Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Log inSign up
Challenges
Datasets
Workspaces
Papers
Discussions
Leaderboard
Blog
Job Board
Q3AS

© 2026 Aqora Quantum S.A.S.

TermsPrivacyLegal Notice

International Conference on Quantum Communications, Networking, and Computing (QCNC)

Implementation of a Hybrid QKD/PQC Network and Applications

Christoph Döberl, Wolfgang Eibner, Hannes Hübel, Manuela Kos, Florian Kutschera, Stephan Laschet, Andreas Neuhold, Sebastian Ramacher, Philipp Stanzer, Werner Strasser

Published Apr 6, 2026• 0 citations
Publisher

Abstract

The European Quantum Communication Infrastructure (EuroQCI) initiative is fostering the deployment of national quantum key distribution (QKD) testbeds across the European Union. In this context, we report on the design, implementation, and evaluation of the Austrian testbed, with a particular focus on advances in key management and applicationlevel integration of QKD. First, we introduce a hybrid key management system (KMS) that combines QKD-derived keys in a decentralized architecture with post-quantum authenticated key exchange, enabling end-to-end hybrid keys while reducing trust assumptions in intermediate nodes. Second, we present three QKD-enabled applications: (i) a secure secret-sharing-based storage system leveraging QKD-protected share distribution, (ii) a QKD-integrated extension of Jitsi employing ETSI GS QKD 014 group keys to reduce overhead in multi-party communication, and (iii) a hybrid QKD/PQC WireGuard-based VPN enabling QKD-secured HSM backup operations without requiring modifications to proprietary HSM protocols. Finally, we describe the deployment of these solutions in a national network comprising a four-node metropolitan testbed and a 200 km long-distance link with trusted nodes, and provide performance measurements for both the network and the hybrid KMS. Together, these results demonstrate the feasibility of integrating QKD into heterogeneous applications and hybrid cryptographic infrastructures.

DOI
10.1109/qcnc69040.2026.00025

Related papers

Hybrid QKD & PQC Protocols implemented in the Berlin OpenQKD testbed

Marc Geitz, Ronny Döring, Ralf-Peter Braun

This paper introduces several hybrid protocols based on Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) implemented in the OpenQKD testbed Berlin to improve the security of the QKD nodes. Instead of following the ETSI QKD014 standard of a key management system based on classical security, i.e., RSA authentication and ECC encryption, we implemented a quantum-secure Key Management System based on PQC Key Encapsulation and Signature algorithms. The hardware and the software components of the QKD network authenticate themselves using a PQC trust chain and Pre-Shared Secrets, wherever supported. The communication between QKD nodes, as for the encryption key forwarding process, is hardened by Post-Quantum Cryptography to prevent cryptographic key exposure on intermediate network nodes. Using the two implemented key exchange processes, based on QKD and PQC, applications are able to request any kind of encryption key from the Key Management System and combine them arbitrarily to compute more reliable cryptographic keys.

International Conference on Frontiers of Signal Processing (ICFSP)•Oct 23, 2023•20 citations

PQC-Enhanced QKD Networks: A Layered Approach

Paul Spooren, Andreas Neuhold, Sebastian Ramacher +1 more

We present a layered and modular network architecture that combines Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) to provide scalable end-to-end security across long distance multi-hop, trusted-node quantum networks. To ensure interoperability and efficient practical deployment, hop-wise tunnels between physically secured nodes are protected by WireGuard with periodically rotated pre-shared keys sourced via the ETSI GS QKD 014 interface. On top, Rosenpass performs a PQC key exchange to establish an end-to-end data channel without modifying deployed QKD devices or network protocols. This dual-layer composition yields post-quantum forward secrecy and authenticity under practical assumptions. We implement the design using open-source components and validate and evaluate it in simulated and lab test-beds. Experiments show uninterrupted operation over multi-hop paths, low resource footprint and fail-safe mechanisms. We further discuss the design's compositional security, wherein the security of each individual component is preserved under their combination and outline migration paths for operators integrating QKD-aware overlays in existing infrastructures.

quant-pharXiv:2604.05599•International Conference on Quantum Communications, Networking, and Computing (QCNC)•Apr 8, 2026•1 citation

Secure Quantum Key Distribution Protocol for Hybrid Classical-Quantum Networks

Saiyed Faiayaz Waris, L. Bhagyalakshmi, M. Muni Babu +3 more

The existence of quantum computing presents an existential threat to the traditional cryptographic algorithms, and there is a need to create communication mechanisms that are fundamentally secure. In this regard, the concept of Quantum Key Distribution (QKD) provides information-theoretic security, which is founded on quantum mechanics. Nevertheless, conventional QKD protocols have serious shortcomings such as lack of distance in communication, vulnerability to side-channel attacks, and inability to support the large-scale heterogeneous network. We suggest that HQNet-QKD a Hybrid Quantum Key Distribution framework can help solve these issues by offering a more secure, scalable and future-proof key exchange framework in hybrid classical-quantum networks. To support multi-layered security, the proposed architecture is a network ensuring the smoothness of decoy-state BB84, Measurement-Device-Independent QKD (MDI-QKD), entanglement/twin-field-based QKD with verifiable Secret Sharing (VSS) and Post-Quantum Cryptography (PQC). It provides a complete methodology such as system architecture, mathematical modeling, and end-to-end key synthesis. When used over a distance of 300 km, simulation and testing have shown that HQNet-QKD can achieve up to$2.7 \times$higher secret key rate (SKR) than conventional methods, secret communication at 700 km and resilience to both quantum and classical attacks more than 96%. In addition, the framework guarantees forward secrecy, detector-side immunity, contextbound key derivation, and composability and thus resistant to current and future adversaries. It has a low-computational overhead modular design, making it trivial to deploy in a real world, in applications like quantum-secured 5G backbones, cloud data centers, critical infrastructure, and satellite-based communication systems. The findings make HQNet-QKD a new generation solution to quantum-safe secure communication and the first step towards the implementation of the quantum internet.

IEEE International Conference on ICT in Business Industry & Government (ICTBIG)•Dec 12, 2025•18 citations

Key Management Systems for Large-Scale Quantum Key Distribution Networks

Paul James, Stephan Laschet, Sebastian Ramacher +1 more

The Key Management System (KMS) is an important component in scaling up from link-to-link key generation to large key distribution networks. In this work we provide an overview of a KMS in the context of Quantum Key Distribution Networks (QKDN) and give a thorough summary of the functionality of a KMS in such an application. Beyond classical QKDNs, we discuss Post Quantum Cryptography (PQC) hybridization techniques at the KMS level. These methods add an additional layer of security against quantum computer driven attacks. We also discuss selected topics regarding the development, deployment and operation of components for such security infrastructure. In addition, relevant standards in the realm of Quantum Key Distribution (QKD) are outlined and analyzed. As some of the necessary interfaces have not been standardized, namely the interface between two KMS instances and the interface between the KMS and the Software Defined Network (SDN) Agent, we propose APIs for these two cases. The design of the interface between the KMS and QKD modules is discussed and, considering their resource constraints, a push mode for the ETSI GS QKD 004 standard is proposed. Finally, implementation details of a prototype KMS are outlined and trade-offs are discussed.

International Conference on Availability, Reliability and Security (ARES)•Aug 9, 2023•27 citations

Quantum Key Distribution with Enhanced PQC Validation

Vlad Beraru, Carmen MILEA

Quantum Key Distribution (QKD) provides information-theoretic security based on quantum mechanics, but its practical deployment is limited by its reliance on classical infrastructure and inability to operate as a standalone solution.Recent research emphasizes hybrid approaches that combine QKD with post-quantum cryptography (PQC) to achieve practical and robust security.This paper presents a hybrid key distribution model integrating QKD with the postquantum key encapsulation mechanism.The two independently generated keys are combined to derive a unified shared secret, enhancing resilience against both classical and quantum adversaries.The system is implemented using a simulated quantum environment, enabling the emulation of quantum communication over classical networks.The proposed approach is validated through a secure image transmission use case, demonstrating the correctness of the hybrid key exchange.The results highlight the feasibility of hybrid classical-quantum cryptographic systems as a practical step toward secure communication in emerging quantum network infrastructures.

Informatica Economica•Jun 30, 2026•0 citations

Interconnecting Regional QKD Networks: Hybrid Key Delivery Across Quantum Domains

David Barral, Aitor Brazaola-Vicario, Diego Cifrián +9 more

QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.

arXiv:2604.20376•IEEE Transactions on Quantum Engineering•Jan 1, 2026•0 citations
The European Quantum Communication Infrastructure (EuroQCI) initiative is fostering the deployment of national quantum key distribution (QKD) testbeds across the European Union. In this context, we report on the design, implementation, and evaluation of the Austrian testbed, with a particular focus on advances in key management and applicationlevel integration of QKD. First, we introduce a hybrid key management system (KMS) that combines QKD-derived keys in a decentralized architecture with post-quantum authenticated key exchange, enabling end-to-end hybrid keys while reducing trust assumptions in intermediate nodes. Second, we present three QKD-enabled applications: (i) a secure secret-sharing-based storage system leveraging QKD-protected share distribution, (ii) a QKD-integrated extension of Jitsi employing ETSI GS QKD 014 group keys to reduce overhead in multi-party communication, and (iii) a hybrid QKD/PQC WireGuard-based VPN enabling QKD-secured HSM backup operations without requiring modifications to proprietary HSM protocols. Finally, we describe the deployment of these solutions in a national network comprising a four-node metropolitan testbed and a 200 km long-distance link with trusted nodes, and provide performance measurements for both the network and the hybrid KMS. Together, these results demonstrate the feasibility of integrating QKD into heterogeneous applications and hybrid cryptographic infrastructures.
This paper introduces several hybrid protocols based on Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) implemented in the OpenQKD testbed Berlin to improve the security of the QKD nodes. Instead of following the ETSI QKD014 standard of a key management system based on classical security, i.e., RSA authentication and ECC encryption, we implemented a quantum-secure Key Management System based on PQC Key Encapsulation and Signature algorithms. The hardware and the software components of the QKD network authenticate themselves using a PQC trust chain and Pre-Shared Secrets, wherever supported. The communication between QKD nodes, as for the encryption key forwarding process, is hardened by Post-Quantum Cryptography to prevent cryptographic key exposure on intermediate network nodes. Using the two implemented key exchange processes, based on QKD and PQC, applications are able to request any kind of encryption key from the Key Management System and combine them arbitrarily to compute more reliable cryptographic keys.
We present a layered and modular network architecture that combines Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) to provide scalable end-to-end security across long distance multi-hop, trusted-node quantum networks. To ensure interoperability and efficient practical deployment, hop-wise tunnels between physically secured nodes are protected by WireGuard with periodically rotated pre-shared keys sourced via the ETSI GS QKD 014 interface. On top, Rosenpass performs a PQC key exchange to establish an end-to-end data channel without modifying deployed QKD devices or network protocols. This dual-layer composition yields post-quantum forward secrecy and authenticity under practical assumptions. We implement the design using open-source components and validate and evaluate it in simulated and lab test-beds. Experiments show uninterrupted operation over multi-hop paths, low resource footprint and fail-safe mechanisms. We further discuss the design's compositional security, wherein the security of each individual component is preserved under their combination and outline migration paths for operators integrating QKD-aware overlays in existing infrastructures.
The existence of quantum computing presents an existential threat to the traditional cryptographic algorithms, and there is a need to create communication mechanisms that are fundamentally secure. In this regard, the concept of Quantum Key Distribution (QKD) provides information-theoretic security, which is founded on quantum mechanics. Nevertheless, conventional QKD protocols have serious shortcomings such as lack of distance in communication, vulnerability to side-channel attacks, and inability to support the large-scale heterogeneous network. We suggest that HQNet-QKD a Hybrid Quantum Key Distribution framework can help solve these issues by offering a more secure, scalable and future-proof key exchange framework in hybrid classical-quantum networks. To support multi-layered security, the proposed architecture is a network ensuring the smoothness of decoy-state BB84, Measurement-Device-Independent QKD (MDI-QKD), entanglement/twin-field-based QKD with verifiable Secret Sharing (VSS) and Post-Quantum Cryptography (PQC). It provides a complete methodology such as system architecture, mathematical modeling, and end-to-end key synthesis. When used over a distance of 300 km, simulation and testing have shown that HQNet-QKD can achieve up to2.7×2.7 \times2.7×higher secret key rate (SKR) than conventional methods, secret communication at 700 km and resilience to both quantum and classical attacks more than 96%. In addition, the framework guarantees forward secrecy, detector-side immunity, contextbound key derivation, and composability and thus resistant to current and future adversaries. It has a low-computational overhead modular design, making it trivial to deploy in a real world, in applications like quantum-secured 5G backbones, cloud data centers, critical infrastructure, and satellite-based communication systems. The findings make HQNet-QKD a new generation solution to quantum-safe secure communication and the first step towards the implementation of the quantum internet.
The Key Management System (KMS) is an important component in scaling up from link-to-link key generation to large key distribution networks. In this work we provide an overview of a KMS in the context of Quantum Key Distribution Networks (QKDN) and give a thorough summary of the functionality of a KMS in such an application. Beyond classical QKDNs, we discuss Post Quantum Cryptography (PQC) hybridization techniques at the KMS level. These methods add an additional layer of security against quantum computer driven attacks. We also discuss selected topics regarding the development, deployment and operation of components for such security infrastructure. In addition, relevant standards in the realm of Quantum Key Distribution (QKD) are outlined and analyzed. As some of the necessary interfaces have not been standardized, namely the interface between two KMS instances and the interface between the KMS and the Software Defined Network (SDN) Agent, we propose APIs for these two cases. The design of the interface between the KMS and QKD modules is discussed and, considering their resource constraints, a push mode for the ETSI GS QKD 004 standard is proposed. Finally, implementation details of a prototype KMS are outlined and trade-offs are discussed.
Quantum Key Distribution (QKD) provides information-theoretic security based on quantum mechanics, but its practical deployment is limited by its reliance on classical infrastructure and inability to operate as a standalone solution.Recent research emphasizes hybrid approaches that combine QKD with post-quantum cryptography (PQC) to achieve practical and robust security.This paper presents a hybrid key distribution model integrating QKD with the postquantum key encapsulation mechanism.The two independently generated keys are combined to derive a unified shared secret, enhancing resilience against both classical and quantum adversaries.The system is implemented using a simulated quantum environment, enabling the emulation of quantum communication over classical networks.The proposed approach is validated through a secure image transmission use case, demonstrating the correctness of the hybrid key exchange.The results highlight the feasibility of hybrid classical-quantum cryptographic systems as a practical step toward secure communication in emerging quantum network infrastructures.
QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.