QKD vs post-quantum cryptography: which one do you need?

Quantum key distribution (QKD) and post-quantum cryptography (PQC) both respond to the same threat, a future quantum computer that breaks today’s public-key encryption, but they are not equal alternatives. PQC is new math that runs as software on the servers, phones and network gear you already own. QKD is optical hardware that sends keys as quantum states of light over dedicated fiber or satellite links. The NSA, the UK’s National Cyber Security Centre (NCSC) and the national security agencies of France, Germany, the Netherlands and Sweden all say the same thing: migrate to post-quantum cryptography first, and treat QKD as a niche tool for a few fixed links.

If a vendor is pitching QKD to your bank, operator or ministry, here is the comparison, what the agencies wrote and what to ask.

What is the difference between QKD and post-quantum cryptography?

Post-quantum cryptography replaces the vulnerable algorithms (RSA, Diffie-Hellman, elliptic curves) with algorithms that quantum computers are not known to break. QKD replaces the key exchange step with a physical process. The table sums up how they compare on the points that matter for a budget.

The reach figure comes from a January 2024 position paper by four European agencies, which says commercial QKD systems “typically reach about one hundred kilometres.” NIST published the three post-quantum standards on August 13, 2024 and urged administrators to start the transition “as soon as possible.”

How does QKD work, and what does it promise?

QKD encodes bits in individual photons and sends them over an optical link. Measuring a quantum state disturbs it, so an eavesdropper on the line introduces errors that the two ends can detect. After discarding the suspect bits and running classical post-processing, both ends share a secret key, which then encrypts data with a normal symmetric cipher such as AES.

The appeal is that security rests on physics rather than on a math problem, which is why ministries describe QKD in strong terms. Brazil’s science ministry, presenting the Recife quantum network in May 2026, spoke of “a impossibilidade de interceptar informações” (the impossibility of intercepting information). The agencies below disagree, for practical rather than theoretical reasons.

What do security agencies say about QKD?

They are unusually aligned. Four sources carry most of the weight.

NSA (United States). Its QKD page states: “NSA does not recommend the usage of quantum key distribution and quantum cryptography for securing the transmission of data in National Security Systems (NSS) unless the limitations below are overcome.” It lists five limitations: QKD is “only a partial solution,” it “requires special purpose equipment,” it “increases infrastructure costs and insider threat risks,” validating it “is a significant challenge,” and it “increases the risk of denial of service.” The NSA’s CNSA 2.0 FAQ, in its October 2026 version, goes further: “NSS owners should not use or research QKD at this time without consulting NSA directly.” The same FAQ sets ML-KEM-1024 and ML-DSA-87 as the post-quantum algorithms for all classification levels.

UK NCSC. Its white paper on quantum networking technologies, published on August 5, 2025, says: “The NCSC will not support the use of QKD for government or military applications. PQC is the best mitigation to the threat to cryptography from quantum computers.” For other sectors, it says QKD “should not be solely relied upon for generating and distributing cryptographic keys.”

France, Germany, the Netherlands and Sweden. Their joint position paper of January 26, 2024 concludes that “QKD can however currently only be used in practice in some niche use cases” and that “QKD is not yet sufficiently mature from a security perspective.” Its recommendation is that “the clear priorities should therefore be the migration to post-quantum cryptography and/or the adoption of symmetric keying.”

NIST. Its final transition report, NIST IR 8547 (October 2026), states that NIST “will deprecate quantum-vulnerable public-key cryptography after 2030 and disallow its use under NIST standards and guidelines after 2035,” and points to its post-quantum standards as the replacement.

Why can’t QKD replace post-quantum cryptography?

Because it solves a smaller problem than the one you have, and it still depends on the thing it is supposed to replace.

1. It does not authenticate anyone. The NCSC puts it bluntly: “QKD does not provide authentication, nor do any other quantum techniques.” The European position paper explains that QKD “requires a classical authenticated channel,” built either on pre-shared keys or on post-quantum signatures, in which case the “authentication relies on the security of the post-quantum scheme.” So a QKD link still needs PQC or a manual key logistics process.
2. It does not sign anything. Software updates, TLS certificates, bank-to-bank messages and electronic invoices all depend on digital signatures. QKD offers nothing there, so you need ML-DSA or SLH-DSA regardless.
3. Distance forces trusted nodes. Beyond roughly 100 km, the European paper says “trusted nodes must be introduced,” and adds that “the satellites themselves constitute trusted nodes in most current implementations.” At a trusted node the key exists in the clear, which is the insider risk the NSA mentions.
4. The security lives in the hardware. Real detectors and light sources are imperfect, which is why the NSA calls validation “a significant challenge.” An algorithm can be patched; a flawed photon detector has to be replaced.
5. It is easy to disrupt. The sensitivity that detects eavesdroppers also lets anyone with access to the fiber stop the key flow, the NSA’s denial-of-service point.

None of this applies to post-quantum cryptography, which travels over any network and includes signatures. Our explainer on post-quantum cryptography and FIPS 203, 204 and 205 covers how those standards work.

Where is QKD actually deployed?

At national scale in China, as an infrastructure program in Europe, and in a few point-to-point pilots elsewhere.

• China built the largest network. A Nature paper of January 6, 2021 describes more than 700 fiber QKD links and a ground network of more than 2,000 kilometres built on trusted relays, reaching 4,600 km with satellite links. Another, of March 19, 2025, reports that the Jinan-1 microsatellite shared keys between ground stations in China and South Africa more than 12,900 kilometres apart, with the satellite acting as a trusted relay.
• The European Union is building EuroQCI. The Commission’s page, updated November 5, 2026, says it works “with all 27 EU Member States,” that the Connecting Europe Facility funds 19 cross-border projects, and that the Eagle-1 prototype satellite is “due to be launched in late 2027.”
• Banks and telecoms run pilots on short links. HSBC protected a €30 million euro to dollar trade over a 63 km BT and Toshiba network between Canary Wharf and Slough in December 2023. JPMorgan Chase connected two data centers with its Q-CAN network in May 2024, and the bank’s announcement quoted Lori Beer describing “a dual remediation strategy that incorporates both post-quantum cryptography and QKD.” In June 2026 Telefónica announced a pilot that combines QKD and post-quantum cryptography between two Policía Nacional data centers in Madrid, running until the end of 2026.

The pattern is consistent: fixed links between a few sites, and in the serious deployments, QKD added on top of post-quantum cryptography rather than instead of it. The distance record tells the same story. A twin-field QKD experiment published in May 2023 reached 1,002 km of fiber, but at a key rate of about 9.5 bits per trillion pulses, which is a physics milestone, not a service.

Is there QKD in Latin America?

As research, yes; as a commercial service, we did not find one. Brazil leads. Its science ministry reported on May 5, 2026 that a team led by Daniel Felinto at the Universidade Federal de Pernambuco built the Recife Quantum Network over unused city fiber, with support from the research network RNP, validated 7 km tests and is aiming for 40 km. Other groups work on the Rede Rio Quântica, a metropolitan network under construction in Rio de Janeiro, and at CPqD in Campinas, which reported sending quantum information over 200 km of fiber on a lab testbed in April 2026. In Chile, researchers at the Universidad de Concepción posted a QKD test over installed multicore fiber on their campus in June 2026.

We found no operating QKD network or commercial QKD offer in Colombia, Mexico or Argentina in public sources as of November 2026. Colombian university groups work on quantum optics and communications, and our overview of quantum computing in Colombia lists them. Any QKD purchase in the region today would be an early, vendor-led project.

When does QKD make sense for a company?

Only when several conditions hold at once. Use this as a filter before taking a meeting:

• The link is fixed and short: two of your own sites, such as data centers, within about 100 km and connected by fiber you control.
• Someone with authority asks for it, such as a government customer, a defense contract or a regulator, and is willing to pay.
• It runs as an extra layer on top of post-quantum key exchange, never alone, in line with the NCSC’s warning that it “should not be solely relied upon.”
• The equipment has been evaluated against a recognized profile. ETSI released GS QKD 016, a protection profile for QKD modules, in April 2023, and Germany’s BSI certified a version of it in January 2024. ISO/IEC 23837-1 (2023) covers security requirements and test methods.

If those conditions do not hold, the money buys more security in a post-quantum migration. That is the case for most banks, insurers, retailers and public agencies, and it is why our telecommunications and government and public sector pages treat QKD as a narrow option.

If a vendor still makes the case, ask four questions. How is the channel authenticated (if the answer is pre-shared keys or post-quantum signatures, you still need a post-quantum program)? What key rate is guaranteed over your actual fiber, and who operates the trusted nodes? Which lab evaluated the equipment, and against which profile? What is the fallback when the link is cut, and is it post-quantum?

What should a company in Latin America do first?

Start with post-quantum cryptography, because it covers every link and every signature and its deadlines are already set: our tracker of post-quantum migration deadlines shows how the 2030 and 2035 dates reach the region. The first concrete step is a cryptographic inventory, because you cannot judge whether a link deserves QKD until you know what crosses it and how long it must stay secret, the question at the heart of harvest now, decrypt later.

A quantum readiness assessment gives you that picture, including an honest answer on whether any of your links is a QKD candidate. When you are ready to move, post-quantum cryptography migration is the program that covers everything else. The glossary defines QKD, QRNG, hybrid key exchange and the other terms used here.