Hybrid QKD-PQC Key Exchange Protocol

• Hybrid QKD-PQC key exchange protocols integrate QKD’s information-theoretic secrecy with PQC’s quantum-resistant authentication to establish secure keys.
• They use diverse architectures—including PQC-authenticated QKD, parallel key combination, and network overlays—to optimize performance and scalability.
• Experimental implementations demonstrate minimal authentication overhead, efficient key management, and robust performance across variable network conditions.

A hybrid QKD-PQC key exchange protocol is a family of constructions that combines Quantum Key Distribution (QKD) with post-quantum cryptography (PQC) to establish, authenticate, transport, or derive shared secret keys under mixed physical and computational assumptions. Across the literature, the term covers at least three distinct designs: using PQC signatures and PKI to authenticate the classical channel required by QKD; running QKD and a PQC key-establishment primitive in parallel or in series and combining their outputs into a final session key; and embedding QKD-derived key material into larger network overlays, VPNs, or inter-domain key-delivery services while retaining end-to-end PQC protection (Yang et al., 2021, Zeng et al., 2024, Spooren et al., 7 Apr 2026). The common rationale is that QKD offers information-theoretic secrecy for generated key material, whereas PQC offers deployability on classical infrastructure and quantum-resistant authentication or key encapsulation under hardness assumptions.

1. Architectural forms

Hybrid QKD-PQC key exchange is not a single canonical protocol. The published designs separate into several recurring architectural forms.

Form	Core mechanism	Representative papers
PQC-authenticated QKD	PQC signatures and certificates authenticate QKD classical messages	(Liu-Jun et al., 2020, Yang et al., 2021)
Parallel or series key combination	QKD key and PQC key are combined by XOR, KDF, KMAC, or extractor	(Zeng et al., 2024, Chen, 30 Sep 2025, Giestinhas et al., 27 Mar 2026)
Layered network overlay	Hop-wise QKD-derived PSKs protect tunnels; end-to-end PQC runs above them	(Spooren et al., 7 Apr 2026)
Cross-domain key relay	QKD-domain keys are forwarded across WAN segments using Kyber and AES	(Barral et al., 22 Apr 2026)
Hybrid AKE formalization	QKD is modeled as an oracle and composed with KEM-based AKE	(Hövelmanns et al., 15 Sep 2025)
Protocol retrofits for deployed stacks	IKEv2/IPsec, WireGuard, Guardian, and proxy-based systems are adapted	(Blanco-Romero et al., 12 Jul 2025, Raj et al., 9 Sep 2025, Mallick et al., 7 May 2026)

In the authentication-centric line, QKD remains the sole source of final secret keying material, but PQC replaces pre-shared symmetric authentication keys on the classical channel. The central claim is operational rather than algebraic: each user holds a certificate from a Certification Authority, so authentication scales with PKI rather than with pairwise symmetric secrets (Liu-Jun et al., 2020, Yang et al., 2021).

In the key-combination line, the endpoint derives a final session key from both a QKD output and a PQC output. The simplest form is XOR, written as $K_{\rm final} = K_{\rm QKD}\oplus K_{\rm PQC}$ or $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$, but several papers instead use concatenation followed by HKDF, KDF2, KMAC, or a universal-hash extractor (Zeng et al., 2024, Barral et al., 22 Apr 2026, Raj et al., 9 Sep 2025, Chen, 30 Sep 2025, Giestinhas et al., 27 Mar 2026).

In the network-overlay line, the hybrid design is explicitly layered. A lower layer uses QKD-generated keys as periodically refreshed pre-shared keys for hop-wise tunnels, while an upper layer runs an end-to-end PQC handshake and injects its output into a final tunnel protecting application traffic (Spooren et al., 7 Apr 2026). This differs substantially from metro-QKD authentication systems, where PQC signs post-processing traffic but does not necessarily contribute entropy to the final key (Yang et al., 2021).

2. Protocol mechanics and key derivation

The authentication-oriented workflow is exemplified by the Jinan metropolitan network and the earlier Aigis-Sig experiments. Each QKD node generates a lattice-based signature key pair $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$, obtains a certificate from a CA, and stores the CA public key for verification. For each post-processing message $m_k$, the sender computes an SM3 tag $t_k = H_{\rm SM3}(m_k)$, chooses a fresh nonce, signs $(t_k \parallel N)$, and transmits certificate, nonce, message, tag, and signature. The receiver verifies the certificate, checks nonce freshness, and runs signature verification before accepting the message. Once the classical channel is authenticated in each round, privacy amplification yields an information-theoretically secure key $K_{\rm final}$; in the Jinan description, privacy amplification is written as $K_{\rm final} = T \cdot K_{\rm corr} \bmod 2$, where $T$ is a shared Toeplitz matrix (Yang et al., 2021).

The underlying QKD phase in these systems is standard BB84-style or decoy-state BB84. In the Jinan implementation, each active sender-receiver pair runs decoy-state BB84 with polarization encoding at 40 MHz and InGaAs detectors with 15% efficiency, followed by sifting, Winnow error correction, and Toeplitz-hashing privacy amplification (Yang et al., 2021). In the entity-source-authentication formulation, BB84 with decoy states is paired with Wegman–Carter authentication for QKD control messages, while a PQC signature scheme authenticates device identity and the initial nonce exchange (Prisco, 2023).

Parallel hybrid protocols add a PQC KEM phase and then fuse keys. One formulation uses Kyber512 after QKD and derives the final key by $$K_{\rm final} = \mathrm{KDF}(K_{\rm QKD} \parallel K_{\rm PQC} \parallel n_A \parallel n_B)$$ (Prisco, 2023). Another combines ML-KEM and BB84 or E91 and computes $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$0 in Method 1, or $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$1 in Method 2, where $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$2 is the ECDH shared value (Chen, 30 Sep 2025). A further variant concatenates X25519, ML-KEM-768, and Guardian-delivered QKD bits, then runs KDF2-SHA256 to split the result into encryption and MAC keys (Raj et al., 9 Sep 2025).

Overlay protocols use more elaborate KDFs because multiple QKD links and a separate PQC handshake coexist. In the layered WireGuard design, Alice and Bob run Rosenpass end-to-end over hop-wise QKD-protected tunnels, obtain a shared secret $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$3, and derive

$K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$4

before injecting it as the PSK into a final WireGuard tunnel (Spooren et al., 7 Apr 2026). In the transparent-proxy formulation, the hybrid KDF is staged through HKDF-Extract on $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$5, then again with $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$6, followed by HKDF-Expand to derive $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$7 or traffic keys (Mallick et al., 7 May 2026).

A distinct mathematical line replaces XOR or ad hoc concatenation with strong seeded extractors backed by the Quantum Leftover Hash Lemma. In that setting, after obtaining $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$8 and $K_{\rm end} = K_{\rm QKD} \oplus K_{\rm PQC}$9, the parties compute $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$0, either by slicing the combined key material into input and seed or by agreeing on a fresh public seed. This formulation is motivated by a different residual-entropy behavior under leakage than naive XOR (Giestinhas et al., 27 Mar 2026).

3. Network integration, standards, and systems

Hybrid QKD-PQC key exchange has been implemented in metro networks, trusted-node backbones, inter-domain key-delivery systems, VPN overlays, IKEv2/IPsec, and management-plane integrations based on ETSI interfaces.

The Jinan field metropolitan QKD network integrates PQC authentication into a commercial QKD system with 14 user nodes and 5 optical switching nodes. Traditional trusted relays become pure optical MEMS switches, each insertion adds approximately 1.5 dB loss, and a centralized Key Management System dynamically configures up to three levels of switches per path. The 14 QKD nodes, comprising seven senders and seven receivers, form up to 49 logical links, 30 of which achieve loss $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$1 dB and remain active (Yang et al., 2021). The stated architectural advantage is that the classical channel authenticated by PQC removes the need to trust the center of the switch.

The ETSI-centered overlay approach is explicitly modular. At the lower layer, Arnika retrieves 256-bit QKD keys through the ETSI GS QKD 014 interface every $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$2 s and injects them as WireGuard PSKs. At the upper layer, Rosenpass performs a four-message end-to-end handshake yielding a 32-byte shared secret and establishing a final WireGuard data tunnel. The implementation uses open-source components, ThinkQuantum and QO Jena modules, Ubuntu 24.04, and a daisy-chain testbed with 2 end nodes and 4 trusted nodes (Spooren et al., 7 Apr 2026). The paper emphasizes that no changes are required to existing QKD devices or WireGuard code.

Cross-domain delivery introduces a different trust boundary. In the regional-network design, isolated QKD domains are connected via classical WAN links carrying ETSI GS QKD 020 messages encrypted by PQC and AES. One KMSTN software agent is deployed per physical or logical site, with southbound ETSI GS QKD 014 toward the local QKD KMS and east-west ETSI GS QKD 020 between peers. Horizontal channels use HTTPS + mTLS plus an application-level AES-256 layer, and TPM sealing is used for local key pools (Barral et al., 22 Apr 2026). A forwarded key is protected by the hybrid composition $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$3, where $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$4 is produced by Kyber.

Retrofitting existing key-establishment protocols is another major theme. In IKEv2, one proposal replaces the Diffie–Hellman exchange in IKE_SA_INIT with identifier-based QKD coordination, while a second proposal introduces a unified QKD-KEM abstraction in a single IKE_SA_INIT round. In the client-initiated hybrid flow, Alice sends a QKD identifier and a PQC public key, Bob retrieves $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$5 via the KME, encapsulates to the PQC public key, and both derive IKE SA keys from $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$6 (Blanco-Romero et al., 12 Jul 2025). This is a protocol-level fusion rather than a transport overlay.

Guardian-based and proxy-based systems further broaden the design space. Guardian exposes QKD output through an ETSI TS QKD 014 API and is used alongside X25519 and ML-KEM-768 in a three-source design (Raj et al., 9 Sep 2025). Aquaman, by contrast, proposes a transparent proxy that can fetch QKD-derived key material through SKIP or ETSI GS QKD 014 and combine it with X25519 and ML-KEM at the network boundary (Mallick et al., 7 May 2026).

4. Security model, composition, and formal analysis

The most basic security fact in this area is that QKD does not eliminate authentication requirements. QKD provides information-theoretic secrecy of the final key only if the classical messages used for sifting, error correction, privacy amplification, and key confirmation are integrity-authenticated; otherwise an active man-in-the-middle can interfere with the classical channel (Yang et al., 2021, Liu-Jun et al., 2020). This point is central to the authentication-centric hybrid designs.

In PQC-authenticated QKD, secrecy and authentication are intentionally separated. The final QKD key is claimed to be unconditionally secure once classical authentication succeeds, but the authentication itself is computational. One paper states this directly: authentication here is computational; secrecy remains information-theoretic (Yang et al., 2021). The earlier Aigis-Sig work phrases the same asymmetry as a short-term-security assumption on PQC signatures that suffices to obtain long-term security for the distributed keys (Liu-Jun et al., 2020).

The composition claims vary with the combiner. For XOR and concatenation-based designs, the recurring claim is that the final key remains secure if at least one component remains secret to the adversary (Zeng et al., 2024, Zeng et al., 2024, Blanco-Romero et al., 12 Jul 2025). In the series-connection protocol, Eve must break all three links—two QKD links and the KEM—to recover $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$7 (Zeng et al., 2024). In layered overlays, the claim is stronger in temporal terms: periodic rotation at both layers is presented as yielding forward secrecy, so compromise of one epoch’s secrets cannot decrypt earlier epochs (Spooren et al., 7 Apr 2026).

Formal work exposes subtler issues. The QKD-oracle model argues that improper handling of QKD key identifiers leads to Dependent-Key attacks on authenticated key exchange. To prevent this, the tuple $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$8 is included in the inner transcript, and a revealed QKD key causes freshness to be lost for the associated session (Hövelmanns et al., 15 Sep 2025). This shifts attention from mere key combination to state management and partner-session definitions.

Extractor-based combination makes a different security claim from XOR. By modeling the PQC key as having HILL entropy and applying a strong seeded extractor backed by the Quantum Leftover Hash Lemma, the output can remain close to uniform against an adversary that has not broken both sources, while also allowing transcript binding and quantifiable leftover min-entropy in unrevealed material if one input or even the combined output is exposed (Giestinhas et al., 27 Mar 2026). A plausible implication is that combiner choice matters not only for elegance but also for leakage resilience.

Some systems also address finite-key and side-channel concerns explicitly. A hybrid system based on BBM92, Kyber, and an information-theoretically secure instruction sequence states that confidentiality can be maintained even when both QKD and PQC primitives are compromised, because recovering the instruction sequence still requires work $$(pk_i, sk_i) \leftarrow \mathrm{Aigis.KeyGen}(1^\lambda)$$9 (Gupta et al., 4 Dec 2025). This is not the dominant model in the broader hybrid-QKD literature, but it shows that side-channel leakage and finite-key effects are no longer treated as peripheral implementation details.

5. Performance, scalability, and operational behavior

Experimental evidence shows that PQC authentication overhead can be small relative to QKD post-processing and key generation. In the 14-node Jinan network, 30 active links operated over distances from 0.47 to 21.46 km with losses from 3.1 to 20.67 dB. Average sifted-key rates per link ranged from 0.564 to 35.277 kbps, measured QBER ranged from 0.557 to 1.218%, and during a 36-day continuous run no link dropped on account of PQC authentication failures. Public-key operations were each below 10 ms, and an entire message-tagging round was below 100 ms for classical bandwidths up to 100 kbps and latency up to 10 ms (Yang et al., 2021).

The same work reports a direct comparison between symmetric-key authentication and PQC authentication on the U4–U3 link: 30.441 kbps versus 29.997 kbps over 6 hours, leading to the conclusion that PQC authentication does not degrade QKD throughput (Yang et al., 2021). The earlier Aigis-Sig experiment gives similar intuition at a smaller scale: Aigis-Sig signatures are 2 445 bytes, sign takes about 0.5 ms and verify about 0.15 ms on Intel i7-9750H, and a 40 km fiber run over 30 h showed an average key rate of 144.1 kbps with average QBER 0.876% (Liu-Jun et al., 2020).

Scalability benefits appear most clearly in certificate management and user onboarding. Pairwise pre-shared authentication keys for $m_k$0 users require $m_k$1, whereas certificate-based authentication requires only $m_k$2 certificates and reduces management from $m_k$3 to $m_k$4 (Liu-Jun et al., 2020). In the same experimental line, new users U11 and U12 entered the network by obtaining certificates and immediately formed authenticated QKD links with existing users, with key rates including 139.8 kbps on U11–U2 and 83.1 kbps on U11–U12 (Liu-Jun et al., 2020).

Overlay architectures exhibit different performance bottlenecks. In the Arnika–Rosenpass–WireGuard system, setup times over 100 runs were 10.27 s for 10 trusted nodes, 10.62 s for 100 trusted nodes, 9.93 s for dual-path PQC over 2×50 trusted nodes, and 11.6 s on a degraded link with 300 ms latency and 1% loss. Arnika and Rosenpass each used less than 5% CPU, memory stayed below 50 MB per instance, and control-plane overhead was below 500 bytes every 120 s per tunnel (Spooren et al., 7 Apr 2026). In the regional-domain service, short links delivered about 2–3 kb/s, the 120 km link about 0.5 kb/s, and median latency was typically 100–140 ms, with long-haul endpoints reaching about 700 ms (Barral et al., 22 Apr 2026).

IKEv2 measurements highlight the cost of protocol composition strategy. Under 0, 10, and 100 ms latency conditions, pure QKD handshake times were reported as 25, 35, and 125 ms, while parallel QKD–Kyber512 measured 30, 40, and 140 ms. The sequential QKD$m_k$5Kyber512 design reached 45, 65, and 345 ms, reflecting the extra RTTs introduced by sequential composition (Blanco-Romero et al., 12 Jul 2025). In a separate performance-oriented framework, commercial-parameter QKD rates were given as approximately 200 Mb/s at 0 km, 50 Mb/s at 25 km, 20 Mb/s at 50 km, and 1 Mb/s at 100 km, while Kyber-1024 throughput was about 8 Mb/s; the resulting series-connection protocol was reported at about 56 Mb/s, or a 7× improvement over standalone PQC in that configuration (Zeng et al., 2024).

6. Design tensions, misconceptions, and research directions

Several recurrent misconceptions are corrected by the hybrid-QKD literature. First, QKD is not a complete authenticated key-exchange protocol by itself: the classical channel must still be authenticated, either by pre-shared symmetric keys, Wegman–Carter authentication, or PQC signatures and PKI (Yang et al., 2021, Prisco, 2023). Second, “hybrid” does not imply a fixed trust model. Some designs reduce trust assumptions by replacing trusted relays with optical switches, but others still rely on trusted nodes, KMSTNs, TPM-sealed storage, or physically secured intermediate sites (Yang et al., 2021, Barral et al., 22 Apr 2026, Spooren et al., 7 Apr 2026).

A third misconception is that all hybrid combiners are equivalent. XOR is attractive because of simplicity and because several papers state an “at least one secret” intuition for it, but extractor-based work argues that strong seeded extractors are an alternative to XOR-based key combining with different characteristics, notably quantifiable residual min-entropy when one source or even the combined output is compromised (Giestinhas et al., 27 Mar 2026). This suggests that combiner selection is a primary design choice rather than a cosmetic implementation detail.

Another active issue is migration into existing protocol stacks. Some proposals insist on no changes to existing QKD devices or WireGuard code, and rely on open-source pluggable daemons plus ETSI GS QKD 014-compliant KMSs (Spooren et al., 7 Apr 2026). Others focus on strict ETSI 014/020 compliance for interoperability across vendors and domain boundaries (Barral et al., 22 Apr 2026). IPsec-oriented work emphasizes that protocol mechanics matter: parallel hybridization avoids the multiplicative latency penalties of sequential methods mandated by RFC 9370 (Blanco-Romero et al., 12 Jul 2025).

Formalization remains uneven. The inter-domain key-delivery service explicitly notes that no formal reduction proofs are given, offering instead informal layered-defense arguments (Barral et al., 22 Apr 2026). By contrast, the QKD-oracle line provides a CK+-style AKE model with a concrete security bound of the form

$m_k$6

and claims this is the first provably secure hybrid protocol that maintains information-theoretic security of QKD (Hövelmanns et al., 15 Sep 2025).

Taken together, the literature indicates that hybrid QKD-PQC key exchange is best understood as a design space spanning authentication substitution, key combiner design, overlay composition, and standards-based operational integration rather than as a single protocol schema. The persistent research directions are finite-key analysis, side-channel leakage, trusted-node minimization, dependent-key-safe state management, and migration paths that preserve interoperability while adding post-quantum and information-theoretic security properties (Gupta et al., 4 Dec 2025, Hövelmanns et al., 15 Sep 2025, Spooren et al., 7 Apr 2026).