The HM-QCT protocol, presented by Mazzoncini et al. in 2025, uses a unique feature of quantum information to achieve quantum key distribution (QKD) with secret-key rates beyond standard constructions. The protocol has been designed in the hybrid quantum-computational time-lock (QCT) security model which imposes two independent (but related) restrictions on the attacker: (1) a computationally secure encryption scheme which a successful attacker must break within a narrow timeframe and (2) an assumption that the attacker can only store quantum information with low fidelity. We first review the protocol and its two-assumption model by presenting, in explicit form, the two natural "harvest now, decrypt later" strategies against it, one using quantum memory and one using classical memory. We show how each is excluded by exactly one of the two assumptions, so that harvesting resistance rests on their conjunction and on the presumed existence of a technological gap: the adversary's quantum memory must decohere much faster than the time it takes to break the short-term encryption. Finally, we introduce HM-PRF , a variant that replaces the short-term encryption with a pseudorandom function (PRF) , evaluated locally. By eliminating the transmission of enciphered classical information, the adversary does not need to race an impending expiry event. We compare the security of our construction against the original and argue that our PRF-based assumption yields a more realistic adversary. It simply requires the existence of one-way functions rather than a predicted lasting limitation of quantum computation and memory technology.
The HM-QCT protocol, presented by Mazzoncini et al. in 2025, uses a unique feature of quantum information to achieve quantum key distribution (QKD) with secret-key rates beyond standard constructions. The protocol has been designed in the hybrid quantum-computational time-lock (QCT) security model which imposes two independent (but related) restrictions on the attacker: (1) a computationally secure encryption scheme which a successful attacker must break within a narrow timeframe and (2) an assumption that the attacker can only store quantum information with low fidelity. We first review the protocol and its two-assumption model by presenting, in explicit form, the two natural "harvest now, decrypt later" strategies against it, one using quantum memory and one using classical memory. We show how each is excluded by exactly one of the two assumptions, so that harvesting resistance rests on their conjunction and on the presumed existence of a technological gap: the adversary's quantum memory must decohere much faster than the time it takes to break the short-term encryption. Finally, we introduce HM-PRF , a variant that replaces the short-term encryption with a pseudorandom function (PRF) , evaluated locally. By eliminating the transmission of enciphered classical information, the adversary does not need to race an impending expiry event. We compare the security of our construction against the original and argue that our PRF-based assumption yields a more realistic adversary. It simply requires the existence of one-way functions rather than a predicted lasting limitation of quantum computation and memory technology.
We introduce an explicit construction for a key distribution protocol in the Quantum Computational Timelock (QCT) security model, where one assumes that computationally secure encryption may only be broken after a time much longer than the coherence time of available quantum memories.Taking advantage of the QCT assumptions, we build a key distribution protocol called HM-QCT from the Hidden Matching problem for which there exists an exponential gap in one-way communication complexity between classical and quantum strategies.We establish that the security of HM-QCT against arbitrary i.i.d. attacks can be reduced to the difficulty of solving the underlying Hidden Matching problem with classical information. Legitimate users, on the other hand, can use quantum communication, which gives them the possibility of sending multiple copies of the same quantum state while retaining an information advantage. This leads to an everlasting secure key distribution scheme over n bosonic modes. Such a level of security is unattainable with purely classical techniques. Remarkably, the scheme remains secure with up to O ( n log ( n ) ) input photons for each channel use, extending the functionalities and potentially outperforming QKD rates by several orders of magnitudes.
Extending the functionality and overcoming the performance limitation of QKD requires either quantum repeaters or new security models. Investigating the latter option, we introduce the Quantum Computational Timelock (QCT) security model, assuming that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. These two assumptions, namely short-term computational security and noisy quantum storage, have so far already been considered in quantum cryptography, yet only disjointly. A practical lower bound on time, for which encryption is computationally secure, can be inferred from assumed long-term security of the AES256 encryption scheme (30 years) and the value of coherence time in experimental demonstrations of storage and then retrieval of optically encoded quantum information, at single-photon level range from a few nanoseconds to microseconds. Given the large gap between the upper bound on coherence time and lower bound on computational security time of an encryption scheme, the validity of the QCT security model can be assumed with a very high confidence today and also leaves a considerable margin for its validity in the future. Using the QCT security model, we propose an explicit d-dimensional key agreement protocol that we call MUB-Quantum Computational Timelock (MUB-QCT), where a bit is encoded on a qudit state using a full set of mutually unbiased bases (MUBs) and a family of pair-wise independent permutations. Security is proved by showing that upper bound on Eve's information scales as O(1=d). We show MUB-QCT offers: high resilience to error (up to 50% for large d) with fixed hardware requirements; MDI security as security is independent of channel monitoring and does not require to trust measurement devices. We also prove the security of the MUB-QCT protocol, with multiple photons per channel use, against non-adaptive attacks, in particular, proactive MUB measurement where eve measures each copy in a different MUB followed by post-measurement decoding. We prove that the MUB-QCT protocol allows secure key distribution with input states containing up to O(d) photons which implies a significant performance boost, characterized by an O(d) multiplication of key rate and a significant increase in the reachable distance. These results illustrate the power of the QCT security model to boost the performance of quantum cryptography while keeping a clear security advantage over classical cryptography.
Extending the functionality and overcoming the performance limitation under which QKD can operate requires either quantum repeaters or new security models. Investigating the latter option, we introduce the \textit{Quantum Computational Hybrid} (QCH) security model, where we assume that computationally secure encryption may only be broken after time much longer than the coherence time of available quantum memories. We propose an explicit d-dimensional key distribution protocol, that we call MUB-\textit{Quantum Computational Timelock} (MUB-QCT) where one bit is encoded on a qudit state chosen among d+1 mutually unbiased bases (MUBs). Short-term-secure encryption is used to share the basis information with legitimate users while keeping it unknown from Eve until after her quantum memory decoheres. This allows reducing Eve's optimal attack to an immediate measurement followed by post-measurement decoding. \par We demonstrate that MUB-QCT enables everlasting secure key distribution with input states containing up to O(d) photons. This leads to a series of important improvements when compared to QKD: on the functional side, the ability to operate securely between one sender and many receivers, whose implementation can moreover be untrusted; significant performance increase, characterized by a O(d) multiplication of key rates and an extension by 25km×log(d) of the attainable distance over fiber. Implementable with a large number of modes with current or near-term multimode photonics technologies, the MUB-QCT construction has the potential to provide a radical shift to the performance and practicality of quantum key distribution.
The rapid advancement of quantum computing, exemplified by Shor’s and Grover’s algorithms, poses an existential threat to the Rivest-Shamir-Adleman algorithm, elliptic curve cryptography, and symmetric encryption. This paper presents a critical and integrative review of two defensive paradigms, quantum key distribution and post-quantum cryptography, covering studies published from 2020 to 2026 and mapped to four objectives spanning quantum threats, quantum key distribution viability, standardization, and hybrid synergies. Quantum key distribution protocols offer information-theoretically secure key distribution, though twin-field quantum key distribution’s 833.8 kilometer distance record comes at secure key rates as low as 0.014 bits per second. Post-quantum cryptography algorithms spanning lattice-based, code-based, hash-based, multivariate, and isogeny-based schemes offer unlimited range but rest on unproven mathematical assumptions, illustrated by the 2022 classical break of the Supersingular Isogeny Diffie-Hellman scheme and a 2024 quantum attack on the Rainbow signature scheme. Following the National Institute of Standards and Technology’s 2024 finalization of its primary standards, with the Hamming Quasi-Cyclic scheme subsequently added as a backup key encapsulation mechanism, this review identifies five hybrid architectural patterns combining quantum key distribution and post-quantum cryptography, evaluates their maturity from proposed to experimentally validated, and quantifies their cost: hybrid throughput collapses by two orders of magnitude once quantum key distillation is incorporated. Comparative benchmarking, an architecture diagram, and a thematic analysis identify quantum repeater networks, long-term cryptanalysis, and security-performance trade-off frameworks as critical research gaps, positioning hybrid integration as the most promising pathway toward secure communications.
In contrast to classical public-key cryptosystems, where the security of encoded messages relies on on computational assumptions, Quantum Key Distribution (QKD) enables two distant parties to establish a shared secret key that, when combined with a one-time pad, provides information-theoretically secure encryption, provided that the QKD protocol is supported by a rigorous security proof. In the last decades, security proofs robust against a wide range of eavesdropping strategies have established the theoretical soundness of several QKD protocols. However, most proofs are based on idealized models of the physical systems involved in such protocols and often include assumptions that are not satisfied in practical implementations. This mismatch creates a gap between theoretical security guarantees and actual experimental realizations, making QKD protocols vulnerable to attacks. To ensure the security of real-world QKD systems, it is therefore essential to account for imperfections in security analyses. In this article, we present an overview of recent analytical and numerical developments in QKD security proofs, which provide a versatile approach for incorporating imperfections and re-establishing the security of quantum communication protocols under realistic conditions.
The emergence of quantum computing has provided new paradigms for cryptography. On the one hand, it poses significant new threats to existing classically cryptographic systems, requiring the community to define new security models that capture what a quantum adversary can do. On the other hand, it gives us new tools to design cryptographic protocols, with weaker assumptions than in the classical world, or even protocols that are impossible classically. In this survey, we first give an overview of new security definitions for classical cryptography, considering quantum adversaries who can either only use local quantum computation (post-quantum security), or even send quantum messages and in particular have access to oracle in superposition (quantum security). We explore these new notions through the examples of commitments, zero-knowledge proofs, encryption, and signatures. Then, we present what is arguably the most famous application of quantum cryptography: quantum key distribution (QKD) protocols that take advantage of unique properties of quantum mechanics to provide secure communication unconditionally. We also explore cryptography beyond QKD, focusing on unclonable cryptography: a family of cryptographic functionalities, built with quantum states, and designed to be resistant to counterfeit by leveraging the “no-cloning” theorem. We examine in particular quantum money, but also the recent notions of unclonable encryption and copy-protection, including related variants. By presenting a comprehensive survey of these topics, this paper aims to provide a thorough understanding of the current landscape and future potential of quantum cryptography.