The NIST and NSA position on QKD and Quantum cryptography

There are a number of government-sanctioned institutions in the U.S. that deal with questions around quantum cryptography, quantum encryption, and quantum communication in general. Foremost among them are the NSA and NIST. Both of these bodies have released positions on their view of the future of quantum security.

In a paper entitled “Quantum Key Distribution (QKD) and Quantum Cryptography (QC)” the NSA notes that it does not recommend the use of these technologies in its systems unless certain “limitations” are overcome.

It lists these perceived limitations as:

Quantum key distribution is only a partial solution:

Quantum Key Distribution (QKD) alone does not provide source authentication, requiring additional measures like asymmetric cryptography or preplaced keys. Quantum-resistant cryptography can offer similar confidentiality services with lower costs and a better-understood risk profile.

Quantum key distribution requires special-purpose equipment:

QKD relies on specialized equipment and physical layer communications, making it incompatible with software-based or network-integrated implementations. The need for dedicated fiber connections or free-space transmitters adds complexity and limits flexibility for upgrades.

Quantum key distribution increases infrastructure costs and insider threat risks:

QKD networks often require trusted relays, leading to increased infrastructure costs and heightened insider threat risks. This restricts the range of viable use cases for QKD.

Securing and validating quantum key distribution is a significant challenge:

The practical security of QKD systems depends on hardware and engineering designs rather than theoretical unconditional security from the laws of physics. Validating QKD’s cryptographic security is challenging due to the stringent error tolerance required, and vulnerabilities in specific hardware can undermine its security.

Quantum key distribution increases the risk of denial of service:

The sensitivity of QKD to eavesdroppers also exposes it to the risk of denial of service attacks. This highlights a significant vulnerability in QKD systems.

U.S. Backing Post Quantum Cryptography

Instead of QKD, it recommends “quantum-resistant or post-quantum cryptography (PQC) as a more cost-effective and easily maintained solution than quantum key distribution” until the above “limitations” are overcome.

Is PQC the way forward?

The NSA writes, regarding post-quantum cryptography, or “quantum-resistant algorithms” as they put it, that these algorithms “derive their security through mathematical complexity” and “provide the means for assuring the confidentiality, integrity, and authentication of a transmission—even against a potential future quantum computer.”

QNu Labs and many other OEMs across the world, who have built QKD systems spending a lot of effort and money do not agree with the NSA’s viewpoint. They believe that QKD offers a specific value in terms of unhackable security to the encryption keys which is not possible through any other means. These OEMs have been improving systems over the years and with initial deployments underway, they are getting feedback from the real-world deployments to learn and improve the QKD systems to build viable QKD networks.

McKinsey notes that “PQC solutions are still nascent and because it is impossible to test them against quantum computers that do not yet exist, they haven’t been conclusively proven to protect quantum—or even conventional—threats.” Given that the foundation of PQC algorithms is based on computational complexity, it is theoretically insecure compared to QKD.

What’s more, as has been extensively reported, one of the NIST’s PQC finalists has already had its algorithm cracked and several serious vulnerabilities have been found and reported.   This certainly does not instil confidence in the approach as it indicates that the PQC algorithms will continue to evolve and be replaced by the new algorithms. 

Our take on QKD and Quantum Communications

While QNu Labs tend to agree with the NSA’s opinion that successful QKD adoption is highly implementation-dependent, we and many other OEMs disagree with some of the claimed technical limitations of QKD.

As the QNu Labs’ Armos solution shows – together with the path adopted by Europe, Asia, and Australia – QKD is a viable and essential tool in securing communications in a quantum world. 

Specifically, in response to the NSA points, we believe:

1. “Quantum key distribution is only a partial solution”: PQC cannot guarantee that it will remain safe against future quantum computing power. QKD on the other hand can make this claim. And even more so, QKD and PQC can absolutely coexist. Indeed it is the plan by the EU and others to adopt PQC on top of their QKD networks as a second line of defence.
2. “Quantum key distribution requires special purpose equipment”: specialized equipment is required in communication environments all the time. Solutions such as QNu Labs’ Armos can be placed into racks as standard 2U communication equipment, and can be set up as easily as setting up a switch. What’s more, specialized equipment significantly reduces the scope for attack and manipulation: anyone, anywhere in the world can attempt to break an algorithm with increasing computing power and generative AI tools to help the attacker. Whereas only those with physical access to QKD equipment and special knowledge can even consider interfering with QKD’s secure communication.
3. “Quantum key distribution increases infrastructure costs and insider threat risks”: as with any new technology, the costs related to QKD equipment are coming down dramatically. Many solutions, such as those from QNu Labs simply plug into existing networks, with no additional infrastructure costs required. PQC also has indirect infrastructure costs. The highly compute-intensive algorithms PQC relies on require additional compute and memory resources from existing equipment if they are to work without increasing the latency and throughput of the underlying data pipes. Thus it is unclear if the total cost of ownership (TCO) of PQC is actually higher or lower than QKD. This requires additional research. The insider threat can be mitigated both by special solutions integrated into the QKD systems, as is the case with QNu Labs’ systems; and also through smart multiple path key routing on the network. Of course, PQC solutions are just as susceptible to the insider threat, and perhaps even more so.
4. “Securing and validating quantum key distribution is a significant challenge”: as with any new industry, processes to secure and validate QKD systems will increasingly be available to vendors and users as the industry grows. QNu Labs’ for example, has been working with some of the most demanding government security organizations to test and validate its offerings.
5. “Quantum key distribution increases the risk of denial of service”: Sophisticated QKD systems, such as QNu Labs’ Armos, can run in parallel to the existing network and are in many ways impervious to DoS attacks. What’s more, as QKD generates many more keys than consumed by routers today, router manufacturers can implement fallback options, such as keeping a QKD-generated key buffer to verify that communication continues uninterrupted even if the QKD line breaks. Finally, QKD works out-of-band, further refuting this point.

A recent Forbes article concurs with many of these points, adding the following instructive elements:

• QKD systems authenticate at both ends of the exchange, seamlessly securing communication
• Current in-ground fiber infrastructure is enough to support QKD
• Distance limitations between endpoints are quickly being minimized
• Many of the criticisms of QKD from NIST and the NSA are regarding issues that have subsequently been corrected
• Regarding eavesdropping and potential denial of service attacks, keys can be redirected “so quickly and randomly that the user will see no performance impact, and the interloper will be shut out”

The bottom line is that as the rest of the world has decided, quantum cryptography in the form of QKD is an essential part of quantum encryption, and will play a central role in securing quantum communications going forward.

Conclusion

After carefully examining the current implementations and emerging protocols and QKD systems, the global consensus concludes QKD as an integral component of quantum encryption and is here to stay.  Acknowledging the strengths and weaknesses of both QKD and PQC, the prevailing approach involves overlaying PQC on top of QKD for a comprehensive and effective secure quantum communications solution and several hybrid solutions have emerged and are being deployed across industries.

QKD keys will be extended to longer distances by using PQC to extend the QKD keys to the cloud. 

QNu Labs has announced its enterprise platform ‘QShield’ which offers solutions leveraging both quantum and post-quantum cryptography technologies. QNu Labs also believes that while the PQC layer using NIST-specified algorithms will be widely adopted for interoperability, countries will also build and use proprietary cryptography layers to strengthen the overall security of the stack.