Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

IEEE International Conference on Trust, Security and Privacy in Computing and Communications (TrustCom)

Post-Quantum Cryptography for Secure Authentication Key Distribution in QKD Networks

Filip Lauterbach, Lukáš Kapičák, Sergej Jakovlev, Miralem Mehić, Stefan Raß, Miroslav Vozn̆ák

Published Nov 14, 2025• 0 citations
Publisher

Abstract

This paper presents a vendor-agnostic architecture for secure pre-shared key (PSK) exchange between Quantum Key Distribution (QKD) nodes, leveraging post-quantum cryptography (PQC) tools. The proposed system combines PQC-OpenVPN and OQS-OpenSSH with USB mass storage emulation and single-board computers (SBCs) to automate the transfer of initial authentication secrets. This design significantly reduces manual intervention and mitigates risks associated with physical key handling. The solution was experimentally validated on IDQ Clavis3 and Cerberis3 devices and is broadly applicable to other QKD platforms that support only USB-based key input. Integration of lattice-based algorithms such as Kyber, Dilithium, and ML-DSA enables encapsulation and authentication of quantum-safe keys. Furthermore, a layered design using VPN and SSH channels provides robust cryptographic isolation for authentication material in transit. The work contributes a reproducible and cost-effective testbed for post-quantum hardened QKD deployments and demonstrates the practical feasibility of combining PQC mechanisms with QKD systems to enhance trust in future quantum-safe infrastructures.

DOI
10.1109/trustcom66490.2025.00177

Related papers

Hybrid QKD & PQC Protocols implemented in the Berlin OpenQKD testbed

Marc Geitz, Ronny Döring, Ralf-Peter Braun

This paper introduces several hybrid protocols based on Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) implemented in the OpenQKD testbed Berlin to improve the security of the QKD nodes. Instead of following the ETSI QKD014 standard of a key management system based on classical security, i.e., RSA authentication and ECC encryption, we implemented a quantum-secure Key Management System based on PQC Key Encapsulation and Signature algorithms. The hardware and the software components of the QKD network authenticate themselves using a PQC trust chain and Pre-Shared Secrets, wherever supported. The communication between QKD nodes, as for the encryption key forwarding process, is hardened by Post-Quantum Cryptography to prevent cryptographic key exposure on intermediate network nodes. Using the two implemented key exchange processes, based on QKD and PQC, applications are able to request any kind of encryption key from the Key Management System and combine them arbitrarily to compute more reliable cryptographic keys.

International Conference on Frontiers of Signal Processing (ICFSP)•Oct 23, 2023•20 citations

Quantum Key Distribution with Enhanced PQC Validation

Vlad Beraru, Carmen MILEA

Quantum Key Distribution (QKD) provides information-theoretic security based on quantum mechanics, but its practical deployment is limited by its reliance on classical infrastructure and inability to operate as a standalone solution.Recent research emphasizes hybrid approaches that combine QKD with post-quantum cryptography (PQC) to achieve practical and robust security.This paper presents a hybrid key distribution model integrating QKD with the postquantum key encapsulation mechanism.The two independently generated keys are combined to derive a unified shared secret, enhancing resilience against both classical and quantum adversaries.The system is implemented using a simulated quantum environment, enabling the emulation of quantum communication over classical networks.The proposed approach is validated through a secure image transmission use case, demonstrating the correctness of the hybrid key exchange.The results highlight the feasibility of hybrid classical-quantum cryptographic systems as a practical step toward secure communication in emerging quantum network infrastructures.

Informatica Economica•Jun 30, 2026•0 citations

PQC-Enhanced QKD Networks: A Layered Approach

Paul Spooren, Andreas Neuhold, Sebastian Ramacher +1 more

We present a layered and modular network architecture that combines Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) to provide scalable end-to-end security across long distance multi-hop, trusted-node quantum networks. To ensure interoperability and efficient practical deployment, hop-wise tunnels between physically secured nodes are protected by WireGuard with periodically rotated pre-shared keys sourced via the ETSI GS QKD 014 interface. On top, Rosenpass performs a PQC key exchange to establish an end-to-end data channel without modifying deployed QKD devices or network protocols. This dual-layer composition yields post-quantum forward secrecy and authenticity under practical assumptions. We implement the design using open-source components and validate and evaluate it in simulated and lab test-beds. Experiments show uninterrupted operation over multi-hop paths, low resource footprint and fail-safe mechanisms. We further discuss the design's compositional security, wherein the security of each individual component is preserved under their combination and outline migration paths for operators integrating QKD-aware overlays in existing infrastructures.

quant-pharXiv:2604.05599•International Conference on Quantum Communications, Networking, and Computing (QCNC)•Apr 8, 2026•1 citation

Experimental Authentication of Quantum Key Distribution with Post-quantum Cryptography

Liujun Wang, Kaiyi Zhang, Jiayong Wang +9 more

Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computer. However, QKD requires the classical channel to be authenticated, and the current method is pre-sharing symmetric keys. For a QKD network of $n$ users, this method requires $C_n^2 = n(n-1)/2$ pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum resistant security, each user only needs to apply for a digital certificate from certificate authority (CA) to achieve efficient and secure authentication for QKD. We only need to assume the short-term security of the PQC algorithm to achieve the long-term security of the distributed keys. Here, we experimentally verified the feasibility, efficiency and stability of the PQC algorithm in QKD authentication, and demonstrated the advantages when new users join the QKD network. Using PQC authentication we only need to believe the CA is safe, rather than all trusted relays. QKD combined with PQC authentication will greatly promote and extend the application prospects of quantum safe communication.

arXiv:2009.04662•Sep 10, 2020•6 citations

Experimental authentication of quantum key distribution with post-quantum cryptography

Liujun Wang, Kaiyi Zhang, Jiayong Wang +9 more

Abstract Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computers. However, QKD requires the classical channel to be authenticated, the current method for which is pre-sharing symmetric keys. For a QKD network of n users, this method requires $${C}_{n}^{2}=n(n-1)/2$$ C n 2 = n ( n − 1 ) / 2 pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of a mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum-resistant security, each user only needs to apply for one digital certificate from a certificate authority (CA) to achieve efficient and secure authentication for QKD. We need to assume only the short-term security of the PQC algorithm to achieve long-term security of the distributed keys. Here, we experimentally verified the feasibility, efficiency, and stability of the PQC algorithm in QKD authentication, and demonstrated the advantages when new users join the QKD network. Using the PQC public-key infrastructure, the nodes need to mutually trust only the CA to authenticate each other. QKD combined with PQC authentication will greatly promote and extend the application prospects of quantum-safe communication.

npj Quantum Information•May 6, 2021•154 citations

Post-Quantum Secure VPN: A Quantum-Resistant Protocol for Confidential Communication

Priyam Khan, G. Gopichand

The fast development of quantum computing presents a great threat to the security of classical cryptographic algorithms that support secure communication systems like Virtual Private Networks (VPNs). RSA and ECC algorithms that are commonly employed in key exchange and digital authentication can fall victim to quantum attacks from Shor’s and Grover’s algorithms. This study introduces the design and deployment of a post-quantum-resistant VPN protocol using post-quantum cryptographic (PQC) primitives, i.e., Kyber for key encapsulation and Dilithium for digital signatures. The suggested structure is incorporated into OpenVPN via the Open Quantum Safe (OQS) framework for uninterrupted post-quantum compatibility. The protocol is also capable of supporting hybrid cryptography for smooth transition from classical to post-quantum systems. Performance benchmarks are performed over metrics like handshake latency, tunnel throughput, CPU usage, and certificate overhead. The findings illustrate that post-quantum secure VPNs are not only achievable but also feasible for near-future deployment. This work adds a future-proof framework to improve the resilience of secure communications in the post-quantum era with a focus on scalability, crypto-agility, and real-world implementation readiness.

IEEE International Conference on Emerging Computing and Intelligent Technologies (ICoECIT)•Jan 28, 2026•0 citations
This paper presents a vendor-agnostic architecture for secure pre-shared key (PSK) exchange between Quantum Key Distribution (QKD) nodes, leveraging post-quantum cryptography (PQC) tools. The proposed system combines PQC-OpenVPN and OQS-OpenSSH with USB mass storage emulation and single-board computers (SBCs) to automate the transfer of initial authentication secrets. This design significantly reduces manual intervention and mitigates risks associated with physical key handling. The solution was experimentally validated on IDQ Clavis3 and Cerberis3 devices and is broadly applicable to other QKD platforms that support only USB-based key input. Integration of lattice-based algorithms such as Kyber, Dilithium, and ML-DSA enables encapsulation and authentication of quantum-safe keys. Furthermore, a layered design using VPN and SSH channels provides robust cryptographic isolation for authentication material in transit. The work contributes a reproducible and cost-effective testbed for post-quantum hardened QKD deployments and demonstrates the practical feasibility of combining PQC mechanisms with QKD systems to enhance trust in future quantum-safe infrastructures.
This paper introduces several hybrid protocols based on Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) implemented in the OpenQKD testbed Berlin to improve the security of the QKD nodes. Instead of following the ETSI QKD014 standard of a key management system based on classical security, i.e., RSA authentication and ECC encryption, we implemented a quantum-secure Key Management System based on PQC Key Encapsulation and Signature algorithms. The hardware and the software components of the QKD network authenticate themselves using a PQC trust chain and Pre-Shared Secrets, wherever supported. The communication between QKD nodes, as for the encryption key forwarding process, is hardened by Post-Quantum Cryptography to prevent cryptographic key exposure on intermediate network nodes. Using the two implemented key exchange processes, based on QKD and PQC, applications are able to request any kind of encryption key from the Key Management System and combine them arbitrarily to compute more reliable cryptographic keys.
Quantum Key Distribution (QKD) provides information-theoretic security based on quantum mechanics, but its practical deployment is limited by its reliance on classical infrastructure and inability to operate as a standalone solution.Recent research emphasizes hybrid approaches that combine QKD with post-quantum cryptography (PQC) to achieve practical and robust security.This paper presents a hybrid key distribution model integrating QKD with the postquantum key encapsulation mechanism.The two independently generated keys are combined to derive a unified shared secret, enhancing resilience against both classical and quantum adversaries.The system is implemented using a simulated quantum environment, enabling the emulation of quantum communication over classical networks.The proposed approach is validated through a secure image transmission use case, demonstrating the correctness of the hybrid key exchange.The results highlight the feasibility of hybrid classical-quantum cryptographic systems as a practical step toward secure communication in emerging quantum network infrastructures.
We present a layered and modular network architecture that combines Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) to provide scalable end-to-end security across long distance multi-hop, trusted-node quantum networks. To ensure interoperability and efficient practical deployment, hop-wise tunnels between physically secured nodes are protected by WireGuard with periodically rotated pre-shared keys sourced via the ETSI GS QKD 014 interface. On top, Rosenpass performs a PQC key exchange to establish an end-to-end data channel without modifying deployed QKD devices or network protocols. This dual-layer composition yields post-quantum forward secrecy and authenticity under practical assumptions. We implement the design using open-source components and validate and evaluate it in simulated and lab test-beds. Experiments show uninterrupted operation over multi-hop paths, low resource footprint and fail-safe mechanisms. We further discuss the design's compositional security, wherein the security of each individual component is preserved under their combination and outline migration paths for operators integrating QKD-aware overlays in existing infrastructures.
Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computer. However, QKD requires the classical channel to be authenticated, and the current method is pre-sharing symmetric keys. For a QKD network of nnn users, this method requires Cn2=n(n−1)/2C_n^2 = n(n-1)/2Cn2​=n(n−1)/2 pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum resistant security, each user only needs to apply for a digital certificate from certificate authority (CA) to achieve efficient and secure authentication for QKD. We only need to assume the short-term security of the PQC algorithm to achieve the long-term security of the distributed keys. Here, we experimentally verified the feasibility, efficiency and stability of the PQC algorithm in QKD authentication, and demonstrated the advantages when new users join the QKD network. Using PQC authentication we only need to believe the CA is safe, rather than all trusted relays. QKD combined with PQC authentication will greatly promote and extend the application prospects of quantum safe communication.
Abstract Quantum key distribution (QKD) can provide information theoretically secure key exchange even in the era of quantum computers. However, QKD requires the classical channel to be authenticated, the current method for which is pre-sharing symmetric keys. For a QKD network of n users, this method requires Cn2=n(n−1)/2{C}_{n}^{2}=n(n-1)/2Cn2​=n(n−1)/2 C n 2 = n ( n − 1 ) / 2 pairs of symmetric keys to realize pairwise interconnection. In contrast, with the help of a mature public key infrastructure (PKI) and post-quantum cryptography (PQC) with quantum-resistant security, each user only needs to apply for one digital certificate from a certificate authority (CA) to achieve efficient and secure authentication for QKD. We need to assume only the short-term security of the PQC algorithm to achieve long-term security of the distributed keys. Here, we experimentally verified the feasibility, efficiency, and stability of the PQC algorithm in QKD authentication, and demonstrated the advantages when new users join the QKD network. Using the PQC public-key infrastructure, the nodes need to mutually trust only the CA to authenticate each other. QKD combined with PQC authentication will greatly promote and extend the application prospects of quantum-safe communication.
The fast development of quantum computing presents a great threat to the security of classical cryptographic algorithms that support secure communication systems like Virtual Private Networks (VPNs). RSA and ECC algorithms that are commonly employed in key exchange and digital authentication can fall victim to quantum attacks from Shor’s and Grover’s algorithms. This study introduces the design and deployment of a post-quantum-resistant VPN protocol using post-quantum cryptographic (PQC) primitives, i.e., Kyber for key encapsulation and Dilithium for digital signatures. The suggested structure is incorporated into OpenVPN via the Open Quantum Safe (OQS) framework for uninterrupted post-quantum compatibility. The protocol is also capable of supporting hybrid cryptography for smooth transition from classical to post-quantum systems. Performance benchmarks are performed over metrics like handshake latency, tunnel throughput, CPU usage, and certificate overhead. The findings illustrate that post-quantum secure VPNs are not only achievable but also feasible for near-future deployment. This work adds a future-proof framework to improve the resilience of secure communications in the post-quantum era with a focus on scalability, crypto-agility, and real-world implementation readiness.