REVIEW 4 major objections 5 minor 24 references
Network-wide Quantum Key Distribution with Onion Routing Relay (Conference Version)
T0 review · 4 major / 5 minor · reviewed 2026-08-15 · deepseek-v4-flash
Pith's one-line read The paper proposes onion-routed QKD relay so that intermediate nodes never see the relayed key, at a modest delay cost.
desk verdict A useful, reproducible performance comparison of onion-routing key relay for QKD, but the security claims in Section 4 are unsupported and internally contradicted by the paper's own basic-vs-authenticated split. read the letter →
The pith
A machine-rendered reading of the paper's core claim, the machinery that carries it, and where it could break.
The reading
What carries the argument
The load-bearing object is the onion ciphertext: a layered message in which each layer is encrypted for one node in the relay path using a post-quantum Key Encapsulation Mechanism, with the innermost secret protected by symmetric encryption. Each intermediate node owns a KEM key pair, peels exactly its layer, learns only the address of the next hop, and forwards the smaller onion; the destination finally unwraps the secret $S$. The optional ORR-Ext variant appends an end-to-end authentication tag so the receiver can verify that no hop modified the onion. The argument's quantitative core is the measured scaling of this peeling process: encryption time in ORR grows only from 33.4 to 47.25 microseconds as circuits grow from 3 to 11 nodes, whereas ORR-Ext grows from 238.78 to 5327.31 microseconds because authentication operations accumulate at every layer.
What would settle it
Set up a three-node ORR circuit in which the middle node is adversarial: give it the private key that opens the next node's encryption layer, or let it replace its own public key during path setup, then check whether it recovers the relayed secret $S$ or modifies the onion without the receiver detecting it. A successful peel or undetected modification would falsify the paper's end-to-end security claim.
Extended reading notes
Core claim
ORR keeps the key-relay architecture of QKD networks but changes what each intermediate node can see. The initiator generates a secret $S$, wraps it in layers using PQC-KEM encapsulation keys for each node along the path, and applies symmetric encryption (AES-256) on the innermost payload; each hop unwraps its own layer and forwards the rest, so the whole path never exposes $S$ in the clear. The paper asserts this guarantees unconditionally secure key distribution and preserves confidentiality, integrity, authenticity, and destination anonymity against malicious intermediate nodes. Benchmarking a C simulation against real QKD hardware-driven key requests, the paper measures average key distribution times: KR starts at 167.7 microseconds (3 nodes) and reaches 272.31 microseconds (11 nodes); TN goes from 224.24 to 862.55 microseconds; ORR goes from 227.62 to 389.02 microseconds; ORR-Ext goes from 465.8 to 6571.89 microseconds. From these numbers the paper concludes that basic ORR gives a meaningful security upgrade without breaking quality of service, while ORR-Ext's end-to-end authentication carries a latency cost that limits it to high-security settings.
Load-bearing premise
The entire security benefit rests on the assumption that an intermediate node cannot peel or forge an onion layer and cannot substitute itself during circuit setup; the paper invokes this assumption without giving a threat model or proof.
Editorial extensions
If this is right
- Basic ORR can be dropped into a key-relay QKDN without redesigning the network: only the initiator and per-hop nodes need PQC-KEM layer handling, and the measured delay penalty stays under roughly 120 microseconds at 11-node circuits.
- Trusted-node networks that want to shed the all-or-nothing trust assumption can adopt ORR without the latency blowup of ORR-Ext; at 11 nodes ORR (389.02 microseconds) actually distributes keys faster than TN (862.55 microseconds).
- ORR-Ext is viable only where key requests are infrequent or latency-tolerant; its 3-node cost already exceeds ORR's 11-node cost, and at 11 nodes it is about 17 times slower than ORR.
- Using PQC signature schemes inside each onion layer for end-to-end authentication makes ciphertexts grow to tens of kilobytes, so bandwidth, not just CPU, limits ORR-Ext.
- If ORR's security assumption holds, QKDN operators can offer end-to-end key confidentiality and destination anonymity without trusting every intermediate node, addressing a known vulnerability of current KR/TN models.
Reading between the lines
- The paper's phrasing 'guarantees unconditionally secure' goes beyond what its measurements can show; the security claim would need a formal adversary model proving that onion layers cannot be peeled or forged by a malicious insider, which the paper does not provide.
- A natural next experiment is to make one simulated intermediate node actively malicious, substituting its own KEM key during circuit setup or replaying or splicing onions, and measure how often it can recover or alter $S$; the current benchmarks assume honest-but-curious nodes.
- The anonymity property could be reused beyond key relay: because each node learns only the next hop, ORR could hide the final destination of a key from all earlier routers, which standard KR/TN key management does not offer.
- If end-to-end authentication is needed at scale, the largest lever is reducing per-layer signature overhead, for instance one aggregate signature for the whole circuit instead of a signature in every layer, since the measurements show ORR-Ext's cost growing superlinearly with circuit length.
Signed reviews
Editorial analysis
A structured set of objections, weighed in public.
Referee Report
Summary. The paper describes and evaluates Onion Routing Relay (ORR), a key-relay protocol for QKD networks that wraps a QKD-generated secret in layered PQC-KEM and symmetric encryption along a path, and compares its simulated performance (encryption time and key-distribution time for circuits of 3 to 11 nodes) with key-relay (KR) and trusted-node (TN) models. It also evaluates an extension, ORR-Ext, that adds end-to-end authentication via HMAC or PQC signatures. The central assertion is that ORR improves confidentiality, integrity, authenticity, and anonymity over KR/TN while retaining competitive key-distribution latency, and that ORR 'guarantees unconditionally secure key distribution within QKDN'. The experiments use a localhost threaded simulation in C, with one pair of real Cerberis QKD nodes supplying key material through a RESTful API. The paper concludes that basic ORR is a feasible compromise between efficiency and security, whereas ORR-Ext is expensive and suitable only for high-security applications.
Significance. If the security claims were supported, ORR would be a practical way to protect relayed QKD keys from malicious intermediate nodes at modest latency cost, and the open-source implementation plus the explicit comparative timing would be a useful resource for the QKD networking community. The manuscript has concrete strengths: it ships a public GitHub repository, reports a clear parameter table, and provides reproducible measurement scripts. However, the headline security claims are not supported by the described construction. The protocol uses computationally secure primitives (Kyber-768, AES-256-CBC) while claiming unconditional security, and the basic ORR variant has no end-to-end authentication, leaving it open to an active key-substitution attack by an intermediate node. The performance measurements may still be a valid contribution if the claims are re-scoped to a well-defined threat model, but the security claims as written are not defensible.
major comments (4)
- [Section 4 and Abstract] The claim that ORR 'guarantees unconditionally secure key distribution within QKDN' is contradicted by the paper's own implementation choices in Table 1 (Kyber-768 PQC-KEM, AES-256-CBC) and by Section 3, which correctly defines PQC as providing computational security against quantum attacks. A protocol built on PQC-KEM and AES cannot provide unconditional security; at best it offers computational security under the hardness assumptions of Kyber and the security of AES. This is a load-bearing error because the abstract and introduction sell the protocol on this guarantee.
- [Section 5 and Table 2] The basic ORR variant has no end-to-end authentication. Table 2 reports zero bytes for both the Signature and MAC columns for ORR, and the text separates ORR-Ext precisely because it adds end-to-end authentication. Without an end-to-end integrity tag, an active malicious intermediate node can decrypt its onion layer, discard the inner payload, and construct a fresh onion that encapsulates an adversary-chosen key K' under the public keys of the remaining nodes; the destination will accept K' because nothing binds the inner payload to the initiator. This key-substitution attack invalidates the claimed end-to-end confidentiality, integrity, and authenticity for basic ORR, and it is not merely an anonymity loss. The authors must either add and evaluate an authentication mechanism in the basic model or explicitly restrict the security claims to a threat model that excludes active intermediate adversaries.
- [Section 5, ORR-Ext description] HMAC-256 is repeatedly called a 'signature scheme' (e.g., 'the HMAC-256 algorithm was employed as signature scheme'), but HMAC is a keyed message-authentication code, not a digital signature, and cannot provide public-key authenticity or non-repudiation. More importantly, the manuscript does not specify how the HMAC key is established end-to-end between initiator and destination in a way that is unknown to the intermediate nodes. Without this key-management step, the authentication extension is underspecified and its security cannot be evaluated.
- [Section 4 and Section 6] No adversary model is ever defined. The paper claims CIA principles and anonymity but does not state what an adversary can do (passive or active, which nodes are corrupt, whether the adversary is quantum or classical, whether the QKD backbone itself is trusted). Consequently, phrases like 'guarantees unconditionally secure key distribution,' 'ensures end-to-end security,' and 'enhanced protection against malicious intermediaries' are not checkable. This is not merely a presentation issue: Section 6 measures only time, not security, so the conclusions in Section 7 overstate what the experiments can support.
minor comments (5)
- [Section 4] The phrase 'The ORR model is detailed described in our previous work' is ungrammatical and should read 'is described in detail'; the same section also contains the typo 'key-managment-system' in Section 5.
- [Table 2] The column header 'Signature' is misleading for the HMAC row; HMAC output is a message-authentication tag, not a signature. The table would benefit from a separate 'MAC' column or clearer terminology, especially since the text itself uses 'signature scheme' for HMAC.
- [Section 6 and Figure 2] The results are averages of 100 iterations, but no confidence intervals, standard deviations, or quartiles are reported in Figure 2 or the text. Given that the key-distribution times for ORR-Ext span from 465.8 to 6571.89 microseconds, error bars would materially help the reader assess the stability of the comparison.
- [Section 7] The conclusion that ORR and ORR-Ext 'strengthen the security of key relaying in QKD networks at the cost of some extra bandwidth only' is contradicted by the paper's own Section 6 data, which show ORR-Ext encryption time more than 1800 times higher than KR at 11 nodes. The overhead is computational as well as bandwidth-related, and this should be acknowledged.
- [References] The protocol details are delegated to the authors' own preprint [9], but the security-critical aspects (onion construction, key encapsulation sequence, and any per-hop authentication) should be summarized in the present paper so that the security claims are self-contained and reviewable.
Circularity Check
No significant circularity: ORR evaluation is an independent empirical benchmark; the only self-citation is a disclosed protocol reference, not a derivation shortcut.
full rationale
The paper does not derive any predicted quantity from its own fitted parameters. Section 6 reports measured encryption and key distribution times for KR, TN, ORR, and ORR-Ext; these are empirical comparisons against standard alternatives, not quantities forced by construction. The repeated statement that ORR 'guarantees unconditionally secure key distribution' (Section 4) is an asserted security property, not a conclusion obtained by substituting equations; it is also questionable because the implementation uses Kyber-768 and AES-256-CBC (Table 1), but that is a correctness or terminology issue, not circular reasoning. The references to the authors' prior work [9] in Sections 1, 2, and 4 ('The ORR model is detailed described in our previous work [9]') are self-citations, but they are used to point to the protocol specification, not to justify a prediction by a self-referential uniqueness theorem. No fit is renamed as a prediction, no ansatz is smuggled in via citation, and no known result is merely renamed. Thus the circularity score is 0.
Assumptions & free parameters
assumptions (4)
- domain assumption Onion routing provides anonymity and end-to-end confidentiality against intermediate nodes.
- domain assumption PQC-KEM (Kyber-768) offers post-quantum computational security.
- ad hoc to paper The simulation environment with threads, PRNG, and localhost communication is representative of QKD network performance.
- domain assumption AES-256-CBC is secure against quantum attacks when used with a QKD key.
Cite this review
Pith. "Pith review of Network-wide Quantum Key Distribution with Onion Routing Relay (Conference Version)." pith.science (2026). https://pith.science/paper/3WZKNKEQ
@misc{pith2026250513158,
author = {Pith},
title = {Pith review of: Network-wide Quantum Key Distribution with Onion Routing Relay (Conference Version)},
year = {2026},
howpublished = {\url{https://pith.science/paper/3WZKNKEQ}},
note = {Machine review of arXiv:2505.13158}
}
read the original abstract
The advancement of quantum computing threatens classical cryptographic methods, necessitating the development of secure quantum key distribution (QKD) solutions for QKD Networks (QKDN). In this paper, a novel key distribution protocol, Onion Routing Relay (ORR), that integrates onion routing (OR) with post-quantum cryptography (PQC) in a key-relay (KR) model is evaluated for QKDNs. This approach increases the security by enhancing confidentiality, integrity, authenticity (CIA principles), and anonymity in quantum-secure communications. By employing PQC-based encapsulation, ORR aims to avoid the security risks posed by intermediate malicious nodes and ensures end-to-end security. Our results show a competitive performance of the basic ORR model, against current KR and trusted-node (TN) approaches, demonstrating its feasibility and applicability in high-security environments maintaining a consistent Quality of Service (QoS). The results also show that while basic ORR incurs higher encryption overhead, it provides substantial security improvements without significantly impacting the overall key distribution time. Nevertheless, the introduction of an end-to-end authentication extension (ORR-Ext) has a significant impact on the Quality of Service (QoS), thereby limiting its suitability to applications with stringent security requirements.
Figures
Reference graph
Works this paper leans on
-
[9]
Onion Routing Key Distribution for QKDN
P. Otero-García et al., “Onion routing key distribution for QKDN,”arXiv preprint arXiv:2502.06657, 2025
work page Pith review arXiv 2025
-
[1]
Roadmap to fault tolerant quantum computation using topological qubit arrays,
D. Aasen et al., “Roadmap to fault tolerant quantum computation using topological qubit arrays,” 2025. [Online]. Available: https://arxiv.org/abs/2502.12252
arXiv 2025
-
[2]
Quantum cryptanalysis: shor, grover, and beyond,
S. P. Jordan and Y.-K. Liu, “Quantum cryptanalysis: shor, grover, and beyond,” IEEE Security & Privacy , vol. 16, no. 5, pp. 14–21, 2018
work page 2018
-
[3]
An update on quantum cryptography,
C. H. Bennett and G. Brassard, “An update on quantum cryptography,” 1984
1984
-
[4]
Quantum cryptography based on bell’s theorem,
A. K. Ekert, “Quantum cryptography based on bell’s theorem,” Physical Review Letters, vol. 67, no. 6, p. 661, 1991
work page 1991
-
[5]
Recent progress in quantum key distribution network deployments and standards,
Stanley et al., “Recent progress in quantum key distribution network deployments and standards,” inJournal of Physics: Conference Series , 2022
work page 2022
-
[6]
Status report on the fourth round of the NIST post-quantum cryp- tography standardization process,
Alagic et al., “Status report on the fourth round of the NIST post-quantum cryp- tography standardization process,” National Institute of Standards and Technology, Tech. Rep. NIST IR 8545, 2025
work page 2025
-
[7]
C. Elliott, “Building the quantum network,”New Journal of Physics , vol. 4, no. 1, p. 46, 2002
work page 2002
Show all 24 references
-
[8]
Quantum key distribution networks – Key management,
International Telecommunication Union, “Quantum key distribution networks – Key management,” ITU-T, Tech. Rep. Y.3803, Dec. 2020
2020
-
[10]
Onion routing,
D. Goldschlag, M. Reed, and P. Syverson, “Onion routing,”Communications of the ACM, vol. 42, no. 2, pp. 39–41, 1999
1999
-
[11]
Long-range QKD without trusted nodes is not possible with current technology,
Huttner et al., “Long-range QKD without trusted nodes is not possible with current technology,” npj Quantum Information , 2022
2022
-
[12]
Hacking the least trusted node: Indirect eavesdropping in quantum networks,
S. Rass, M. Mehic, M. Voznak, and S. König, “Hacking the least trusted node: Indirect eavesdropping in quantum networks,”IEEE Access, 2024
2024
-
[13]
Parallel trusted node approach for satellite quantum key distri- bution,
De Santis et al., “Parallel trusted node approach for satellite quantum key distri- bution,” arXiv preprint arXiv:2406.08562, 2024
2024 arXiv
-
[14]
End-to-end QKD network with non-localized trust,
Davide Li Calsiet al., “End-to-end QKD network with non-localized trust,” 2025. [Online]. Available: https://arxiv.org/abs/2411.17547
2025
-
[15]
Relaxing trust assumptions on quantum key distribution networks,
N. Vyas and P. Mendes, “Relaxing trust assumptions on quantum key distribution networks,” arXiv preprint arXiv:2402.13136, 2024
2024 arXiv
-
[16]
Post-quantum TLS without handshake signatures,
Schwabe et al., “Post-quantum TLS without handshake signatures,” inProceedings of the 2020 ACM SIGSAC Conference on Computer and Communications Security
2020
-
[17]
QTrustNetVirtualPrivateNetwork (VPN): Enhancing security in the quantum era,
H.Shim,B.Kang,H.Im,D.Jeon,andS.Kim,“QTrustNetVirtualPrivateNetwork (VPN): Enhancing security in the quantum era,”IEEE Access, 2025
2025
-
[18]
Towards the quantum-safe web: Benchmarking post-quantum TLS,
R. Rios, J. A. Montenegro, A. Muñoz, and D. Ferraris, “Towards the quantum-safe web: Benchmarking post-quantum TLS,”IEEE Network, 2025
2025
-
[19]
Towards efficient and secure quantum-classical communication net- works,
Zeng et al., “Towards efficient and secure quantum-classical communication net- works,” in 2024 IEEE 6th International Conference on Trust, Privacy and Security in Intelligent Systems, and Applications (TPS-ISA) , IEEE, 2024, pp. 520–523
2024
-
[20]
Experimental authentication of quantum key distribution with post-quantum cryptography,
L.-J. Wang et al., “Experimental authentication of quantum key distribution with post-quantum cryptography,” npj Quantum Information , 2021
2021
-
[21]
Joint QKD-post-quantum cryptosystems,
I. B. Djordjevic, “Joint QKD-post-quantum cryptosystems,”IEEE Access, vol. 8, pp. 154708–154712, 2020
2020
-
[22]
Breaking and (partially) fixing provably secure onion routing,
C. Kuhn, M. Beck, and T. Strufe, “Breaking and (partially) fixing provably secure onion routing,” 2019. [Online]. Available: https://arxiv.org/abs/1910.13772
2019 arXiv
-
[23]
Cerberis XGR QKD System,
ID Quantique, “Cerberis XGR QKD System,” 2021. [Online]. Available: https://www.idquantique.com/quantum-safe-security/products/cerberis-xgr- qkd-system/
2021
-
[24]
Quantum Key Distribution (QKD); Protocol and data format of REST- based key delivery API,
ETSI, “Quantum Key Distribution (QKD); Protocol and data format of REST- based key delivery API,” Tech. Rep., 2019
2019
Reviewed August 15, 2026 · model on record in the stance chip above.
Discussion (0). Continue with ORCID to comment.