PQC vs. QKD: Two Lines of Defense Against Quantum Computers

Mon, 15 Jun 2026 00:00:00 +0000

Facing the threat described in , the security community has developed two defenses that differ in almost every respect: Post-Quantum Cryptography and Quantum Key Distribution. People often treat them as competing options, but they actually solve two different classes of problems.

	PQC	QKD
Layer	Software	Hardware
Security basis	A math problem hard even for quantum computers	Laws of quantum physics
Security level	Computational	Information-theoretic, unconditional
Hardware required	Existing CPUs and GPUs	Single-photon sources, SPAD detectors, dedicated optical infrastructure
Deployment	Available now	Requires building new, more complex infrastructure
Standardized protocols	NIST 2024: CRYSTALS-Kyber, CRYSTALS-Dilithium	BB84, BBM92, CV-QKD

PQC: a software upgrade on infrastructure you already have

Post-Quantum Cryptography is still classical: it runs entirely on ordinary CPUs and GPUs, but it is built around mathematical problems that even a quantum computer has no known efficient way to solve, lattice-based cryptography being the leading example. Its biggest advantage is that it can be deployed right now. No new physical infrastructure is needed, only a software update. In 2024, NIST officially standardized CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures, marking PQC’s move into practical deployment.

Its weakness sits in the nature of computational security itself: it rests on the assumption that no one has yet found an algorithm to break it, not on an absolute proof. A future mathematical breakthrough or a new quantum algorithm could still weaken PQC, even though nothing of the sort has appeared so far.

QKD: security grounded in physics

QKD takes the opposite approach. Instead of encrypting data with a hard-to-solve algorithm, it uses the quantum state of photons themselves to distribute a key, and its security rests on physical law, specifically the no-cloning theorem and the nature of quantum measurement. That security holds regardless of how much computational power an attacker has, including a quantum computer decades from now. This is information-theoretic security, the strongest form of security that exists in theory.

The trade-off is that QKD needs entirely new physical infrastructure: single-photon sources and detectors, high-precision optics, and, as I discuss in my posts on satellite FSO, extreme sensitivity to channel conditions like atmospheric loss and turbulence. Deploying QKD at scale is far more complex and costly than rolling out a PQC software update.

Not one or the other, but both

The consensus among researchers today is not to pick a side, but to combine both. PQC is well suited to protecting broad, everyday infrastructure right away, things like email and web traffic. QKD is better suited to point-to-point links that demand extremely high, long-term-stable security, such as critical government, defense, and financial systems, or future quantum networks that need to carry actual quantum states rather than just classical key material.

The paper I analyzed for my seminar, , makes exactly this point: it focuses on QKD because its security is grounded in physics, without dismissing PQC’s role. The two are complementary, not mutually exclusive.

Why We Need Quantum-Safe Security Today, Not in 2030

Fri, 12 Jun 2026 00:00:00 +0000

“Powerful quantum computers are still a decade away, why worry now?” I hear this reaction often when the topic of quantum threats to encryption comes up, and it is a fairly dangerous misunderstanding. The timeline below explains why.

From theory to a real threat

The story starts in the 1980s, when Richard Feynman and David Deutsch laid the theoretical groundwork for quantum computation. The original idea was fairly simple: use a quantum system to simulate other quantum systems, a task classical computers handle very inefficiently.

The real turning point came in 1994, with Shor’s algorithm. It proved, at least in theory, that a sufficiently powerful quantum computer could factor large integers in polynomial time, while a classical computer needs exponential time for the same task. This genuinely shook the cryptography community, because RSA’s security, along with many other public-key schemes, rests entirely on integer factorization being computationally hard.

In 2019, Google announced Sycamore, demonstrating what is called quantum supremacy: completing a specific computation far faster than the most powerful classical supercomputer of the time. That computation had no practical use, but it was hardware proof that quantum computing was actually advancing, not just a theoretical exercise. Several industry and academic roadmaps now place 2030 to 2035 as the window in which quantum computers could have enough qubits and enough error correction to run Shor’s algorithm at a scale that breaks widely deployed RSA and ECC keys.

What RSA and AES actually depend on

Nearly all of today’s digital security, from HTTPS and VPNs to online banking and digital signatures, depends on the computational hardness of two problems: factoring large integers for RSA, and the discrete logarithm problem on elliptic curves for ECC. On a classical computer, both problems are practically unsolvable within any useful timeframe. Shor’s algorithm breaks precisely that assumption, not because RSA or ECC are weak, but because the underlying computational model changes entirely.

AES, a symmetric cipher, is far less affected. Grover’s algorithm only speeds up brute-force search by a square root factor, so doubling the key length, using AES-256 instead of AES-128, is enough to compensate. RSA and ECC are where the real vulnerability sits.

Harvest now, decrypt later

This is why the quantum threat is not a distant problem. An attacker with resources, whether a nation-state or a well-funded organization, can harvest and store encrypted data right now, even without being able to read it, and simply wait until a quantum computer capable of decrypting it exists.

This strategy is especially dangerous for data with long-term value: medical records, defense secrets, intellectual property, sensitive financial information. If a piece of data needs to stay protected for the next fifteen or twenty years, waiting until quantum computers actually arrive before taking action is already too late. Data harvested today may already be sitting in an attacker’s hands, waiting for its decryption day.

This is the motivation behind two lines of defense being developed in parallel today: Post-Quantum Cryptography, which upgrades software on infrastructure that already exists, and Quantum Key Distribution, which builds security infrastructure grounded in physical law itself. I break down the differences and the complementary role of each in .

Cryptography | Truong Tuan Nghia