---
title: Parallel Hybrid QKD-PQC Key Establishment
url: https://www.emergentmind.com/topics/parallel-hybrid-qkd-pqc-key-establishment
type: topic
---

# Parallel Hybrid QKD-PQC Key Establishment

Searching arXiv for recent papers on hybrid QKD–PQC key establishment and related authentication/network architectures.
Parallel hybrid QKD–PQC key establishment denotes a family of key-establishment constructions in which a Quantum Key Distribution (QKD) protocol and a post-quantum cryptographic (PQC) key-establishment primitive are executed side by side, and their outputs are combined into a single session key. Across the literature, this combination is motivated by defense-in-depth: QKD contributes information-theoretic security for generated key material under its standard assumptions, while PQC contributes algorithmic quantum resistance on conventional classical networks and improves deployability in settings where QKD alone is constrained by authentication, distance, or operational factors [2311.10636][2411.01086][2604.05599]. The resulting systems vary in combiner design, protocol placement, and network architecture, but they share a common objective: an attacker must compromise heterogeneous security layers, rather than a single primitive, to recover the final session key [2311.08038][2507.09288].

## 1. Conceptual definition and architectural variants

The core architectural pattern is parallel execution of two independent key-establishment branches. In one representative formulation, a BB84-style QKD link runs over a quantum channel plus an authenticated classical channel, while a PQC key-encapsulation or key-agreement protocol runs concurrently over an IP-based network, authenticated using a PQC signature such as CRYSTALS-Dilithium [2311.10636]. The outputs are denoted \(K_{\mathrm{QKD}}\) and \(K_{\mathrm{PQC}}\), and are subsequently combined by a KDF:
\[
K \;=\; \mathcal{KDF}\bigl(K_{\mathrm{QKD}\;\Vert\;K_{\mathrm{PQC}\bigr)\,.
\]
This formulation emphasizes compositional separation between the QKD secrecy mechanism and the PQC computational mechanism [2311.10636].

A second major variant uses an XOR combiner. In the formulation adapted from Zeng et al., Alice and Bob run a prepare-and-measure BB84-style protocol in parallel with a CCA-secure KEM, and then compute
\[
k_{\rm final} \;=\; k_1 \;\oplus\; k_2 \;\in\; \{0,1\}^\ell.
\]
Here \(k_1\) is the final QKD key share and \(k_2\) is the KEM-derived secret; because XOR of two length-\(\ell\) strings is length \(\ell\), the information-ratio \(\eta=1\) [2411.01086]. This line of work explicitly studies throughput and universal-composability implications of waiting for both branches before combining them.

A third architectural class treats QKD as if it were a second KEM inside an existing protocol stack. In hybrid IKEv2 for IPsec, the initiator sends a PQC public key together with a QKD KeyID in the normal `IKE_SA_INIT` exchange; the responder retrieves the referenced QKD block, encapsulates under the PQC public key, and both peers derive a shared secret
\[
S \leftarrow pq\_shared \,\|\, K_Q,
\]
which is then injected into the standard IKEv2 `prf`/`prf+` derivation machinery [2507.09288]. This “unified QKD-KEM abstraction” preserves the classical message flow while performing quantum and post-quantum secret acquisition in one round trip [2507.09288].

A fourth class is layered rather than algebraically parallel. In multi-hop QKD networks, per-hop WireGuard tunnels are protected by pre-shared keys sourced via ETSI GS QKD 014, while an end-to-end Rosenpass handshake using Classic McEliece and Kyber establishes an application-layer secret over the concatenated QKD-protected path [2604.05599]. This does not combine \(K_{\mathrm{QKD}}\) and \(K_{\mathrm{PQC}}\) into a single bit string at one endpoint in the same manner as the XOR or KDF combiners, but it is still described as a dual-layer composition providing post-quantum forward secrecy and authenticity under practical assumptions [2604.05599].

This suggests that “parallel hybrid QKD–PQC” is best understood as a design space rather than a single protocol. The common invariant is concurrent execution of heterogeneous secret-generation mechanisms, followed either by explicit key combination or by layered cryptographic composition [2311.10636][2411.01086][2604.05599][2507.09288].

## 2. Protocol mechanics and key-combination methods

At the protocol level, parallel hybrid schemes typically proceed in three stages: bootstrap or authenticate the classical control plane, execute QKD and PQC concurrently, and combine the resulting secrets.

In the BB84-plus-PQC pattern, entity authentication is first established. One option is a small pre-shared secret \(K_0\) used in a Wegman–Carter universal-hash authentication scheme, with every classical QKD message tagged as
\[
\mathrm{tag} = H_W(K_0,\mathrm{message}).
\]
Fresh QKD bits replace \(K_0\) after privacy amplification, giving everlasting authenticity [2311.10636]. The alternative recommended in the same source is PQC-signature authentication: each QKD device holds a certified Dilithium public key, and the first classical QKD message is signed, for example
\[
\text{Alice} \rightarrow \text{Bob}: \text{“Start BB84, nonce}=n_A,\ \sigma_A=\mathrm{Sign}_{\mathrm{Dilithium}_A}(n_A \,\|\, B_A)\text{”},
\]
after which all QKD classical traffic is sent under an information-theoretic MAC keyed by newly generated QKD bits or under fresh Dilithium signatures if desired [2311.10636].

The QKD branch itself follows the standard prepare-and-measure flow: raw state transmission, basis announcement, sifting, parameter estimation, error correction, and privacy amplification. In one explicit formulation, Alice encodes \(r_A \in \{0,1\}^N\) using BB84 states, Bob measures with random bases, both keep \(m \approx p^2N\) matching-basis bits, reveal a small random subset to estimate the quantum channel error rate \(e\), reconcile to a common string \(\tilde{k}_{\mathrm{QKD}}\), and apply a two-universal hash map
\[
h: \{0,1\}^{\ell_{\mathrm{QKD}}} \to \{0,1\}^{\ell}
\]
to obtain
\[
k_{\mathrm{QKD}} = h(\tilde{k}_{\mathrm{QKD}}) \in \{0,1\}^{\ell}
\]
with
\[
\|\rho_{AE} - \tau_A \otimes \rho_E\|_1 \le \varepsilon_{\mathrm{QKD}}
\]
[2411.01086].

In parallel, the PQC branch typically instantiates a CCA-secure KEM such as CRYSTALS-Kyber or ML-KEM. A canonical exchange is:
\[
(pk,sk) \leftarrow \mathrm{KeyGen}_{\mathrm{KEM}}(1^\lambda), \quad
(c,k_{\mathrm{enc}}) \leftarrow \mathrm{Encaps}_{\mathrm{KEM}}(pk), \quad
k_{\mathrm{dec}} \leftarrow \mathrm{Decaps}_{\mathrm{KEM}}(sk,c),
\]
with correctness failure probability \(\delta_{\mathrm{KEM}}\) [2411.01086]. In several systems, the KEM messages themselves are signed with PQC signatures such as Dilithium, Falcon, or McEliece-based authentication capsules [2311.10636][2311.08038][2604.05599].

The final combination step differs across designs.

| Combiner family | Formula | Representative source |
|---|---|---|
| Concatenation into KDF | \(K=\mathcal{KDF}(K_{\mathrm{QKD}}\|K_{\mathrm{PQC}})\) | [2311.10636] |
| XOR combiner | \(k_{\rm final}=k_1\oplus k_2\) | [2411.01086] |
| KDF over multiple shares | \(k_{\mathrm{final}} \leftarrow \mathsf{KDF}(r_3,\; r_1\|r_2)\) or \(K_{\mathrm{master}}=\mathrm{KDF2}(k_{ecdh}\|k_{pqc}\|k_{qkd})\) | [2510.02379][2509.10551] |
| Universal-hash extractor | \(Z=h_s(k_{\mathrm{pqc}}\|k_{\mathrm{qkd}})\) | [2603.26907] |

The KDF-based approach is operationally simple and aligns naturally with protocol stacks such as IKEv2 or WireGuard overlays [2311.10636][2507.09288]. XOR-based combination offers the “either-one-secure” guarantee in the universal-composability treatment described for parallel hybrid protocols [2411.01086]. Universal-hash extraction has been proposed as an alternative to XOR because it binds transcript information naturally and preserves quantifiable min-entropy under partial compromise, at the cost of seed management and extractor overhead [2603.26907].

A plausible implication is that combiner choice is not a superficial engineering decision: it determines not only algebraic output formation, but also the failure model, leakage resilience, and transcript-binding strategy of the whole hybrid system [2411.01086][2603.26907].

## 3. Authentication, entity source assurance, and trust bootstrapping

Authentication is a foundational issue because QKD does not eliminate the need to authenticate the classical channel; rather, it changes the security objectives attached to that channel [2311.10636][2009.04662]. In the defense-in-depth literature, this point is frequently framed as “entity source authentication,” namely the sufficiency of initial hardware and channel authentication required to guard against man-in-the-middle attacks in QKD [2311.10636].

Two broad models recur. The first is information-theoretic authentication using a small pre-shared secret and a Wegman–Carter MAC. This model descends from Bennett–Brassard 1984 and yields everlasting authenticity once fresh QKD bits are available to refresh the authentication key [2311.10636]. The second is PKI-based PQC authentication. In experimental work on authentication of QKD with PQC, each user obtains a post-quantum digital certificate from a CA, enabling efficient pairwise interconnection without \(C_n^2=n(n-1)/2\) pre-shared symmetric keys; in that formulation, one only needs to assume the CA is safe, rather than all trusted relays [2009.04662].

In protocol terms, PQC authentication is applied at multiple granularities. One blueprint signs every classical QKD message involved in sifting, error correction, privacy amplification, and final verification, with messages hashed together with fresh nonces \(R_A, R_B\) to prevent replay [2009.04662]. Another approach signs only the initial QKD classical messages and then migrates to information-theoretic MACs keyed by newly generated QKD bits [2311.10636]. In network-scale architectures, signatures and KEMs are also used at border nodes that relay or protect QKD-derived key material across incompatible or geographically remote domains [2311.08038][2604.20376].

Misconceptions arise at this stage. One common misconception is that QKD alone solves authentication. The literature instead states that standalone QKD requires a long-term pre-shared secret or PKI to authenticate its classical channel [2311.10636]. Another misconception is that hybridization eliminates trust assumptions. In fact, trust is redistributed: CA trust, trusted-node assumptions, secure KMS or HSM operation, and authenticated classical post-processing remain central to deployed systems [2009.04662][2311.08038][2604.20376].

This suggests that hybrid QKD–PQC is as much about trust-architecture design as about cryptographic composition. PQC signatures and certificates are not auxiliary conveniences; in many implementations they are the practical mechanism that makes QKD entity authentication scalable beyond small, manually provisioned deployments [2311.10636][2009.04662].

## 4. Security models, composability, and threat mitigation

The security claims made for parallel hybrid QKD–PQC systems are usually expressed in compositional terms. For QKD, a standard statement is that Eve’s information on the QKD key satisfies
\[
I_E \le 2^{-s}
\]
after privacy amplification, where \(s\) is the security parameter [2311.10636]. For a KEM branch, the relevant notion is computational indistinguishability or IND-CCA security against quantum polynomial-time adversaries, with failure or advantage parameter \(\delta_{\mathrm{KEM}}\) [2411.01086].

When a KDF combiner is used, the literature gives the aggregate failure bound
\[
\varepsilon_{\mathrm{total}} \le \varepsilon_{\mathrm{QKD}} + \varepsilon_{\mathrm{KEM}} + \varepsilon_{\mathrm{auth}},
\]
with typical practice choosing each component \(\le 2^{-64}\) or \(2^{-128}\) [2311.10636]. In the XOR-composition treatment, the key lemma states that if \(k_1\) is \(\varepsilon_1\)-close to uniform conditioned on Eve’s view and \(k_2\) is \(\varepsilon_2\)-indistinguishable from uniform for a computationally bounded Eve, then
\[
k_{\mathrm{final}}=k_1\oplus k_2
\]
is \((\varepsilon_1+\varepsilon_2)\)-secure in the UC sense, yielding
\[
\varepsilon_{\mathrm{total}} \le \varepsilon_{\mathrm{QKD}} + \delta_{\mathrm{KEM}}
\]
[2411.01086].

The defense-in-depth interpretation is explicit in several sources. Authentication of both channels prevents an active man-in-the-middle from injecting classical control messages into QKD or spoofing the KEM handshake [2311.10636]. If a future cryptographically relevant quantum computer breaks the PQC KEM, it cannot retroactively learn past QKD-derived bits because \(K_{\mathrm{QKD}}\) confidentiality is information-theoretic [2311.10636]. Conversely, if side-channel or implementation flaws affect the QKD hardware, the PQC-derived key still protects confidentiality [2311.10636]. In cross-domain deployments, multipath diversity is used so that an attacker must break at least one implementation on each path, and composable security can be bounded by the sum of individual path extraction errors [2311.08038].

At the same time, the literature is careful about what is not guaranteed. In trusted-node federations, a fully malicious intermediate trusted node breaks end-to-end confidentiality [2604.20376]. In layered network designs, the theorem for end-to-end confidentiality, authenticity, and forward secrecy assumes that the adversary cannot break both the PQC KEM and QKD simultaneously [2604.05599]. In HOQS\(^+\)-style constructions, security is strengthened with an information-theoretically secure instruction sequence that determines primitive configuration, and the text states that message confidentiality is ensured even when both the QKD and the PQC primitives are compromised [2512.04429]. That claim is tied to the secrecy of the instruction sequence rather than to conventional “at least one primitive remains secure” hybrid reasoning [2512.04429].

A common controversy concerns whether hybrid security is “the union of strengths” or merely “the minimum of components.” The sources support both framings in different senses. One source expresses combined security set-theoretically as
\[
S = \bigl(\mathrm{ITS}\setminus \mathrm{SC}_{\mathrm{QKD}\bigr)\;\cup\;\bigl(\mathrm{MC}\setminus \mathrm{SC}_{\mathrm{PQC}\bigr)
\]
[2311.08038], while throughput-oriented analyses show that operational key rate is the minimum of the parallel branches,
\[
R_{\mathrm{total}}=\min\{R_{\mathrm{QKD}},R_{\mathrm{KEM}}\}
\]
[2411.01086]. Security combination and performance composition therefore obey different laws.

## 5. Performance, latency, and finite-key effects

Performance behavior in parallel hybrid schemes is dominated by the fact that both branches must usually complete before the final key can be used. In the throughput model for the XOR-based architecture, producing one block of \(\ell\) bits takes
\[
T_{\mathrm{QKD}}=\frac{\ell}{R_{\mathrm{QKD}}}, \qquad
T_{\mathrm{KEM}}=\frac{\ell}{R_{\mathrm{KEM}}},
\]
and therefore
\[
T_{\mathrm{block}}=\max\{T_{\mathrm{QKD}},T_{\mathrm{KEM}}\}, \qquad
R_{\mathrm{total}}=\min\{R_{\mathrm{QKD}},R_{\mathrm{KEM}}\}
\]
[2411.01086]. Because \(R_{\mathrm{QKD}}(L)\approx R_0\,10^{-\alpha L/10}\) often decays exponentially with distance whereas \(R_{\mathrm{KEM}}\) is essentially distance-independent, the QKD branch commonly becomes the bottleneck at longer distances [2411.01086].

Experimental systems confirm this asymmetry. In one hybrid encryption framework, the measured latency for ECDH is \(0.12\) ms, for ML-KEM-768 \(0.95\) ms, and for a Guardian QKD 256-bit vault \(25\) ms, while the total hybrid latency is \(25.1\) ms; comparative throughput is \(\sim 8\,300\) keys/s for pure ECDH, \(\sim 1\,050\) keys/s for pure ML-KEM-768, \(\sim 40\) keys/s for pure QKD 256-bit blocks, and \(\sim 40\) keys/s for the hybrid because it is bottlenecked by QKD [2509.10551]. In another implementation study, ML-KEM-512, ML-KEM-768, and ML-KEM-1024 take approximately \(1.0\), \(1.3\), and \(1.6\) ms respectively, whereas simulated QKD BB84 with \(n=384\) takes \(80\) ms and E91 with \(n=384\) takes \(115\) ms [2510.02379].

Latency-sensitive protocol integration benefits particularly from true parallelism. For IKEv2, sequential hybrid according to the model requires
\[
T_{\mathrm{seq}} = 2\cdot RTT + T_{\mathrm{kem}} + T_{\mathrm{qkd}},
\]
whereas the parallel hybrid design gives
\[
T_{\mathrm{par}} = RTT + \max(T_{\mathrm{kem}},T_{\mathrm{qkd}})
\]
[2507.09288]. Measurements over 50 runs show that under \(100\) ms RTT, sequential `qkd-ke1_kyber1` averages \(475 \pm 20\) ms, while parallel `qkd_kyber1` averages \(310 \pm 15\) ms, a \(35\%\) latency reduction; even at low RTT the parallel design saves a full extra round trip [2507.09288]. Pure QKD in that implementation uses only a 16-byte KeyID and no fragmentation, while Kyber512 public key plus KeyID fits in a single 1,472-byte IKE fragment [2507.09288].

Multi-hop and network-overlay systems report a different performance envelope. In the Rosenpass-over-QKD-tunnels architecture, WireGuard uses 3 packets and 398 bytes per handshake, Arnika exchange 2 packets and 78 bytes, and Rosenpass 4 packets and 4,772 bytes; hand-provisioning times averaged \(10.27\) s over 10 hops, \(10.62\) s over 100 hops, \(9.93\) s for dual QKD-path and dual Rosenpass, and \(11.6\) s in a degraded case with \(300\) ms latency and \(1\%\) loss [2604.05599]. The same work reports a fail-safe window with measured mean disruption of \(548.4\) s after QKD failure, Arnika resource footprint below \(2\) MB RSS and below \(1\%\) CPU/core, and Rosenpass scaling to \(5\,000\) peers/core with below \(100\%\) CPU per \(120\) s interval [2604.05599].

Finite-key effects in the QKD branch materially affect hybrid design. One analysis gives
\[
R_{QKD}(\varepsilon_{QKD}) = R_0\,10^{-\,\alpha L/10}\,\bigl[1-H_2(e)-\Delta(\varepsilon_{QKD},m)\bigr],
\]
so smaller \(\varepsilon_{\mathrm{QKD}}\) implies larger \(\Delta\) and reduced \(R_{\mathrm{QKD}}\) [2411.01086]. A more explicit finite-key treatment for BBM92 defines the composable failure budget
\[
\varepsilon_{\mathrm{QKD}} \ge \varepsilon_{\mathrm{auth}}+\varepsilon_{\mathrm{ec}}+\varepsilon_{\mathrm{pa}}+2\varepsilon_{\mathrm{pe}}
\]
and derives the maximal secret-key length
\[
\ell = \lfloor n(1-H)-r-t+\log_2(4B^2)\rfloor
\]
with \(B=\varepsilon_{\mathrm{QKD}}-\varepsilon_{\mathrm{ec}}-\varepsilon_{\mathrm{auth}}-2\varepsilon_{\mathrm{pe}}\) [2512.04429]. This anchors hybrid performance claims in the same finite-key constraints that govern standalone QKD.

## 6. Networked deployment, interoperability, and scaling

Parallel hybrid QKD–PQC becomes more complex in networked settings because keys must often traverse domains, relay nodes, or heterogeneous physical media. Several systems address this through standard interfaces and border-node abstractions.

A European testbed links metro QKD networks in Berlin, Madrid, and Poznań and demonstrates four border-node methods for transparent hybridization [2311.08038]. Method 1 XOR-combines keys from two physical QKD links locally at each border node to produce a single bridge key. Method 2 emulates long-haul QKD with two PQC KEM links in parallel, treated by the local QKD-SDN controller as QKD links via an extended ETSI GS QKD 015 `link-type` property; outputs of two PQC KEMs are XOR’ed to form the long-haul key. Method 3 uses application-level services on border nodes to fetch local QKD keys and protect them via two independent PQC KEM+SIG chains. Method 4 further hardens the design with multi-path diversity over Iridium and public Internet, deriving the final key as
\[
K_{\mathrm{final} \;=\;\mathsf{KDF}(\text{RND}_1,\;\text{RND}_2,\;\mathit{PSK})\,.
\]
All PQC links use TCP/IP, observed key-error rate is effectively \(0\%\), and Method 4 reaches \(4\) kbit/s, while Methods 1–3 offer QoS at \(256\) bit/s in the reported demos [2311.08038].

A layered network architecture for trusted-node quantum networks combines per-hop WireGuard tunnels protected by ETSI GS QKD 014-derived PSKs with an end-to-end Rosenpass KEM over those tunnels [2604.05599]. PSKs are rotated every \(120\) s with a \(60\) s grace period, and the average Rosenpass handshake time is approximately \(0.2\) s end-to-end [2604.05599]. The design is explicitly positioned as interoperable because it uses ETSI 014 and requires no modifications to WireGuard or QKD devices [2604.05599].

A related distributed architecture for federated QKD islands uses KMSTNs that speak ETSI GS QKD 014 southbound to local vendor KMSs and ETSI GS QKD 020 horizontally to relay keys across a WAN [2604.20376]. At each overlay hop, a message is encrypted under an ephemeral symmetric key derived by blending a QKD link key with a Kyber secret:
\[
k' = k \oplus s, \qquad
C_{\mathrm{msg}} = \mathsf{AES256\_Enc}(k',IV,\mathrm{Payload}).
\]
This architecture introduces dynamic routing and concurrency parameters, but it also retains the trusted-node assumption: a fully malicious KMSTN breaks end-to-end confidentiality [2604.20376].

Scaling analyses at the abstract network level show that between any two users in a graph \(G=(N,E)\), one may build composite protocols by routing through relay nodes, using parallel XOR-combinations, or adopting more general secret-sharing access structures [2411.01086]. For \(M\) parallel QKD–PQC pairs, the net rate is
\[
R_{AB}=\min_{1\le i\le M}R_{\mathrm{total}}^{(i)},
\]
since all \(M\) shares must finish to produce one final block [2411.01086]. This identifies a fundamental tension between redundancy for security and synchronization overhead for throughput.

Deployment practice also centers on standards. ETSI GS QKD 004/014 are repeatedly used for application-layer or stateless key delivery, ETSI GS QKD 015 appears in SDN control-plane integration, and ETSI GS QKD 020 is used for cross-domain KMS interoperability [2311.08038][2507.09288][2604.20376]. A plausible implication is that standard interface convergence is a precondition for hybrid QKD–PQC systems to move from isolated proofs of concept to operational multi-domain services.

## 7. Open design questions and research directions

The literature identifies several unresolved design questions. One concerns the best key combiner. XOR is simple, has no auxiliary seed, and supports the claim that if either QKD or PQC remains unbroken, no adversary can predict \(k_{\mathrm{final}}\) with non-negligible advantage [2411.01086]. However, universal-hash-based strong extractors have been proposed as an alternative because, unlike XORing, they ensure that if the combined output and one initial key are compromised, the remaining key material retains quantifiable min-entropy and remains secure in exchange of longer keys [2603.26907]. The same work notes the cost of a public seed is essentially \(d\approx N\) for Toeplitz constructions, making parameter selection and seed management nontrivial [2603.26907]. This is a live theoretical and engineering trade-off rather than a settled consensus.

A second question concerns the role of transcript binding and active security. Universal-hash extraction can include the entire transcript as part of the extractor input,
\[
X = (k_{\mathrm{pqc}}\|k_{\mathrm{qkd}})\|\mathsf{traffic},
\]
so that any active modification changes the extractor input and therefore the derived key [2603.26907]. By contrast, protocol-stack integrations such as IKEv2 reuse existing authenticated derivation mechanisms rather than placing the transcript directly inside a separate extractor [2507.09288]. The two approaches reflect different philosophies of composition.

A third question concerns side channels and failure domains. The set-theoretic and UC claims for hybrid security are often conditioned on primitive-level abstractions [2311.08038][2411.01086], but multiple sources emphasize implementation flaws as a primary rationale for hybridization itself [2311.10636][2512.04429]. HOQS\(^+\) goes further by introducing an information-theoretically secure instruction sequence to determine the ordering of OTP, AES, and Ascon layers, asserting that this preserves message confidentiality even when both the QKD and the PQC primitives are compromised [2512.04429]. This approach departs from standard “one-of-two survives” hybrid reasoning and may be viewed as a distinct branch of the field.

A fourth question is practical scalability under realistic QKD rates and trusted-node constraints. Hybrid systems can span metro, regional, and continental distances by substituting PQC on long-haul segments, multiplexing paths, or using overlay relays [2311.08038][2604.20376]. Yet throughput remains constrained by slow or bursty QKD generation, and static routing can lead to congestion or buffer depletion [2604.20376]. This suggests that future research will likely focus not only on cryptographic proofs but also on control-plane adaptation, rate-aware scheduling, and dynamic path selection.

Finally, there is a migration question. Several architectures emphasize that operators can swap PQC implementations at endpoints without touching trusted nodes, or integrate hybrid overlays without modifying deployed QKD devices or network protocols [2604.05599]. In that sense, parallel hybrid QKD–PQC key establishment also functions as a transition mechanism: it allows immediate use of QKD-derived entropy and standards-based PQC while preserving interoperability with existing secure-channel frameworks [2507.09288][2604.05599].

Taken together, these strands establish parallel hybrid QKD–PQC key establishment as a mature research area spanning protocol design, composable security, finite-key analysis, systems engineering, and standards-driven deployment. Its central premise is stable across formulations: quantum and post-quantum key-establishment mechanisms are run concurrently, and their outputs are combined so that heterogeneity of assumptions becomes an explicit part of the security architecture [2311.10636][2411.01086][2507.09288].

Source: https://www.emergentmind.com/topics/parallel-hybrid-qkd-pqc-key-establishment