| Attribute | Terrestrial fiber QKD | Post-quantum cryptography (software) |
|---|---|---|
| What it protects | The key exchange between two fixed physical endpoints | Key exchange and signatures across any network path, including the internet |
| Distance limit | Roughly 100-150 km on standard fiber before signal loss forces a relay | None; works over unlimited hops and existing routing |
| Hardware needed | Dedicated single-photon transmitters, detectors, and often a separate dark fiber strand | None beyond existing CPUs; runs as a software or firmware update |
| Multi-party or cloud traffic | Poor fit; QKD is fundamentally point-to-point | Native fit; scales to any number of endpoints |
| Cost profile | High capital cost per link, plus ongoing operations for trusted nodes | Near-zero marginal cost once integrated into existing protocol stacks |
| Maturity in 2026 | Commercially deployed in select finance and government pilots | Standardized by NIST (FIPS 203/204/205) and shipping in mainstream TLS stacks |
Quantum key distribution gets described in two very different ways depending on who is talking. Physicists describe it as one of the few concrete, commercially available applications of quantum mechanics: a way to detect eavesdropping on a key exchange because measuring a quantum state disturbs it. Skeptics describe it as an expensive, fragile science project that solves a problem enterprises do not actually have, while ignoring the problem they do have. Both camps are working from real evidence, and the confusion mostly comes from conflating two very different deployment contexts: satellite-relayed QKD built for continental and intercontinental distance, and terrestrial fiber QKD built for a single metro-area or campus link.
This piece is about the second category only. If you are researching space-based quantum key relays, satellite constellations, or free-space optical links between ground stations and orbit, our companion piece on satellite quantum communication innovations covers that ground. Here, the question is narrower and more operational: does it make sense to run quantum key distribution over the fiber you already lease between two buildings, two data centers, or two trading floors, and where does that judgment call go wrong.
What Terrestrial QKD Actually Does
Quantum key distribution is a method for two parties to generate a shared secret key with a mathematically provable guarantee that any eavesdropping attempt will be detected. The most widely deployed protocol, BB84, encodes key bits onto the polarization or phase of individual photons sent down an optical fiber. Because quantum states cannot be measured without disturbing them, an attacker who intercepts and re-transmits photons introduces detectable errors. The two endpoints compare a sample of their results over a separate authenticated channel; if the error rate is too high, they discard the key and try again.
Crucially, QKD does not encrypt your data. It only establishes a symmetric key, which is then used with a conventional cipher such as AES-256 to actually encrypt traffic. This distinction matters enormously for how organizations should think about QKD: it replaces one specific step (key agreement) in a security stack that still needs authentication, access control, key management, and application-layer protections doing everything else.
The physical constraints that shape every deployment decision
Photons degrade as they travel through glass. Attenuation in standard telecom fiber runs around 0.2 dB per kilometer, and because QKD works at the single-photon level, there is no way to simply amplify the signal the way conventional optical networking does with erbium-doped fiber amplifiers. Amplifying a quantum state destroys the very property that makes it secure. In practice, this caps unrepeated QKD links at somewhere between 100 and 150 kilometers on commercial-grade fiber, and even that upper bound requires excellent equipment and quiet conditions.
Extending beyond that range requires a “trusted node”: a physical relay point where the key is fully decrypted, regenerated, and re-encrypted for the next hop. Every trusted node is, by definition, a place where the key exists in the clear. That is the central engineering trade-off of terrestrial QKD, and it is the detail most vendor pitches gloss over.
Where Terrestrial QKD Genuinely Makes Sense
Despite the caveats, there are real, economically defensible deployments running today. The pattern across nearly all of them is the same: a short, high-value, physically controlled link between two points that already justify significant security spend.
Bank data-center interconnects
The most mature real-world case is exactly this scenario. JPMorgan Chase, working with Toshiba and Ciena, built a quantum-secured crypto-agile network (Q-CAN) connecting two of its own data centers over roughly 46 kilometers of deployed telecom fiber, running 100 Gbps QKD-secured IPsec VPN tunnels with over 45 days of continuous operation. A separate demonstration multiplexed a QKD channel onto the same fiber carrying 800 Gbps optical data channels, explicitly to secure a blockchain settlement application. These are not laboratory curiosities; they are production-adjacent trials on infrastructure the bank owns end to end, which removes the trusted-node problem almost entirely because the bank controls both endpoints and the fiber path between them.
National and metro-area government backbones
Singapore’s National Quantum-Safe Network is built around fiber-connected nodes across government, university, and select private-sector premises, explicitly designed as a testbed for quantum-safe key distribution across a metro footprint where the state controls the physical fiber plant. Similar metro testbeds exist across parts of Europe and China, generally sized to a single city or research corridor rather than a national long-haul network. In these cases, the organization deploying QKD is also the one who owns or heavily regulates the fiber, which sidesteps a lot of the third-party trust problem that dogs commercial deployments.
Point-to-point links protecting long-lived secrets
QKD’s clearest value proposition is protecting data with a very long confidentiality shelf life against “harvest now, decrypt later” collection, where an adversary records encrypted traffic today intending to decrypt it once a cryptographically relevant quantum computer exists. For a narrow set of links, such as a link carrying decades-sensitive state secrets, legal case files, or root key material between a primary and disaster-recovery site, the cost of dedicated QKD hardware is trivial next to the cost of that data leaking in fifteen years. Our piece on harvest-now-decrypt-later threats goes deeper into which data categories actually warrant this kind of urgency.
| Use case | Fits terrestrial QKD? | Why |
|---|---|---|
| Bank primary-to-DR data center link, owned fiber, under 80 km | Yes | Single high-value point-to-point path, no third-party trust needed |
| Government building-to-building link within one metro area | Yes, with caveats | State can secure the fiber plant and the trusted nodes it controls |
| Retail bank branch network across a country | No | Thousands of endpoints and long distances make trusted-node sprawl unmanageable |
| SaaS company protecting API traffic to customers | No | QKD cannot reach arbitrary internet endpoints; PQC in TLS is the correct tool |
| Multi-cloud workload replication across providers | No | Cloud provider network paths are not QKD-compatible and change dynamically |
Where Terrestrial QKD Is Overkill or Impractical
The trusted-node problem does not disappear, it relocates
QKD is often marketed as removing the need to trust intermediaries, because the physics detects tampering. That is true for a single unrepeated hop. The moment a network needs more than one hop, which is most real enterprise topologies, every relay node becomes a point where keys exist in plaintext and depend entirely on conventional physical and operational security. A national QKD backbone with dozens of trusted nodes has, in a meaningful sense, reintroduced the exact trust assumptions QKD was meant to remove, just moved from “trust the math” to “trust the guards, the vetting process, and the software on each relay box.” Security researchers who have pushed back on aggressive QKD marketing, including in published rebuttals to national security agency objections, generally converge on this point: QKD’s guarantee is narrow and does not extend across a multi-hop network the way marketing materials sometimes imply.
A three-hop terrestrial QKD path
Bank A and Bank B are 260 km apart, beyond the roughly 100-150 km unrepeated range of fiber QKD. Two trusted nodes sit at the midpoints, each one fully decrypting and re-generating the key before forwarding it. The cryptographic guarantee between Bank A and node one, and between node one and node two, is strong. The overall guarantee between Bank A and Bank B depends on the physical and operational security of both intermediate nodes, which is a conventional security problem, not a quantum one.
Distance and topology mismatches
Most enterprise security problems are not point-to-point. They involve branch offices scattered across a country, remote employees on home internet connections, third-party APIs hosted by vendors you do not control, and workloads that move between cloud regions on a schedule set by a cost-optimization script. QKD has no answer for any of that. It requires dedicated fiber (or, at minimum, a wavelength on fiber you control) between two known, fixed points. As soon as a security requirement involves “any two endpoints on the internet,” QKD is architecturally the wrong tool, and post-quantum cryptography embedded in TLS is the appropriate one. Our deep dive on post-quantum cryptography in TLS covers how that transition is actually happening across the wider internet.
Cost that does not scale
A single commercial QKD system, including transmitter, receiver, and integration engineering, typically runs from the mid six figures into seven figures per link, before ongoing operational costs for monitoring, key management appliances, and physical security of the trusted nodes. Post-quantum cryptography, by contrast, is a software and firmware upgrade that rides on hardware organizations already own. For an enterprise with dozens or hundreds of network paths to secure against the same harvest-now-decrypt-later threat, spending seven figures per link on a handful of QKD paths while leaving the rest exposed is, in nearly every threat model, a worse allocation of budget than deploying PQC everywhere and reserving QKD for the two or three links where its very specific properties are worth the premium.
QKD does not address most real breach vectors
The overwhelming majority of enterprise breaches involve credential theft, phishing, misconfigured cloud storage, unpatched software, or insider misuse, none of which QKD touches. QKD hardens exactly one link in the chain: the key exchange on a specific physical path. An organization that deploys expensive QKD hardware while leaving multi-factor authentication gaps or unpatched VPN appliances has spent significant capital defending against an attack that quantum computers cannot yet perform, while leaving open the attack that is actually happening this week.
Building a Decision Framework
Rather than treating QKD as a binary yes-or-no technology, it helps to score a candidate link against the conditions that made the JPMorgan and Singapore deployments work.
| Question | Favors terrestrial QKD | Favors PQC instead |
|---|---|---|
| Do you own or fully control the fiber path? | Yes, single-tenant dark fiber | No, leased or shared carrier network |
| What is the distance? | Under 100-150 km, one hop | Any distance, especially multi-hop or internet-routed |
| How many endpoints need protecting? | One or two high-value links | Dozens to thousands of endpoints |
| How long must the data stay confidential? | Decades, justifying a capital-intensive solution | Standard retention windows |
| Is there budget for dedicated hardware and trusted-node security? | Yes, seven-figure budget available | Limited budget, prefer software-only upgrade |
If a link scores mostly in the QKD column, treat it as a genuine candidate. If it scores mostly in the PQC column, and most enterprise links do, then hybrid PQC key establishment is the pragmatic choice. Many mature security teams are landing on a hybrid posture anyway: PQC everywhere as the baseline, with QKD reserved for a small number of links where the physical control and budget both align, and where a hybrid classical-plus-QKD key can still fail over gracefully if the quantum link degrades. Maintaining that kind of flexibility is really a crypto-agility problem, and our guide to building crypto-agility into cryptographic infrastructure covers how to keep both options open without hard-coding a single algorithm choice into every system.
Operational Realities Teams Underestimate
Beyond the headline distance and cost figures, several operational details tend to surprise teams evaluating QKD for the first time.
- QKD systems require precise timing and calibration; environmental vibration, temperature swings in outdoor fiber runs, and even seasonal fiber expansion can degrade key generation rates, requiring active monitoring that most network operations teams have never had to run before.
- Key generation rates on commercial QKD systems are modest, often in the range of kilobits to low megabits per second after error correction and privacy amplification, meaning QKD supplies the symmetric key material while a conventional cipher does the actual high-throughput encryption.
- Vendor lock-in is a real concern; QKD hardware from different manufacturers frequently does not interoperate cleanly, and switching vendors after a deployment can mean re-running fiber characterization and re-certifying the link.
- Regulatory and export-control considerations apply to quantum cryptographic hardware in a number of jurisdictions, adding procurement lead time that rarely shows up in initial project timelines.
Common Mistakes and What Actually Worked
Common mistake
Treating a QKD pilot as a substitute for a broader post-quantum migration plan. Several early enterprise QKD projects secured one flagship link, generated a strong press release, and then left the remaining ninety-plus percent of the organization’s network paths on classical RSA and ECDH key exchange with no PQC roadmap at all. QKD on one link does nothing to protect the thousands of other sessions carrying equally sensitive data. A single hardened link inside an otherwise unmigrated network is a demonstration project, not a security posture.
What worked
Organizations that treated QKD as one tool inside a layered, crypto-agile architecture got the most durable value. JPMorgan’s Q-CAN network paired QKD-derived keys with a conventional IPsec VPN and an orchestration layer (Clarion KX) capable of switching key-generation methods without redesigning the application layer. That combination meant the flagship link was genuinely hardened, while the broader PQC migration for everything else could proceed on its own, separate timeline without being blocked on quantum hardware procurement.
Frequently Overlooked Details
- Authentication channel dependencyQKD needs a pre-existing authenticated classical channel to prevent man-in-the-middle attacks during key negotiation; that channel itself must be secured, often with the very classical or post-quantum cryptography QKD is meant to complement.
- Denial-of-service exposureBecause QKD channels are extremely sensitive to noise, an attacker can deliberately inject light or vibration into the fiber to drive the error rate above threshold, forcing the system to discard keys and effectively denying service, without ever breaking the cryptography itself.
- Key management overheadQKD generates raw key material that still needs a key management system to buffer, synchronize, and hand off to the encryption layer; this software layer is often underbudgeted relative to the photonic hardware itself.
- Fiber sharing constraintsRunning QKD on the same fiber as high-power classical data channels can introduce Raman scattering noise that degrades the quantum signal, sometimes forcing organizations to lease a dedicated dark fiber strand rather than reuse existing lit capacity.
- Regulatory audit expectationsAuditors evaluating a QKD deployment increasingly expect documentation of the trusted-node security model, not just the photonic layer, since that is where the actual attack surface for multi-hop networks lives.
Glossary
- BB84
- The original and most widely implemented quantum key distribution protocol, using the polarization states of single photons to encode key bits and detect eavesdropping through induced measurement errors.
- Trusted node
- A physical relay point in a multi-hop QKD network where the key is decrypted and regenerated in the clear before being re-encrypted for the next segment, relying on conventional security rather than quantum guarantees.
- Harvest now, decrypt later
- An attack strategy in which an adversary records encrypted traffic today with the intent of decrypting it once a sufficiently powerful quantum computer becomes available, making long-lived confidential data a priority for early cryptographic protection.
- Crypto-agility
- The architectural property of a system that allows cryptographic algorithms and key-establishment methods to be swapped or upgraded without redesigning the surrounding application, useful for hedging between QKD, classical, and post-quantum approaches.
- Privacy amplification
- A post-processing step in QKD that distills a shorter, fully secret key from a longer raw key, removing any partial information an eavesdropper might have gained during transmission.
Key Takeaways
- Terrestrial QKD is a mature, commercially deployed technology, but its guarantees apply cleanly only to a single unrepeated fiber hop, typically under 100-150 kilometers.
- Real enterprise deployments, such as JPMorgan’s data-center interconnect and Singapore’s metro network, succeed because the organization controls both endpoints and the fiber path between them.
- Multi-hop QKD networks require trusted nodes, which reintroduce conventional physical and operational trust assumptions that the technology is often marketed as eliminating.
- QKD cannot reach arbitrary internet endpoints, cloud workloads, or branch office networks; its topology is fundamentally point-to-point.
- Post-quantum cryptography is a software upgrade that scales to unlimited endpoints at near-zero marginal cost, making it the correct default for the vast majority of enterprise links.
- The strongest real-world deployments pair QKD with crypto-agile orchestration so the flagship link is hardened while the rest of the network migrates to PQC on its own schedule.
- A useful screening test before funding a QKD project is whether the link is short, single-tenant, extremely high value, and needs decades of confidentiality; if not, PQC is very likely the better investment.
FAQs
Is terrestrial quantum key distribution the same as satellite QKD?
No. Terrestrial QKD runs over ground-based optical fiber and is limited to roughly 100-150 kilometers per unrepeated hop. Satellite QKD uses free-space optical links to relay quantum keys across continental and intercontinental distances, avoiding fiber attenuation but introducing its own engineering challenges around tracking, weather, and orbital mechanics.
What is the maximum distance for terrestrial QKD without a relay?
Commercial systems on standard telecom fiber generally reach somewhere between 100 and 150 kilometers before signal loss makes key generation impractical. Beyond that distance, networks require a trusted node that decrypts and regenerates the key, which introduces a conventional security dependency at each relay point.
Does QKD encrypt my data directly?
No. QKD only establishes a shared symmetric key between two parties. That key is then used with a standard cipher, typically AES-256, to actually encrypt the data. QKD replaces the key-exchange step in a security stack; authentication, access control, and application security still need to be handled separately.
Why do banks like JPMorgan invest in terrestrial QKD if it is so limited?
Because their use case fits the narrow conditions where QKD excels: a short, high-value link between two data centers the bank fully owns, carrying traffic sensitive enough to justify dedicated hardware. Owning both endpoints and the fiber path removes most of the trusted-node trust problem that affects wider deployments.
Can QKD protect cloud-to-cloud or branch office traffic?
Generally not in any practical sense. QKD requires a fixed physical fiber path or free-space link between two known points, and cloud provider networks route dynamically across shared infrastructure that is incompatible with that requirement. Post-quantum cryptography in standard TLS is the appropriate tool for that traffic.
Is QKD vulnerable to quantum computers itself?
The key exchange mechanism relies on physical laws rather than computational hardness, so a quantum computer cannot break the core BB84 protocol the way it could break RSA. However, implementation flaws in real hardware, such as detector blinding attacks, have been demonstrated against commercial systems, meaning security still depends heavily on rigorous engineering, not just the underlying physics.
How much does a terrestrial QKD deployment typically cost?
Costs vary widely by vendor and distance, but a single commercial link including transmitter, receiver, and integration engineering commonly runs from the mid six figures into seven figures, before ongoing costs for monitoring and trusted-node security. This is why most organizations reserve QKD for a small number of very high-value links rather than network-wide deployment.
Should every enterprise be evaluating terrestrial QKD right now?
Most should not make it a priority. Post-quantum cryptography addresses the same harvest-now-decrypt-later threat for a fraction of the cost and scales to every network path an organization has, while QKD only fits a small number of point-to-point links where physical control, budget, and confidentiality duration all line up favorably.
- JPMorgan Chase, “Firm Establishes Quantum-Secured Crypto-Agile Network,” JPMorgan Technology Blog
- JPMorgan Chase, Toshiba, and Ciena, “Build the First Quantum Key Distribution Network Used to Secure Mission-Critical Blockchain Application,” JPMorgan Technology Blog
- ID Quantique, “IDQ Enables Successful 100Gbps IPSec VPN Demo at JPMorgan Chase,” idquantique.com
- The Quantum Insider, “Understanding Quantum Networking and Its Industrial Potential,” thequantuminsider.com
- arXiv preprint, “Quantum Key Distribution for Data Center Security: A Feasibility Study,” arxiv.org/abs/2307.13098
- arXiv preprint, “The Debate Over QKD: A Rebuttal to the NSA’s Objections,” arxiv.org/abs/2307.15116
- arXiv preprint, “Towards National Quantum Communication in Europe: Planning and Sizing Terrestrial QKD Networks,” arxiv.org/abs/2604.06764
- Palo Alto Networks, “What Is Quantum Key Distribution (QKD)? Plus How It Works,” paloaltonetworks.com/cyberpedia
Terrestrial QKD sits alongside a broader set of cryptographic modernization decisions enterprises are working through right now, including how to inventory existing cryptography with a cryptographic bill of materials and how hardware security modules need to evolve for a post-quantum world, covered in our guide to hardware security modules and PQC readiness. Read those alongside this piece before committing budget to any single quantum-safe technology.
