We argue that the optimal solution is a hybrid architecture, in which PQC provides authentication and cryptographic agility across heterogeneous endpoints, while QKD supplies an additional physical-layer shield for high-value links. The central engineering challenge is brownfield coexistence: deploying QKD over existing lit telecom fibers that carry high-power classical traffic. We review three spectral coexistence strategies to mitigate Spontaneous Raman Scattering (SpRS) – O-band separation, dense C-band DWDM integration with guard bands, and an “inverted” spectrum approach where data uses the O-band and QKD uses the C-band – and we discuss emerging physical media such as hollow-core and multi-core fibers. At the protocol layer, we discuss hybrid key encapsulation and the role of crypto-agile gateways in combining keys from classical, PQC and QKD sources [1]. Finally, we survey industrial pilots (e.g., SK Telecom, EuroQCI / OPENQKD) and outline open challenges in cost, standardisation and operations. The goal is to provide practitioners with a realistic, engineering-oriented overview of how PQC and QKD can be combined in brownfield optical networks.
The future security of digital communications will increasingly rely on the integration of Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC), indicating a necessary convergence rather than a competitive relationship between these two technologies. Following the publication of NIST FIPS 203, 204 and 205, the industry now possesses standardised algorithmic tools for migrating away from RSA and elliptic-curve cryptography (ECC). At the same time, for critical infrastructure facing “harvest-now, decrypt-later” adversaries, purely software-based measures provide only computational, not information-theoretic, security. We argue that the optimal solution is a hybrid architecture, in which PQC provides authentication and cryptographic agility across heterogeneous endpoints, while QKD supplies an additional physical-layer shield for high-value links. The central engineering challenge is brownfield coexistence: deploying QKD over existing lit telecom fibers that carry high-power classical traffic. We review three spectral coexistence strategies to mitigate Spontaneous Raman Scattering (SpRS) – O-band separation, dense C-band DWDM integration with guard bands, and an “inverted” spectrum approach where data uses the O-band and QKD uses the C-band – and we discuss emerging physical media such as hollow-core and multi-core fibers. At the protocol layer, we discuss hybrid key encapsulation and the role of crypto-agile gateways in combining keys from classical, PQC and QKD sources [1]. Finally, we survey industrial pilots (e.g., SK Telecom, EuroQCI / OPENQKD) and outline open challenges in cost, standardisation and operations. The goal is to provide practitioners with a realistic, engineering-oriented overview of how PQC and QKD can be combined in brownfield optical networks.
Cryptographically relevant quantum computers do not yet exist, but the transition away from classical public-key cryptography is already underway: adversaries can record encrypted traffic today and decrypt it once a sufficiently capable quantum computer becomes available, a threat known as harvest-now, decrypt-later. This paper examines the engineering case for combining post-quantum cryptography (PQC) with quantum key distribution (QKD) as a strategy for securing next-generation communication infrastructure, focusing on 6G core and radio-access networks, Open RAN (O-RAN), and constrained Internet of Things (IoT) deployments. Rather than treating the two mechanisms as symmetric, interchangeable layers, the paper examines what each one actually guarantees, surveys the empirical evidence available for deployment cost, and describes where national security authorities and standards bodies disagree on the value of QKD. The architecture is grounded in the finalized National Institute of Standards and Technology (NIST) PQC standards and its 2025 hybrid key-establishment guidance, drawing on empirical Open RAN latency and energy measurements published during 2025 and 2026, embedded-hardware benchmarks for constrained devices, and the small number of quantum key distribution deployments operating at metropolitan or national backbone scale today. The paper is explicit about which figures are measured results and which remain illustrative proposals, and it closes by naming the specific standardization and field-trial gaps that separate current practice from the architecture it describes. The purpose of the work is to give network architects and policymakers a single, evidence-graded reference for deciding where each mechanism belongs in a real deployment, rather than treating post-quantum and quantum-distributed keying as equivalent options.
Quantum computing advances pose a serious threat to conventional public-key cryptographic systems such as RSA and elliptic curve cryptography as quantum algorithms may undermine the computational assumptions that guaranty their security. This challenge has driven the development of quantumsafe security approaches among which Quantum Key Distribution (QKD) represents a fundamentally different paradigm based on quantum mechanical principles rather than mathematical complexity. This paper presents a structured review of recent progress in QKD based on a systematic analysis of literature between 2020 and 2025, we examine core protocols including discrete-variable, continuous-variable, measurement-deviceindependent, and twin-field approaches, while also discussing their relationship with post-quantum cryptography as a complementary strategy for future secure communication systems. We provide a unified comparison framework to support practical design and policy decisions by organizing protocols and implementations along deployment dimensions. The study analyze theoretical foundations, implementation technologies across fiber, free-space, satellite, and integrated photonic platforms, and key performance trade-offs involving scalability, security robustness, and deployment feasibility. Findings indicate substantial progress in transitioning QKD from laboratory research toward practical implementations, supported by advances in network architectures, integrated hardware and hybrid cryptographic designs. The comparative analysis will highlight distinct strengths and limitations among protocol families and emphasize the potential of combining QKD with post-quantum cryptographic methods to enhance resilience. Remaining challenges including scalability constraints, implementation-level vulnerabilities, performance limitations over long distances, and integration with existing communication infrastructures are critically discussed. Finally, emerging research directions such as quantum repeaters, hybrid quantum-classical security models, and exploratory directions such as artificial intelligence-assisted optimizations are identified as key factors in enabling the evolution of QKD toward largescale quantum-secure networking.
Abstract: This study advances a unifying systems perspective on quantum-safe network security by synthesizing recent progress in quantum cryptography with practical integration patterns across carrier-grade infrastructures. Concept analysis distinguishes the roles of quantum key distribution (QKD), device-independent variants, quantum authentication, and post-quantum cryptography (PQC) within zero-trust architectures. Building on this, a layered framework—spanning physical/entanglement resources, key management, crypto-agility, control plane orchestration, and policy/compliance—is articulated to support end-to-end, composable guarantees. The problem addressed is the realization of verifiable, quantum-resilient security under operational constraints involving latency, key-rate variability, and heterogeneous trust assumptions. Methodology combines a structured literature synthesis with formal composability mapping to universal composability principles, adversarial threat modeling for quantum-enabled attackers, and testbed/simulation evaluation of hybrid QKD–PQC pipelines across L2–L3 segments and 5G/6G backhaul scenarios. Key results indicate that (i) selective QKD deployment on high-value links coupled with PQC at endpoints enhances resilience while preserving crypto-agility; (ii) automated key-lifecycle orchestration reduces exposure windows; and (iii) device-independent assurances strengthen guarantees where trust relaxation is necessary. The impact is a deployment-ready reference architecture, measurable integration metrics, and guidance aligned with emerging standards for critical infrastructure and national networks. The implications extend to procurement, compliance, and roadmap planning for quantum-era network security. Keywords: quantum-safe cryptography, quantum key distribution (QKD), post-quantum cryptography (PQC), hybrid QKD–PQC, composable security, device-independent QKD, zero-trust networks, key management and orchestration, 5G/6G backhaul, network security architecture, standards and interoperability
Quantum computing is posing a serious risk to classical cryptographic tools such as RSA and ECC as sophisticated quantum algorithms are able to crack their mathematical foundation in a time bound that is a a polynomial in the number of repetitions. In this paper, we will describe the process of integrating Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD) into a hybrid approach to secure communications in the post-quantum world. The suggested methodology is a combination of the computational efficiency and scalability of PQC and the information-theoretic security and eavesdropping detection abilities of QKD. Simulation observations indicate that PQC-only systems are both faster in generating keys and scalable, but do not have a strong eavesdropping detection. On the other hand, non-conditional security is only a feature of systems based on QKD, but it is also highly overhead and slows down key rate. The hybrid PQC-Q KD model provides a balanced performance, high resilience, high authentication, high confidentiality, and realistic deployability. On balance, this discussion demonstrates that the hybrid approach is better than standalone methods and can provide a strong solution to protect against new quantum threats. The large-scale network protocol can be optimized, resources and further integration with other emerging technologies, such as 5G/6G, IoT or cloud computing, can be directed in future research.
Introduction The rapid advancement of quantum computing presents an existential threat to the mathematical foundations of modern internet security. Fault-tolerant quantum computers are projected to reach the logical qubit scale necessary to execute Shor's algorithm by 2030–2035, threatening currently deployed public-key cryptography infrastructures. Methods We evaluate the performance metrics of integrating post-quantum cryptography (PQC), specifically the newly finalized NIST standards (FIPS 203, 204, and 205), with quantum key distribution (QKD) across communication networks. Results Our analysis demonstrates that while hybrid PQC-QKD models reduce long-term key compromise probabilities to near 0%, they introduce a 15% to 40% increase in bandwidth overhead during initial cryptographic handshakes. Discussion Given that enterprise-wide cryptographic migrations historically require 7–10 years, organizations face an immediate vulnerability window against “harvest now, decrypt later” adversaries. Ultimately, we propose a phased, cryptographically agile framework to achieve a Zero-Trust, Quantum-Safe network architecture within a 5-year implementation timeline.
Quantum computing threatens classical cryptography, which has prompted the creation of post-quantum cryptography (PQC) and quantum key distribution (QKD). Hybrid cryptography integrates classical, post-quantum, and quantum techniques for achieving multi-layer security and smooth migration towards quantum-safe infrastructures. In this paper, practical deployment patterns, the employment of cryptographic agility, and integration of PQC with QKD are presented with emphasis on hybrid methods as a key strategy for quantum-secure communication.