Secure communication

Confidential communication rests on symmetric encryption: Alice and Bob hold a shared secret key K and use a fast cipher such as AES to encrypt and decrypt with it. That part is settled; the open problem is key distribution — getting the same K to both parties over a public network without an eavesdropper, Eve, obtaining a copy. Quantum key distribution is one answer to that problem; understanding where it fits means first seeing the alternatives.

The quantum threat falls on key distribution, not on the cipher itself. Grover's algorithm speeds up brute-force key search only quadratically — about 2⁶⁴ steps for AES-128 rather than 2¹²⁸ — but those steps are essentially serial and the parallel form of Grover barely helps, so under any realistic limit on how deep a quantum computation can run, detailed circuit estimates put the real cost of an AES-128 key search far above 2⁶⁴.^{Grassl et al. 2016}^{Jaques et al. 2020} NIST's standing assessment is that Grover gives little practical advantage against AES, that AES-128 likely stays secure for decades, and that symmetric encryption needs at most a doubling of key size — with AES-256 the choice for long-lived data.^{Chen et al. 2016}

Three ways to distribute a shared key

Symmetric encryption needs a shared key K. Alice encrypts with it, the ciphertext crosses the public channel past Eve, and Bob decrypts with the same key. Classical public-key agreement (RSA, ECDH) is broken by Shor's algorithm on a cryptographically-relevant quantum computer; ML-KEM and QKD are the two responses — one keeps the computational model and changes the mathematics, the other moves the security onto physical law.

Three ways deliver that key, and they differ in what their security rests on:

Classical public-key agreement (RSA, ECDH). Both sides derive a shared key from public values exchanged over the open channel. Security rests on the computational hardness of factoring or the discrete logarithm — both of which a cryptographically-relevant quantum computer (CRQC) solves in polynomial time with Shor's algorithm, breaking them.^{Shor 1997}
Post-quantum cryptography (ML-KEM, NIST FIPS 203). The same public-channel key agreement, rebuilt on a lattice problem with no known efficient quantum attack — a software upgrade to the existing model.^{Technology 2024}
Quantum key distribution (BB84). Carries key material on single quantum states,^{Bennett et al. 1984} so its security rests on physics — the no-cloning theorem^{Wootters et al. 1982} and the disturbance any measurement imposes on a quantum state — rather than on an assumption about an adversary's computing power. An eavesdropper who intercepts the photons raises the error rate and is detected.^{Pirandola et al. 2020}

ML-KEM and QKD are the two responses to the quantum threat against classical public-key cryptography: one changes the mathematics, the other changes the trust basis to physical law. QKD is the response that needs a quantum network — a quantum channel between the endpoints and, over distance, trusted nodes or repeaters.

Quantum key distribution (QKD)

QKD is the only application of quantum networking with commercial deployment today. Two paradigm families: prepare-and-measure protocols (BB84 and its variants, with decoy states for security against photon-number-splitting attacks) where Alice prepares states and Bob measures; and entanglement-based protocols (BBM92, Ekert91) where a shared Bell pair is the resource. Variants address specific operational constraints: Measurement-Device-Independent QKD (MDI-QKD) puts the trust in the source and removes detector side-channel attacks; Twin-Field QKD (TF-QKD) scales the key rate as √η rather than η, doubling effective reach, and now holds the fibre-distance record at 1002 km ^{Liu et al. 2023}. A separate research thread, High-Dimensional QKD (HD-QKD), encodes each photon in a qudit (d > 2, via time-bin or orbital-angular-momentum modes) to raise bits-per-photon and noise tolerance ^{Islam et al. 2017} — still academic; no commercial deployments.

QKD requires the lowest fidelity threshold of any quantum-network application — ~0.85 raw is workable after error correction and privacy amplification, and field-deployed systems run reliably between metropolitan-scale endpoints. The bulk of vendor activity in quantum networking is QKD ^{Kumar et al. 2025}.

For the broader set of network-consuming applications — distributed and blind quantum computing, networked sensing, position verification, multiparty consensus — see the applications subject.