Quantum key distribution: how it works and where it fits
In short: Quantum key distribution lets two parties grow a shared secret key using single photons, and any eavesdropping causes detectable errors. It needs dedicated optical links, has distance limits and still relies on classical authentication. Several national security agencies advise post-quantum cryptography for most uses, with QKD for niche cases.
Security from physics
Most cryptography is secure because certain maths problems are hard. Quantum key distribution (QKD) takes a different route. It uses the behaviour of single particles of light (photons) to let two parties, traditionally called Alice and Bob, agree a shared secret key. Two quantum rules make this possible: measuring a quantum state generally disturbs it, and an unknown quantum state cannot be copied perfectly (the no-cloning theorem). So an eavesdropper, Eve, cannot quietly read the photons; her attempts leave traces Alice and Bob can detect.
QKD only creates keys. The data itself is then encrypted with a normal symmetric cipher such as AES, or in principle a one-time pad.
The BB84 idea
The first QKD protocol, BB84, was proposed by Charles Bennett and Gilles Brassard in 1984. In outline:
- Alice sends photons, encoding each bit in one of two randomly chosen bases (for example, two different polarisation orientations).
- Bob measures each photon in a randomly chosen basis of his own.
- Over an ordinary, authenticated channel they compare which bases they used, not the bit values, and keep only the bits where the bases matched.
- They reveal a sample of those bits to estimate the error rate. A high error rate suggests eavesdropping, so they discard the key.
- If errors are low enough, they correct the remaining errors and apply privacy amplification to shrink away any information Eve might have.
Other protocols use entangled photon pairs or continuous variables, but the principle is the same: eavesdropping is detectable.
Practical limits
| Limit | Why it matters |
|---|---|
| Distance | Photons are lost in fibre, so direct links are limited and key rates drop with distance |
| Trusted nodes | Longer networks relay keys through intermediate nodes that see the key and must be physically secured |
| Authentication | QKD cannot tell who is at the other end; it still needs classical authentication, such as pre-shared keys or PQC signatures |
| Hardware cost | Dedicated optical equipment and often dedicated fibre |
| Implementation attacks | Real detectors and sources have flaws that research has shown can be exploited |
| Denial of service | Anyone disturbing the link can stop key generation |
Satellite links and quantum repeaters are being researched to extend range, but quantum repeaters are not yet a mature technology. Standards bodies such as ETSI and ITU-T publish QKD specifications, and some countries run testbed networks.
QKD or post-quantum cryptography?
Security agencies including the UK NCSC and the US National Security Agency (NSA) have published positions that favour post-quantum cryptography as the main defence for most organisations, citing QKD's need for special hardware, its trusted-node problem and its dependence on classical authentication. Other countries and some research programmes invest more heavily in QKD. A reasonable professional view is that QKD is an interesting option for specific high-security point-to-point links, while PQC is the practical path for the internet, cloud services and everyday systems.
Tip: in exams, do not mix up QKD and PQC. QKD needs quantum hardware to distribute keys; PQC is classical software designed to resist quantum attacks.
Practice
Why can QKD detect an eavesdropper?
Why does QKD still need classical authentication?
What is a trusted node in a QKD network?
Key takeaways
- QKD uses photons and quantum physics to share keys and detect eavesdropping.
- BB84 compares bases publicly, checks error rates and amplifies privacy.
- Limits: distance, trusted nodes, hardware cost and the need for authentication.
- QKD only creates keys; data is still encrypted with symmetric ciphers.
- Many agencies favour PQC for most uses; QKD fits niche point-to-point links.
Original content written by Mohamed Fayas for FM TecHub. © 2026 FM TecHub. You're welcome to share a link to this page; please don't copy the text elsewhere without permission.