Conventional networking
Fiber, radio and free-space optical paths carry traffic. Define routing, segmentation, monitoring, resilience and the protected endpoints.
Quantum networking
Two security paths. One accountable network.
Post-quantum cryptography (PQC) protects conventional systems with new algorithms. Quantum key distribution (QKD) uses a specialised physical link to establish key material. Neither replaces sound network engineering or endpoint security.
Three distinct layers
Start with the actual service path.
An optical link transports data; cryptography protects it. The customer architecture must specify both.
PQC · software-led migration
Inventory public-key cryptography and test NIST-standardised key establishment and signatures on compatible conventional platforms.
QKD · physical-key experiment
Evaluate a dedicated fiber or free-space quantum channel, specialised terminals and an authenticated classical channel in a separately scoped pilot.
Post-quantum cryptography · PQC
Protect existing networks against a future quantum threat.
PQC is the practical starting point for most customers because it can be integrated into conventional systems. It addresses quantum-vulnerable public-key cryptography; it does not make an application secure by itself.
01 / Discover exposure
Identify certificates, key exchange, signatures, firmware, VPNs, APIs, long-lived data and supplier dependencies.
02 / Choose the standard
Evaluate ML-KEM for key establishment (FIPS 203), ML-DSA for signatures (FIPS 204) and SLH-DSA as another signature option (FIPS 205), where each fits the use case.
03 / Test interoperability
Pilot a bounded connection or signing workflow. Measure handshake and signature behavior, key management, device support, latency and rollback.
04 / Expand in stages
Record owners, replacement windows, vendor readiness, monitoring and cryptographic agility before wider deployment.
- No quantum hardware is required for this migration path
- Algorithms and configurations must be validated in the customer environment
- An approved implementation, not a product label alone, determines the assurance level
Standards and migration guidance: NIST FIPS 203, 204 and 205 · NIST NCCoE migration project.
Quantum key distribution · QKD
Prove the physical key path before proposing deployment.
QKD distributes cryptographic key material using quantum states. It does not encrypt the customer data or authenticate the endpoints by itself, so the design still needs conventional security controls.
01 / Select a justified use case
Define which two endpoints need key material, why PQC alone does not meet the stated requirement and how the keys reach the application.
02 / Engineer the channel
Check fiber loss or free-space geometry, optical terminals, distance, weather exposure, trusted-node assumptions and the authenticated classical channel.
03 / Run a bounded pilot
Measure usable secret-key rate, error rate, uptime, environmental sensitivity, key handoff, operational workload and failure recovery.
04 / Review acceptance
Compare measured results, security assumptions and total operating cost with a PQC-based alternative before choosing any next stage.
- Dedicated optical infrastructure and specialist equipment are in scope
- Authentication, endpoint trust and application encryption remain separate requirements
- No claim of unconditional or production-ready security follows from a simulation
Independent limitations to evaluate: NSA QKD guidance. NSA does not recommend QKD for U.S. National Security Systems unless its stated limitations are overcome.
PQC and QKD together
Different tools, different evidence.
The first decision is the required customer outcome, not which technology sounds newer. A scoped architecture can assess both without treating them as interchangeable.
PQC
Conventional systems
Changes key-establishment and signature algorithms in supported software, protocols and devices.
First evidence:Cryptographic inventory, interoperability test and migration plan.
QKD
Specialised physical channel
Generates and distributes key material over engineered quantum and authenticated classical channels.
First evidence:Link budget, key-rate measurements, endpoint assurance and operating costs.
A practical migration path
Start with the exposure you can identify.
Each phase is tied to a customer-controlled environment and the agreed scope.
Discover
Inventory cryptographic uses, certificates, keys, devices, data lifetimes and network dependencies.
Prioritise
Consider data sensitivity, retention needs, interoperability and the effort required to change each dependency.
Validate
Test selected implementations and interface behaviour in the scoped pilot before an operational migration.
Operate
Document ownership, key management, monitoring, recovery and how future cryptographic changes will be introduced.
Optical resilience
Plan for real operating conditions.
Clouds, atmospheric interference and precise pointing are practical free-space optical constraints. Site diversity and alternate paths belong in the service design.
- Ground and spacecraft geometry assessed for the intended link
- Environmental evidence considered in site selection
- A recovery strategy appropriate to the continuity requirement
- Security and transport acceptance criteria recorded separately
Technical foundations: NASA optical communications · NIST post-quantum cryptography.