PQC vs. QKD: Two Lines of Defense Against Quantum Computers
Facing the threat described in my previous post, the security community has developed two defenses that differ in almost every respect: Post-Quantum Cryptography and Quantum Key Distribution. People often treat them as competing options, but they actually solve two different classes of problems.
| PQC | QKD | |
|---|---|---|
| Layer | Software | Hardware |
| Security basis | A math problem hard even for quantum computers | Laws of quantum physics |
| Security level | Computational | Information-theoretic, unconditional |
| Hardware required | Existing CPUs and GPUs | Single-photon sources, SPAD detectors, dedicated optical infrastructure |
| Deployment | Available now | Requires building new, more complex infrastructure |
| Standardized protocols | NIST 2024: CRYSTALS-Kyber, CRYSTALS-Dilithium | BB84, BBM92, CV-QKD |
PQC: a software upgrade on infrastructure you already have
Post-Quantum Cryptography is still classical: it runs entirely on ordinary CPUs and GPUs, but it is built around mathematical problems that even a quantum computer has no known efficient way to solve, lattice-based cryptography being the leading example. Its biggest advantage is that it can be deployed right now. No new physical infrastructure is needed, only a software update. In 2024, NIST officially standardized CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures, marking PQC’s move into practical deployment.
Its weakness sits in the nature of computational security itself: it rests on the assumption that no one has yet found an algorithm to break it, not on an absolute proof. A future mathematical breakthrough or a new quantum algorithm could still weaken PQC, even though nothing of the sort has appeared so far.
QKD: security grounded in physics
QKD takes the opposite approach. Instead of encrypting data with a hard-to-solve algorithm, it uses the quantum state of photons themselves to distribute a key, and its security rests on physical law, specifically the no-cloning theorem and the nature of quantum measurement. That security holds regardless of how much computational power an attacker has, including a quantum computer decades from now. This is information-theoretic security, the strongest form of security that exists in theory.
The trade-off is that QKD needs entirely new physical infrastructure: single-photon sources and detectors, high-precision optics, and, as I discuss in my posts on satellite FSO, extreme sensitivity to channel conditions like atmospheric loss and turbulence. Deploying QKD at scale is far more complex and costly than rolling out a PQC software update.
Not one or the other, but both
The consensus among researchers today is not to pick a side, but to combine both. PQC is well suited to protecting broad, everyday infrastructure right away, things like email and web traffic. QKD is better suited to point-to-point links that demand extremely high, long-term-stable security, such as critical government, defense, and financial systems, or future quantum networks that need to carry actual quantum states rather than just classical key material.
The paper I analyzed for my seminar, “Quantum Internet in the Sky”, makes exactly this point: it focuses on QKD because its security is grounded in physics, without dismissing PQC’s role. The two are complementary, not mutually exclusive.