# Quantum key distribution
**Quantum key distribution** (QKD) is a family of protocols for growing a private encryption key between two parties by transmitting quantum signals, so that any eavesdropping on the transmission is in principle detectable through the laws of quantum mechanics.[1](https://www.nature.com/articles/s41534-017-0031-5) The key itself is an ordinary string of bits used to scramble and unscramble data; what is quantum is its delivery, typically by photons.[2](https://www.nist.gov/cybersecurity-and-privacy/what-quantum-cryptography) Published security analyses hold that the resulting key can be proven secure even against an eavesdropper with unbounded computational ability.[3](https://www.itu.int/ITU-T/recommendations/rec.aspx?lang=en&rec=14408)
| Key fact | Detail |
|---|---|
| First protocol | BB84, published by Charles Bennett and Gilles Brassard in 1984[4](https://www.cse.wustl.edu/~jain/cse571-07/ftp/quantum/index.html) |
| Security basis | No-cloning theorem and measurement disturbance make eavesdropping detectable[2](https://www.nist.gov/cybersecurity-and-privacy/what-quantum-cryptography) |
| Post-processing | Sifting, parameter estimation, information reconciliation, and privacy amplification over an authenticated classical channel[5](https://pubs.aip.org/aip/apr/article/11/1/011318/3279669/Continuous-variable-quantum-key-distribution) |
| Distance limit | Fiber-based QKD reaches a few hundred kilometers at most because attenuation scales exponentially with distance[6](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544) |
| Extension | Satellites as trusted relay nodes, or quantum repeaters, extend the reach toward global scale[1](https://www.nature.com/articles/s41534-017-0031-5) |
| Institutional stance | The NSA does not support QKD for US National Security Systems and views post-quantum cryptography as more cost effective[7](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/) |
| Standardization | ITU-T (Y.3800 series, X.1710, X.1711) and ETSI maintain QKD network and security standards[3](https://www.itu.int/ITU-T/recommendations/rec.aspx?lang=en&rec=14408) • [8](https://www.etsi.org/technical-groups/qkd/) |
## How a protocol works
The canonical example is BB84, laid out by Bennett and Brassard in 1984.[4](https://www.cse.wustl.edu/~jain/cse571-07/ftp/quantum/index.html) The sender, conventionally called Alice, generates a random sequence of bits and, for each bit, randomly chooses one of two conjugate bases in which to prepare a photon; the receiver, Bob, measures each arriving photon in a randomly chosen basis. When their bases match, Bob's result deterministically reproduces Alice's bit; when they differ, his outcome is random.[9](https://quantum.cloud.ibm.com/learning/en/modules/computer-science/quantum-key-distribution) After the transmission, Alice and Bob publicly compare their basis choices, keep only the matching rounds, and obtain a correlated raw key.[10](https://www.nist.gov/news-events/news/2004/04/background-quantum-key-distribution)
**Eavesdropping detection.** The security argument rests on two quantum effects. Non-orthogonal quantum states cannot be copied accurately, and any measurement that tries to discriminate them inevitably disturbs them.[11](https://link.springer.com/article/10.1140/epjqt/s40507-023-00197-8) An interceptor, conventionally Eve, cannot read a photon without altering it: she must guess the basis, and her wrong guesses inject errors into the shared string. By comparing a sample of their key bits, Alice and Bob can estimate the quantum bit error rate (QBER); if errors exceed what known noise sources explain, they discard the key.[10](https://www.nist.gov/news-events/news/2004/04/background-quantum-key-distribution) In BB84, an intercept-resend eavesdropper introduces a detectable 25% QBER.[12](https://www.physweb.com/learn/qic/quantum-crypto)
## Classical post-processing
The quantum transmission is only the first stage. A typical system then runs four classical steps over a channel that is public but authenticated, meaning Eve can read the messages but cannot alter them: base sifting, parameter estimation, information reconciliation, and privacy amplification.[5](https://pubs.aip.org/aip/apr/article/11/1/011318/3279669/Continuous-variable-quantum-key-distribution)
**Information reconciliation** corrects the discrepancies between the two raw keys, which arise from channel noise and detector imperfections, using error-correcting codes such as low-density parity-check (LDPC) or polar codes.[11](https://link.springer.com/article/10.1140/epjqt/s40507-023-00197-8) The interactive Cascade protocol was an early de facto standard, but one-way LDPC-based schemes reduce communication rounds and adapt to different error rates.[13](https://arxiv.org/abs/1007.1616)
**Privacy amplification** then compresses the reconciled string with a hash function or randomness extractor, producing a shorter final key about which Eve's information is reduced to a negligible level.[9](https://quantum.cloud.ibm.com/learning/en/modules/computer-science/quantum-key-distribution) • [14](https://www.itu.int/epublications/publication/itu-t-x-1711-2026-03-framework-of-quantum-key-distribution-qkd-protocols-in-qkd-networks) The compression ratio is set by the estimated leakage from the parameter-estimation step.[14](https://www.itu.int/epublications/publication/itu-t-x-1711-2026-03-framework-of-quantum-key-distribution-qkd-protocols-in-qkd-networks)
The authenticated classical channel is itself a cryptographic requirement: QKD does not authenticate its own transmission source, so entity authentication must come from pre-shared keys, public-key certificates, or post-quantum signatures.[7](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/) • [14](https://www.itu.int/epublications/publication/itu-t-x-1711-2026-03-framework-of-quantum-key-distribution-qkd-protocols-in-qkd-networks) A fraction of each round's key is typically set aside to authenticate the next round's classical channel.[15](https://backend.orbit.dtu.dk/ws/portalfiles/portal/388154801/thesis_final.pdf)
## Distance limits and networks
Signal loss constrains every ground-based implementation. In optical fiber, attenuation grows exponentially with distance, limiting fiber QKD to a few hundred kilometers even under controlled conditions.[6](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544) Practitioners in a UK government assessment put fiber links without trusted nodes at roughly 30 km, and noted that fiber absorbs the photon signal beyond about 200 km.[16](https://www.gov.uk/government/publications/quantum-key-distribution-research-report/quantum-key-distribution-research-report) • [17](https://www.axios.com/2017/12/15/china-takes-the-lead-in-building-quantum-data-security-networks-1513305463) Because the no-cloning theorem forbids copying and amplifying quantum signals the way classical repeaters do, long-haul links need either trusted nodes, where the key is regenerated in the clear and therefore exposed to insider risk, or quantum repeaters, which distribute and swap entanglement but remain a major practical challenge.[7](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/) • [2](https://www.nist.gov/cybersecurity-and-privacy/what-quantum-cryptography)
**Deployed networks.** China built a 2,000-km fiber optic QKD network between Beijing and Shanghai, dedicated to basic research on quantum satellite communications.[17](https://www.axios.com/2017/12/15/china-takes-the-lead-in-building-quantum-data-security-networks-1513305463) Earlier demonstrations include a 2008 SECOQC network in Europe and a 2004 QKD-secured bank transfer in Vienna.[18](https://www.nature.com/articles/npjqi201625) • [2](https://www.nist.gov/cybersecurity-and-privacy/what-quantum-cryptography)
## Satellite QKD
Satellites extend QKD because free-space optical links lose signal mainly through beam divergence, so transmission efficiency falls quadratically with distance rather than exponentially as in fiber.[6](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544) A 2017 review identified the flying trusted-node scheme, in which a satellite relays keys between ground stations, as the most common satellite QKD approach viable with present technology.[1](https://www.nature.com/articles/s41534-017-0031-5) A 2025 architecture assessment concluded that low-Earth-orbit satellites acting as trusted nodes for prepare-and-measure discrete-variable downlinks with weak laser pulses are the advisable near-term option, and that the decoy-state version of BB84 is the most promising protocol owing to its mature security proofs, high key rate, and low system complexity.[6](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544)
## Protocol families
QKD divides by the carrier of the key into discrete-variable (DV) and continuous-variable (CV) protocols.[11](https://link.springer.com/article/10.1140/epjqt/s40507-023-00197-8) DV-QKD encodes bits in the polarization or phase of single photons and suits long distances; CV-QKD encodes information in the quadratures of optical fields, is compatible with coherent telecom technology, and achieves high key rates at short and medium range. Point-to-point CV-QKD transmission has reached 202.81 km of ultralow-loss fiber.[11](https://link.springer.com/article/10.1140/epjqt/s40507-023-00197-8)
**Decoy states** address a source flaw: weak laser pulses occasionally emit multiple photons, which an eavesdropper can split off without triggering alarms.
**Device-independence** reduces trust assumptions. Conventional security proofs assume the devices match their mathematical description; measurement-device-independent (MDI) protocols remove detector side channels by letting both parties send states to an untrusted middle node, and fully device-independent (DI) protocols treat all devices as black boxes, certifying security through the violation of a Bell inequality (test whose violation certifies quantum correlations). The first DI security proof guaranteeing a linear amount of key under a constant noise rate appeared in 2012, and the first experimental DI-QKD demonstrations have since been carried out.[19](https://arxiv.org/abs/1210.1810) • [6](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544)
## Security in practice
The gap between proven theory and built hardware is the field's central practical issue. Real devices leak through side channels: detectors that miss photons, sources that emit extra photons, and hardware that can be probed or faulted. Well-publicized attacks on commercial QKD systems exploit exactly such implementation loopholes, and a complete security proof should account for all known discrepancies between the protocol model and its physical implementation.[7](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/) • [6](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544) The same eavesdropper sensitivity that underpins QKD's security claims also makes denial of service a significant risk, since an attacker can continuously disturb the quantum channel and force the system to discard keys.[7](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/) • [16](https://www.gov.uk/government/publications/quantum-key-distribution-research-report/quantum-key-distribution-research-report)
**Institutional positions.** The NSA does not support QKD or quantum cryptography for US National Security Systems, citing the need for special-purpose hardware, trusted relays with insider-threat costs, validation difficulty, and the availability of quantum-resistant cryptography as a typically less expensive alternative with a better understood risk profile.[7](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/) The French security agency ANSSI, with its German, Dutch, and Swedish counterparts, gives clear priority to post-quantum cryptography for migration to a quantum-attack-resistant environment.[20](https://cyber.gouv.fr/actualites/la-distribution-quantique-de-cl%C3%A9-son-utilisation-et-ses-limites/) A UK research report found broad stakeholder consensus that QKD will not become a dominant standalone security technology; its value lies in defense-in-depth enhancements for high-value fixed links, where it fails differently from mathematically based schemes, and as a stepping stone toward quantum networks.[16](https://www.gov.uk/government/publications/quantum-key-distribution-research-report/quantum-key-distribution-research-report)
## Standardization
Standardization bodies have built a QKD network framework. ITU-T Recommendation Y.3800 overviews networks supporting QKD, in which pairs of QKD modules link over a quantum channel and a classical channel, and Y.3803 covers key management, the storage, relay, and supply of keys to cryptographic applications.[3](https://www.itu.int/ITU-T/recommendations/rec.aspx?lang=en&rec=14408) X.1710 specifies a security framework for QKD networks covering authentication, access control, confidentiality, integrity, availability, and accountability, and X.1711 frames the QKD protocols themselves.[21](https://www.itu.int/epublications/en/publication/itu-t-x-1710-2020-10-security-framework-for-quantum-key-distribution-networks/en) • [14](https://www.itu.int/epublications/publication/itu-t-x-1711-2026-03-framework-of-quantum-key-distribution-qkd-protocols-in-qkd-networks) ETSI's QKD industry specification group works on protocol security proofs, implementation security, evaluation, and interoperable key management APIs.[8](https://www.etsi.org/technical-groups/qkd/)
## References
1. [Bedington, Arrazola, and Ling (2017). Progress in satellite quantum key distribution. npj Quantum Information 3, 30.](https://www.nature.com/articles/s41534-017-0031-5)
2. [What Is Quantum Cryptography? NIST](https://www.nist.gov/cybersecurity-and-privacy/what-quantum-cryptography)
3. [ITU-T Y.3803 (12/2020): Quantum key distribution networks – Key management](https://www.itu.int/ITU-T/recommendations/rec.aspx?lang=en&rec=14408)
4. [Quantum Key Distribution, CSE 571, Washington University in St. Louis](https://www.cse.wustl.edu/~jain/cse571-07/ftp/quantum/index.html)
5. [Continuous-variable quantum key distribution system: Past, present, and future. Applied Physics Reviews (2024)](https://pubs.aip.org/aip/apr/article/11/1/011318/3279669/Continuous-variable-quantum-key-distribution)
6. [Orsucci et al. (2025). Assessment of Practical Satellite Quantum Key Distribution Architectures. Int J Satell Commun Network](https://onlinelibrary.wiley.com/doi/full/10.1002/sat.1544)
7. [NSA: Quantum Key Distribution (QKD) and Quantum Cryptography (QC)](https://www.nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/)
8. [ETSI: Quantum Key Distribution (QKD) technical group](https://www.etsi.org/technical-groups/qkd/)
9. [Quantum Key Distribution, IBM Quantum Learning](https://quantum.cloud.ibm.com/learning/en/modules/computer-science/quantum-key-distribution)
10. [Background on Quantum Key Distribution, NIST (2004)](https://www.nist.gov/news-events/news/2004/04/background-quantum-key-distribution)
11. [Yang et al. (2023). Information reconciliation of continuous-variables quantum key distribution. EPJ Quantum Technology 10, 40](https://link.springer.com/article/10.1140/epjqt/s40507-023-00197-8)
12. [Quantum Cryptography & BB84, PhysWeb](https://www.physweb.com/learn/qic/quantum-crypto)
13. [Elkouss, Martinez-Mateo, and Martin (2010). Information Reconciliation for Quantum Key Distribution. arXiv](https://arxiv.org/abs/1007.1616)
14. [ITU-T X.1711 (03/2026): Framework of QKD protocols in QKD networks](https://www.itu.int/epublications/publication/itu-t-x-1711-2026-03-framework-of-quantum-key-distribution-qkd-protocols-in-qkd-networks)
15. [DTU thesis: Quantum Key Distribution, authenticated classical channel](https://backend.orbit.dtu.dk/ws/portalfiles/portal/388154801/thesis_final.pdf)
16. [Quantum key distribution research report, GOV.UK (2025)](https://www.gov.uk/government/publications/quantum-key-distribution-research-report/quantum-key-distribution-research-report)
17. [China takes the lead in building quantum data security networks, Axios (2017)](https://www.axios.com/2017/12/15/china-takes-the-lead-in-building-quantum-data-security-networks-1513305463)
18. [Diamanti et al. (2016). Practical challenges in quantum key distribution. npj Quantum Information 2, 16025](https://www.nature.com/articles/npjqi201625)
19. [Fully device independent quantum key distribution. arXiv (2012)](https://arxiv.org/abs/1210.1810)
20. [La distribution quantique de clé, son utilisation et ses limites, ANSSI](https://cyber.gouv.fr/actualites/la-distribution-quantique-de-cl%C3%A9-son-utilisation-et-ses-limites/)
21. [ITU-T X.1710 (10/2020): Security framework for quantum key distribution networks](https://www.itu.int/epublications/en/publication/itu-t-x-1710-2020-10-security-framework-for-quantum-key-distribution-networks/en)
---
*Topic: Encyclopedia › Physical world and mathematics › Physics › Quantum physics › Quantum information science › Quantum communication and information theory › Quantum cryptography › Quantum key distribution — overview*
*Initially written Sep 17, 2026 · Reviewed: Sep 30, 2026; Oct 15, 2026 · Edited: Sep 30, 2026; Oct 15, 2026 · Last review: Oct 15, 2026*
*Copyright 2026 EdgeChat AI, a subsidiary of Biostate AI.*
License: Edgepedia Community License 1.0, https://www.edgepedia.org/edgepedia/license