PQC vs. QKD: Two Lines of Defense Against Quantum Computers

Mon, 15 Jun 2026 00:00:00 +0000

Facing the threat described in , the security community has developed two defenses that differ in almost every respect: Post-Quantum Cryptography and Quantum Key Distribution. People often treat them as competing options, but they actually solve two different classes of problems.

	PQC	QKD
Layer	Software	Hardware
Security basis	A math problem hard even for quantum computers	Laws of quantum physics
Security level	Computational	Information-theoretic, unconditional
Hardware required	Existing CPUs and GPUs	Single-photon sources, SPAD detectors, dedicated optical infrastructure
Deployment	Available now	Requires building new, more complex infrastructure
Standardized protocols	NIST 2024: CRYSTALS-Kyber, CRYSTALS-Dilithium	BB84, BBM92, CV-QKD

PQC: a software upgrade on infrastructure you already have

Post-Quantum Cryptography is still classical: it runs entirely on ordinary CPUs and GPUs, but it is built around mathematical problems that even a quantum computer has no known efficient way to solve, lattice-based cryptography being the leading example. Its biggest advantage is that it can be deployed right now. No new physical infrastructure is needed, only a software update. In 2024, NIST officially standardized CRYSTALS-Kyber for key exchange and CRYSTALS-Dilithium for digital signatures, marking PQC’s move into practical deployment.

Its weakness sits in the nature of computational security itself: it rests on the assumption that no one has yet found an algorithm to break it, not on an absolute proof. A future mathematical breakthrough or a new quantum algorithm could still weaken PQC, even though nothing of the sort has appeared so far.

QKD: security grounded in physics

QKD takes the opposite approach. Instead of encrypting data with a hard-to-solve algorithm, it uses the quantum state of photons themselves to distribute a key, and its security rests on physical law, specifically the no-cloning theorem and the nature of quantum measurement. That security holds regardless of how much computational power an attacker has, including a quantum computer decades from now. This is information-theoretic security, the strongest form of security that exists in theory.

The trade-off is that QKD needs entirely new physical infrastructure: single-photon sources and detectors, high-precision optics, and, as I discuss in my posts on satellite FSO, extreme sensitivity to channel conditions like atmospheric loss and turbulence. Deploying QKD at scale is far more complex and costly than rolling out a PQC software update.

Not one or the other, but both

The consensus among researchers today is not to pick a side, but to combine both. PQC is well suited to protecting broad, everyday infrastructure right away, things like email and web traffic. QKD is better suited to point-to-point links that demand extremely high, long-term-stable security, such as critical government, defense, and financial systems, or future quantum networks that need to carry actual quantum states rather than just classical key material.

The paper I analyzed for my seminar, , makes exactly this point: it focuses on QKD because its security is grounded in physics, without dismissing PQC’s role. The two are complementary, not mutually exclusive.

PQC | Truong Tuan Nghia

PQC vs. QKD: Two Lines of Defense Against Quantum Computers

PQC: a software upgrade on infrastructure you already have

QKD: security grounded in physics

Not one or the other, but both