Quantum key distribution vs post-quantum cryptography: what each protects against

How quantum key distribution and post-quantum cryptography differ in goals, assumptions, deployment trade-offs, and the threats each addresses.

Quantum key distribution and post-quantum cryptography are often grouped together as “quantum-safe” technologies, but they solve different problems in different ways. QKD is a method for creating shared secret keys whose security is tied to quantum-mechanical behavior, while PQC is a family of mostly public-key algorithms intended to keep today’s digital systems secure against future quantum computers.

The practical choice is usually not either/or. QKD is about key establishment with eavesdropping detection under specific physical and networking assumptions; PQC is about replacing vulnerable cryptographic building blocks across existing infrastructure. Understanding what each protects against starts with that distinction.

Two different answers to the quantum threat

The core concern behind both approaches is that quantum computing threatens many widely used public-key systems. According to Wikipedia’s summary of post-quantum cryptography, most deployed public-key algorithms rely on integer factorization, discrete logarithms, or elliptic-curve discrete logarithms, and a sufficiently powerful quantum computer running Shor’s algorithm could solve those problems efficiently.

That does not mean all cryptography breaks at once. Wikipedia’s summary also says current symmetric cryptography and hash functions are considered relatively secure against quantum attacks, although Grover’s algorithm can speed up brute-force search and can be countered in practice by doubling key size.

From there, QKD and PQC diverge:

QKD aims to let two parties generate a shared random secret key using quantum states.
PQC aims to replace vulnerable classical public-key algorithms with new ones that are currently believed, though not proven, to resist quantum attacks.

That difference in scope matters. QKD does not encrypt your application data by itself; it distributes keys. PQC, by contrast, is meant to slot into the places where public-key cryptography is already used for key establishment and digital signatures.

What QKD protects against

QKD is a secure communication method built on quantum mechanics, including the measurement-disturbance principle and the no-cloning theorem. Its purpose is to let two parties create a shared secret key known only to them.

Its distinctive security property is eavesdropping detection. In general, measuring a quantum system disturbs it. So if a third party tries to learn the key by measuring the transmitted quantum states, that interference creates anomalies that the legitimate parties can detect. If the observed disturbance is below a threshold, they may still derive a secure key; if it is too high, they abort.

Wikipedia’s article on quantum key distribution describes QKD’s security as resting on physics rather than on the assumed hardness of mathematical problems. It also describes QKD as having provable security based on information theory and as providing forward secrecy.

That said, QKD protects a narrower slice of the problem than many people assume:

It protects the process of distributing a key.
It does not directly send the message data.
The resulting key must still be used with an encryption method such as a one-time pad or a symmetric algorithm like AES.

So if the question is “What does QKD defend?” the answer is: it defends the confidentiality of the key exchange itself, under the assumptions of the protocol and implementation, by making eavesdropping on the quantum channel detectable.

How QKD works at a high level

Wikipedia’s article on quantum key distribution describes two broad families of QKD protocols.

Prepare-and-measure

In this model, one party prepares quantum states and sends them over an insecure quantum channel. The receiver measures them. Later, over an authenticated classical channel, the two sides compare limited information to check whether the measurements are consistent with an undisturbed transmission.

If not, they infer possible eavesdropping or excessive noise and may abort.

The best-known example is BB84, introduced by Charles H. Bennett and Gilles Brassard in 1984. In BB84, the sender encodes random bits in one of two possible bases, and the receiver measures each incoming quantum state using a randomly chosen basis. Afterward, they publicly compare basis choices and discard the positions where they used different bases. They then test a subset of the remaining bits for errors; too many errors imply that security cannot be guaranteed.

Entanglement-based

These protocols use entangled states shared between the two parties. Wikipedia explains that measuring one half of an entangled pair affects the overall system, and interception changes the correlations in detectable ways. One cited example is E91, proposed by Artur Ekert in 1991.

For a non-specialist, the important point is that both families try to achieve the same goal: generate a secret shared key while making interception visible.

QKD’s hidden dependency: authentication

QKD’s headline feature can obscure a crucial requirement. Wikipedia’s article on quantum key distribution states that QKD usually relies on an authenticated classical channel. That is how the two parties know they are really talking to each other during the public discussion stage, rather than to an impersonator.

This creates an important practical limitation:

To authenticate that classical channel, the parties already need some trusted cryptographic basis, such as a previously exchanged symmetric key or sufficiently secure public keys.

That means QKD does not eliminate the authentication problem. It solves key distribution under the assumption that authentication is already available.

Wikipedia’s article is unusually direct about the consequence: if you already have what is needed to authenticate securely, then in practice you may be able to achieve secure communication without QKD, using conventional symmetric cryptography. It even characterizes QKD as doing the job of a stream cipher at much higher cost.

This is one of the key trade-offs in the QKD debate. Its security model is attractive, but the system-level deployment burden is substantial.

What PQC protects against

PQC addresses a different threat surface. It is the development of cryptographic algorithms, usually public-key algorithms, that are currently thought to remain secure against quantum-computer attacks.

Its main target is the future failure of today’s public-key systems. Wikipedia’s summary of post-quantum cryptography also highlights two reasons migration is urgent before large quantum computers exist:

Migration takes time.
Harvest now, decrypt later is a real concern: data collected today may still be sensitive years from now.

PQC therefore protects against two related risks:

Future decryption of data protected today with quantum-vulnerable public-key methods.
Future forgery or failure of authenticity mechanisms that rely on those same vulnerable methods.

Unlike QKD, PQC is not based on quantum communication hardware. It is a classical cryptographic transition: replacing algorithms inside software, hardware, protocols, and standards.

PQC is broader than one algorithm family

Wikipedia’s summary of post-quantum cryptography lists several research directions in PQC, including lattice-based, multivariate, hash-based, code-based, and isogeny-based cryptography, along with symmetric-key approaches using sufficiently large keys.

A central nuance is that PQC is not proven secure in a blanket sense. Wikipedia repeatedly describes these systems as currently thought to be secure, and it notes that some candidates have failed. A striking example is SIDH/SIKE, which was broken in 2022.

That does not undermine PQC as a whole, but it does show that “quantum-resistant” is not a permanent label. It is a research and standardization process built on ongoing cryptanalysis.

Some families have stronger formal reductions than others, and some have practical trade-offs such as larger keys, signatures, or ciphertexts. Wikipedia notes that many PQC algorithms require larger key sizes than pre-quantum public-key systems, and that this can create trade-offs in transmission size and computational efficiency.

Standardization and deployment reality

The clearest signal on PQC’s practical status comes from NIST.

NIST says it released its principal PQC standards in 2024 and that organizations should begin migration now. The listed standards are:

FIPS 203: ML-KEM
FIPS 204: ML-DSA
FIPS 205: SLH-DSA

NIST also says these standards should form the basis for most deployments and that additional standards are in progress, including Falcon and HQC. It further states that under the transition timeline in NIST IR 8547, quantum-vulnerable algorithms will be deprecated and ultimately removed from NIST standards by 2035, with higher-risk systems moving earlier.

This is an important contrast with QKD. Whatever one thinks of the long-term merits of either approach, PQC is already on a standards-based migration path aimed at broad deployment across ordinary digital infrastructure.

Side-by-side: what each protects against

Aspect	Quantum key distribution	Post-quantum cryptography
Primary purpose	Create a shared secret key	Replace vulnerable public-key algorithms
Security basis	Quantum mechanics and detectable disturbance	Classical algorithms believed resistant to quantum attacks
What it directly protects	The confidentiality of key distribution	Key establishment, signatures, and other public-key functions in digital systems
Eavesdropping detection	Yes, as a built-in protocol property	No equivalent physical detection property
Hardware requirement	Requires a quantum channel plus classical channel	Runs on classical digital infrastructure
Authentication need	Requires an authenticated classical channel	Provides authentication mechanisms itself through signature/KEM standards
Deployment model	Specialized links and protocol setup	Software, hardware, and protocol migration across existing systems
Main trade-off in evidence	High cost and dependence on prior authentication	Larger keys/signatures and ongoing algorithm-evaluation risk

So which one protects “more”?

Neither universally protects more; they protect differently.

QKD offers a distinctive security claim for key distribution: attempted interception on the quantum channel is, in principle, detectable. For applications where that property is decisive, QKD can be attractive. But it comes with demanding assumptions, especially the need for an authenticated classical channel and specialized communication infrastructure.

PQC addresses the broader, more immediate systems problem: replacing public-key cryptography that a future quantum computer could break. It does not offer QKD’s physics-based eavesdropping detection, but it is designed to secure the cryptographic functions that modern networks actually depend on at scale.

Another way to frame it:

If your concern is how two endpoints establish keys over a quantum-observable channel, QKD is the relevant tool.
If your concern is how the internet, software supply chains, identity systems, and long-lived encrypted data survive the arrival of quantum attacks, PQC is the central answer.

The open questions and trade-offs

A balanced view should keep several uncertainties in sight.

For QKD:

Its security story is strong in theory, but it depends on correct implementation.
It does not remove the need for authentication.
Wikipedia explicitly raises the practical question of whether the added cost is justified when classical authenticated encryption may already meet the need.

For PQC:

These algorithms are thought, not proven, to be secure against quantum attacks.
Some candidate families or schemes have failed under cryptanalysis.
Practical deployment can involve larger keys and other performance trade-offs.

Still, NIST points to a current operational consensus: migrate toward standardized PQC now, because waiting for fully mature quantum computers may leave too little time to protect long-lived confidentiality and authenticity.

Key takeaways

QKD and PQC are not substitutes in a simple sense. QKD distributes secret keys; PQC replaces vulnerable public-key cryptography.
QKD’s standout feature is detectable eavesdropping on the quantum channel, rooted in quantum measurement disturbance.
QKD does not encrypt messages by itself and usually requires an authenticated classical channel, meaning some trust basis must already exist.
PQC is aimed at the broader migration problem created by quantum threats to current public-key systems.
Current symmetric cryptography is less disrupted by quantum computing than current public-key cryptography, though larger key sizes may be prudent.
PQC is already entering mainstream standards. NIST released FIPS 203, 204, and 205 in 2024 and says organizations should begin migration now.
Neither path is cost-free. QKD brings infrastructure and authentication burdens; PQC brings algorithmic uncertainty and performance trade-offs such as larger keys.
For most organizations, PQC is the primary near-term response to quantum risk, while QKD addresses a narrower and more specialized security objective.