Two procurement requests can land on the same desk in the same week, asking to solve the same problem in opposite ways.
One is a quote for dedicated fiber and specialized hardware to link a data center in Frankfurt with one in Singapore, so the two sites can exchange encryption keys using the physics of light. The other is a request to schedule four hours of downtime so a security team can push updated cryptographic algorithms to every server in both locations. Both proposals use the words "quantum safe." Both are responding to the same threat. They are not, however, the same kind of thing, and a buyer who treats them as interchangeable options on a comparison chart will make an expensive mistake.
Quantum key distribution and post-quantum cryptography answer different questions, and quantum key distribution is the older, narrower answer of the two. One is infrastructure. The other is a software replacement. Knowing which is which, and what each one actually covers, matters more than picking a winner.
QKD vs PQC: Two Answers to Different Questions
Start with what each one is, stripped of marketing.
Quantum key distribution uses quantum mechanics to let two parties generate a shared secret key, with the property that any eavesdropping attempt is physically detectable. That guarantee comes from quantum physics directly, not from an assumption about computing power. It requires purpose-built hardware and, in its standard form, a dedicated optical fiber connecting two fixed points.
Post-quantum cryptography is a set of new cryptographic algorithms, built on math problems believed to resist attack from quantum computers, designed as drop-in replacements for the asymmetric cryptography already running in browsers, VPNs, and certificate infrastructure everywhere. No new hardware. No new fiber. It runs on the classical computers already in production.
That is the entire qkd vs pqc question, answered in two paragraphs. Everything else is detail. But the detail is where buyers get into trouble, because QKD generates keys and PQC replaces algorithms, and those are not competing answers to the same question so much as two different layers of the same stack. One without the other leaves gaps. Confusing the two, or assuming a QKD deployment makes the rest of an estate quantum safe, is the actual risk.
What Quantum Computing Actually Breaks
Neither technology exists without a specific, narrow vulnerability in classical cryptography, so it is worth being precise about what quantum computers threaten and what they leave alone. Most of what people worry about, quantum computers do not touch.
In 1994, mathematician Peter Shor proved that a sufficiently powerful quantum computer could efficiently solve integer factorization and discrete logarithm problems, the two math problems underneath RSA, Diffie-Hellman, and elliptic-curve cryptography. That is the entire security foundation of the asymmetric handshake that starts nearly every encrypted connection online. Quantum computers, once large enough, dismantle it, which is the entire premise both QKD and PQC are built to answer.
Symmetric encryption is a different story. AES loses some effective strength against quantum attacks, but doubling the key length restores the margin, and organizations already use key sizes that account for it. The vulnerability sits almost entirely in public key cryptography, specifically in the handshake, which is precisely why both QKD and post-quantum cryptography exist to fix the same narrow failure point rather than to rebuild cryptography from scratch.
My colleague Ari Krakauer wrote about why this threat exists before either quantum key distribution or post-quantum cryptography enters the picture, including why traffic captured today stays exposed until the encryption underneath it is broken, in Messages that Waited 30 Years. That piece covers the "why now" of quantum computing as a threat. This one covers what to actually deploy in response.
How Quantum Key Distribution Handles Key Distribution
Quantum key distribution earns its name honestly: distributing keys is the entire job, and quantum key distribution does not claim to do anything else.
The mechanism rests on two properties of quantum mechanics that have nothing to do with how fast quantum computers can calculate. Under the no-cloning theorem, an unknown quantum state cannot be copied without destroying the original, and any attempt to measure a quantum system disturbs it in a way that leaves a trace. Put those together and you get something classical cryptography cannot offer: a communication channel where an eavesdropper's presence shows up as a measurable disturbance rather than as something you infer after the fact. BB84, the original protocol from 1984, still anchors most commercial quantum key distribution protocols in deployment today.
The security this buys is called information-theoretic security, which means it holds regardless of how much computing power an adversary has, quantum or otherwise. That is a stronger guarantee, in principle, than anything resting on computational difficulty, since it holds even against quantum computers nobody has built yet. It is also a guarantee about one specific thing: the key exchange between two points. QKD systems do not encrypt your data. The key they generate gets handed off to ordinary symmetric encryption to do that work.
And QKD has a gap that surprises people who hear "physics-based security" and assume it covers everything: it cannot authenticate who is on the other end of the line. Confirming identity still requires asymmetric cryptography or pre-shared keys, which means a QKD deployment leans on the exact category of cryptography it is sometimes pitched as replacing.
Where Post Quantum Cryptography Fits
Post-quantum cryptography took the software route, and the timeline behind it is longer than most people assume.
The National Institute of Standards and Technology opened a public competition for quantum-resistant algorithms in 2016, ran it through eight years of open cryptanalysis with researchers worldwide trying to break every candidate, and published the first finalized standards in 2024. A fourth algorithm was added as a backup in 2025. The result: ML-KEM for key encapsulation, and ML-DSA and SLH-DSA covering digital signatures.
What makes post-quantum cryptography PQC the practical default for most organizations comes down to two things. First, it runs on hardware you already have. No specialized equipment, no new fiber, no distance limit. It works identically whether the endpoint is a data center, a laptop, a mobile phone, or an IoT sensor that will never see a dedicated optical link in its operational life. Major browsers have quietly rolled out hybrid classical and post-quantum key exchange already, so there is a reasonable chance the connection serving this page used it.
Second, post-quantum cryptography covers territory QKD cannot touch by design. Digital signatures, code signing, certificate authorities: none of that is key distribution, and all of it depends on the same vulnerable public key cryptography that quantum computers threaten. A quantum key distribution link between two data centers does nothing for a certificate chain. Post-quantum cryptography reaches every one of those cases because it replaces the underlying cryptographic algorithms rather than building a parallel channel around them.
Lattice Based Cryptography and the Mathematics Underneath
The algorithms NIST standardized needed a new mathematical foundation, since the old one is exactly what quantum computers break. None of these replacement algorithms depend on quantum physics at all; they run entirely on ordinary math.
Most of them rest on lattice based cryptography. A lattice, in this context, is a highly structured grid of points extending across many dimensions, and certain problems on that grid, like locating the point closest to an arbitrary target, have no known efficient solution on classical or quantum hardware. ML-KEM and ML-DSA are both lattice based constructions, and the choice was not casual: lattice problems had already absorbed years of cryptanalytic attention before NIST's competition even began.
SLH-DSA takes a more conservative path. It is hash based, meaning its security reduces entirely to the properties of cryptographic hash functions, which remain well understood and are not meaningfully weakened by attacks from quantum computers. The tradeoff is size. Hash based signatures run considerably larger than their lattice based counterparts, which is the price of resting on a narrower, more thoroughly tested assumption.
None of this needs to be understood to use it. Nobody using a bank's website needs to understand elliptic curves today, and nobody using tomorrow's post-quantum browser session will need to understand lattices either.
The Practical Limits of QKD Systems
QKD's physics is not in question. Its deployment envelope is, and the constraints are specific enough to name.
Distance. Photon loss in fiber is exponential, not linear, which caps commercial QKD at roughly 100 kilometers before signal degrades past usability. Researchers have pushed a trusted-node link past 303 kilometers between Linköping and Stockholm using deployed fiber, but "trusted node" is doing real work in that phrase: it means intermediate relays hold the keys briefly, and each relay is a point where the physical guarantee no longer applies. Classical fiber solves distance with optical amplifiers. QKD cannot use them, because amplifying a quantum signal means copying it, and the no-cloning theorem that makes QKD secure is the same property that rules amplification out.
Authentication. Already covered above, and worth repeating because it surprises people: QKD alone leaves the door open to man-in-the-middle attacks unless authentication is bolted on separately.
Denial of service. The same sensitivity that reveals an eavesdropper also means an attacker can kill a session just by injecting noise into the fiber, without ever learning the key.
Implementation security. Theoretical security and deployed security are not the same thing. QKD's real-world security depends on how well the hardware is built, and researchers have demonstrated working side-channel attacks against commercial QKD systems by exploiting the physical implementation rather than the underlying math.
Cost. Specialized hardware, dedicated fiber, point-to-point topology. None of it is cheap, and none of it scales the way a software patch does.
Governments disagree about what to do with this list. The NSA's public guidance states plainly that it does not support QKD for protecting National Security Systems and views post-quantum cryptography as the more practical, cost-effective path, with no plans to certify QKD products unless the limitations above are resolved. The UK has taken a comparable position. The European Union has gone the other direction, building EuroQCI as a continent-spanning QKD network.
It is not a settled argument. Renner and Wolf published a detailed rebuttal to the NSA's position, arguing that several of the objections apply just as well to classical systems and that others will likely be resolved as the hardware matures. Both sides have a case. What is not really contested is the near-term calculus for a typical enterprise: QKD earns its cost in a narrow set of high-security, fixed-endpoint scenarios. Post-quantum cryptography is what covers everything else.
Crypto Agility Is the Requirement Neither One Satisfies
Here is the question both vendor pitches tend to skip past.
Whatever you deploy this year will not be the final answer. NIST has already revised the standard suite once, and the body that wrote it expects to do so again before 2035. An organization that treats this as a single migration project is planning for a version of the future that will not arrive.
What actually matters is crypto agility, and the term deserves a harder definition than the one it usually gets. Crypto agility is not a roadmap slide or a stated intention to "support future algorithms." It is a demonstrated capability: one completed rotation, where a policy change propagates to every affected system, nothing breaks in production, and telemetry confirms the new algorithm is actually in use everywhere it needs to be. Until that rotation has happened once, agility is a claim rather than a fact.
That single completed rotation proves several things at once: that the cryptographic inventory is accurate, that the policy mechanism actually reaches every path it claims to cover, and that the change can be verified after the fact instead of taken on faith. A vendor's roadmap for future algorithm support is not evidence of any of that. A rotation log is.
What Post Quantum Protection Requires on a Real Network
This is the gap both procurement requests from the opening left unaddressed: neither one tells you which of your paths are actually protected right now.
An organization can deploy post-quantum cryptography, in fact, on 40 percent of its estate and still be fully exposed on the other 60 percent, because the algorithm choice says nothing about coverage. Coverage is a network-wide property, not a product feature, and it is the thing that actually determines whether harvested traffic stays safe or becomes a future breach.
Three requirements define real coverage, and they apply to any vendor's claim, including ours.
East-west and cross-cloud paths count, not just the perimeter. The traffic between services, across regions, and between clouds is where an enterprise's actual secrets travel, and it is routinely the traffic perimeter-focused deployments miss entirely.
Coverage cannot depend on rerouting traffic to reach an inspection point. A deployment that requires redesigning how traffic flows is a network migration wearing a security label, and most of those migrations stall before they finish.
Every point where cryptography terminates and re-originates has to be accounted for. Each one is a place where harvested traffic could be exposed, regardless of what the box doing the terminating is called or who sells it.
That third requirement applies to Aviatrix exactly as much as to any competitor mentioned in this article. A standard that exempts its author is not a standard, and we expect to be measured against it the same way anyone else should be.
There is one move available right now that requires no cryptographic migration at all: default-deny egress. If a workload was never permitted to send traffic to a destination, there is nothing there for an adversary to harvest. Distributed Cloud Firewall enforces exactly that at the workload level, shrinking the exposed surface before a single algorithm gets touched. For the paths that legitimately need to stay open, High Performance Encryption handles what travels across them. Together, that is containment applied to a quantum-era problem: limit what is reachable first, then protect what has to remain reachable.
The two procurement requests from the opening will both get answered eventually, probably by the same organization, because most enterprises need some version of both technologies somewhere in their estate. But the more useful question was never QKD versus PQC. It was which paths are carrying data that needs to stay secret past the day a quantum computer arrives, and whether anyone has actually checked.
See which paths in your own environment are currently exposed with a free Workload Attack Path Assessment.
