Quantum Key Distribution: Physics as a Tripwire

Quantum key distribution (QKD) lets two parties grow a shared secret key over an optical link, with the guarantee that any eavesdropper measuring the photons unavoidably disturbs them and reveals herself as an elevated error rate. It works — commercial systems exist today at metropolitan distances — but it needs dedicated photonic hardware, is sharply distance-limited by fiber loss, and solves a narrower problem than post-quantum cryptography, which is why most traffic will use PQC instead.

What problem does QKD solve?

Every encrypted conversation starts with a key-agreement problem: two parties must end up holding the same secret bits while an adversary watches the channel. Classical solutions (Diffie-Hellman, and now ML-KEM from the previous chapter) solve it with computational hardness — the eavesdropper sees everything but cannot compute the secret. Quantum key distribution solves it with physics instead: encode random bits on single photons such that measurement itself disturbs them. An eavesdropper who intercepts the photons unavoidably corrupts a detectable fraction of them, because in quantum mechanics you cannot measure an unknown state without risking changing it, and the no-cloning theorem (a proved result: unknown quantum states cannot be copied) forbids her from duplicating photons to measure at leisure.

Two honest framings before the mechanics. First, QKD does not encrypt your data — it only produces a shared random key; the data still travels under ordinary symmetric encryption (typically AES) using that key. Second, the security guarantee is conditional in practice on the hardware faithfully implementing the theory — real detectors and lasers have exploitable imperfections, an active research area called quantum hacking. The theory's guarantee is information-theoretic, meaning it holds against an eavesdropper with unlimited computing power, unlike the computational-hardness guarantees of classical cryptography; the boxes are engineering.