Post-quantum critical communications: why math-based cryptography (PQC) seems to be winning over QKD

According to reports, government and military communications are said to be shifting toward post-quantum cryptography (PQC) rather than quantum key distribution (QKD). This would not be a theoretical rejection of QKD, but a judgment on the costs, infrastructural complexity, and operational risks of a technology that today does not appear to offer a sufficient advantage over the mathematical alternative — one that is already standardized and ready for migration. It should be stated clearly upfront: the primary sources that would indicate this position could not be retrieved during verification, so what follows should be read as an attributed position, not confirmed data — with the exception of the NIST standards section, which has been verified.

What's changing (according to the cited, as-yet-unconfirmed sources)

A policy document attributed to NATO is said to steer critical communications toward PQC rather than QKD, and a quantum technology roadmap, also attributed to NATO, is said to confirm that direction by anticipating the adoption of PQC standards. We are not able to cite a verified document code or date for these two sources: we are not reporting them so as not to attribute to NATO statements we could not check against an official text. We therefore treat these two points as reported positions, not as confirmed NATO statements.

The reasons circulating in support of this direction are technically plausible and consistent with QKD's known limitations: the need for an authenticated classical channel, specialized and costly optical hardware, distance limits, reliance on trusted intermediate nodes to extend networks, some implementation vulnerabilities, and the current lack of a sufficient operational advantage over PQC.

QKD vs. PQC: two security logics compared

The core difference is not «which technology is more secure in theory», but which one is better suited today to be deployed across existing networks, at scale, with sustainable cost and operational complexity.

The most delicate technical point: an authenticated channel is not key distribution

A recurring objection to QKD is that it still requires an authenticated classical channel, and would therefore be somehow redundant. That's a flawed equivalence, and it is the only technical point in this article that does not depend on any institutional source requiring verification: it is well-established technical consensus. Authenticating a channel is not the same as distributing secret keys. QKD uses a short, pre-shared authentication key to prevent man-in-the-middle attacks on the classical channel; from that base it then generates new, longer key material, securely shared between the parties. QKD's real limitation, then, is not mathematical uselessness, but the balance of benefits, complexity, costs, and operational risks — which is also the argument said to underpin the preference for PQC.

What is actually confirmed: the NIST standards

Here the ground is solid. In August 2024, NIST finalized the first three post-quantum cryptography standards, including ML-KEM (for key establishment) and ML-DSA (for digital signatures) — published as FIPS 203 and FIPS 204 respectively. This is a matter of public record, confirmed on NIST's official page, and it is today the most concrete reference point for anyone planning a cryptographic migration: unlike QKD, finalized standards exist here that can be implemented on existing networks and hardware.

The other cited positions: to be treated with caution

It has long been reported that the NSA holds reservations about QKD for national security systems, as part of its CNSA 2.0 guidance: this is a publicly known position, but one we could not re-confirm against a primary source in this verification, so we flag it as a position attributed to the NSA, not as a verbatim quotation.

On the Italian side, a national strategy for quantum technologies — whose exact year of publication could not be confirmed here — is said to treat PQC and QKD as complementary rather than alternative. This is not necessarily at odds with the position attributed to NATO: what to adopt today for operational networks (PQC, already standardized) is one question, and what to fund as future research and technological autonomy (QKD, on which the cited roadmap is said to maintain R&D investment regardless) is another.

The practical implications for compliance teams

Regardless of the definitive confirmation of the NATO positions cited above, the core point for anyone managing security and compliance does not change: organizations operating in regulated sectors — defense, public administration, finance, critical infrastructure — or that otherwise follow NIST standards for cryptographic migration should:

• inventory the cryptographic algorithms currently in use (certificates, TLS, VPNs, digital signatures);
• map data exposed to harvest now, decrypt later risk — data encrypted today that could be decrypted in the future with a quantum computer;
• assess their crypto-agility, i.e. the ability to swap out an algorithm without redesigning the entire infrastructure;
• plan the migration to the NIST ML-KEM and ML-DSA standards, which are real, finalized, and already available.

This path makes sense regardless of whether an organization is a NATO target, and regardless of whether the two documents cited at the outset are ever confirmed.

Note on sources

Verified against a primary source in this review: the finalization of the NIST ML-KEM/ML-DSA standards (August 2024) and the technical distinction between channel authentication and key distribution in QKD (well-established technical consensus, not derived from a single regulatory source). Not verified against a primary source, and therefore hedged in the text: the existence and exact content of the position paper and roadmap attributed to NATO (no document code or date reported), the NSA's position on CNSA 2.0, and the Italian strategy for quantum technologies (publication year omitted). These three points should be confirmed against a primary source before being cited as facts rather than as reported positions.