How Do QKD and Post-Quantum Cryptography Differ?

• A sufficiently capable quantum computer (red block)
• QKD: two entangled particles
• PQC: math problems and code

What you will learn

• State the threat that quantum computers pose to today’s cryptography.
• Describe what PQC rests on and what NIST has done.
• Compare QKD and PQC by foundation, form of deployment and the problem each one solves.

Before you start

It helps to read Which Problem Does Quantum Key Distribution Solve? first. This article reuses its terms.

Which parts of cryptography do quantum computers threaten?

A sufficiently large and reliable quantum computer could threaten widely used public-key cryptosystems. NIST identifies this as the reason for developing quantum-resistant algorithms. A quantum computer should not be pictured as merely trying every answer at once and reading them all out.

The Stanford Encyclopedia of Philosophy is more specific in its entry on quantum computing: implementing Shor’s algorithm on a large-scale quantum computer would render ineffective the widely used cryptosystems that rely on the premise that no efficient algorithm for factoring exists.

The threat depends on the problem and algorithm, not on a claim that quantum computers are faster at everything. A projected date in a news release is not a guaranteed deadline for a cryptographically capable machine.

• A sufficiently capable quantum computer
• The lock of today's encryption
• Cracks: the lock is broken

How does post-quantum cryptography answer it?

PQC swaps the problems a quantum computer could solve for other math problems. According to NIST, the algorithms it has standardized are based on different math problems that would stymie both conventional and quantum computers.

NIST started selecting and standardizing quantum-resistant algorithms in 2015. By the news release dated August 13, 2024, NIST had finalized its principal set of encryption algorithms, designed to withstand cyberattacks from a quantum computer. Three new standards were released, containing the algorithms’ computer code, instructions for implementing them and their intended uses.

So PQC is something that can be installed in systems now. NIST encourages system administrators to start integrating the standards immediately, because full integration will take time.

• A sufficiently capable quantum computer
• New math problems (three hexagons)
• Standard packaged as code

How does QKD differ from PQC?

QKD differs from PQC in deployment resources and functions. RFC 9583 describes both prepare-and-measure QKD without entangled pairs and entanglement-based QKD. Key generation also requires classical post-processing and authentication. Meanwhile, the NIST release announces standards for key establishment and digital signatures: PQC covers more than sharing keys alone.

The table below gathers what the sources say. Neither NIST source compares the two approaches directly; setting them side by side is this article’s own step.

• QKD: entangled particle pair
• PQC: lines of code

Real-world example

Imagine a company with two data centres in two cities. PQC gives it a new set of algorithms to replace the encryption inside its existing software, and the update is a job for system administrators. QKD would need a link and quantum equipment between the two sites to create keys from measurements on entangled photon pairs.

This is a made-up scenario to show the difference in deployment, not a recommendation for any product.

Common misunderstandings

PQC is not cryptography that runs on a quantum computer. According to NIST, it consists of encryption algorithms written as computer code, designed to withstand attacks by quantum computers.

QKD and PQC are not two names for the same thing. One establishes keys through quantum exchange; the other provides cryptographic algorithms on conventional machines.

Quantum computers breaking encryption is not something that has happened. The Stanford source says it would take Shor’s algorithm on a large-scale machine, and no proof exists of the general superiority of quantum computers.

Frequently asked questions

What is post-quantum cryptography?

Encryption algorithms based on math problems that are hard for both ordinary and quantum computers. NIST has finalized its principal set of standards.

Can QKD replace PQC?

It is not a wholesale replacement. QKD establishes keys but still needs partner authentication; PQC also includes digital-signature algorithms. A QKD link alone does not supply all these functions.

Why do quantum computers threaten today’s encryption?

Shor’s algorithm on a sufficiently large machine can efficiently solve the factoring problem underlying RSA. This does not mean every encryption algorithm is broken in the same way.

What does NIST recommend?

NIST encourages system administrators to start integrating the new standards immediately, because full integration will take time.

Summary

• A sufficiently capable quantum computer could break today’s encryption, so two approaches have emerged.
• PQC uses math problems hard for both ordinary and quantum computers, and NIST has finalized its principal standards.
• QKD generates keys using quantum exchange and authenticated classical post-processing; not all protocols use entanglement.