Hybrid QKD–PQC Digital Signature Scheme

• Hybrid QKD–PQC digital signature schemes are cryptographic methods that fuse quantum key distribution with post-quantum digital signatures to secure authenticity and integrity in the face of quantum-capable adversaries.
• They encompass diverse constructions, including symmetric-key based signatures via QKD, PQC-authenticated QKD networks, and certificate reconstruction using QKD-derived randomness.
• Key advantages include fixed-length signature generation independent of message size, improved scalability in key management, and low computational and bandwidth overhead.

Searching arXiv for the cited papers and closely related work to ground the article. Hybrid QKD–PQC digital signature schemes are cryptographic constructions that combine quantum key distribution with post-quantum or QKD-derived authentication mechanisms in order to preserve authenticity under quantum-capable adversaries while exploiting the information-theoretic properties of QKD where available. The recent literature spans at least three closely related designs: a QKD-assisted digital signature built from symmetric keys distilled by QKD and block-hash verification (Cid et al., 2023); QKD systems whose classical control traffic is authenticated by lattice-based post-quantum signatures and PKI (Liu-Jun et al., 2020, Yang et al., 2021); and certificate-oriented hybrids in which a PQC signature is reconstructed during verification using fresh randomness established through BB84 or E91 (Chen, 30 Sep 2025). Across these designs, a common premise is that QKD provides information theoretically secure key exchange but still requires authenticated classical communication, so the hybridization target is not secrecy alone but the authenticity, integrity, and non-repudiation boundary around QKD-enabled systems (Liu-Jun et al., 2020, Yang et al., 2021).

1. Conceptual scope and taxonomy

The phrase “hybrid QKD–PQC digital signature scheme” does not denote a single protocol family. In the cited literature it refers to distinct compositions of quantum and classical primitives, with different trust anchors, interaction patterns, and security objectives.

Construction class	Signing material	Role of QKD
QKD-assisted three-party signature	Symmetric keys $k_1,k_2$ and hash functions	Generates ITS keys and induces verifier asymmetry through block exchange
PQC-authenticated QKD	Aigis-Sig with PKI and certificates	Protects classical QKD messages end-to-end
QKD-assisted PQC certificate verification	ML-DSA or SLH-DSA plus reconstructed signature value	Supplies fresh secret $r_3$ for signature reconstruction

The three-party construction of Amiri et al. is a “quantum-assisted digital signature protocol based on symmetric keys generated by QKD” and is explicitly designed to be independent of message length (Cid et al., 2023). By contrast, the Aigis-Sig deployments do not replace the QKD authentication problem with a new signature primitive; they authenticate the classical channel of BB84 post-processing using a lattice-based signature algorithm and a conventional CA-rooted PKI (Liu-Jun et al., 2020, Yang et al., 2021). The certificate-reconstruction construction is different again: the certificate embeds only a 32-byte Request Code for Signature, while the full PQC signature is recovered during verification through QKD-shared randomness and SHAKE expansion (Chen, 30 Sep 2025).

A recurrent misconception is that QKD obviates digital-signature design. The experimental QKD-authentication papers state the opposite: QKD requires the classical channel to be authenticated, and the operational question is whether that authentication should rely on pre-shared symmetric keys or on a post-quantum PKI (Liu-Jun et al., 2020, Yang et al., 2021).

2. QKD-generated symmetric-key signatures in the three-party model

The three-party protocol in “A Feasible Hybrid Quantum-Assisted Digital Signature for Arbitrary Message Length” is defined for one signer and two receivers: Alice is the sender, Bob and Charlie are independent verifiers, and all parties are honest except for at most one colluding adversary among $\{A,B,C\}$ (Cid et al., 2023). The channel model assumes authenticated classical channels between every pair and quantum channels $A \to B$ and $A \to C$ to run QKD, for example BB84, and distill information-theoretically secure symmetric keys.

Alice and Bob run QKD and obtain $k_1 \in \{0,1\}^{l}$; Alice and Charlie independently obtain $k_2 \in \{0,1\}^{l}$. An integer $n$ is chosen and both keys are split into $n$ contiguous blocks of length $l/n$ bits:

$r_3$0

Bob applies a random permutation $r_3$1 to the blocks of $r_3$2 and sends the first $r_3$3 permuted blocks to Charlie, denoted $r_3$4. Charlie analogously permutes $r_3$5 by $r_3$6 and sends Bob the first $r_3$7 permuted blocks $r_3$8. At the end of this step, Bob knows all of $r_3$9 and half of $\{A,B,C\}$0, Charlie knows all of $\{A,B,C\}$1 and half of $\{A,B,C\}$2, and Alice does not know which half-blocks moved.

For an arbitrary-length message $\{A,B,C\}$3, the public parameters are a cryptographic hash $\{A,B,C\}$4 with $\{A,B,C\}$5 and a block-hash function $\{A,B,C\}$6. Alice forms the combined key

$\{A,B,C\}$7

computes the fixed-length digest $\{A,B,C\}$8, and one-time-pad encrypts it under $\{A,B,C\}$9:

$A \to B$0

The ciphertext $A \to B$1 is partitioned into $A \to B$2 blocks of length $A \to B$3. For each block, Alice computes

$A \to B$4

and the signature is the sequence

$A \to B$5

She then sends $A \to B$6 to Bob over the authenticated classical channel.

Bob constructs $A \to B$7, computes $A \to B$8, derives $A \to B$9, partitions $A \to C$0 into $A \to C$1 blocks, and forms

$A \to C$2

He accepts if the number of indices $A \to C$3 for which $A \to C$4 is at least a pre-set threshold $A \to C$5. Charlie performs the analogous procedure with $A \to C$6 and threshold $A \to C$7 (Cid et al., 2023).

Two properties are central to the protocol’s stated motivation. First, because $A \to C$8 is fixed, the cost of computing $A \to C$9 is independent of $k_1 \in \{0,1\}^{l}$0 and only one hash invocation is needed. Second, the final signature length is $k_1 \in \{0,1\}^{l}$1 bits, independent of $k_1 \in \{0,1\}^{l}$2. The design goal is therefore not to remove hashing but to compress arbitrary-length messages into a fixed-length digest before the QKD-derived verification asymmetry is applied.

3. PQC-authenticated QKD networks and Aigis-Sig integration

A second line of work uses post-quantum digital signatures to authenticate the classical traffic of QKD rather than to create a new standalone signature primitive. In “Experimental Authentication of Quantum Key Distribution with Post-quantum Cryptography,” the authors assume a standard PKI with a trusted Certificate Authority whose long-term public key is known to all QKD parties. Each user generates one PQC key pair, obtains a certificate from the CA, exchanges certificates and fresh nonces with its QKD peer, and signs classical QKD messages after hashing them with SM3 (Liu-Jun et al., 2020).

The authentication workflow is explicit. User $k_1 \in \{0,1\}^{l}$3 sends $k_1 \in \{0,1\}^{l}$4 to $k_1 \in \{0,1\}^{l}$5, user $k_1 \in \{0,1\}^{l}$6 sends $k_1 \in \{0,1\}^{l}$7 to $k_1 \in \{0,1\}^{l}$8, and both verify the certificates under the CA public key. When $k_1 \in \{0,1\}^{l}$9 sends a classical QKD message $k_2 \in \{0,1\}^{l}$0, it computes

$k_2 \in \{0,1\}^{l}$1

signs $k_2 \in \{0,1\}^{l}$2 with $k_2 \in \{0,1\}^{l}$3, and sends $k_2 \in \{0,1\}^{l}$4; $k_2 \in \{0,1\}^{l}$5 recomputes the digest and verifies under $k_2 \in \{0,1\}^{l}$6 (Liu-Jun et al., 2020). This replaces the requirement to pre-distribute pairwise symmetric authentication keys by a per-user certificate model.

“Authentication of Metropolitan Quantum Key Distribution Network with Post-quantum Cryptography” describes the same general architecture in an integrated commercial BB84 setting (Yang et al., 2021). Each QKD node contains an FPGA that performs BB84 post-processing, an ARM-based PQC module implementing Aigis-Sig digital-signature operations, and a small PKI in which each node holds $k_2 \in \{0,1\}^{l}$7 certified by a common CA whose root public key is pre-installed. For every classical-channel message $k_2 \in \{0,1\}^{l}$8—for example a basis-sifting matrix, error-correction syndrome, privacy-amplification seed, or final-key verification hash—the sender computes $k_2 \in \{0,1\}^{l}$9, signs $n$0 with Aigis-Sig, and transmits $n$1 to the peer.

The metropolitan deployment also identifies the specific BB84 post-processing flows that must be authenticated: basis sifting, error correction via Winnow, privacy amplification, and final-key verification. The architectural consequence is significant: because all classical authentication is end-to-end with PQC signatures, intermediate optical switches need no secret material and can replace previously trusted relays in the network core (Yang et al., 2021). This is not a purely cryptographic observation; it changes the trust topology of the deployed QKD network.

4. QKD-assisted reconstruction of PQC signatures in certificates

The 2025 hybrid proposal introduces a certificate-centric mechanism in which QKD does not merely protect transport but participates directly in reconstructing the signature value that is verified (Chen, 30 Sep 2025). The scheme supports two NIST-standard PQC signature families: Module-Lattice-based Digital Signature Algorithm (ML-DSA, FIPS 204) and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA, FIPS 205).

For ML-DSA, the key-generation summary is:

1. sample secret vectors $n$2;
2. compute $n$3;
3. define $n$4 and $n$5.

Signing samples a small random $n$6, computes $n$7, forms the challenge

$n$8

computes $n$9, and outputs $n$0. Verification recomputes

$n$1

and accepts iff the challenge matches (Chen, 30 Sep 2025). For SLH-DSA, the paper describes a generic XMSS-style stateless signature over a Merkle tree, with per-leaf one-time key pairs derived from a seed and verification by recomputing the path to the root.

The certificate format is modified in a specific way. In the X.509 certificate for Alice, the CA places Alice’s PQC public key in SubjectPublicKeyInfo, sets keyUsage = digitalSignature, includes QKDInfo = { quantumChannelParameters, classicalChannelParameters } as an extension, and places a 32-byte random Request Code for Signature $n$2 in the signature field. The actual PQC signature $n$3 over the to-be-signed data is computed by the CA but not embedded in the certificate. Instead, the CA stores $n$4 locally and publishes the certificate containing $n$5.

Verification is interactive. Bob retrieves the certificate, performs standard X.509 checks, and then executes a QKD run with the CA—either BB84 or E91—to agree on a fresh 32-byte random value $n$6. If BB84 is used, the protocol exchanges $n$7 qubits in random bases and sifts out $n$8 half; if E91 is used, it exchanges $n$9 entangled-pair qubits and sifts to $l/n$0 bits, then pads or truncates to exactly 32 bytes. Let $l/n$1 be the PQC-signature length in bytes. Both sides compute

$l/n$2

The CA then computes the Signature Reconstruction Value

$l/n$3

and sends $l/n$4 to Bob over the authenticated classical channel. Bob reconstructs

$l/n$5

and accepts iff $l/n$6 (Chen, 30 Sep 2025).

This construction separates certificate storage from full-signature availability. The paper reports that stand-alone PQC certificates hold the full $l/n$7-byte signature, whereas the hybrid certificate holds only the 32-byte Request Code plus QKDInfo of approximately 100 bytes, giving total overhead of approximately 132 bytes and reducing certificate sizes by up to 98% (Chen, 30 Sep 2025).

5. Security properties and composability

Across all three construction classes, the security discussion begins from the same baseline: QKD provides information-theoretic secrecy only under authenticated classical communication. The hybrid signature layer therefore carries the burden of authenticity, and the compositional question is how the authentication primitive interacts with the QKD-generated secrecy (Liu-Jun et al., 2020, Yang et al., 2021).

In the three-party symmetric-key signature scheme, the stated properties are integrity, unforgeability, authenticity, and non-repudiation (Cid et al., 2023). Integrity is reduced to the second-preimage resistance of the message hash: if an adversary modifies $l/n$8 but reuses $l/n$9, then $r_3$00 except with probability approximately $r_3$01, and the mismatch propagates through $r_3$02 and the block-hashes. Unforgeability is tied to the verifier asymmetry induced by the exchanged half-blocks: a forger such as Bob does not know half of Alice–Charlie key $r_3$03, so guessing it correctly costs on average $r_3$04 trials, negligible if $r_3$05. Non-repudiation is quantified by

$r_3$06

which vanishes as $r_3$07 grows if thresholds $r_3$08 and $r_3$09 are chosen appropriately. The paper further states that QKD yields information-theoretically secure keys and OTP encryption under those keys gives perfect secrecy for the digest $r_3$10 (Cid et al., 2023).

In the PQC-authenticated QKD literature, the critical distinction is between short-term authentication security and long-term secrecy of the distilled QKD key. The 2020 experimental paper states that authentication signatures need only remain unforgeable during each QKD session; once basis sifting, error correction, and privacy amplification have been authenticated and the QKD protocol finishes, the resulting key is information-theoretically secure even if the PQC is broken later (Liu-Jun et al., 2020). The same paper states an EUF-CMA condition for signature unforgeability and notes that a successful forgery would imply solving MSIS or MLWE in the stated reductionist framework.

The metropolitan-network paper makes the composition statement explicit: if authentication has failure probability $r_3$11 and QKD has $r_3$12, then overall

$r_3$13

Its threat model allows Eve to eavesdrop on all quantum and classical channels and to insert or modify classical messages at will, while assuming she cannot break Module-LWE. The paper reports unforgeability with probability at most $r_3$14 per signature for Module-LWE-based Aigis-Sig and combines this with $r_3$15 to obtain a total security parameter of approximately $r_3$16 (Yang et al., 2021).

The certificate-reconstruction scheme adds a different security claim. It states that even if the PQC signing oracle or the CA secret key is later compromised, past certificates cannot be forged unless an adversary also knows the ephemeral $r_3$17 established through QKD; conversely, if QKD succeeds, the shared $r_3$18 remains uniform and secret from the adversary (Chen, 30 Sep 2025). A plausible implication is that this construction is aimed less at reducing the cost of PQC verification than at coupling certificate validation to fresh quantum-generated confirmation material.

6. Performance, scalability, and deployment constraints

The experimental evidence for PQC-authenticated QKD indicates that the signature overhead can be small relative to ordinary QKD session times. On an Intel i7-9750H @ 2.6 GHz with 8 GB RAM, the 2020 experiment reports Aigis-Sig signature size $r_3$19 bytes, signing cost 459,903 CPU cycles $r_3$20 ms, verification cost 104,337 cycles $r_3$21 ms, and overall execution per authentication below 1 ms, while the QKD block time is approximately 1 s (Liu-Jun et al., 2020). Secret-key rate versus fiber length under PQC authentication matches the pre-shared-key baseline within statistical error; example point-to-point rates averaged over 5 minutes are approximately 360 kbps at 10 km, approximately 72 kbps at 50 km, and approximately 10 kbps at 100 km. A 30-hour continuous run on a 40 km link showed a stable key rate of 100–180 kbps with average 144.1 kbps and QBER approximately 0.65–1.1%, with no PQC-program failures. In the network-scaling discussion, pairwise symmetric authentication requires

$r_3$22

whereas the certificate approach requires only

$r_3$23

per-user key pairs and certificates (Liu-Jun et al., 2020).

The 2021 metropolitan deployment reports implementation metrics on ARM AM3354 and FPGA hardware (Yang et al., 2021). The concrete Aigis-Sig parameter set yields public keys of 1.3 KB, private keys of 3.4 KB, and signatures of approximately 2.4 KB. Key generation takes approximately 8 ms, signing approximately 3 ms, and verification approximately 2 ms; end-to-end sign plus verify is below 10 ms on ARM AM3354. The per-message authentication path includes SM3 hashing on FPGA in at most 0.5 ms, FPGA–ARM inter-board latency of approximately 1 ms each way, and packet transmission of 10 ms for a 1 kb payload at 100 kbps, leading to end-to-end delay of at most 100 ms per authenticated message. The paper states that this added delay has negligible impact on typical QKD key rates of 10 kbps at 10 dB loss. In the Jinan field network, 14 user nodes and 5 optical switching nodes were deployed; link lengths vary from 5 m to 21.46 km, and after adding 1.5 dB per switch insertion loss the end-to-end losses range from approximately 3 dB to approximately 20 dB. Of 49 possible sender/receiver pairs, 30 yielded stable keys over 36 days, namely those with loss at most 17 dB. On link U4–U3, pre-shared symmetric-key authentication gave 30.441 kbps and PQC authentication gave 29.997 kbps, a difference of at most 1.5% and within run-to-run variance (Yang et al., 2021).

The certificate-reconstruction proposal evaluates its QKD component and storage savings separately (Chen, 30 Sep 2025). On an Intel i7-10510U with 16 GB RAM and QKD via IBM Qiskit simulator, the reported timings are approximately 0.4 ms for ECDH NIST P-256, approximately 0.8 ms for ECDH Brainpool P-256, approximately 0.05 ms for ML-KEM-512, approximately 1,200 ms for QKD BB84 with $r_3$24 bits and 768 runs, and approximately 1,800 ms for QKD E91 with $r_3$25 bits and 1,152 runs. All methods passed NIST SP 800-90B min-entropy, independence, goodness-of-fit, and longest repeated substring tests as summarized in the paper. Signature lengths vary widely: ML-DSA-44 is 2,420 bytes, ML-DSA-65 is 3,160 bytes, ML-DSA-87 is 3,972 bytes, SLH-DSA-SHA2-128f is 16,784 bytes, SLH-DSA-SHAKE-128f is 10,294 bytes, and SLH-DSA-SHA2-256f is 31,408 bytes, while the embedded Request Code remains fixed at 32 bytes. Signature recovery requires one SHAKE expansion of length $r_3$26 bytes and is reported as approximately 0.1 ms for $r_3$27 KB; verification cost is identical to PQC verification plus negligible XORs (Chen, 30 Sep 2025).

The limitations are correspondingly heterogeneous. The three-party QKD-assisted signature requires QKD hardware and quantum links $r_3$28–$r_3$29 and $r_3$30–$r_3$31, incurs multi-party key management and block-exchange overhead, and may produce signatures that exceed optimized PQC schemes if $r_3$32 is large (Cid et al., 2023). The metropolitan PQC-authenticated architecture still faces optical-loss constraints: each optical switch adds approximately 1.5 dB insertion loss, beyond approximately 20 dB total no key can be generated, trusted relays are still required for ultra-long or multi-hop links, the current KMS limits multi-level switching to at most three cascaded switches, and 2.4 KB signatures impose modest bandwidth demands on low-rate classical channels (Yang et al., 2021). The certificate-reconstruction scheme shrinks stored-signature overhead substantially but adds an interactive QKD run per verification; this suggests a trade-off between certificate compactness and verification latency (Chen, 30 Sep 2025).

Taken together, the literature does not yet converge on a single canonical hybrid QKD–PQC signature architecture. Instead it delineates a design space: QKD-derived symmetric-key signatures with verifier asymmetry, PQC signatures used to authenticate QKD control traffic, and PQC certificates whose verifiable signature values are reconstructed through QKD. What unifies these approaches is not a single algorithm but a common objective: combining information-theoretic secrecy from quantum communication with quantum-resistant authenticity mechanisms that remain operational in realistic PKI- and network-based deployments (Cid et al., 2023, Liu-Jun et al., 2020, Yang et al., 2021, Chen, 30 Sep 2025).