Two things called quantum security
Let us untangle the names first, because the confusion is genuine. Quantum key distribution, or QKD, sends single photons or entangled pairs between two parties so that any eavesdropper disturbs them and gets noticed. It gives you a shared secret key protected by physics rather than by the difficulty of a maths problem. Post-quantum cryptography, or PQC, keeps the internet's existing architecture and swaps the maths: instead of RSA and elliptic curves, which Shor's algorithm would break, it uses problems based on lattices and hash functions that no known quantum algorithm cracks. One needs new hardware and new fibre. The other is a software update, albeit an enormous one. Our advantage guide covers how far off the machine that motivates all this actually is.
QKD from a whiteboard to a satellite
QKD started as a thought experiment: Charles Bennett and Gilles Brassard's protocol of 1984, now called BB84, and Artur Ekert's entanglement-based version in 1991. Commercial boxes from companies such as ID Quantique and Toshiba have existed for years, and the physics has held up well. The practical problem is distance. A photon cannot be copied or amplified without destroying the very property you rely on, so in ordinary fibre a link stretches to a hundred or two hundred kilometres before losses make the key rate useless. The twin-field protocol proposed in 2018 and developed by Toshiba's Cambridge lab has pushed laboratory links to several hundred kilometres, which is a real advance but still not a continent.
China's answer was to go over the top. The Micius satellite, launched in August 2016 by the Chinese Academy of Sciences under a team led by Pan Jianwei, distributed entangled photon pairs between ground stations roughly 1,200 kilometres apart, published in Science in 2017, and later underpinned a QKD-secured video call between Beijing and Vienna. On the ground, the Beijing–Shanghai backbone, which opened in 2017, runs about 2,000 kilometres by chaining links through "trusted nodes" that decrypt and re-encrypt the key at each hop. Those nodes are the honest weakness: every one of them holds the key in the clear.
Entanglement networks and repeaters
The way past trusted nodes is a quantum repeater, a device that stores entanglement in a quantum memory and stitches links together by entanglement swapping without ever reading the key. This is where the field's most elegant recent work sits. QuTech in Delft demonstrated a three-node network in 2021 using nitrogen-vacancy centres in diamond, published in Science, and followed it with teleportation between non-neighbouring nodes in 2022. A Harvard group has since run a two-node link over tens of kilometres of deployed fibre under Boston using silicon-vacancy centres. Memory lifetimes, rates and the sheer engineering of keeping these systems aligned are the current limits, and nobody has a repeater chain in commercial service. But the pieces exist, and that was not true a decade ago.
The policy split. The UK's National Cyber Security Centre published a position paper saying it does not endorse QKD for government or military systems, pointing to the trusted-node problem, the need for special hardware and the lack of authentication, and recommending post-quantum cryptography instead. The US National Security Agency takes a similar line. The European Union, by contrast, is funding EuroQCI, a programme to build a continental quantum communication infrastructure, and China invests heavily in both routes.
The post-quantum standards
The other clock has been ticking since the US National Institute of Standards and Technology launched an open competition in 2016 to find quantum-resistant algorithms. After several rounds of public cryptanalysis, which knocked out some strong-looking candidates, NIST published three standards in August 2024: FIPS 203 for ML-KEM, the key-encapsulation scheme derived from CRYSTALS-Kyber; FIPS 204 for ML-DSA, the signature scheme derived from Dilithium; and FIPS 205 for SLH-DSA, the hash-based signature scheme derived from SPHINCS+. A further signature standard based on Falcon was in draft at the time, and NIST later selected a code-based scheme, HQC, as a backup to ML-KEM. Mainstream browsers and large content networks have deployed hybrid key exchange that pairs a classical elliptic-curve exchange with ML-KEM, so much of the web already carries post-quantum protection for its keys.
Why the hurry, when the computer does not exist yet? Because of "harvest now, decrypt later". Encrypted traffic recorded today could be decrypted whenever a large enough machine arrives, so anything that must stay secret for decades needs protecting now. The NCSC has published a phased migration timeline for UK organisations running into the 2030s; the exact milestones are on its website and worth reading in the original.
What we would actually do about it
We are a column, not a consultancy, so take this as friendly general guidance and talk to a qualified security professional about your own systems. The sensible starting point that everyone from NIST to the NCSC agrees on is an inventory: find out where your organisation uses public-key cryptography, which is usually far more places than anyone expects. Then ask suppliers what their post-quantum plans are, and favour systems built to swap algorithms without a rebuild. QKD is worth understanding and, for some point-to-point links, worth trialling, but on current official guidance it is not where the mainstream migration is going.