REVIEW 4 major objections 8 minor 16 references
Onion Routing Key Distribution for QKDN
T0 review · 4 major / 8 minor · reviewed 2026-08-08 · deepseek-v4-flash
Pith's one-line read The paper claims that combining QKD with onion-routed post-quantum encapsulation lets any two nodes in a QKD network establish a shared secret without revealing it to intermediate relays or exposing the sender-receiver pair.
desk verdict A sensible but broken composition: the initiator would need every intermediate node's private signing key, so the protocol as written cannot be instantiated. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The carrying mechanism is the layered onion ciphertext adapted from onion routing to QKDN key distribution. Each layer carries the next hop's identity and the rest of the onion, encrypted with a QKD-derived symmetric key for transport; the innermost payload is additionally protected by a post-quantum KEM key shared between initiator and destination. Per-node integrity tags, computed as post-quantum signatures over the next onion and its encrypted padding blocks, let each relay detect tampering before forwarding, and random padding blocks keep all onions the same length so relays cannot learn their position in the circuit.
What would settle it
Run the protocol on a three-node circuit where the middle node is compromised and holds its own QKD keys. If the initiator sends a secret S to the destination, the central claims are refuted exactly when the compromised node can recover S from the onions it forwards, or can use the observed traffic to determine that a specific sender and receiver are communicating.
Extended reading notes
Core claim
The central claim is that a hybrid of QKD, post-quantum key encapsulation, and onion routing can secure key distribution in a QKDN against malicious intermediaries. The initiator builds an onion whose innermost payload is the shared secret encrypted under a post-quantum KEM key shared only with the destination; each intermediate node decrypts one layer with the QKD key it shares with its predecessor, verifies an integrity tag, and forwards the remainder. Because no relay ever removes the final PQC layer, no relay ever sees the plaintext secret, and because each node only sees its immediate neighbors, no single node can identify both endpoints. The paper states this satisfies the confidentiality, integrity, authenticity, and anonymity requirements it sets out.
Load-bearing premise
The integrity check depends on the initiating node being able to produce a signature that is tagged with each intermediate node's private signing key; if, as the stated assumptions say, each node alone holds its own private key, that signature cannot be generated as written.
Editorial extensions
If this is right
- A compromised intermediate QKD node would not learn the shared secret, because the innermost layer is encrypted with a KEM key held only by the initiator and destination.
- No single relay can determine both the sender and the receiver, since each node sees only its predecessor and successor on the circuit.
- The protocol runs over existing key-relay infrastructure, so it does not require quantum repeaters or direct quantum links between distant endpoints.
- Critical infrastructure, inter-data-center links, and digital payment networks could use the scheme on near-term QKD hardware without waiting for quantum repeaters.
- If one ingredient fails, such as the PQC algorithm being broken, the QKD encryption still confines the secret to the network's nodes, giving a layered fallback.
Reading between the lines
- A direct extension would be to quantify the added latency per hop; the paper compares the protocol qualitatively to anonymous networks but does not report measured overhead.
- The anonymity argument covers individual on-path nodes; whether it survives a global adversary who can observe all links simultaneously is not addressed and would need a separate threat model.
- If implementation shows that generating each node's integrity tag requires that node's private key, replacing per-node signatures with keyed MACs derived from the initiator's shared KEM keys would preserve integrity without changing the onion structure.
- The same layered-encapsulation pattern could be adapted to group key distribution, where each unwrapped layer reveals the next recipient's share rather than a single shared secret.
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The manuscript proposes a key-distribution protocol for quantum key distribution networks (QKDNs) that combines the key-relay model with onion-routing-style layered encryption and post-quantum cryptography (Kyber/Dilithium). The initiator constructs layered onions containing a shared secret S and per-hop integrity tags, and each intermediate QKD node decrypts one layer, verifies a tag, re-randomizes padding, and forwards the onion over the next QKD link. The authors claim this guarantees confidentiality, integrity, authenticity, and anonymity, including protection of S against compromised intermediate nodes. The paper describes the protocol steps, presents assumptions and notation, lists three use cases, and concludes that the protocol will be implemented in a real QKDN, but contains no security proof or adversary model.
Significance. If it worked as claimed, the protocol would address a real limitation of QKD key-relay and trusted-node models, where intermediate nodes currently see the shared secret. The idea of applying onion routing to QKDN key distribution with PQC layers is timely and the use-case section is relevant. However, the central construction is not instantiable as written because the initiator is required to produce signatures with private keys it does not possess, and the paper provides no threat model or security analysis to substantiate the claimed guarantees. No code, machine-checked proofs, or parameter-free derivations are supplied; the contribution is currently a protocol sketch with unsupported security claims.
major comments (4)
- [Section III-A, step 1.iv.c.i] The integrity tag construction requires the initiator to compute tau_i = Sig(sk_i, (O_{i+1}||B'_1||...||B'_{N-1})) for every intermediate node i. This requires possession of each node's post-quantum private signing key sk_i, but Assumptions 1-7 only give the initiator its own keys, the public keys of other nodes, QKD keys with neighbors, and PQC-KEM shared keys. Assumption 6 only states that each node can sign and verify; it does not authorize the initiator to hold other nodes' private keys, and Table I defines sk_i as node i's private key. Since the verification in step 2.vii checks Ver(pk_i, ...), the initiator cannot generate a tag that node i will accept. The protocol is therefore uninstantiable and the claimed integrity and authenticity guarantee is unsupported.
- [Section III-A, steps 1.iii-1.v and 2.iv-2.viii] The padding and extension construction is internally inconsistent. Step 1.v defines O'_i = O_i || t_i || rdm_i for i=1..n+1, but only t_1..t_n and rdm_1..rdm_n are ever defined; t_{n+1} and rdm_{n+1} are undefined. Moreover, step 1.iv.a sets t_i to a vector of padding blocks, while step 1.iv.c.i defines a signature tau_i and step 2.vi and 2.vii treat t_i as a signature to be verified with pk_i. The notation conflates a block list with a signature, and the final replacement in step 1.iv.d does not make clear which value is actually transmitted as the extension. As written, the algorithm cannot be executed deterministically by a receiver.
- [Section III-A, step 1.iv.c.ii and step 2.vi] There is a second key-handling contradiction. The initiator builds Bnew = Esym(k_i, embed(k_i, tau_i)), i.e., encrypts with the one-time key k_i, but the processing node is expected to recover (k_i, t_i) via Extract(Dsym(k_{1,i}, B1)), i.e., by first decrypting B1 with the PQC-KEM key shared between P0 and P_i (also written kPQC_{P0,Pi}). The node cannot decrypt Bnew with k_{1,i} if Bnew was encrypted with k_i, and it cannot obtain k_i before decrypting B1; this is circular. The intended transport mechanism for the one-time keys is therefore not specified coherently.
- [Section III.A and Section V] The paper claims in the Abstract and Section V that the protocol 'guarantee[s] confidentiality, integrity, authenticity and anonymity', including protection of S from compromised intermediate nodes, yet no adversary model, security definitions, or proofs are given. Section III.A itself says the hybrid model 'almost ensures' the CIA triad and that only integrity needs to be guaranteed, which is in tension with the abstract's guarantee. For a cryptographic protocol paper, the security claims are therefore not substantiated; at minimum a threat model that specifies which nodes are corrupted, what capabilities they have, and what the anonymity notion is would be required. The absence of such a model leaves the main claims as assertions.
minor comments (8)
- [Section II.A] The text contains the typo 'trused-node', which should be 'trusted-node'.
- [Section III-A, step 2.iii.a] The key is written as kPQC_1,PN, which is inconsistent with the earlier kPQC_{P0,PN} notation; this appears in the decryption equations and should be corrected.
- [Table I and Section III-A] The protocol does not define the embed() function or the KDF used to derive r_i from KDF(P_i,k_i); without these definitions the padding generation is underspecified.
- [Section III-A, step 1.iii.b] The expression r_i <- QRNG(KDF(P_i,k_i)) treats a quantum random number generator as a deterministic function; please clarify whether r_i is fresh randomness that is transported in the onion or a deterministically derived value.
- [Section III-A, step 2.v] The phrase 'If receptor' appears to mean 'If receiver', and the branch returns (∅, O_{i+1}) without performing the tag verification described in the following step; the control flow needs to be stated more carefully.
- [Section V] The conclusion states that the protocol 'will be implemented in a real QKDN', but no implementation, simulation, or performance evaluation is included in this manuscript; please either remove this claim or mark it explicitly as future work.
- [Section III.A] The text says the initiator has 'previously computed a PQC-KEM key with the other nodes', but the protocol also requires per-circuit one-time keys k_i; the relationship between these two sets of keys should be clarified.
- [Section III.A] The paper cites [13] and [14] for the onion-routing construction but does not state which aspects are taken from those works and where the proposal deviates; a brief comparison would help the reader assess novelty.
Circularity Check
No significant circularity: the paper proposes a protocol construction and asserts its security properties rather than deriving them from the same properties or from the authors' own prior results.
full rationale
The paper is a construction/position proposal rather than a derivation, and its central claims do not reduce to its inputs. There are no fitted parameters, no empirical predictions, and no load-bearing self-citation: the protocol is explicitly based on the external onion-routing construction of Kuhn et al. [14], and the PQC/QKD components are standard cited primitives. The claimed confidentiality, integrity, authenticity and anonymity properties are stated (Abstract and Section V) rather than proven, which is a soundness or rigor gap, but not circularity. The most serious technical defect, in Section III-A step iv-c-i, is that the initiator is asked to compute tau_i = Sig(sk_i, ...) using the private signature key of each intermediate node, while Assumption 6 only grants each node the ability to sign and verify; this makes the integrity-tag construction uninstantiable as written. This is an internal-consistency/correctness flaw, not a circular step, because the protocol does not define the output property in terms of the input assumption; it simply fails to support the output. Overall, no step reduces by construction to an input or to the conclusion being claimed.
Assumptions & free parameters
assumptions (6)
- domain assumption Neighboring QKD nodes have pre-shared symmetric keys (assumption 3).
- domain assumption Each node's PQC private key is known only to that node (assumptions 5-6).
- domain assumption Initiator has a precomputed PQC-KEM key with every other node (Section III-A preamble).
- domain assumption Kyber and Dilithium are secure against quantum and classical adversaries (assumptions 5-6, background).
- domain assumption QKD provides information-theoretic security and adjacent-node integrity (Section II-A, footnote 2).
- domain assumption Onion routing with replies [14] provides the security properties the paper claims to adapt (Section III-A, 'based on [14]').
Cite this review
Pith. "Pith review of Onion Routing Key Distribution for QKDN." pith.science (2026). https://pith.science/paper/G3RKJXGX
@misc{pith2026250206657,
author = {Pith},
title = {Pith review of: Onion Routing Key Distribution for QKDN},
year = {2026},
howpublished = {\url{https://pith.science/paper/G3RKJXGX}},
note = {Machine review of arXiv:2502.06657}
}
read the original abstract
The advance of quantum computing poses a significant threat to classical cryptography, compromising the security of current encryption schemes such as RSA and ECC. In response to this challenge, two main approaches have emerged: quantum cryptography and post-quantum cryptography (PQC). However, both have implementation and security limitations. In this paper, we propose a secure key distribution protocol for Quantum Key Distribution Networks (QKDN), which incorporates encapsulation techniques in the key-relay model for QKDN inspired by onion routing and combined with PQC to guarantee confidentiality, integrity, authenticity and anonymity in communication. The proposed protocol optimizes security by using post-quantum public key encryption to protect the shared secrets from intermediate nodes in the QKDN, thereby reducing the risk of attacks by malicious intermediaries. Finally, relevant use cases are presented, such as critical infrastructure networks, interconnection of data centers and digital money, demonstrating the applicability of the proposal in critical high-security environments.
Figures
Reference graph
Works this paper leans on
-
[1]
Shor, P. W. ”Polynomial-time algorithms for prime factorization and discrete logarithms on a quantum computer.” SIAM Review, vol. 41, no. 2, 1999, pp. 303–332
work page 1999
-
[2]
Grover, L. K. ”A fast quantum mechanical algorithm for database search.” Proceedings of the 8th Annual ACM Symposium on Theory of Computing, 1996, pp. 212–219
work page 1996
-
[3]
”An update on quantum cryptography.” 1984
Bennett, Charles H., and Gilles Brassard. ”An update on quantum cryptography.” 1984
work page 1984
-
[4]
”Quantum cryptography based on Bell’s theorem.” Physical Review Letters, vol
Ekert, Artur K. ”Quantum cryptography based on Bell’s theorem.” Physical Review Letters, vol. 67, no. 6, 1991, pp. 661
work page 1991
-
[5]
Alagic, G., et al. ”Status Report on the Third Round of the NIST Post-Quantum Cryptography Standardization Process.” NIST Intera- gency/Internal Report (NISTIR), 2022. DOI: 10.6028/NIST.IR.8413. Available at: https://doi.org/10.6028/NIST.IR.8413
-
[6]
Avanzi, Roberto, et al. ”CRYSTALS-Kyber (version 3.02) - Submission to round 3 of the NIST post-quantum project.” NIST, Technical Report, 2020
work page 2020
-
[7]
”Crystals-dilithium.” Algorithm Specifica- tions and Supporting Documentation, 2020
Lyubashevsky, Vadim, et al. ”Crystals-dilithium.” Algorithm Specifica- tions and Supporting Documentation, 2020
work page 2020
-
[8]
Zeng, Pei, et al. ”Practical hybrid PQC-QKD protocols with enhanced security and performance.” arXiv preprint arXiv:2411.01086, 2024
arXiv 2024
Show all 16 references
-
[9]
”OpenStack Security Guidelines: Crypto- graphic Algorithms.” 2024
OpenStack Foundation. ”OpenStack Security Guidelines: Crypto- graphic Algorithms.” 2024. Available at: https://wiki.openstack.org/wiki/ Security/Guidelines/crypto algorithms
2024
-
[10]
”Building the quantum network.” New Journal of Physics, vol
Elliott, Chip. ”Building the quantum network.” New Journal of Physics, vol. 4, no. 1, 2002, pp. 46. IOP Publishing
2002
-
[11]
”Quantum key distribution net- works – Key management.” ITU-T Recommendation Y .3803, December 2020
International Telecommunication Union. ”Quantum key distribution net- works – Key management.” ITU-T Recommendation Y .3803, December 2020
2020
-
[12]
”Onion routing.” Communications of the ACM, vol
Goldschlag, David, Michael Reed, and Paul Syverson. ”Onion routing.” Communications of the ACM, vol. 42, no. 2, 1999, pp. 39–41. ACM New York
1999
-
[13]
”Breaking and (partially) fixing provably secure onion routing.” 2020 IEEE Symposium on Security and Privacy (SP), IEEE, 2020, pp
Kuhn, Christiane, Martin Beck, and Thorsten Strufe. ”Breaking and (partially) fixing provably secure onion routing.” 2020 IEEE Symposium on Security and Privacy (SP), IEEE, 2020, pp. 168–185
2020
-
[14]
Kuhn, Christiane, et al. ”Onion routing with replies.” Advances in Cryptology–ASIACRYPT 2021: 27th International Conference on the Theory and Application of Cryptology and Information Security, Springer, 2021, pp. 573–604
2021
-
[15]
”Key management systems for large-scale quantum key distribution networks.” Proceedings of the 18th International Con- ference on Availability, Reliability and Security, 2023, pp
James, Paul, et al. ”Key management systems for large-scale quantum key distribution networks.” Proceedings of the 18th International Con- ference on Availability, Reliability and Security, 2023, pp. 1–9
2023
-
[16]
”Cerberis XGR QKD System.” 2021
ID Quantique. ”Cerberis XGR QKD System.” 2021. Available at: https://www.idquantique.com/quantum-safe-security/products/ cerberis-xgr-qkd-system/
2021
Reviewed August 8, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.