QKD and QuStream both reach for security rooted in physics rather than unbroken mathematics — and they arrive by opposite routes. QKD sends single photons down dedicated fibre and reads the laws of quantum mechanics off the wire; QuStream consumes the quantum randomness once, in software, and spends it cleverly. This sets them side by side: the physics each relies on, the distance and rate each can reach, what each one costs to field, and why the property they share is best delivered the way QuStream delivers it.
Quantum key distribution is the original physics-based answer to the quantum threat. Where PQC swaps in harder mathematics, QKD discards the mathematics of key agreement entirely: it lets two parties grow a shared secret by exchanging single photons, and the laws of quantum mechanics guarantee that any eavesdropper who measures those photons disturbs them and is detected. The security is real and provable, and it is the same kind of security — information-theoretic — that QuStream's strongest tier claims.
So the two are cousins, not opposites. The difference is where the physics lives. QKD puts the quantum process on the wire, continuously: every key bit is the result of a live photon measurement, so the link needs dedicated optical hardware, a clear quantum channel, and a connection short enough that single photons survive. QuStream puts the quantum process at the source, once: it draws on a quantum random number generator to build its key material, then derives session keys in software by walking that material along a secret path. One is a physics experiment that must run for the lifetime of the link; the other is a physics-seeded algorithm that runs on an ordinary processor.
That single architectural choice cascades into everything that follows — distance, rate, cost, topology, authentication, and deployability. The honest summary up front: QKD delivers genuine information-theoretic key agreement, but at a hardware and distance cost that has kept national security agencies from endorsing it; QuStream delivers comparable information-theoretic guarantees in software, over the networks that already exist, and in topologies QKD cannot serve — and where a QKD link does exist, QuStream is happy to use it as one more way to deliver the initial secret.
The canonical protocol is BB84. The sender encodes random bits on the polarisation of single photons, choosing at random between two incompatible bases; the receiver measures in a randomly chosen basis. Afterwards they compare bases over a public channel and keep only the bits where the bases matched. The no-cloning theorem does the security work: an eavesdropper cannot copy an unknown quantum state, so any attempt to intercept and re-send introduces measurable errors. The parties estimate the error rate on a sample; if it is low enough, they distil a shorter, provably secret key and proceed. If it is too high, they know they are being watched and abort.
QKD's security is not in dispute; its practicality is. Four constraints follow directly from putting the quantum process on the wire, and together they explain why the UK's NCSC and the US NSA both decline to endorse QKD for government or military use, recommending PQC instead.
A single photon cannot be copied or amplified, so signal intensity decays exponentially with fibre length and is eventually swamped by noise. This is the repeaterless bound, a fundamental rate-versus-distance limit. Real systems show it starkly: about 1.26 Mb/s over 50 km of standard fibre, falling to roughly one bit per hour over 404 km of ultra-low-loss fibre; a heroic twin-field experiment reached 1,002 km at around 10⁻¹¹ bits per pulse — a secret-key rate so low it is a laboratory result, not a service. Practical fibre QKD is confined to a few hundred kilometres.
To cross continental distance, QKD networks chain shorter hops through intermediate relays — China's 2,000 km Beijing–Shanghai backbone uses dozens of them every 80–100 km. But each relay decrypts and re-encrypts the key, so it sees the key in the clear. The vaunted end-to-end information-theoretic guarantee is surrendered at every hop: you must now trust each node, its operator, and its physical security. A long QKD link is only as secure as its most compromised relay — which reintroduces exactly the insider-threat and supply-chain risk QKD was meant to abolish.
This is the decisive one. QKD proves a key was not observed; it cannot prove who is at the other end. The public reconciliation channel must be authenticated separately, and — as NCSC states plainly — QKD does not provide authentication, nor does any other quantum technique. Without it, QKD is wide open to a man-in-the-middle who simply runs two QKD sessions, one to each victim. So every QKD deployment must be paired with classical authentication: either pre-shared symmetric keys, or the very public-key signatures (now PQC) that QKD was supposed to make unnecessary. QKD does not stand alone.
QKD's security derives from a physical-layer process, so it needs special-purpose equipment: single-photon sources and detectors, precise timing, and a dedicated dark-fibre or free-space optical path. As the NSA notes, it cannot be implemented in software or offered as a service over existing networks, and it cannot be patched in the field the way an algorithm can. The hardware is costly, the fibre is dedicated, and a determined adversary need only cut or flood the quantum channel to deny the key entirely — a trivially available denial-of-service that no amount of physics prevents.
Setting QKD and QuStream beside classical key agreement clarifies that QKD and QuStream are reaching for the same prize — physics-based, assumption-free key security — and that QuStream reaches it without inheriting QKD's deployment penalties.
| Property | Classical (ECDH) | QKD (BB84) | QuStream |
|---|---|---|---|
| Security basis | Computational hardness | Laws of quantum mechanics | Information-theoretic + PQC tier |
| Where physics lives | Nowhere | On the wire, continuously | At the source (QRNG), once |
| Quantum resistance | Broken by Shor | Unconditional (key only) | Unconditional (ITS tier) |
| Provides authentication? | Yes (signatures) | No — needs classical/PQC | Yes — one-time MAC, ITS |
| Distance limit | Unlimited (routed) | ~few hundred km / trusted nodes | Unlimited — runs over IP |
| Key rate vs distance | Flat | Collapses exponentially | Flat — line speed |
| Hardware | Any CPU | Single-photon kit + dark fibre | Any CPU / MCU · software |
| Runs over existing network? | Yes | No — dedicated channel | Yes — any IP bearer |
| Field-upgradable? | Yes | No — physical install | Yes — software update |
| Topology | Point-to-point / routed | Point-to-point only | 1:1, broadcast, one-to-many |
| Denial of service | Network-level | Cut/flood the photon channel | Network-level only |
| Official posture (NCSC/NSA) | Deprecated (quantum) | Not endorsed for gov/mil | Software PQC + ITS path |
The pattern is that QKD and QuStream share the one row that matters most — unconditional, physics-based key security — and then diverge on every row that governs whether a thing can actually be fielded. QuStream matches QKD's headline guarantee and also keeps the deployability of classical software: it authenticates itself, runs over the network you already have, reaches any distance, serves broadcast topologies, and updates in the field.
The economics follow from §3.4. A QKD link is a capital project: transmitter and receiver units, dedicated fibre leased or laid, trusted-node facilities physically secured along the route, and specialist staff to run it. It secures exactly one point-to-point link, and extending range or adding endpoints means more hardware and more relays. QuStream is a software library; the marginal cost of one more endpoint is a key-fill at provisioning and the CPU cycles to run the derivation. The contrast is not incremental — it is the difference between deploying an optical instrument and deploying an app.
| Deployment factor | QKD | QuStream |
|---|---|---|
| Endpoint hardware | Single-photon source/detector, timing electronics | Existing CPU / MCU — no new hardware |
| Transmission medium | Dedicated dark fibre or free-space optics | Any existing IP / RF / optical bearer |
| Range extension | Add trusted relay nodes (trust cost) | None — routes like any traffic |
| Add an endpoint | New optical kit + link | Provision a PDK · software only |
| One-to-many / broadcast | Not supported | Native |
| Constrained / mobile device | Infeasible | Runs on Raspberry Pi-class MCU |
| Field upgrade / patch | Physical re-install | Software update |
| Authentication included | No — bolt on separately | Yes — integral one-time MAC |
It would be a mistake to read this as QuStream against QKD in every setting. Where a QKD link already exists — a metro government fibre, a campus backbone, an inter-data-centre run — it produces exactly what QuStream's strongest tier wants: a stream of information-theoretically secure shared bits. That makes QKD an excellent bootstrap channel for the initial PDK, one of the four provisioning routes set out in the PQC head-to-head. QKD delivers the first secret over the short, high-value optical hop it is good at; QuStream then carries that security across the whole network — over IP, to mobile and constrained endpoints, to broadcast groups, and to any distance — places the photons can never reach.
QKD and QuStream agree on the deepest point — that the strongest security comes from physics, not from an unbroken assumption — and disagree only on engineering. QKD insists on running a live quantum process for every key bit, and pays for that insistence in dedicated fibre, a few hundred kilometres of reach, trusted relays that hand the security back, a missing authentication layer, and hardware that cannot be patched or broadcast. QuStream takes the quantum randomness at the source, once, and spends it in software — earning the same information-theoretic guarantee while running over the networks that already exist, authenticating itself, reaching any distance, serving broadcast and constrained endpoints, and updating in the field. It is no accident that the agencies which decline to endorse QKD endorse exactly the properties QuStream was built to deliver. And where a QKD link does exist, QuStream does not compete with it — it drinks from it, using those quantum-perfect bits to seed a secret it then carries everywhere the photons cannot follow.
Reach for QKD where you have a short, fixed, high-value point-to-point optical link, the budget for dedicated hardware and fibre, a separate authentication mechanism already in place, and a requirement that the key-agreement step itself be physically grounded. Reach for QuStream for essentially everything else: any link that must cross real distance, run over existing IP or RF, serve mobile or constrained or broadcast endpoints, authenticate itself, and be maintainable in software for a decades-long service life. And where both are available, let QKD bootstrap QuStream — the photons deliver the first secret over the hop they are good at, and QuStream delivers the security everywhere else.
Quantum key distribution achieves genuine information-theoretic key agreement by exchanging single photons, but the physics that makes it secure also binds it to dedicated optical hardware, a few hundred kilometres of reach, trusted relays that surrender end-to-end security, and a separate authentication layer it cannot supply — which is why the NCSC and NSA recommend post-quantum cryptography over QKD for serious use. QuStream reaches the same physics-based guarantee from the other direction: it consumes quantum randomness once at the source and derives keys in software, so it authenticates itself, runs over any existing network at any distance, serves broadcast and constrained endpoints, and updates in the field. QKD is a remarkable instrument for one short link; QuStream is the way to give a whole network the property QKD demonstrates — and a QKD link, where present, is simply one more excellent way to light the first spark.