What is QKD — and does your company need it?

Quantum key distribution is the piece of the quantum industry a security vendor is most likely to pitch next — hardware, physics, and the word “unhackable” in the deck. This post is the decision record: what QKD is, what six security agencies have published about it (NSA, Aug 2021; UK NCSC, Mar 2020; the French, German, Dutch and Swedish agencies jointly, Jan 25, 2024), what is physically deployed as of today, and the gates a company should clear before spending anything on it.

What is QKD, exactly?

QKD is a hardware technique for agreeing secret keys — not for encrypting data. Two fixed endpoints exchange single photons over a dedicated optical channel; quantum mechanics (the no-cloning theorem) makes eavesdropping on that exchange physically detectable, so the two ends can distill a shared key and know whether someone listened (protocol family BB84 and successors — see the agency papers below for the standard description: NCSC Mar 2020, joint paper Jan 2024). The data itself still travels under ordinary symmetric encryption; QKD only replaces the key-agreement step, and only on that one link.

Two boundaries the marketing tends to blur. QKD is not post-quantum cryptography: PQC is new math running as software on the network you already have. And QKD is not quantum computing: it belongs to the communications branch of quantum technology — a sibling of the sensing branch whose real 2025 revenue we tabulated in our quantum sensors verdict, and unrelated to the machines whose advantage scoreboard Rosetta Quantum keeps at zero.

How is QKD different from post-quantum cryptography?

They answer the same threat — a future cryptographically relevant quantum computer running Shor's algorithm — from opposite directions. PQC swaps the mathematics inside the protocols you already run: NIST finalized FIPS 203, 204 and 205 on August 13, 2024, and our standards-clock post tracks that migration. QKD swaps the physical channel instead, and that swap is expensive in three ways the agency documents keep returning to (NSA Aug 2021; NCSC Mar 2020; joint paper Jan 2024):

Authentication. A QKD link cannot authenticate itself: without a classical authentication layer (pre-shared keys or, in practice, PQC), it is open to man-in-the-middle attack. Both NSA and NCSC list this first — the hardware still needs the software fix it is sold as replacing.

Coverage. QKD secures one fixed point-to-point link. PQC covers TLS sessions, VPNs, signatures, firmware updates and stored data across arbitrary networks — the actual attack surface of a company.

The clock. “Harvest now, decrypt later” applies to traffic crossing ordinary networks today (what the attack would take, in numbers: RSA-2048 and Bitcoin's ECC). A QKD box on one link does nothing for everything else already being recorded.

What do security agencies actually say?

Zero of the six Western security agencies with published QKD positions that Rosetta Quantum tracks recommend it as a primary quantum-safe control — all six point to post-quantum cryptography first. These are positions about a technology class, published by the agencies themselves and linked per row below; none of them disputes the physics. What they dispute is engineering maturity, assurance and cost.

The newest of these positions is from March 2025. If any of the six changes, this verdict will be re-dated and re-published.

What is actually deployed in the real world?

Real QKD networks exist, ship keys daily, and are large — and every long-distance one runs through trusted relays, which is precisely the weakness the agencies flag. China operates the largest deployment: a carrier-grade network reported at over 12,000 km of fiber with 145 backbone nodes across roughly 80 cities (npj Quantum Information, 2025), built on the Beijing–Shanghai backbone — 2,032 km, 32 trusted relay nodes, opened September 2017 — and a 4,600 km integrated space-ground network (Chen et al., Nature 589, 2021). At each trusted relay the key exists in classical form, so every relay is a room that must be physically guarded: the security reduces from “physics” to “who controls 32 rooms”.

In Europe the numbers are smaller and dated 2026: a 303 km QKD link over live Swedish telecom fiber with one trusted node (published Jun 4, 2026); EU coordination mandates PETRUS2 and HarmoniQCI awarded July 14, 2026 to unify 26 fragmented national QKD testbeds; and Eagle-1, Europe's first QKD satellite, which will launch — the plan says late 2026 or early 2027 — while EuroQCI will aim for operational status in 2027. Those last two lines are plans, and they stay in the future tense until they happen. Micius, the satellite that started the field in August 2016, reentered the atmosphere in late January 2026 after nearly a decade in orbit.

When would QKD make sense for a company?

Almost never as the first move — and that ordering comes from the agencies, not from Rosetta. Four gates before a QKD pilot is rational: (1) your PQC migration is underway, because every published agency position puts PQC first; (2) the asset is a fixed point-to-point link you control both ends of — a metro data-center interconnect, not “the network”; (3) your threat model justifies defense-in-depth on top of PQC, which is the only framing the January 2024 joint paper leaves open; and (4) you accept that no mature certification scheme yet exists against implementation attacks on QKD hardware — the joint paper's “security maturity” objection. A telecom, national lab or contractor inside EuroQCI or a national program plays by different rules: those programs exist to mature the technology, and participating is the point. For everyone else, the honest sequencing in 2026 is PQC now, QKD on the watch-list.

What should your company do this year instead?

Run the PQC clock, not a QKD pilot. The NCSC's published timeline (Mar 20, 2025) is the concrete version: complete a cryptographic discovery and migration plan by 2028, execute the highest-priority migrations by 2031, and finish by 2035. Inventory where your cryptography lives, ask vendors for their FIPS 203/204/205 roadmaps, and treat long-lived secrets that cross networks today as already exposed to harvest-now-decrypt-later. Scope note: Rosetta has not measured any QKD hardware in-house — this post is the documented record of published positions and deployments, not a bench verdict. If a QKD link ever goes on our bench, the numbers will be published raw, win or lose.

What we don't know

• Whether a certification scheme for QKD implementations will mature, and when — the January 2024 joint paper calls current assurance insufficient, and European standardization work continues.
• Whether Eagle-1 will make its late-2026/early-2027 launch window, and what its in-orbit key rates will be.
• The unit economics of the Chinese network — per-link cost and utilization are not public in a form we can audit.
• Whether any of the six agency positions will change as the technology matures; the newest is from March 2025, and we will re-verify all six when this verdict is refreshed.
• What we would find if we benchmarked QKD hardware ourselves — we have not, and nothing in this post is a Rosetta measurement.

Rosetta Quantum publishes verdicts with raw, reproducible data and dates on every claim. This is educational content, not a product claim.