Post-quantum cryptography and quantum key distribution address the same strategic threat through different systems.
Post-quantum cryptography, or PQC, replaces vulnerable classical public-key algorithms with new algorithms designed to resist known quantum attacks. Quantum key distribution, or QKD, uses quantum states to establish shared keys and detect interception.
For most organizations, PQC is the migration path. QKD fits narrower environments where specialized optical hardware, controlled links, and a large operating budget make sense.
What threat are both approaches addressing?
Shor's algorithm would threaten widely used public-key systems such as RSA and elliptic-curve cryptography on a sufficiently large fault-tolerant quantum computer. An attacker also might record encrypted traffic now and decrypt it later. Long-lived secrets therefore face risk before a cryptographically relevant quantum computer exists.
PQC and QKD do not protect the same layer in the same way. PQC replaces mathematical key exchange and digital signatures inside software and network protocols. QKD produces shared symmetric keys across a quantum communication link. Applications still need authentication, endpoint security, key management, and protected data storage.
How post-quantum cryptography works
PQC runs on ordinary computers, servers, phones, and network devices. It uses classical mathematics based on problems such as lattice learning, hash inversion, or code decoding. Security rests on resistance to known classical and quantum algorithms, not on a claim of information-theoretic security.
NIST's standardized PQC families include ML-KEM for key establishment, ML-DSA for digital signatures, and SLH-DSA as a hash-based signature option. Implementations still need careful review. Larger keys, larger signatures, different performance profiles, and protocol changes affect bandwidth and software design.
PQC fits broad networks because deployment follows a software and hardware upgrade path. Teams inventory cryptographic use, replace vulnerable primitives, test interoperability, update certificates and firmware, and keep algorithm agility for future changes.
How QKD works
QKD sends quantum states through an optical link. In a simplified prepare-and-measure protocol, the sender and receiver compare selected measurement information over an authenticated classical channel. Interception changes observable statistics, so the parties estimate a quantum bit error rate and reject a compromised session.
QKD does not send application data directly. It produces shared symmetric key material. A separate authenticated channel remains necessary, and authentication normally relies on classical cryptography or pre-shared credentials.
QKD hardware includes photon sources, detectors, optical components, timing systems, key-management software, and link monitoring. Fiber loss limits distance. Longer networks need trusted relay nodes, quantum repeaters, or other network architectures. Trusted relays expand the attack surface because each relay handles key material.
Direct comparison
| Question | PQC | QKD |
|---|---|---|
| Main requirement | Software and compatible hardware | Dedicated quantum optical equipment |
| Network scope | Internet-scale protocols | Specific optical links |
| Key protection | Computational assumption | Quantum channel plus implementation security |
| Authentication | Digital signatures or other classical methods | Still required through an authenticated channel |
| Deployment path | Firmware, libraries, certificates, protocols | Fiber, optics, detectors, key-management systems |
| Distance limits | Network and protocol limits | Optical loss and link architecture |
| Main cost | Migration, testing, and larger messages | Equipment, installation, operations, and link upgrades |
| Best fit | General enterprise and government migration | Specialized high-value links and research networks |
The table describes system properties, not a guarantee for one vendor's product.
QKD does not replace PQC
QKD does not protect endpoints from malware, insider access, bad randomness, detector flaws, denial of service, or compromised key-management servers. A secure optical link still terminates at computers with ordinary software and hardware.
QKD also does not solve digital signatures. Organizations still need authenticated software updates, certificates, identity systems, and signed transactions. PQC supplies those signatures. QKD does not.
PQC also has limits. A bad implementation, weak randomness, exposed private key, or protocol error defeats a mathematically strong algorithm. Quantum resistance does not remove standard security work.
A practical decision path
Start with a cryptographic inventory. Find RSA, elliptic-curve key exchange, elliptic-curve signatures, certificate authorities, VPNs, device firmware, backups, embedded systems, and long-lived archived data.
Next, migrate high-risk public-key uses to standardized PQC algorithms or approved hybrid modes. Test message sizes, latency, certificate chains, hardware support, and failure recovery. Record data with long secrecy requirements first.
Consider QKD only after a specific link has a threat model requiring its properties and a budget for dedicated infrastructure. Confirm optical path quality, endpoint security, relay trust, key-management integration, maintenance, and fallback behavior.
For most teams, the answer is PQC first. QKD is a specialized addition, not a general substitute. Our post-quantum cryptography guide, migration deadline guide, and quantum networking overview cover the surrounding work.