Can QKD and Post-Quantum Cryptography Work Together?

Quantum key distribution (QKD) and post-quantum cryptography (PQC) get pitched as rivals, one physics and one math, fighting to secure the world against quantum computers, which is the wrong framing. They guard different layers, and some commercial systems already combine them. QKD also needs a separate authentication step to stay safe, and PQC is one natural way to supply it. Layering the two helps in a small number of places, and a QKD-plus-PQC communications stack doesn’t by itself protect your on-chain signature.

Two tools for two different layers

Post-quantum cryptography replaces the quantum-vulnerable parts of public-key cryptography. It provides key-establishment mechanisms and digital signatures that run as software on the computers you already own.

Quantum key distribution does something narrower. It uses specialized hardware to exchange quantum optical signals, often weak laser pulses and in some protocols single photons, between two endpoints, and it gives those endpoints a physics-based way to detect interception or excess disturbance under the protocol’s assumptions.

In other words, one is math you install, the other is equipment you wire between two sites. They fail in different ways, and that difference is the reason to run them together.

QKD needs authentication to be safe

One point gets lost in the ‘versus’ framing. QKD can’t run securely on its own. The quantum part hands two endpoints a shared key, but they still compare notes over an ordinary classical channel, and that channel has to be authenticated. Without authentication, an attacker can impersonate both endpoints and run the entire exchange from the middle undetected. QKD gives you no protection against that by itself.

So every QKD link needs a separate way to prove the endpoints are who they claim to be. That can come from a pre-shared symmetric key, a conventional signature, a post-quantum signature, or a hybrid of these. Post-quantum signatures are attractive when an operator wants authentication that also resists a future quantum computer, though they’re one option among several, not a requirement as part of QKD. Either way, QKD doesn’t remove the need for conventional authentication and key-management infrastructure. It plugs into that infrastructure, which is another reason the rivalry framing misleads.

Why you’d layer them: insurance

Authentication aside, there’s a second reason to run both.

PQC’s security rests on math problems staying hard for a quantum computer to crack. That’s a well-founded assumption, but a future cryptanalytic breakthrough could still weaken it. QKD’s security rests on physics, though physical devices carry implementation flaws and side channels that can undercut the theory.

Feed a QKD-derived secret and a PQC-derived secret into a vetted key combiner, bind them to the same authenticated session, and the intended result is a session key that stays secret as long as one input stays secret and the combiner’s assumptions hold. This guards against the failure of a single mechanism. It won’t save you if the endpoint itself is compromised. Shared randomness that undermines both mechanisms, or careless handling of the final session key, can defeat it too.

Where it fits, and where it doesn’t

This layering pays off in a few settings only. It needs specialized hardware and dedicated or carefully engineered optical links, sometimes sharing a fiber with ordinary traffic on separate wavelengths. That suits fixed, high-value connections, like a bank wiring two of its own data centers, or a defense link guarding secrets that must stay private for decades. It isn’t a practical general-purpose replacement for key establishment across the open internet, where billions of devices reach servers they’ve never met.

Standards and policy are still catching up, and they’re more cautious than the marketing. ETSI has standardized hybrid key establishment that combines a classical algorithm with a post-quantum one. Its main constructions cover elliptic-curve Diffie-Hellman and post-quantum KEMs rather than QKD, though the specification lets QKD-derived material serve as an optional pre-shared input. France’s ANSSI and Germany’s BSI, together with their Dutch and Swedish counterparts, published a joint position in 2024 calling today’s QKD a niche technology with unresolved security and deployment limits, and telling organizations to prioritize PQC.

BSI did certify a Common Criteria protection profile for prepare-and-measure QKD modules that same year, which sets evaluation requirements rather than blessing any product. The US National Security Agency goes further for its National Security Systems, recommending quantum-resistant classical algorithms over QKD. So, combining the two stays a specialist option. For most operators, PQC by itself is the plan.

What it means for you

If you’re crypto holder, none of this changes the practical answer. QKD doesn’t produce digital signatures, so it can’t sign a blockchain transaction. A QKD-and-PQC layer on a custodian’s private links between data centers doesn’t touch the rules a chain uses to validate a transaction either. Post-quantum signatures are a different story.

Schemes like ML-DSA and SLH-DSA are built to sign, and a blockchain can adopt them, but only if its own protocol adds support. So protecting ownership against a quantum computer comes down to the chain moving to a post-quantum signature scheme. A QKD link, with or without PQC alongside it, supplies key material that other systems use to secure communications between two machines. It doesn’t change what proves you own your coins.

Bottom line

All things considered, the “QKD versus PQC” debate asks the wrong question. For most organizations, post-quantum cryptography is the practical migration path, and the agencies above prioritize it. QKD can add a second layer on a small number of fixed, high-value links, and its classical channel has to be authenticated, sometimes with post-quantum signatures and sometimes not.

When QKD and PQC both contribute key material, the system needs a sound key combiner and secure endpoint handling. What this communications-layer stack doesn’t do is protect an on-chain signature. That needs the blockchain itself to adopt post-quantum signatures.