Quantum Key Distribution: From Theory to Real-World Attacks

Most of the cryptography we rely on today is built on hard mathematical problems, ones that would take even the fastest computers an impractical amount of time to solve. That's what keeps things like our online banking safe. But the arrival of quantum computers threatens a good part of this, in particular the public-key systems like RSA, which a big enough quantum computer running the right algorithm could break in a way that classical machines never could. So people have started looking into how to prepare for that future, along two different lines: post-quantum cryptography, which is still math-based but built on problems quantum computers aren't good at, and quantum cryptography, which takes a completely different approach.

Quantum cryptography is interesting because its security doesn't come from a hard problem at all. It comes from the laws of quantum mechanics. The idea is that if you encode information in individual photons, an eavesdropper can't secretly measure them without disturbing them, and that disturbance is something the two legitimate parties can detect. Under the right assumptions, this can be proven secure, not "hard to break given current computers" but secure in a stronger, physical sense. That's a different kind of guarantee, and it's the whole reason the field exists.

At least, that's the theory. The reality is more complicated, because a security proof is a statement about an idealized protocol, and the systems people actually build don't have ideal hardware. The proofs don't fully account for the messy physical devices in the real world, and that gap is where things get interesting. In one attack, an eavesdropper was able to shine bright light into the receiver's equipment and, by doing so, take control of what it recorded, learning the shared key while the system carried on as if nothing was wrong.

That sounds damning, but it isn't really. If anything it's a sign the field is maturing. This is roughly how security technologies grow up: someone finds an attack, the attack gets understood, and the next version closes the hole. Quantum key distribution is far enough along that it now has this back-and-forth of real attacks and real fixes, which is what any technology needs before it can be trusted at scale.

Which leaves the obvious question. If the security of this whole approach is supposed to come from the laws of physics, how does someone break it by shining a light at a detector?

BB84

The Physics

Before the protocol can make any sense, we need to talk about the photons, because everything about the security comes from the way they behave when you try to measure them. If you've never done any physics, don't worry.

Light travels as a wave, and like any wave it oscillates. That oscillation can take a few different forms, and the one that matters for us is the simplest: the wave stays in a single direction, moving side to side across the way the light is travelling. The direction it oscillates along is what we call its polarization. It can be straight up and down, which we'll call vertical, or left and right, which we'll call horizontal, or along any angle in between. A photon is the smallest possible unit of light, a single quantum of it, and it carries a polarization in just the same way.

Not all light has a single, definite direction of oscillation. The light from the sun or a lamp is unpolarized, which just means its oscillation is jumbled, a mixture of every direction at once with no orientation preferred over any other.

Take some of that unpolarized light and send it through a polarizing filter, the same kind of thing that's in polarized sunglasses. A filter has an axis. Say this one is oriented vertically. What comes out the other side is only the vertical part of the light. Everything else has been stripped away. The light that emerges is now purely vertical, oscillating cleanly up and down, and it's dimmer than what went in, because only part of the original made it through.

This example contains almost everything we'll need. It tells you what polarization is: an orientation the light oscillates along. It tells you what a filter does: it picks out one orientation and lets only that through. And it shows you something about measuring that turns out to be the whole foundation of the security later on. The light coming out of the vertical filter is vertical no matter what it was before. Whatever mixture went in, the filter has discarded it and replaced it with a clean vertical beam. The original is gone, and you cannot look at what came out and work backwards to what went in.

Now shrink this down to a single photon, since that's what the protocol actually uses. When one photon meets the vertical filter it can't come out "half as bright," because a single photon can't be dimmer. Instead it either passes through completely or it's absorbed and stops there. Whether it passes is a matter of chance, and the odds depend on how the photon was oriented to begin with.

If the photon was already oriented in line with the filter, a vertical photon meeting a vertical filter, it passes every single time, and it comes out vertical. The measurement is completely reliable. Ask the same question again with another vertical filter and you'll get the same answer, pass, every time.

If the photon was oriented straight across the filter, a horizontal photon meeting a vertical filter, it never passes. That's reliable too, just the opposite answer.

The interesting case is when the photon sits at an angle to the filter, and the angle that matters is forty-five degrees. A photon polarized at forty-five degrees, meeting a vertical filter, passes with exactly fifty-fifty odds. It's a genuine coin flip. Nothing about the photon settles the outcome in advance, and no amount of careful measurement can predict it. And the interesting part is if that forty-five-degree photon does pass, it comes out vertical, not at forty-five degrees. Its original orientation has been erased and replaced, exactly the way the jumbled beam was cleaned into a vertical one. So you didn't just get a random answer, you also destroyed the very thing you were trying to measure. You can't check again, because the forty-five-degree photon you started with no longer exists.

There's a tempting way around all this: if measuring a photon destroys it, why not copy the photon first, set the copy aside untouched, and measure that instead, keeping the original safe? The answer is that you can't. Quantum mechanics forbids making a perfect copy of an unknown state, a result known as the no-cloning theorem. There is no device, however clever, that can take in a photon of unknown polarization and produce two of them carrying the same state. Copying is off the table, which means measuring is the only way to learn anything about a photon, and measuring, as we've just seen, is destructive. Those two facts together are what make the whole scheme possible.

The light we're using oscillates along a single direction, and that direction is its polarization. Measuring means choosing an orientation to check the photon against, and from here on we'll call that choice a basis.

A basis is really a matched pair of orientations at right angles to each other, because a single basis has to be able to represent both a 0 and a 1, one bit value for each of its two directions. Vertical and horizontal together make up one basis; the two diagonals at forty-five and hundred-thirty-five degrees make up the other. Setting your filter upright measures in the first basis, turning it to the diagonal measures in the second.

A photon measured in the same basis it was prepared in gives a reliable answer, a photon measured in the other basis gives a random one, and either way the photon is left aligned with the orientation you measured, its old state gone for good. Keep that in mind, and the protocol and the reason nobody can eavesdrop on it unnoticed, will feel almost obvious.

The Setting

Before we walk through the protocol, it's worth laying out the situation it takes place in. Two people, Alice and Bob, want to end up sharing a secret key, a string of bits known only to the two of them. They start with no such key between them, since building one is the whole point. What they do have is two different ways of communicating.

The first is a quantum channel, the line that actually carries the photons from Alice to Bob. This is the channel the eavesdropper, Eve, has power over. She can insert her own equipment, intercept the photons, measure them, block them, or send along replacements of her own. Nothing in the setup assumes this channel is safe.

The second is a classical channel, an ordinary public line, a phone call or an internet connection, that Alice and Bob use to talk things over after the photons have been sent. Because it's public, Eve hears everything said on it. What she can't do is forge it. The channel is authenticated, which means Alice and Bob can each tell that a message genuinely came from the other and wasn't altered on the way.

The Protocol

The protocol begins with Alice. For each photon she's about to send, she makes two random choices: a basis, rectilinear or diagonal, and a bit, 0 or 1. She then prepares a photon that encodes that bit in that basis. In the rectilinear basis she might send horizontal for 0 and vertical for 1; in the diagonal basis, the two orientations are the one at forty-five degrees and the one at a hundred and thirty-five degrees, carrying 0 and 1 in the same way. She sends the photon to Bob over the quantum channel and moves on to the next one, and she keeps a private record of every basis and bit she chose.

Bob, at the other end, has no idea which basis Alice used, so for each photon that arrives he simply picks a basis of his own at random and measures. When his choice happens to match the one Alice used, his result is reliable and he recovers exactly the bit she sent. When it doesn't match, his result is a fresh coin flip, uncorrelated with her bit, which is why those rounds can safely be thrown away later. Bob keeps his own private record of the basis he chose and the result he got each time.

Once they've repeated this enough times, the public part begins. First, Bob announces which rounds he actually detected a photon in, because plenty of them never arrive at all; the quantum channel is lossy, and most of what Alice sends can simply vanish on the way. Alice discards every round Bob didn't detect. Then, for the rounds that survived, the two of them announce their basis choices to each other but they never reveal the bits. Wherever their bases disagree, they drop the round, since Bob's result there is just noise. Wherever their bases agree, roughly half the time, they keep the bit, and it's these kept bits that form the raw material of the key.

In a perfect world, with no eavesdropper and a noiseless channel, the bits they kept would now match perfectly. Whether that's actually true is the thing they have to check, because it's precisely what an eavesdropper would have spoiled. So they sacrifice a random handful of their kept bits and compare them out loud over the public channel. The intuition, which we'll make precise in the next section, is that Eve cannot learn anything about these photons without measuring them, and she cannot measure them without sometimes guessing the basis wrong, and a wrong guess disturbs the photon in a way that turns into a disagreement between Alice and Bob. So if their sampled bits all match, they have good reason to believe no one was listening. If the bits disagree more than honest channel noise can explain, they abort.

The bits they compared in that check are now public knowledge, so they're thrown away. What's left is a shorter string that Alice and Bob share and have reason to trust. Strictly speaking they're not quite finished even then, since a little more processing is needed to reconcile the small errors that ordinary noise introduces.

Why it's secure

Before we argue that BB84 is secure, we should be clear about what "secure" can mean here. Eve already has access to the whole quantum channel; she can intercept, measure, and resend whatever she likes. Instead the protocol guarantees that only one of two things can happen: either Alice and Bob end up with a shared string that Eve knows nothing about, or they notice her and throw the run away. The one case that must never happen is the third, where they walk away thinking the key is private while Eve holds a copy.

That third case can be ruled out because of the physics from earlier. To learn anything about a photon, Eve has to measure it, and to measure it she has to choose a basis. She doesn't know which basis Alice used, because that isn't announced until the quantum part is over, and she can't get around the choice by copying the photon and measuring later, because no-cloning forbids it. So she has to guess. Half the time she guesses wrong, and a wrong guess doesn't only give her a useless result, it disturbs the photon she passes on to Bob. That disturbance is what makes eavesdropping detectable.

The easiest attack looks like this: Eve intercepts every photon, measures it in a basis she picks at random, and sends Bob a fresh photon carrying whatever she got. Consider only the rounds that survive sifting, where Alice and Bob happened to choose the same basis, since those are the rounds that become the key. In such a round, one of two things happened on Eve's end. With probability one half she happened to pick the same basis as Alice, in which case she read the bit correctly, resent it correctly, and Bob receives exactly what Alice sent, no harm done. With probability one half she picked the wrong basis. On those, her own measurement was a coin flip, and worse, she resends the photon in her wrong basis, so the photon arriving at Bob is now forty-five degrees off from what he's about to measure it against. Bob's result becomes a coin flip too, and half of those flips disagree with the bit Alice actually sent. So half the surviving rounds are undamaged, half are corrupted, and half of the corrupted ones come out wrong. Eve's eavesdropping has forced errors into a quarter of the sifted bits, twenty-five percent, and there's nothing she can do about it as long as she runs this attack. That twenty-five percent is the disturbance Alice and Bob's error check is designed to catch.

This is one attack, though, and a real security proof has to do much more: rule out every possible strategy at once, including subtle ones where Eve interacts gently with each photon to learn a little while disturbing it less. It turns the rough idea that eavesdropping causes errors into a precise bound, a threshold error rate, around eleven percent for this protocol, below which Alice and Bob can always distill a key they're sure is secret, and above which they can't and must abort. The full argument was first established by Lo and Chau and by Shor and Preskill, and it's more than we'll take on here, but the intercept-resend case above is the intuition it's built on.

Attacks

We just spent a section proving this can't be broken. So how does anyone break it?

They don't break the proof. Nobody has found a hole in the physics, and the guarantee still holds for the protocol it describes. What gets broken is the gap between that protocol and the actual equipment. Every real attack on QKD finds some piece of hardware behaving in a way the proof never accounted for, and gets in through that.

That splits attacks into two kinds. The first stays inside the assumptions the proof already made, like the intercept-resend from earlier, or gentler versions of the same idea. Those aren't the dangerous ones: the proof covers them, they turn into errors, and the error check catches them. The dangerous kind exploits a physical imperfection the proof left out of its model entirely, and those tend to come from one of two places, the source or the detector.

Splitting the photons

Start with the source. The proof assumed every pulse Alice sends carries exactly one photon, and that assumption is what trapped Eve earlier: to learn a bit she had to measure the photon, and a single photon can't be copied, so she had no way to keep a spare and no way to measure without committing to a basis too early. Real lasers don't respect the assumption. A dimmed laser pulse doesn't hold one photon, it holds a random number of them, usually zero, often one, and every so often two or more. Two identical photons are exactly the spare Eve was missing.

When a pulse comes through carrying two or more photons, Eve takes one off for herself and lets the rest carry on to Bob, untouched. She doesn't measure the photon she forwards, so Bob's arrives exactly as Alice sent it and nothing looks wrong at his end. Her own copy she just holds. Then she waits until Alice and Bob announce their bases on the public channel, when she finally knows which basis that pulse was in, and only then does she measure her stored photon, in the right basis. She never had to guess. This is the photon-number-splitting attack.

On its own that's an occasional lucky peek so Eve needs to do more. The single-photon pulses she genuinely can't touch, since there's no spare to take, so she blocks them and forwards only the multi-photon pulses she can read. Throwing pulses away would normally look suspicious, except that long fibre already swallows the huge majority of what Alice sends, so Bob expects almost everything to go missing anyway. Eve just arranges for the missing ones to be the pulses she couldn't crack. Bob still sees a believable number of photons arrive, the error rate stays clean, and Eve ends up knowing every bit that came from a multi-photon pulse.

Doing this in full, however, needs an unusually capable Eve: she has to store her photon intact until the bases are public, which means a quantum memory, and she has to replace the lossy fibre with a better line so that blocking the single-photon pulses doesn't drop Bob's count too far. Neither is easy. But the threat was taken seriously enough that the defence became standard equipment on real systems, and it's the first fix we'll look at in the next section, where Alice and Bob find a way to measure how much of their key came from single-photon pulses and keep only that part.

Blinding the detector

Now the detector. The source flaw in the last attack handed Eve a share of the key while a detector flaw can hand her all of it. This is the attack the article opened with, the one where someone shines a light into the equipment and walks off with the key.

First, what the detector is and how it notices a single photon. The key part is an electronic component with a voltage set across it. Voltage is just electrical pressure, and the amount of pressure decides how the component behaves. The system sets that pressure very high, just below the level where the component would start conducting electricity on its own. It's balanced right at that point. When a single photon lands on it, the photon adds the tiny extra nudge needed to push it over, and it suddenly conducts: a surge of current runs through it, and the electronics count that surge as one "click." That's how one photon turns into one detectable signal, and balancing the voltage right at that edge is the only reason the component is sensitive enough to react to a single photon at all.

One thing to note about this component: all it can tell Bob is "click" or "nothing." It can't report how bright the incoming light was, or whether a click was caused by one photon or by a flood of them. A click is a click.

Now Eve's move. She shines a bright, steady light into the detector. That constant light makes it conduct over and over, and to cope, the detector's own circuit drops the voltage back down. But the high voltage was the whole point, it was what kept the component balanced at the edge where a single photon could tip it. With the voltage lowered, a single photon no longer does anything. The component now only reacts, only produces a click, when a strong burst of light hits it, bright enough to force it to conduct. So Eve has changed what the detector responds to. It used to react to single photons. Now it reacts only to bright light, above some level of brightness. Call that level the threshold. And because the detector still only ever reports "click" or "nothing," Bob has no way to see that anything about it has changed.

With Bob's detectors switched over like this, Eve does a straightforward intercept. She measures each of Alice's photons in a basis she picks for herself. Then, instead of passing along a real photon, she sends Bob a bright pulse of light standing for the bit she just read, and she sets its brightness right around the threshold.

But how does Eve know which basis Bob is going to measure in? She doesn't, and she doesn't need to. She matches her pulse to her own basis and lets Bob's equipment do the rest. To see why that works, look at what Bob's setup does with the pulse. He has two detectors, one standing for bit 0 and one for bit 1, and in front of them a component that routes the incoming light toward one detector or the other based on its polarization. If Bob's chosen basis lines up with the basis Eve's pulse is in, the light is sent entirely to one detector. That detector gets the full brightness, which is above the threshold, so it clicks, and Bob records exactly the bit Eve picked. If Bob's chosen basis is the other one, his routing component can't send the pulse cleanly to either side, so it splits the light in half, sending half to each detector. Now each detector receives only half the brightness, which is below the threshold, so neither one clicks, and Bob records nothing for that round.

This splitting is the same behaviour from the physics section. There, a single photon measured in the wrong basis went to one detector or the other at random. Here the light is bright rather than a single photon, so instead of going one way at random it goes both ways at once, and half of it isn't enough to make either detector click.

So Bob's own random choice of basis does the sorting, without Eve touching it. When his basis matches Eve's, he gets a click, and it hands him her bit. When his basis doesn't match, he gets no click at all. And no click is what makes the attack invisible: a round with no click looks like a photon that got lost on the way, which happens to most photons anyway, so Bob just discards it and thinks nothing of it. The rounds where he did get a click are the rounds where his basis matched Eve's, and those are the same rounds that survive sifting and become the key. Every one of them holds the bit Eve sent. So she ends up with the whole key, Bob's numbers look normal, and the error rate never rises, because Eve never made his detector perform a real measurement that could come out wrong.

This isn't a thought experiment: Lydersen and colleagues showed it in 2010 against two commercially sold QKD systems, taking the full key without leaving a trace, and a follow-up ran a complete eavesdropper on a working system from end to end.

---

These two aren't the whole list, and the detector in particular has more than one weak point. Some attacks exploit the exact timing of when a photon arrives, since Bob's two detectors aren't perfectly identical and can be pushed into favouring one over the other. Others send light into Alice's or Bob's own equipment and read what bounces back, to work out which settings they're using. Different methods, but underneath they are all the same as the two we went through: none of them breaks the security proof. Each one finds a piece of real equipment behaving in a way the proof never accounted for, and takes advantage of it.

That's the real point of this section. The mathematics was never the weak point. The weak point is the gap between the protocol the proof describes and the actual equipment sitting on the bench, and closing that gap is a different job than proving a theorem. The response to these attacks was to go after the assumptions they relied on and rebuild the protocol so those weak points can't be used. That's what the next section is about.

Improvements to the protocol

Each of the developments since BB84 goes after one of the broken assumptions and rebuilds the protocol so security survives it.

Decoy states

Start with the source. The proof assumed each pulse carries a single photon, but real systems use a heavily dimmed laser instead, and a laser pulse doesn't contain a fixed number of photons: it contains a random number drawn from a Poisson distribution. Tune it so the average is well below one photon per pulse and most pulses are empty, many carry exactly one, and a small but real fraction carry two or more. Those multi-photon pulses are the opening for the photon-number-splitting attack from the last section, where Eve keeps one photon from a multi-photon pulse, forwards the rest to Bob untouched, and reads her copy once the bases are public. Against a plain weak-laser system she can block the single-photon pulses she can't safely read and forward the multi-photon ones she can, learning a share of the key without tripping the error check.

The fix, proposed by Hwang and made practical by Lo, Ma and Chen, is simple. Alice randomly changes the brightness of her pulses among a few preset levels: one "signal" level she uses for the real key, and one or more dimmer "decoy" levels. She writes down which level she used for each pulse and tells no one until later.

The reason this helps comes down to what a brightness level actually is. It only sets the average number of photons in a pulse. It doesn't put a mark on the pulse. Each pulse still ends up with some whole number of photons, 0 or 1 or 2 or more, and a brighter setting just makes the larger numbers a bit more common. So if Eve stops a pulse and counts two photons in it, those two photons look exactly the same whether they came from a signal pulse or a decoy pulse. Nothing in the pulse tells her which level it was. The levels differ only in how often each photon count shows up across many pulses, not in any single pulse she can hold and inspect.

That leaves Eve stuck. Her photon-number-splitting attack means treating pulses differently depending on how many photons they carry: block the single-photon ones she can't read, forward the multi-photon ones she can. But she has to make that choice the moment each pulse reaches her, and at that moment she has no idea whether it was a signal pulse or a decoy pulse. So whatever she does, she does it to the signal and decoy pulses alike.

Once the transmission is over, Alice announces which level each pulse had been sent at. Now the two of them can go back and sort Bob's detections into groups: how many signal pulses got through, how many decoy pulses got through, and so on. In an honest channel, with only fibre loss in play, those numbers make sense based on Alice's original setup. Because Eve favoured some photon counts over others, her tampering makes the numbers stop fitting, and it's obvious in one figure especially: how well the single-photon pulses in particular got through.

Those single-photon pulses are the only ones that were ever safe, since a lone photon can't be split. Being able to pin down how many of them survived is the whole point. Alice and Bob keep a key built only from that safe single-photon portion and throw the rest away. So the imperfect laser doesn't get fixed. It gets measured well enough that they can still pull a safe key out of it.

Measurement-device-independent QKD

Now the detector. The proof assumed Bob's detector behaves like an honest quantum measurement, and the blinding attack we just walked through is what happens when it doesn't. It isn't the only detector attack either, and the detector is the most exposed part of the setup.

Measurement-device-independent QKD, proposed by Lo, Curty and Qi, stops trusting the detector instead of trying to perfect it. Alice and Bob both become senders, each preparing a photon in a random basis and bit, and both send to a station in the middle we'll call Charlie. Neither of them measures anything, instead Charlie does. What makes the scheme worth the trouble is that the design assumes Charlie is Eve, his equipment hostile from the start, and works anyway.

Charlie brings the two incoming photons together on a beamsplitter and watches which detectors click. When two identical photons meet at a beamsplitter they interfere, and the click pattern depends on the relationship between their polarizations, not on either one by itself. So all Charlie can read off is whether Alice's and Bob's photons were the same or different, which he announces publicly each round. He never learns what either photon actually was. That's enough for the other two: if Charlie says "different" and Alice knows she sent 0, she knows Bob sent 1, and Bob recovers Alice's bit the same way. The relationship on its own gives nothing, and that's all Charlie has.

If his box tried to read the individual polarizations it would hit the same wall Eve does: it would have to guess a basis it doesn't know and disturb the photons, which both ruins the interference his announcements depend on and shows up as errors. He can't preserve the interference and read the bits at once. That is what the name means: the proof assumes nothing about the measuring equipment, lets it belong to Eve, and still bounds what it can learn from the observed error rate alone.

The hard part is the interference. It only works if the two photons are indistinguishable when they meet: same arrival time, same colour, same shape, from two independent lasers in different places. Keeping two distant sources that well matched is a real engineering fight, and whenever it slips the interference degrades into extra errors and less key. On top of that, a usable round needs both photons to arrive in the same slot, and since each barely survives the fibre, both surviving at once is rarer still, so the key comes more slowly than in ordinary QKD.

Twin-field QKD

The last two fixes were about security. This one's about distance, and it's worth seeing what actually goes wrong over a long fibre. The trouble is loss. You can only build a key out of photons that reach the far end, and fibre eats them fast, roughly a factor of a hundred for every hundred kilometres. The key rate follows the number that survive, so once a link gets long enough you're getting so few photons through that the whole thing grinds to a halt. And this isn't only an engineering hurdle you can push through. Pirandola and colleagues proved there's a hard ceiling on how well any ordinary point-to-point link can ever do, no matter how good the equipment. MDI didn't get around it either, middle station and all, because a round still only counts when both photons turn up together, and waiting on two survivors instead of one is even worse. For a long time the only known way past it was a quantum repeater, which needs quantum memories that still barely exist outside a lab.

Twin-field QKD, from Lucamarini, Yuan, Dynes and Shields, keeps MDI's untrusted middle station but changes what has to make it there. In MDI a round works only if a photon from Alice and a photon from Bob both survive and meet. Twin-field needs just one photon detected, from either side. And because that single photon only had to travel half the way, to the middle rather than the whole span, the rate drops off much more slowly, about the way it would over a link half as long, which is enough to get past the ceiling. You get the same gain with distance that a quantum repeater would give you, without building one, and the detector can still belong to Eve.

For one photon to carry that much, the information has to live somewhere new. Polarization won't work anymore, so instead Alice and Bob each put their bit into the phase of a dim beam of light, meaning where the wave sits in its up-and-down cycle. Both beams travel to Charlie and overlap at his beamsplitter, and which detector fires comes down to the difference between Alice's phase and Bob's. A single photon out of that combined light already depends on both of their choices, so one click tells you how their two bits relate. As in MDI, that relationship is all Charlie ever sees, never either bit by itself, so the untrusted-middle security carries over unchanged.

The catch is that a phase difference only means something if the two beams are measured against a shared reference, and two independent lasers hundreds of kilometres apart, with drifting fibre in between, don't have one. The fibre keeps shifting the phase as it warms and cools and gets knocked about, fast enough to change from one pulse to the next, and that shift lands right on top of the phase Alice and Bob are trying to send. So the system has to chase the drift in real time and cancel it out, holding the two distant beams lined up just long enough to read the signal. That's harder than anything MDI asks for, and it's the main reason twin-field is difficult to build; much of the later work is different tricks for keeping the phase under control. And it does work. The original paper already got clean results over 550 km of fibre, and since then it's been run over 1,000 km.

Out in the world

Everything so far has been protocols and attacks. It's worth stopping to say that none of this is hypothetical: QKD is running right now, over real fibre, carrying real traffic, and has been for years.

The early networks were modest and mostly experimental. A six-node network ran in Vienna in 2008, another across Tokyo in 2010, each wiring a handful of sites in one city together over dedicated fibre. They were proofs that the thing worked outside a single lab bench, and not much more.

China is where it stopped being a demonstration. Construction on a backbone line between Beijing and Shanghai began in 2013 and finished in 2017: just over 2,000 kilometres of fibre linking the two cities through a string of relay stations along the way. In 2016 the country launched Micius, the first satellite built for quantum key distribution, which can exchange keys with ground stations far beyond the reach of any fibre. In 2020 the two were joined into a single network, fibre backbone plus satellite, spanning 4,600 kilometres, and it wasn't wired up for show. It served more than 150 real users, among them banks, power-grid control centres, and government offices. Since then it has kept growing; by 2025 the fibre network reportedly stretched past 10,000 kilometres, and a lighter follow-up satellite had pushed a key exchange all the way to a ground station in South Africa.

That is a genuinely impressive amount of working infrastructure. But there's a catch. Going back to the distance problem from the twin-field section, photons get lost in fibre, and past a few hundred kilometres almost none arrive, which is a hard limit on how far a single QKD link can reach. Twin-field pushes that limit outward, but 2,000 kilometres is far beyond even that. So how does the Beijing-Shanghai line cover the distance? It's broken into shorter segments, and between each pair of segments sits a relay: a station that runs ordinary QKD with its neighbour on each side. The key is decrypted at the relay and re-encrypted for the next leg.

That decrypt-and-re-encrypt step is the catch. For the moment the key sits inside a relay station, it is plain, readable data on ordinary hardware, protected by nothing more than the physical security of the building it's in. Anyone who controls that station sees the key. These are called trusted nodes. The whole promise of QKD was that you didn't have to trust anything except the laws of physics, that security came from the photons and not from anyone's good behaviour. A network built on trusted nodes has handed that promise back. It secures each individual leg with quantum physics, and then relies on old-fashioned trust in a chain of buildings to stitch the legs together. The satellite is no different, really; it acts as a trusted relay in the sky, one that everyone has to assume isn't keeping a copy. Ways around this exist in the lab, and true quantum repeaters would remove the need for trusted nodes altogether, but they depend on quantum memories that still aren't ready. Every large QKD network running today leans on trusted nodes.

---

China has bet heavily that QKD is worth building out now, trusted nodes and all, and treats it as national infrastructure. The United States has bet the other way. Its National Security Agency has said plainly that it does not consider QKD a practical way to protect national security systems and advises against using it for them, pointing instead to post-quantum cryptography, the new maths-based algorithms from the start of this article, which run as software on the networks that already exist and don't need special hardware or trusted relays at all.

QKD offers something no software can, security that rests on physics rather than on a hard maths problem that a cleverer algorithm might one day crack. That is a real and unique guarantee. But the guarantee is about a single link, and the moment you build it out into a network spanning a country, the trusted nodes creep back in and the guarantee stops covering the parts a real attacker would go after. Whether that trade is worth it depends on what you're protecting and who you're afraid of, and the people best placed to judge have looked at the same technology and reached opposite answers. That is roughly where quantum key distribution sits today: proven, built, genuinely in use, and still arguing with itself about whether the guarantee it was founded on survives contact with a real network.