pith. sign in

arxiv: 2604.20376 · v1 · submitted 2026-04-22 · 💻 cs.NI

Interconnecting Regional QKD Networks: Hybrid Key Delivery Across Quantum Domains

Pith reviewed 2026-05-09 23:51 UTC · model grok-4.3

classification 💻 cs.NI
keywords QKDhybrid key deliverypost-quantum cryptographyquantum networkskey relayWAN interconnectiontestbed implementation
0
0 comments X

The pith

Regional QKD networks interconnect by relaying keys with post-quantum cryptography over classical links.

A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.

This paper develops a hybrid key delivery service to link separate QKD subnetworks across wide areas. It generates secret keys locally using QKD within each domain and relays them securely to other domains using post-quantum cryptography such as Kyber over standard classical network connections. The design is distributed and includes dynamic routing of keys at the system level. The approach has been built and tested in an operational setup with three regional subnetworks, providing performance measurements that demonstrate its scalability for key distribution services.

Core claim

The authors present a standards-driven design for a unified hybrid key delivery service that connects isolated QKD domains via classical WAN links. Keys are generated within each domain using QKD and then relayed using PQC algorithms like Kyber, with dynamic routing and system-level management. This solution has been implemented in a testbed of three regional subnetworks, where design principles, deployment details, and experimental performance results are shown for the scalable service.

What carries the argument

The hybrid key relay using post-quantum cryptography to forward QKD-generated keys between domains over classical links.

If this is right

  • The service enables interconnection of regional QKD networks without direct long-distance quantum links.
  • Dynamic routing allows flexible key delivery across the system.
  • Experimental results from the three-subnetwork testbed validate the performance and scalability.
  • The design follows standards for potential broader adoption.

Where Pith is reading between the lines

These are editorial extensions of the paper, not claims the author makes directly.

  • Such hybrid systems may allow QKD to be deployed more widely by leveraging existing classical infrastructure for long-haul transport.
  • The testbed results suggest potential for extension to larger numbers of domains or integration with other network services.
  • Security assumptions about the PQC relay would need ongoing validation as quantum threats evolve.

Load-bearing premise

Relaying the QKD keys via PQC over classical WAN links does not introduce security vulnerabilities from the relay mechanism or implementation details.

What would settle it

A security breach in the relayed keys or key rates too low for practical use in the three-subnetwork testbed would show the hybrid approach fails to preserve security and scalability.

Figures

Figures reproduced from arXiv: 2604.20376 by Aitor Brazaola-Vicario, Alejandra Ruiz, Ana Fern\'andez-Vilas, David Barral, Diego Cifri\'an, Gonzalo Bl\'azquez, Iago F. Llovo, Juan Villasuso, Manuel Fern\'andez-Veiga, Natalia Costas, Pablo P. Rejo, Pedro Otero-Garc\'ia.

Figure 1
Figure 1. Figure 1: Workflow and message exchange between the KMSTN entities and the SAEs for a key request. [PITH_FULL_IMAGE:figures/full_fig_p011_1.png] view at source ↗
Figure 2
Figure 2. Figure 2: Map and network topology of our testbed, spanning the regions of Galicia and the Basque Country, in Northern [PITH_FULL_IMAGE:figures/full_fig_p014_2.png] view at source ↗
Figure 3
Figure 3. Figure 3: Configuration for the testbed measurements. [PITH_FULL_IMAGE:figures/full_fig_p016_3.png] view at source ↗
Figure 4
Figure 4. Figure 4: Statistics of the keyrate for two nodes. KMSTN1 (left) and KMSTN7 (right) [PITH_FULL_IMAGE:figures/full_fig_p019_4.png] view at source ↗
Figure 5
Figure 5. Figure 5: Statistics of delay for several nodes. link and are capable of attaining only around 500 b/s for the SKR. The distribution of the keyrates ( [PITH_FULL_IMAGE:figures/full_fig_p020_5.png] view at source ↗
Figure 6
Figure 6. Figure 6: Latency of key requests in ms. Values are averaged over a [PITH_FULL_IMAGE:figures/full_fig_p021_6.png] view at source ↗
Figure 7
Figure 7. Figure 7: Latency of concurrent key requests vs. time. Each point is a measure of delay, and the vertical slices correspond [PITH_FULL_IMAGE:figures/full_fig_p022_7.png] view at source ↗
Figure 8
Figure 8. Figure 8: Pairwise correlation matrix between the metrics collected in the experiments. [PITH_FULL_IMAGE:figures/full_fig_p023_8.png] view at source ↗
read the original abstract

QKD technology is being increasingly adopted inside the network core for protecting information transport against any form of computational attacks. However, the use of QKD for wide-area internetworking is still challenging and costly, due to its strong trust assumptions and the low achievable key rates in long QKD links. This paper presents a standards-driven design and implementation of a unified hybrid key delivery service for a network of isolated QKD domains (subnetworks using QKD as provider technology for secret key generation) connected via classical WAN links. The framework follows a distributed architecture and uses a hybrid approach where keys generated in a domain are securely relayed to other domains with PQC (Kyber), dynamically routed, and managed at the system level. The solution has been implemented in an operational testbed comprising three regional subnetworks. We present the design principles, the deployment, and the experimental performance results for this scalable key delivery service.

Editorial analysis

A structured set of objections, weighed in public.

Desk editor's note, referee report, simulated authors' rebuttal, and a circularity audit. Tearing a paper down is the easy half of reading it; the pith above is the substance, this is the friction.

Referee Report

2 major / 0 minor

Summary. The paper describes a standards-driven hybrid key delivery architecture for interconnecting isolated QKD domains over classical WAN links. Keys generated via QKD within each regional subnetwork are relayed using Kyber (PQC) with dynamic routing and system-level management. The design is implemented in an operational testbed spanning three regional subnetworks, and the manuscript presents the deployment details together with experimental performance results for the resulting scalable key delivery service.

Significance. If the hybrid relay mechanism can be shown to preserve end-to-end security, the work would offer a pragmatic path to scaling QKD beyond single domains by exploiting existing classical infrastructure. The concrete testbed deployment with three subnetworks constitutes a useful engineering demonstration of feasibility and interoperability for quantum networking.

major comments (2)
  1. [Abstract / Architecture description] The central claim that keys are 'securely relayed' across domains rests on the hybrid PQC relay preserving the security properties of the original QKD keys. No security model, threat analysis, or reduction is provided anywhere in the manuscript to substantiate this (see abstract and the description of the relay mechanism).
  2. [Experimental results] The experimental results are presented without quantitative metrics, error bars, baseline comparisons, or statistical analysis, which prevents assessment of whether the observed performance supports the scalability claims (see the testbed results section).

Simulated Author's Rebuttal

2 responses · 0 unresolved

We thank the referee for the constructive comments on our manuscript. We address each major point below and will revise the paper to strengthen the security discussion and the presentation of experimental results.

read point-by-point responses
  1. Referee: [Abstract / Architecture description] The central claim that keys are 'securely relayed' across domains rests on the hybrid PQC relay preserving the security properties of the original QKD keys. No security model, threat analysis, or reduction is provided anywhere in the manuscript to substantiate this (see abstract and the description of the relay mechanism).

    Authors: We agree that the manuscript would benefit from an explicit security discussion. The design assumes the information-theoretic security of QKD within each domain and the computational security of Kyber for the WAN relay, with relays trusted to forward but not to learn the keys. In the revised manuscript we will add a dedicated subsection in the architecture section that states the threat model (honest-but-curious inter-domain relays, no collusion with domain-internal QKD nodes), lists the security assumptions, and explains why the hybrid composition preserves end-to-end confidentiality. We will also cite Kyber’s security proofs and note that a full reduction proof lies outside the scope of this engineering-focused paper. revision: yes

  2. Referee: [Experimental results] The experimental results are presented without quantitative metrics, error bars, baseline comparisons, or statistical analysis, which prevents assessment of whether the observed performance supports the scalability claims (see the testbed results section).

    Authors: We acknowledge that the current testbed results section presents performance data primarily through figures without accompanying numerical tables, error bars, or statistical treatment. In the revision we will expand this section with a table of measured key-delivery rates, relay latencies, and overheads (including standard deviations from repeated runs), direct comparisons to single-domain QKD baselines, and a brief discussion of how these metrics scale with the number of domains. This will allow readers to evaluate the scalability claims more rigorously. revision: yes

Circularity Check

0 steps flagged

No circularity: engineering design and experimental report with no derivations

full rationale

The paper presents a standards-driven design, implementation, and experimental evaluation of a hybrid QKD-PQC key relay architecture across regional domains. It describes a distributed system with dynamic routing, reports deployment in a three-subnetwork testbed, and gives performance results. No equations, fitted parameters, uniqueness theorems, or derivation chains appear in the provided text. The central claims concern functionality, scalability, and measured performance rather than any result derived from prior inputs by construction. Any self-citations (if present) are not load-bearing for a mathematical argument because no such argument exists. The absence of a formal security reduction is a completeness concern, not evidence of circularity.

Axiom & Free-Parameter Ledger

0 free parameters · 2 axioms · 0 invented entities

The central claim rests on standard assumptions about QKD security within domains and PQC security for classical relay channels, with no free parameters, invented entities, or ad-hoc axioms introduced.

axioms (2)
  • domain assumption QKD provides information-theoretically secure keys within isolated domains
    Invoked as the foundation for local key generation in the hybrid service.
  • domain assumption Kyber PQC provides secure key encapsulation over classical WAN links
    Used to justify secure relaying of keys between domains.

pith-pipeline@v0.9.0 · 5514 in / 1175 out tokens · 24695 ms · 2026-05-09T23:51:31.947602+00:00 · methodology

discussion (0)

Sign in with ORCID, Apple, or X to comment. Anyone can read and Pith papers without signing in.

Reference graph

Works this paper leans on

41 extracted references · 41 canonical work pages

  1. [1]

    Recent Progress in Quantum Key Distribution Network Deployments and Standards,

    M. Stanley, Y . Gui, D. Unnikrishnan, S. Hall, and I. Fatadin, “Recent Progress in Quantum Key Distribution Network Deployments and Standards,”Journal of Physics: Conference Series, vol. 2416, p. 012001, Dec. 2022

  2. [2]

    The Engineering of Software-Defined Quantum Key Distribution Networks,

    A. Aguado, V . Lopez, D. Lopez, M. Peev, A. Poppe, A. Pastor, J. Folgueira, and V . Martin, “The Engineering of Software-Defined Quantum Key Distribution Networks,”IEEE Communications Magazine, vol. 57, no. 7, pp. 20–26, 2019

  3. [3]

    Deployment-ready quantum key distribution over a classical network infrastructure in padua,

    M. Avesani, G. Foletto, M. Padovan, L. Calderaro, C. Agnesi, E. Bazzani, F. Berra, T. Bertapelle, F. Picciariello, F. B. Santagiustina,et al., “Deployment-ready quantum key distribution over a classical network infrastructure in padua,” Journal of Lightwave Technology, vol. 40, no. 6, pp. 1658–1663, 2022

  4. [4]

    Quantum key distribution networks: challenges and future research issues in security,

    C.-W. Tsai, C.-W. Yang, J. Lin, Y .-C. Chang, and R.-S. Chang, “Quantum key distribution networks: challenges and future research issues in security,”Applied Sciences, vol. 11, no. 9, p. 3767, 2021

  5. [5]

    Quantum key distribution: a networking perspective,

    M. Mehic, M. Niemiec, S. Rass, J. Ma, M. Peev, A. Aguado, V . Martin, S. Schauer, A. Poppe, C. Pacher,et al., “Quantum key distribution: a networking perspective,”ACM Computing Surveys (CSUR), vol. 53, no. 5, pp. 1–41, 2020

  6. [6]

    A critical analysis of deployed use cases for quantum key distribution and comparison with post-quantum cryptography,

    N. Aquina, B. Cimoli, S. Das, K. H ¨ovelmanns, F. J. Weber, C. Okonkwo, S. Rommel, B. ˇSkori´c, I. Tafur Monroy, and S. Verschoor, “A critical analysis of deployed use cases for quantum key distribution and comparison with post-quantum cryptography,”EPJ Quantum Technology, vol. 12, no. 1, p. 51, 2025

  7. [7]

    The evolution of quantum key distribution networks: On the road to the qinternet,

    Y . Cao, Y . Zhao, Q. Wang, J. Zhang, S. X. Ng, and L. Hanzo, “The evolution of quantum key distribution networks: On the road to the qinternet,”IEEE Communications Surveys & Tutorials, vol. 24, no. 2, pp. 839–894, 2022

  8. [8]

    The security of practical quantum key distribution,

    V . Scarani, H. Bechmann-Pasquinucci, N. J. Cerf, M. Du ˇsek, N. L ¨utkenhaus, and M. Peev, “The security of practical quantum key distribution,”Reviews of modern physics, vol. 81, no. 3, pp. 1301–1350, 2009

  9. [9]

    Fundamental limits of repeaterless quantum communications,

    S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental limits of repeaterless quantum communications,” Nature communications, vol. 8, no. 1, p. 15043, 2017

  10. [10]

    Provably secure and high-rate quantum key distribution with time-bin qudits,

    N. T. Islam, C. C. W. Lim, C. Cahall, J. Kim, and D. J. Gauthier, “Provably secure and high-rate quantum key distribution with time-bin qudits,”Science advances, vol. 3, no. 11, p. e1701491, 2017. April 23, 2026 DRAFT 26

  11. [11]

    Quantum Key Distribution Networks - Key Management: A Survey,

    E. Dervisevic, A. Tankovic, E. Fazel, R. Kompella, P. Fazio, M. V oznak, and M. Mehic, “Quantum Key Distribution Networks - Key Management: A Survey,”ACM Computer Surveys, vol. 57, May 2025

  12. [12]

    Integration of quantum key distribution networks and classical networks: An evolution perspective,

    J. Li, P. Zheng, Z. Li, K. Xue, Z. Xie, N. Yu, Q. Sun, and J. Lu, “Integration of quantum key distribution networks and classical networks: An evolution perspective,”IEEE Network, vol. 39, pp. 180–187, May 2025

  13. [13]

    ETSI GS QKD 014: Quantum Key Distribution (QKD); Integration with Transport and Network Security Protocols,

    ETSI, “ETSI GS QKD 014: Quantum Key Distribution (QKD); Integration with Transport and Network Security Protocols,” tech. rep., European Telecommunications Standards Institute, 2023

  14. [14]

    Quantum Key Distribution (QKD); Protocol and data format of REST-based Interoperable Key Management System API,

    ETSI, “Quantum Key Distribution (QKD); Protocol and data format of REST-based Interoperable Key Management System API,” tech. rep., European Telecommunications Standards Institute, 2023

  15. [15]

    FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM),

    NIST, “FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM),” tech. rep., National Institute of Standards and Technology, July 2024. Official NIST standardization of CRYSTALS-Kyber

  16. [16]

    Quantum key distribution networks – Functional architecture (Recommendation Y .3802),

    ITU-T, “Quantum key distribution networks – Functional architecture (Recommendation Y .3802),” Recommendation Y .3802, International Telecommunications Union, Dec. 2020. In force; see also amendment and corrigendum

  17. [17]

    Quantum cryptography in practice,

    C. Elliott, D. Pearson, and G. Troxel, “Quantum cryptography in practice,” inProceedings of the 2003 Conference on Applications, Technologies, Architectures, and Protocols for Computer Communications, SIGCOMM ’03, (New York, NY , USA), p. 227–238, Association for Computing Machinery, 2003

  18. [18]

    Architecture of the Secoqc Quantum Key Distribution network,

    M. Dianati and R. Alleaume, “Architecture of the Secoqc Quantum Key Distribution network,” in2007 First International Conference on Quantum, Nano, and Micro Technologies (ICQNM’07), pp. 13–13, 2007

  19. [19]

    Field demonstration of quantum key distribution in the Tokyo QKD Network,

    M. Fujiwara, H. Ishizuka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y . Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Hasegawa, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, Y . Tokura, and M. Sasaki, “Field demonstration of quantum key distribution in the Tokyo QKD Network,” in2011 International Quantum Electronics Conference (IQEC) and Conf...

  20. [20]

    Long-term performance of the SwissQuantum quantum key distribution network in a field environment,

    D. Stucki, M. Legr ´e, F. Buntschu,et al., “Long-term performance of the SwissQuantum quantum key distribution network in a field environment,”New Journal of Physics, vol. 13, p. 123001, dec 2011

  21. [21]

    An integrated space-to-ground quantum communication network over 4,600 kilometres,

    Y .-A. Chen, Q. Zhang, T.-Y . Chen,et al., “An integrated space-to-ground quantum communication network over 4,600 kilometres,”Nature, vol. 589, pp. 214–219, Jan 2021

  22. [22]

    OpenQKDNetwork — openqkdnetwork.net

    “OpenQKDNetwork — openqkdnetwork.net.” https://www.openqkdnetwork.net/. [Accessed 23-07-2025]

  23. [23]

    European Quantum Communication Infrastructure - EuroQCI — digital-strategy.ec.europa.eu

    “European Quantum Communication Infrastructure - EuroQCI — digital-strategy.ec.europa.eu.” https://digital-strategy. ec.europa.eu/en/policies/european-quantum-communication-infrastructure-euroqci. [Accessed 23-07-2025]

  24. [24]

    Madrid Quantum Communication Infrastructure: a testbed for assessing QKD technologies into real production networks,

    D. Lopez, J. P. Brito, A. Pastor, V . Martin, C. S ´anchez, D. Rincon, and V . Lopez, “Madrid Quantum Communication Infrastructure: a testbed for assessing QKD technologies into real production networks,” in2021 Optical Fiber Communications Conference and Exhibition (OFC), pp. 1–4, 2021

  25. [25]

    Linking QKD Testbeds across Europe,

    M. Brauer, R. J. Vicente, J. S. Buruaga, R. B. M ´endez, R.-P. Braun, M. Geitz, P. Rydlichkowski, H. H. Brunner, F. Fung, M. Peev, A. Pastor, D. R. Lopez, V . Martin, and J. P. Brito, “Linking QKD Testbeds across Europe,”Entropy, vol. 26, no. 2, 2024

  26. [26]

    An Enhanced Virtualized Control and Key Management Model for QKD Networks,

    B. Lopez, I. Vidal, F. Valera, and D. R. Lopez, “An Enhanced Virtualized Control and Key Management Model for QKD Networks,”IEEE Network, vol. 39, no. 3, pp. 165–172, 2025

  27. [27]

    Security of trusted repeater quantum key distribution networks,

    L. Salvail, M. Peev, E. Diamanti, R. All ´eaume, N. L ¨utkenhaus, and T. L ¨anger, “Security of trusted repeater quantum key distribution networks,”J. Comput. Secur., vol. 18, p. 61–87, Jan. 2010

  28. [28]

    On the Security of Quantum Key Distribution networks,

    E. Lella and G. Schmid, “On the Security of Quantum Key Distribution networks,”Cryptography, vol. 7, no. 4, 2023

  29. [29]

    Trust-Enhanced Quantum Key Management System for Meshed QKD Networks,

    J. Berl, M. Wenning, C. Mullan, H. Grießer, and T. Fehenberger, “Trust-Enhanced Quantum Key Management System for Meshed QKD Networks,” inOptical Fiber Communication Conference (OFC) 2025, p. M3Z.16, Optica Publishing Group, 2025. April 23, 2026 DRAFT 27

  30. [30]

    ETSI GS QKD 004: Quantum Key Distribution (QKD); Application Interface,

    ETSI, “ETSI GS QKD 004: Quantum Key Distribution (QKD); Application Interface,” tech. rep., European Telecommunications Standards Institute, 2022

  31. [31]

    Key Management System - QCI-CAT — qci-cat.at

    “Key Management System - QCI-CAT — qci-cat.at.” https://qci-cat.at/key-management-system/. [Accessed 23-07- 2025]

  32. [32]

    All optical metropolitan quantum key distribution network with post-quantum cryptography authentication,

    Y .-H. Yang, P.-Y . Li, S.-Z. Ma,et al., “All optical metropolitan quantum key distribution network with post-quantum cryptography authentication,”Opt. Express, vol. 29, pp. 25859–25867, Aug 2021

  33. [33]

    Hybrid QKD & PQC Protocols implemented in the Berlin OpenQKD testbed,

    M. Geitz, R. D ¨oring, and R.-P. Braun, “Hybrid QKD & PQC Protocols implemented in the Berlin OpenQKD testbed,” in2023 8th International Conference on Frontiers of Signal Processing (ICFSP), pp. 69–74, 2023

  34. [34]

    A method for obtaining digital signatures and public-key cryptosystems,

    R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key cryptosystems,” Communications of the ACM, vol. 21, pp. 120–126, 2 1978

  35. [35]

    Elliptic curve cryptosystems,

    N. Koblitz, “Elliptic curve cryptosystems,”Mathematics of Computation, vol. 48, no. 177, pp. 203–209, 1987

  36. [36]

    Post-Quantum Cryptography key exchange to extend a high-security QKD platform into the mobile 5G/6G networks,

    R. D ¨oring, M. Geitz, and R.-P. Braun, “Post-Quantum Cryptography key exchange to extend a high-security QKD platform into the mobile 5G/6G networks,” inInternational Conference on Communication and Network Technology, pp. 148–158, Springer, 2022

  37. [37]

    Quantum- resistant Transport Layer Security,

    C. Rubio Garc ´ıa, S. Rommel, S. Takarabt, J. J. Vegas Olmos, S. Guilley, P. Nguyen, and I. Tafur Monroy, “Quantum- resistant Transport Layer Security,”Computer Communications, vol. 213, pp. 345–358, 2024

  38. [38]

    Experimental Integration of Quantum Key Distribution and Post-Quantum Cryptography in a Hybrid Quantum-Safe Cryptosystem,

    L. Garms, T. K. Para ¨ıso, N. Hanley,et al., “Experimental Integration of Quantum Key Distribution and Post-Quantum Cryptography in a Hybrid Quantum-Safe Cryptosystem,”Advanced Quantum Technologies, vol. 7, no. 4, p. 2300304, 2024

  39. [39]

    Quantum Cryptography in 5G Networks: A Comprehensive Overview,

    M. Mehic, L. Michalek, E. Dervisevic, P. Burdiak, M. Plakalovic, J. Rozhon, N. Mahovac, F. Richter, E. Kaljic, F. Lauterbach, P. Njemcevic, A. Maric, M. Hamza, P. Fazio, and M. V oznak, “Quantum Cryptography in 5G Networks: A Comprehensive Overview,”IEEE Communications Surveys & Tutorials, vol. 26, no. 1, pp. 302–346, 2024

  40. [40]

    Enhanced Network Security Protocols for the Quantum Era: Combining Classical and Post-Quantum Cryptography, and Quantum Key Distribution,

    C. Rubio Garc ´ıa, A. Cano Aguilera, C. Stan, J. Jos´e Vegas Olmos, S. Rommel, and I. Tafur Monroy, “Enhanced Network Security Protocols for the Quantum Era: Combining Classical and Post-Quantum Cryptography, and Quantum Key Distribution,”IEEE Journal on Selected Areas in Communications, vol. 43, no. 8, pp. 2765–2781, 2025

  41. [41]

    A formal basis for the heuristic determination of minimum cost paths,

    P. E. Hart, N. J. Nilsson, and B. Raphael, “A formal basis for the heuristic determination of minimum cost paths,” IEEE Transactions on Systems Science and Cybernetics, vol. 4, no. 2, pp. 100–107, 1968. April 23, 2026 DRAFT