Are You Ready to Witness the Future of Data Security?
Platform
Resources
©2026 QuNu Labs Private Limited, All Rights Reserved.
October 24, 2026
Sumanth Srirangam
Quantum-Safe Satellite Communication: A Practical Guide
Satellites carry defence telemetry, financial clearing traffic, government commands and emergency communications. A link that can be harvested today and decrypted in five years is not a theoretical problem. It is an operational one.
A quantum-safe satellite, more precisely a quantum-safe satellite link, is one whose encryption keys cannot be broken by a cryptographically relevant quantum computer (CRQC). It is not a special kind of hardware in orbit. It is a question of what cryptography protects the key exchange on the link and whether that cryptography survives Shor's algorithm.
Most satellite links today use RSA or elliptic-curve algorithms to establish session keys, the same algorithms that a CRQC running Shor's algorithm would break. Quantum-safe security replaces or augments those algorithms before that capability arrives.
Satellite downlinks are broadcast over wide beams. A ground receiver anywhere in the footprint can collect the ciphertext without the satellite or the operator knowing. The harvest now, decrypt later threat is therefore easier to execute against satellite links than against a private fibre. The data collected today stays valid as an attack target for as long as it needs to remain confidential, which for defence and government traffic can be decades.
Satellite systems sit beneath GPS timing, financial settlement, weather forecasting and military communications. A successful cryptographic attack against the key exchange on a critical satellite link could affect systems that depend on it at every level. ITU-T's March 2025 report on satellite-based quantum key distribution networks notes that satellite-based QKD needs to integrate with existing fibre-based QKD networks, classical optical communication networks, wireless communication systems and satellite communication infrastructures. Standards bodies treat satellite links as part of the wider cryptographic infrastructure, not a separate category.
Quantum key distribution (QKD) from space sends key material as single photons through free-space optical links between a satellite and ground stations. Any interception disturbs the photons' quantum state and reveals the eavesdropper. The main advantage of satellite-based QKD over fibre is that signal intensity loss over free-space links decreases quadratically with distance rather than exponentially, as in fibre, which makes it practical at intercontinental ranges.
China's Micius satellite, launched in August 2016, proved secure global quantum communications were a real prospect and sparked a global quantum space race. ESA's INT-UQKD project launched the SpeQtre satellite in November 2025 and is planning QKD over a satellite link between Luxembourg and Singapore in Q3/Q4 2026. ESA's QKDSat programme signed its formal delivery contract in September 2025, aiming to build a pre-commercial satellite QKD infrastructure serving governmental and telecommunications operators.
Post-quantum cryptography (PQC) uses mathematical problems that quantum computers are not known to solve efficiently. The NIST standards finalised in August 2024, ML-KEM (FIPS 203), ML-DSA (FIPS 204) and SLH-DSA (FIPS 205), run in software on existing hardware. For satellite operators who cannot replace optical hardware, PQC is the near-term path to quantum-safe key exchange on any link.
PQC also plays a specific role in satellite QKD: QKD requires a classical authenticated channel alongside the quantum channel, and PQC signatures can be used to authenticate that classical channel, replacing pre-shared keys that are impractical to maintain at scale.
The two are complementary, not competing. QKD provides information-theoretic security, meaning its security rests on physics rather than computational hardness. QKD is especially important against harvest-now, decrypt-later strategies, in which communications stored for years or decades could be decrypted if future techniques break deployed PQC. It is therefore well-suited to backbone links carrying the most sensitive traffic.
PQC secures the wider software estate: ground-station management, telemetry processing, control systems and the majority of links where physical QKD infrastructure is not yet available. ESA's INT-UQKD project integrates post-quantum cryptography to complement QKD, offering a belt-and-braces security strategy so that if one layer is broken, the other still holds.
China's Micius satellite has demonstrated QKD and multiple follow-on missions have launched. ESA's EAGLE-1 mission commenced European trials. SealSQ launched six QKD satellites in 2025, marking a commercial milestone. SpeQtral is developing satellite-based QKD with government and commercial partnerships.
Canada's QEYSSat microsatellite, designed to test QKD from low Earth orbit, is on a similar timeline. CubeSats including SPOQC, QUBE-II, QUICK³ and SpeQtral-1 are also in development, pointing to a near-term period where low-cost satellite QKD hardware becomes more accessible.
ITU-T, ISO/IEC, ETSI and CCSDS are beginning to address satellite-based QKD, but gaps persist in areas such as free-space channels, security, and integration with classical networks. ETSI GS QKD 014 specifies system architectures, interfaces and key management protocols for QKD generally. ISO/IEC 23837 covers security requirements and evaluation methods. Neither was written specifically for satellite links, and standardisation work to address free-space channels specifically is ongoing.
For satellite operators, this means deployments today follow ETSI and NIST frameworks applied to free-space contexts, with the expectation that satellite-specific standards will converge as more missions generate operational data
A cryptographic inventory of the satellite ground segment identifies every algorithm, key and certificate in use. Where public-key algorithms are used for key establishment on critical links, the migration target is PQC or a QKD-PQC hybrid. The ground segment, including telemetry, tracking and command (TT&C) systems, should be built for crypto-agility so that algorithms can be changed as standards mature without replacing hardware.
Satellite link encryption should use quantum-safe key establishment for session keys, with quantum random number generation (QRNG) as the entropy source for key generation. Software-defined key management, following ETSI QKD 014 interfaces, allows QKD key material to be inserted into the same key management flow once infrastructure is in place.
Because satellite-specific standards are still developing, vendors and operators should evaluate deployments against ETSI GS QKD 014, NIST FIPS 203/204/205 and, for high-security applications, Common Criteria Protection Profile ETSI GS QKD 016. QShield 2.0 provides the continuous assurance layer to verify that the estate remains quantum-safe as link configurations, certificates and algorithms evolve.