Quantum Onion Routing: Concepts & Challenges

• Quantum Onion Routing (QOR) is an umbrella paradigm for achieving layered, anonymous routing in quantum and quantum-secure networks using specialized quantum or hybrid protocols.
• It encompasses heterogeneous approaches including quantum-native state encryption, metadata protection, key relay in QKD networks, and post-quantum hardened classical schemes.
• Research in QOR focuses on addressing multi-hop quantum payload routing challenges while resolving open questions around formal anonymity frameworks and metadata leakage.

Quantum Onion Routing (QOR) denotes an emerging class of anonymity-oriented routing constructions that try to transplant the layered, relay-compartmentalized logic of classical onion routing into quantum or quantum-secure networking. The term does not yet denote a single standardized protocol. In current literature it spans quantum-native layered schemes for unknown quantum states, anonymous-quantum-networking primitives that hide communication relationships without relay-layered encapsulation, onion-routing-inspired key relay over QKD networks, and post-quantum or quantum-resilient hardenings of classical onion routing. The resulting field is therefore heterogeneous: some systems route quantum payloads, some route only classical relay/control traffic or end-to-end keys, and several papers are relevant precisely because they expose what a complete QOR architecture still lacks (Agathocleous et al., 1 Oct 2025).

1. Scope and terminological boundaries

Across the present literature, “QOR” is best treated as an umbrella concept rather than a settled protocol family. Some works pursue a quantum-native analogue of onion routing, in which the payload is an unknown quantum state and each layer is a reversible quantum encryption. Others instead hide communication metadata in quantum networks, or use onion-routing ideas to protect key relay in QKD networks, or retrofit Tor-like systems against quantum adversaries. This suggests that the decisive question is not whether a paper is “quantum” in some broad sense, but what object is actually routed and which anonymity property is claimed (Sun et al., 2016).

Line of work	Representative papers	Routed object
Quantum-native QOR	(Agathocleous et al., 1 Oct 2025)	Quantum message state plus non-local key-information state
Anonymous quantum-networking primitives	(Sun et al., 2016, Khan et al., 2020)	Traffic-flow metadata or anonymous notification
Quantum transport/routing substrates	(Sazim et al., 2013, Kristjánsson et al., 2022, Farahbakhsh et al., 2022)	Shared-form qubits or coherently routed carriers
QKD-network onion relay	(Otero-García et al., 10 Feb 2025, Otero-García et al., 19 May 2025, Otero-García et al., 19 May 2025)	End-to-end secret keys and classical relay/control data
Quantum-safe or quantum-resilient classical onion routing	(Tujner et al., 2020, Mallick et al., 20 May 2026)	Classical onion setup or fragmented session keys

A recurring misconception follows from this diversity. A protocol may be highly relevant to QOR because it protects sender–receiver relationships, or because it supports multi-hop key relay over a QKD substrate, yet still not qualify as onion routing proper. Conversely, a post-quantum Tor variant may be directly relevant to “quantum-safe onion routing” while having no quantum data plane at all. The literature repeatedly stresses these distinctions rather than collapsing them (Otero-García et al., 19 May 2025).

2. Quantum-native layered constructions

Within the works considered here, the most explicit attempt to define QOR as such is the class-group-action construction built from complex multiplication and isogeny graphs. Its starting point is a structural claim: layered encryption of arbitrary quantum states does not naturally inherit the classical public-key onion model, because keyed unitary encryption is inherently symmetric. The proposed resolution is a symmetric-encryption-based QOR in which each layer is instantiated from the abelian ideal class group action, local neighboring session keys are established by a Diffie–Hellman-style exchange, and a separate non-local key exchange conveys the sender’s decryption key to the receiver without exposing it to intermediaries (Agathocleous et al., 1 Oct 2025).

In that construction, a public starting $j$-invariant $j_0$ anchors the system, and a $j$-invariant $j$ determines a reversible message-encryption circuit

$C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$

The end-to-end message layer is $C(j_A)$, where $j_A=\mathfrak a * j_0$ for the sender’s secret class-group element $\mathfrak a$. Neighboring relays additionally share local transport keys such as $j_{ab}$ and $j_{bc}$, so the message register is rewrapped hop by hop while the receiver separately reconstructs $j_0$0. The receiver prepares a superposition over a hidden cycle segment of $j_0$1-invariants, relays and sender apply class-group actions, intermediaries later remove only their own actions, and the receiver computes

$j_0$2

thereby recovering the sender’s key and applying $j_0$3 to obtain the quantum message. The construction is tied to isogeny graphs, cyclic association schemes, and the Bose–Mesner algebra to formalize the needed commutativity; two implementation paths are proposed, namely a universal quantum oracle evaluating the class-group action with polynomially many quantum resources and an intrinsically quantum approach via continuous-time quantum walks. The accompanying Qiskit example is explicitly a mechanics demonstration rather than an efficiency claim (Agathocleous et al., 1 Oct 2025).

The security basis of this proposal is not information-theoretic anonymity but hardness of the vectorization problem for the class-group action, the same family of assumptions used by contemporary post-quantum class-group-action systems. The paper is careful to note that the construction lacks a full formal anonymity game or composable proof. Its significance is therefore architectural: it identifies one concrete way to obtain commutative, layerable, reversible encryption on unknown quantum states without reverting to classical public-key onion layers. This marks a direct departure from most adjacent literature, where either the payload is not quantum or the anonymity property is weaker than onion routing.

3. Anonymous quantum-networking primitives

A distinct line of work studies anonymity properties in quantum networks without constructing layered relay circuits. Sun and Waks’s secure quantum routing is exemplary. The protocol operates on authenticated classical plus quantum point-to-point links, assumes each node is a secure enclave, and targets an external wiretapper Eve with global passive and active access to all inter-node classical and quantum transmissions “for all time.” A transmitted qubit is represented as

$j_0$4

where $j_0$5 denotes a spatio-temporal mode and $j_0$6 the payload. Type 2 slots provide BB84-style content-secrecy checks; Type 3 slots use interferometric checks to protect the spatio-temporal mode and thus traffic-flow metadata. Under no-disturbance conditions, the paper claims that Eve cannot determine sender, receiver, or even whether communication occurred. Yet the same paper is explicit that this is not onion routing proper: there is no layered relay encryption, no concealed multi-hop circuit, no decentralized path selection, and no threat model involving compromised relays or insider routers (Sun et al., 2016).

Anonymous signaling has also been isolated as a separate primitive. The quantum anonymous notification protocol uses $j_0$7 shared $j_0$8-partite GHZ states, LOCC, and pairwise authenticated classical channels so that one party can anonymously notify another party in an $j_0$9-node quantum network. The paper claims sender anonymity, receiver anonymity, and a traceless property, and states that collaborating malicious participants cannot identify the notifier or the notified party as long as the total number of collaborating parties is less than $j$0. This protocol is relevant to QOR as a control-plane subroutine—anonymous relay selection, next-hop activation, or endpoint notification—but it does not establish hidden paths, forwarding headers, or anonymous payload delivery (Khan et al., 2020).

These works clarify an important boundary. Quantum metadata protection and anonymous notification are not yet onion routing, but they define properties that any full QOR system would likely need. In particular, they separate third-party relationship anonymity from stronger mutual endpoint anonymity, and they show that “quantum anonymity” can reside either in interference-based traffic analysis resistance or in entanglement-assisted signaling, without yet providing a layered relay architecture.

4. Routing and transport substrates without anonymity

Another body of work contributes transport and forwarding mechanisms that are relevant to QOR even though they do not address anonymity. Revocable secret-sharing transport is one such mechanism. In the asynchronous quantum-network protocol for retrieving and routing quantum information, a secret qubit

$j$1

is first embedded into a distributed GHZ-based encoding, later retrieved by the dealer, or transferred to a receiver whose identity was initially unknown. The same framework allows routing the shared encoding through a network, backtracking when a path hits a dead-end due to resource constraints, and using insecure storage hosts without revealing the plaintext qubit. The adversary model is only semi-honest, not Byzantine, and the paper does not provide onion-style anonymity. Its importance for QOR lies in sender-controlled revocation, delayed receiver binding, and movement of quantum information through the network without reconstructing the payload at each intermediate hop (Sazim et al., 2013).

A different transport primitive is coherent routing through multiple paths in superposition. In that model the route degree of freedom itself is placed in superposition, so the carrier propagates simultaneously along multiple relay chains. The paper formalizes the resulting effective end-to-end channel through a vacuum-extension framework and a route-interference operator $j$2. In an idealized $j$3-channel setting, coherent routing yields an asymptotic channel equivalent to a classical $j$4-channel with error probability $j$5, hence positive asymptotic classical capacity

$j$6

This is not a privacy result, and the model assumes trusted or cooperative intermediate operations. Its relevance to QOR is instead at the communication layer: it shows that route delocalization can alter end-to-end performance and suggests a future setting in which a route need not be classically definite (Kristjánsson et al., 2022).

At the scheduler level, opportunistic routing addresses the volatility of entanglement resources. Rather than waiting until all links on a selected path are available, a request advances as soon as an immediate segment becomes usable. The reported result is a $j$7-$j$8 improvement in average total waiting time and average link waiting time relative to several state-of-the-art routing algorithms. The paper also defines $j$9-opportunism, where forwarding begins once the first $j$0 immediate and consecutive hops are available. This line of work contributes no anonymity model, but it is directly relevant to any QOR design that would rely on entanglement-swapping-based multi-hop circuits under finite lifetime and probabilistic generation constraints (Farahbakhsh et al., 2022).

Taken together, these papers indicate that a complete QOR stack would require more than anonymity logic. It would also need revocable custody of quantum payloads, practical multi-hop movement of encoded states, and resource-management policies that tolerate intermittent entanglement without collapsing latency.

5. Onion-relay architectures in QKD networks

The most practically developed “onion” designs in the corpus occur not in quantum-state routing but in QKD networks. Here the object being protected is an end-to-end secret key $j$1, and the main threat is exposure of $j$2 to intermediate relays in key-relay or trusted-node architectures. The 2025 QKDN proposals therefore adapt layered encapsulation to a hybrid setting: QKD supplies hop-by-hop neighbor keys, while PQC protects the inner relayed secret from intermediate nodes. An earlier formulation builds an onion $j$3 recursively from the destination backward, beginning with

$j$4

then wrapping successive layers for intermediate nodes, and finally transporting the resulting extended onion hop by hop under neighboring QKD keys. That design introduces per-hop one-time keys, extension blocks, and Dilithium-style signature or tag checks, but offers no formal anonymity model and leaves several notational and cryptographic details ambiguous, including the treatment of Kyber as public-key encryption and the use of “AES-512-CBC” (Otero-García et al., 10 Feb 2025).

The closely related Onion Routing Relay (ORR) line sharpens this architecture and evaluates it experimentally in QKDNs without quantum repeaters. ORR is explicitly not a protocol for routing quantum states; it is a network-wide key-distribution protocol in which an initiator generates an end-to-end secret $j$5, establishes per-hop onion-layer keys using Kyber-768 or ML-KEM, encrypts layers symmetrically with AES-256-CBC, and forwards the resulting onion through relays that can remove only their own layer. In the conference version, the implementation uses one pair of real ID Quantique Cerberis XGR QKD nodes, exposed through the ETSI GS QKD 014 RESTful key delivery API, and evaluates circuits of $j$6 and $j$7 nodes. For a 5-node circuit, ORR is reported as Onion $j$8 B and ciphertext $j$9 B, while ORR-Ext-HMAC-256 keeps the onion at $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$0 B but raises ciphertext to $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$1 B; Falcon-1024 and Dilithium3 inflate ciphertext to $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$2 B and $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$3 B, respectively. Average key distribution time for basic ORR ranges from $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$4 at 3 nodes to $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$5 at 11 nodes, compared with $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$6 to $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$7 for KR and $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$8 to $C(j)=\bigotimes_{k=0}^{N-1}R_X(\vartheta_k(j)).$9 for TN, whereas ORR-Ext rises from $C(j_A)$0 to $C(j_A)$1 (Otero-García et al., 19 May 2025).

The full ORR version reports the same qualitative conclusion with somewhat different measurements: ORR incurs substantially higher encryption overhead than KR or TN, but key distribution time remains in the same order of magnitude, reaching about $C(j_A)$2 for a 3-node circuit and $C(j_A)$3 for an 11-node circuit, versus nearly $C(j_A)$4 for KR and $C(j_A)$5 for TN at 11 nodes. It also explicitly states that integrity and message-signing mechanisms are outside the scope of that implementation, even though confidentiality, integrity, authenticity, and anonymity are framed as overall objectives (Otero-García et al., 19 May 2025).

These QKDN papers are central to QOR for a precise reason: they import onion layering into quantum-secure infrastructure while remaining entirely classical at the relay/control plane. Their contribution is relay blindness for transported keys, not anonymous routing of quantum states. They therefore occupy an intermediate position between Tor-like path compartmentalization and quantum networking.

6. Quantum-safe and quantum-resilient onion routing over classical substrates

A separate strand treats onion routing as a classical substrate that must survive quantum adversaries. Quantum-Safe Onion Routing (QSOR) studies Tor’s long-term, medium-term, and short-term keys and argues that long-term and medium-term keys should be migrated first. It proposes a purely post-quantum Sweet Onion (QSO), replacing RSA encapsulation with PQC, and a hybrid Sweet Onion (HSO), where two 256-bit AES keys are combined by XOR after one is encapsulated classically and the other post-quantum. The benchmark compares Frodo-640-AES, Frodo-640-SHAKE, Kyber512, NewHope-512-CCA, NTRU-HPS-2048-509, and Sike-p503. In the simplified circuit-build evaluation, Kyber gives total circuit build $C(j_A)$6 cycles and $C(j_A)$7 s, NewHope $C(j_A)$8 cycles and $C(j_A)$9 s, NTRU $j_A=\mathfrak a * j_0$0 cycles and $j_A=\mathfrak a * j_0$1 s, and Sike $j_A=\mathfrak a * j_0$2 cycles and $j_A=\mathfrak a * j_0$3 s. The paper concludes that quantum-safe Tor circuit creation is possible, that bandwidth overhead is the main deployment problem, and that there is no single best PQ choice across CPU and communication costs (Tujner et al., 2020).

The same distinction appears in the 2026 multi-circuit session-key scheme over Tor onion services. Here a QKMS generates a session key $j_A=\mathfrak a * j_0$4, partitions it into $j_A=\mathfrak a * j_0$5 ordered fragments, encrypts each fragment under the recipient’s RSA public key, and delivers them over multiple distinct ephemeral Tor circuits using NEWNYM between bundle transmissions. Reconstruction is $j_A=\mathfrak a * j_0$6-style: the client must receive all fragments, restore order by part index, and concatenate them. The security claim is not payload post-quantum confidentiality; the prototype still uses classical RSA for fragments and Tor’s classical ntor stack. Instead, it targets linkability under harvest-now, decrypt-later assumptions, using the approximation

$j_A=\mathfrak a * j_0$7

The reported end-to-end key-establishment latency is $j_A=\mathfrak a * j_0$8-$j_A=\mathfrak a * j_0$9 s on average, with a $\mathfrak a$0-$\mathfrak a$1 s observed range including tails, and approximately $\mathfrak a$2 of delay is attributed to Tor-related overhead (Mallick et al., 20 May 2026).

These works matter for QOR because they show two different non-quantum uses of the term “quantum”: one refers to post-quantum cryptographic migration of onion routing, the other to quantum-era resilience against retrospective decryption and attribution. Neither routes quantum states, yet both are part of the broader attempt to preserve onion-routing properties in a quantum-threat environment.

7. Security models, limitations, and open research directions

The central security properties associated with QOR are not uniformly realized across the literature. Message secrecy, sender anonymity, receiver anonymity, path secrecy, route unlinkability, traffic-analysis resistance, and robustness against malicious relays are often separated rather than achieved together. Secure quantum routing protects traffic-flow metadata and payload contents against an external wiretapper with global channel access, but explicitly excludes malicious insiders, compromised relays, and multi-hop route concealment. Quantum anonymous notification provides anonymous signaling but not path construction. Revocable shared-state transport assumes semi-honest participants. Coherent and opportunistic routing papers are performance-oriented and non-adversarial. ORR aims at confidentiality, integrity, authenticity, and anonymity in QKDNs, yet does not provide formal anonymity definitions or composable proofs. The class-group-action QOR proposal is the nearest thing to a direct QOR design here, but it likewise lacks a formal anonymity game and leaves metadata leakage questions open (Sun et al., 2016).

Several misconceptions therefore recur. First, “quantum onion routing” often names systems that do not route quantum states at all: ORR routes end-to-end secret keys across QKD networks, while QSOR and the multi-circuit Tor scheme remain classical onion-routing systems hardened for quantum-era threats (Otero-García et al., 19 May 2025). Second, metadata hiding in a quantum network is not automatically onion routing: the Sun–Waks protocol hides communication relationships from an external observer yet has no layered relay encryption or concealed multi-hop circuit structure (Sun et al., 2016). Third, improvements in quantum routing efficiency do not imply anonymity: coherent superposition of paths and opportunistic entanglement management improve transport properties, not sender–receiver unlinkability (Kristjánsson et al., 2022).

The open problems stated across the literature are correspondingly structural. A fuller QOR architecture would still need multi-hop route setup, path-selection algorithms, handling of untrusted intermediate relays, route unlinkability across hops, hiding of multi-hop circuit structure, and formal anonymity notions closer to sender anonymity, receiver anonymity, and resistance to colluding insiders. The class-group-action proposal still needs stronger security modeling, more practical class-group-action implementations, and a fuller development of the CTQW route. QKDN onion-relay protocols still need end-to-end authentication with acceptable overhead, stronger formalization of anonymity guarantees, and resistance to traffic analysis and route-correlation attacks. Transport-layer work leaves finite memory, mixed entangled states, multipartite entangled routing, and active-adversary robustness unresolved (Agathocleous et al., 1 Oct 2025).

The present state of QOR is therefore best described as pre-standard and layered in the literal as well as conceptual sense. The literature already contains quantum-native encryption proposals, traffic-analysis-resistant quantum metadata primitives, QKD-network onion relays, and post-quantum Tor hardenings. What it does not yet contain is a single architecture that simultaneously routes arbitrary quantum payloads, hides endpoints and path structure, tolerates compromised relays, and comes with a mature formal anonymity framework.