Quantum Key Distribution: What Is It and How Does It Work?

In September, a team in India sent encryption keys across 5.56 kilometers of open air, with no fiber between the two ends. The link kept the quantum bit error rate below 5% and generated secure keys at 230 to 260 bits per second [source].  

The security implications were impressive. 

The keys were passed to a platform running post-quantum cryptography (PQC) and quantum random number generation (QRNG), intended to keep data protected even if the quantum link dropped out.  

Put another way, the engineers trusted quantum physics to move the keys while relying on post-quantum math as a safety net. 

This recent example is just one slice of what’s becoming a global trend. Romania’s national network currently runs 36 quantum-secured links across more than 1,500 kilometers, accounting for more than 20% of the terrestrial quantum communications infrastructure in Europe.  

In China, a telecom operator in Macau launched an IP network with quantum key distribution (QKD), and plans to sell quantum-secured private lines to government and enterprise customers [source].  

As governments and carriers make QKD a reality, security leaders need to understand what it does and where it fits in. 

Key Exchange Comes with an Expiration Date 

Most encrypted traffic today relies on public-key algorithms such as RSA and elliptic-curve cryptography to establish a shared secret. That holds up now because classical computers can’t quickly solve the underlying math problems, but it will change when a capable quantum computer starts running Shor’s algorithm. 

And attackers don’t even need to wait for that machine to exist to start causing havoc. 

They can already capture encrypted data and store it until quantum computers can decrypt it. These “harvest now, decrypt later” schemes put sensitive data like health records, financial info, trade secrets and secret government communications at risk now, because the data will remain sensitive for years. 

Ultimately, every encrypted session depends on how the key was exchanged; if that breaks down, so does everything the key was supposed to protect. 

Here’s How Quantum Key Distribution Works 

Quantum key distribution uses physics instead of math. Two parties can exchange keys encoded in the quantum states of individual photons. The most common approach to this is the BB84 protocol, which works in four steps: 

1. The sender transmits a stream of photons, with each polarized in one of two bases chosen at random. 
2. The receiver measures each photon, also choosing a basis at random. 
3. Over a regular channel, both sides compare which bases they used without revealing the actual values. Only the bits where the bases matched are kept. 
4. A sample of those bits is checked for errors. 

The main reason it’s so secure is that measuring a quantum state disturbs it. If someone intercepts the photons, it will be reflected in the error rate, and both parties can discard the key and start over. A low error rate means the key is clean. 

QKD doesn’t carry the business data itself. The quantum channel only distributes the key material; then the actual traffic moves over conventional channels. 

Both sides still need classical authentication to confirm they’re talking to each other and not an attacker. QKD alone doesn’t guarantee a service is secure. Protection also depends on how encryption is implemented, how users are authenticated and how well endpoints are secured. 

As it stands, pairing QKD with post-quantum cryptography makes sense. NIST currently has three PQC standards finalized, including ML-KEM for key encapsulation and ML-DSA and SLH-DSA for digital signatures. Since these algorithms can run on existing hardware, QKD can protect an organization’s highest-value links while PQC covers everything else. 

Each approach produces keys that must be generated, stored, rotated and governed. 

This is Where Fortanix Fits 

Quantum-safe security starts with knowing where your cryptography lives in the first place. Most enterprises can’t currently answer that question because they have keys scattered across cloud accounts, on-prem data centers, databases and applications, with no central inventory. 

Fortanix Key Insight automatically scans hybrid multicloud environments for quantum-vulnerable keys, telling teams where each key lives, how it’s used and which algorithm protects it. PQC Central then turns this information into a prioritized PQC migration plan. 

Meanwhile, Fortanix Data Security Manager (DSM) supports the full suite of CNSA 2.0 algorithms, as well as NIST’s finalized PQC algorithms. It provides organizations with “crypto-agility,” the ability to easily adopt new algorithms without replacing their key management system or HSM deployment. 

Fortanix is also ahead of the game in bringing quantum physics to key generation. DSM can ingest entropy from quantum random number generators and blend it with internal hardware entropy, aligning with NIST’s three-part SP 800-90 framework. Signed, tamper-evident logs record where the entropy came from and when each key was generated, providing reliable audit logs. Keys that travel over a QKD link or a PQC-protected channel are managed under a centralized policy. 

Build a Quantum-Safe Strategy That Lasts 

Quantum key distribution is becoming a reality, with global carriers beginning to roll it into national networks. It uses physics to make digital eavesdropping detectable but works best as one component of a broader strategy that includes post-quantum algorithms, strong key management and full visibility into your cryptographic inventory. 

A long-term strategy starts with knowing where every key in your organization is and how quickly you could replace those vulnerable to quantum computers. Fortanix can help with both; contact us today to learn more about becoming post-quantum ready.