1. The short version / before you read / where this fits in the series

• QKD is not a way to send ciphertext; it is a way to make a key: two distant parties build the same secret random string (the key) using single pulses of light. The key is then used in ordinary encryption (such as shared-key ciphers)[Ref. 2, 3]
• Eavesdropping disturbs the light and raises the error rate: a quantum state changes when measured and cannot be copied. If there are too many errors, the parties assume someone may have been listening and throw the key away[Ref. 1, 4, 2]
• But it is not "unbreakable by the laws of physics": the guarantee holds for ideal devices under stated assumptions. Because real devices have holes, distance is a wall, authentication is needed separately, and dedicated optical links are required, the US NSA, the UK NCSC and four agencies of France, Germany, the Netherlands and Sweden (ANSSI, BSI, NLNCSA and the Swedish NCSA) have published positions that do not recommend QKD for important national communications, or that put PQC first[Ref. 29, 30, 31]

2. What "sharing a key" means: the basics of encryption and keys

Before any quantum physics, let us check the basics of encryption. Once these are clear, it becomes obvious what problem QKD is trying to solve.

(1) Encryption is a lock, and the key is the key

Imagine sending a letter in a locked box. Anyone may inspect how the box is built; only the key is secret. Modern encryption works the same way: the procedure (the algorithm) is public, and the only secret is a string of random digits called the key. In widely used shared-key ciphers (AES and others) the sender and the receiver hold the same key: they lock (encrypt) with it and unlock (decrypt) with it. These ciphers are fast and suit large volumes of data (our commentary).

(2) The weak point: how to hand over the key in the first place

Shared-key ciphers raise a question that cannot be avoided: how do two people far apart share the very first key without anyone listening in? This is the "key distribution problem". If the key is sent over an ordinary channel, anyone who listens in obtains it and can read every later message.

(3) Public-key encryption: the padlock analogy and its weakness

In the 1970s a new answer appeared. Diffie and Hellman presented the idea of a "public key"[Ref. 7], and Rivest, Shamir and Adleman presented a concrete scheme (RSA)[Ref. 8]. In the padlock analogy, the receiver hands out padlocks (public keys) to anyone, and the sender snaps a padlock on the box and sends it. Anyone can close a padlock, but only the receiver, who holds the secret key, can open it. Now no key has to be delivered in advance.

Limit of the analogy: real public-key encryption relies not on a physical padlock but on the hardness of mathematical problems. For example, multiplying two large primes is easy, but finding the original primes from the product (factoring) is believed to be extremely hard. If that belief fails, the padlock is useless. Quantum computers are known to solve this type of problem quickly (Shor's algorithm), which is why cryptography that resists them (PQC) is needed. Our explainer on post-quantum cryptography covers this in detail.

(4) Two ways to use a key: the one-time pad and a fast cipher

In 1949 Shannon showed that a completely random key as long as the message, used once, makes a cipher unbreakable in principle (the one-time pad)[Ref. 9]. But this needs as much key as the amount of data sent. Shared-key ciphers such as AES protect large volumes of data with a short key (a few hundred bits, for example), but their safety rests on the computational argument that the cipher is hard to break. QKD keys can be combined with the one-time pad, or handed to a fast encryption device that refreshes its key at short intervals[Ref. 2].

3. Arrows of light: three properties that QKD needs

QKD uses light one particle (photon) at a time. We describe the state of a photon with the series' common "arrow": picture an arrow from the centre of a sphere to its surface. An arrow pointing north is "0" and one pointing south is "1". An arrow pointing east lies midway between north and south (a superposition).

BB84 uses four arrows. North and south are the two arrows of "way A"; east and west are the two of "way B" (the technical term for a way of measuring is a "basis"). East is "0" and west is "1".

The three rules in Fig. 4 are the foundation of QKD's safety.

• Right way is certain, wrong way is a coin toss: when the measurer asks "north or south?", a north or south arrow gives the right answer. An east or west arrow gives north or south at random (the probability is set by the tilt of the arrow; exactly sideways means 50/50).
• Measuring changes the arrow: after the measurement the arrow points along the result and the original direction is gone.
• It cannot be copied: an unknown quantum state cannot, in principle, be duplicated without destroying the original (the no-cloning theorem; Wootters and Zurek, 1982)[Ref. 4].

4. Following BB84 step by step

BB84 is the first QKD scheme, proposed by Bennett and Brassard in 1984[Ref. 1]; the name comes from their surnames and the year. By convention the sender is called Alice, the receiver Bob and the eavesdropper Eve.

A small worked example

We trace 12 pulses with our own simulation (A = north/south, B = east/west; for Alice's bit 0/1, way A sends a north/south arrow and way B an east/west arrow). The right-hand columns show what Bob obtained with the way he chose at random. In the rows where the ways did not match (keep = no), Bob's result is random and means nothing.

Our calculation. Simulated with Python random numbers (seed 4), with no eavesdropper. The six remaining bits "011001" are the seed of the key that Alice and Bob share (error correction and compression are omitted in this small example).

The key point: in the comparison step only "which way was used" is made public, never the bit values. Knowing the list of ways does not reveal the bits (the eavesdropper did not know whether Alice used A or B at the moment the light passed).

5. What happens when someone eavesdrops

Using the three rules of Chapter 3, let us think about what an eavesdropper, Eve, can do. The simplest eavesdropping is "intercept-resend": Eve catches the light on its way, measures it, and sends Bob a fresh arrow that matches her result[Ref. 2]. Eve does not know which way (A or B) Alice used, so she can only choose A or B at random and measure.

If every pulse is intercepted and re-sent, 25% of the bits that survive sifting disagree[Ref. 2]. Our calculation (multiplying the probabilities above).

Using the same 12-pulse example as in Chapter 4, here is what happens when Eve intercepts and re-sends every pulse (same simulation method).

Our calculation. Simulation (seed 2, intercept-resend on every pulse). With only six bits, 2/6 (about 33%) differs from 25%. With a large number of pulses it approaches 25% (next table).

Our calculation. The theory column follows Scarani et al.: intercept-resend on a fraction p of the pulses gives an error rate Q = p/4[Ref. 2]. The simulation used Python (seed 7); about 100,000 bits survived in each row.

Errors cannot be told apart: eavesdropping or noise?

In real devices, even with no eavesdropper, imperfect optics and detector noise produce an error rate of a few per cent. You cannot tell whether an error came from eavesdropping or from noise. So in security assessments the measured error rate is used to bound how much the eavesdropper may know: the higher the error rate, the more information is assumed to have leaked, and that much is erased later by "compression" (Chapter 6). If the error rate exceeds the limit, the key is discarded. Under ideal conditions (a source emitting exactly one photon, an infinitely long key, one-way post-processing) the BB84 limit has been calculated to be an error rate of about 11%[Ref. 2, 5].

6. After the raw key: error correction, compression, authentication

The bit string left after step 3 of Chapter 4 (the "raw key") cannot be used as a key yet: Alice's and Bob's bits still differ slightly, and an eavesdropper may know part of them. So three post-processing steps are carried out over the public channel (steps 4-7 of Fig. 5).

• Error correction: fixes the mismatches. For example, the bit string is split into small blocks, only whether each block holds an even or odd number of 1s is compared in public, and the mismatching blocks are narrowed down to find the errors (one example of a method; our commentary). What is made public reaches the eavesdropper too, so the key is shortened by that much later.
• Compression (privacy amplification): turns a long string into a shorter one by "mixing" it with a fixed procedure. Even if an eavesdropper knows part of the original string, the mixed, shorter string can be made one about which she knows almost nothing. Scarani et al. summarise that the provable method today uses "two-universal hash functions"[Ref. 2].
• Authentication: confirms that the public messages of steps 3-6 were not altered on the way and that the other party is genuine (explained next).

Here is the final key length as a fraction of the sifted bits, from the formula for the ideal case. For ideal BB84 with true single photons the fraction that becomes key is written approximately 1 − 2h(Q)[Ref. 2], where Q is the error rate and h(Q) is a function (the binary entropy) measuring the "uncertainty of errors". h(Q) is about 0.081 for Q = 1%, 0.286 for 5% and 0.5 for 11%.

Our calculation. The formula 1 − 2h(Q) is a guide for single photons, ideal devices and an infinitely long key[Ref. 2]. Real devices (faint laser pulses, finite key length) give less. As the error rate nears 11%, the fraction left falls steeply to zero.

Authentication: QKD alone cannot confirm "who you are talking to"

QKD theory assumes that Alice and Bob are linked by a public channel that is authenticated and cannot be tampered with[Ref. 2]. Without authentication Eve could pose as Alice to Bob and as Bob to Alice, making a key with each of them (a "man in the middle"). So QKD does not provide authentication, and a separate mechanism is needed; both the NSA and the UK NCSC point this out[Ref. 29, 30].

There are two ways to authenticate. According to the NCSC they are (1) authenticating with post-quantum cryptography (PQC) and (2) authenticating with a pre-shared secret key[Ref. 30]. For (2), information-theoretically secure authentication with a short pre-shared key is known (Wegman and Carter, 1981)[Ref. 10], and part of each newly made QKD key is set aside for the next round of authentication. The NCSC adds that (2) can work in some controlled environments, but distributing and managing those keys makes it hard to scale, so it is not for general-purpose use[Ref. 30].

7. Practical limits: distance, speed and device holes

So far we have assumed ideal devices. Building a real system meets three walls.

(1) The distance wall: light fades exponentially in the fibre

Light is gradually lost in an optical fibre through absorption and scattering. With a loss of 0.2 dB per km (an illustrative figure; for the record-low loss of current fibre see our optical fibre explainer), only 1% of the light arrives after 100 km, one part in ten thousand after 200 km and one in a million after 300 km. A quantum state cannot be amplified and regenerated on the way like an ordinary signal (because of no-cloning). That is a major difference from ordinary optical communication.

So when a fraction η of the light arrives, how much key can be made? Pirandola et al. derived the fundamental upper limit on the key rate for schemes without quantum repeaters (just two end points). At high loss the limit is about 1.44 × η bits per light pulse[Ref. 11]. Real devices fall well below this limit because of detector efficiency and noise.

Our calculation. The limit is −log₂(1 − η) (about 1.44η at high loss)[Ref. 11]. A loss of 0.2 dB/km and 10⁹ pulses per second (1 GHz) are illustrative assumptions. Detector efficiency and noise are ignored, so this is an ideal upper limit. It indicates how high the "wall" is for schemes without repeaters, not the key actually obtained.

To get beyond this wall, besides quantum repeaters (our next article) there are the approaches of Chapter 8: trusted relays, satellites and twin-field QKD.

(2) The speed wall: the farther, the closer to "one bit an hour"

Key rate falls steeply with distance. Lucamarini et al. cite earlier experiments of 1.26 megabits per second over 50 km of standard fibre and 1.16 bits per hour over 404 km of ultralow-loss fibre (in a measurement-device-independent configuration)[Ref. 12]. The same "QKD" differs by many orders of magnitude with distance. Boaron et al. reported 6.5 bits per second over 405 km, and key generation up to 421 km, at a repetition rate of 2.5 GHz[Ref. 19] (table in Chapter 8).

Why does speed matter? Because the amount of key needed depends on how it is used (Chapter 2, part 4). A one-time pad needs as much key as the data, so a few bits per second can carry almost nothing; used to refresh the short key of a shared-key cipher often, even a few to a few thousand bits per second can be useful in some cases (our commentary).

(3) Device holes: the gap between theory's "ideal" and real devices

The third wall is the most fundamental. Security proofs assume that the devices behave as the theory says. When a real device departs from the assumptions of the theory, the departure becomes a "hole".

• Source holes: the theory assumes exactly one photon, but real systems often use faint laser pulses, and a pulse may contain two or more photons. With several photons, an eavesdropper has room to take the spare ones (a photon-number-splitting attack). The countermeasure is the decoy-state method: pulses of different intensity are mixed in so that the eavesdropper's activity can be spotted. It was proposed by Hwang and by Lo and colleagues[Ref. 14]. With decoys the key rate scales with the channel transmission t as t¹; without them it scales as t² and degrades rapidly[Ref. 2].
• Detector holes: the detector that receives the light can respond in unintended ways to unintended inputs. In 2010 Lydersen et al. showed experimentally that the detectors of two commercially available QKD systems could be controlled from outside with specially tailored bright light, and reported that the key could be stolen without being noticed[Ref. 13]. This is an example where the hole lay in the implementation, and the theory was not at fault. Countermeasures (changes to the device, and the schemes below) have since been studied.

There are levels of ways to close such holes.

Xu et al.'s review sets out where each approach stands[Ref. 16]. Sourced

Scale of DIQKD experiments: Nadlinger et al. report obtaining 95,628 bits of key from 1.5 million Bell pairs made in eight hours, from entanglement between two trapped ions over an optical fibre link[Ref. 17]. Zhang et al. used two rubidium atoms in buildings 400 m apart and report a key rate of 0.07 bits per entanglement-generation event in the asymptotic limit[Ref. 18]. These are laboratory demonstrations that handle individual quantum bits; they are not at speeds or distances usable in a network. In 2026 Liu et al., using trapped-ion memories, reported a proof-of-principle device-independent QKD demonstration over 10 km of fibre (with finite-size analysis) and a positive key rate over 101 km in the asymptotic limit; the authors say both distances exceed previous work by more than two orders of magnitude[Ref. 44] (only the abstract was checked; part of the work on repeater building blocks covered in our next article on quantum networks and repeaters).

8. Beating the distance wall: trusted relays, satellites, twin-field

Three approaches have been tried to get past the wall of Chapter 7.

• Trusted relays (trusted nodes): a key is made for every hop by QKD, and at each relay site keys are handed on so that a key reaches from end to end. QKD networks often take this form. But if a relay site is taken over by an attacker, the key leaks. Yin et al. state that relays pose security risks[Ref. 23], and the NSA says trusted relays raise cost and insider threat[Ref. 29]. In Japan, a field test of the Tokyo QKD Network has been reported (Sasaki et al.)[Ref. 25].
• Satellites: space has very little optical loss, so a satellite delivers light to the ground. Experiments with China's Micius satellite since 2017 report key generation from satellite to ground up to 1,200 km[Ref. 22], an experiment sending entangled photons from the satellite to two ground stations to make a key between ground stations 1,120 km apart[Ref. 23], and an integrated network of ground fibre and satellite links[Ref. 24].
• Twin-field QKD (TF-QKD): faint light is sent from both ends to a middle measuring station where it interferes, and the key rate falls with distance following the √η trend rather than η. Lucamarini et al. proposed it in 2018 and argued it can exceed the limit for two end points without quantum repeaters[Ref. 12]. A feature is that security holds whoever controls the middle station[Ref. 12].

Here are the main experiments, each with what the number is. The schemes and conditions differ, so key amounts cannot be used to rank them.

Sourced. All values are those reported in the paper abstracts. Schemes, distances and conditions (asymptotic or finite; per pulse or per second) differ, so the numbers in the table cannot be used to rank the experiments.

9. Standards and the views of national agencies

QKD has two kinds of "yardsticks": technical standards, and the views of national security agencies. Do not confuse them. Standards define how devices and networks are built, connected and tested; agency views are judgements on whether QKD should be used to protect a nation's important information.

(1) Technical standards (checked 16 October 2026)

• ITU-T (the standardisation sector of the International Telecommunication Union): recommendations for QKD networks have been developed in sequence: Y.3800 (overview, October 2019), Y.3801 (functional requirements), Y.3802 (functional architecture), Y.3803 (key management), Y.3804 (control and management; the April 2025 edition is in force) and X.1710 (security framework for QKD networks) and X.1711 (framework of QKD protocols in QKD networks, March 2026). All are shown as "in force"[Ref. 32, 33, 34, 35, 36, 37, 45].
• ETSI (the European Telecommunications Standards Institute): its QKD industry specification group publishes specifications (GS) and reports (GR). Examples are GS QKD 014 (a REST API through which an application receives keys from a QKD network, February 2019)[Ref. 39], GS QKD 011 (how to characterise optical components, May 2016)[Ref. 40], GS QKD 008 (security specification for QKD modules, December 2010)[Ref. 41], GS QKD 016 (a Common Criteria protection profile, V2.1.1, January 2024), GR QKD 007 (vocabulary, V1.2.1, January 2026) and GS QKD 020 (a REST API for interoperable key management systems, V1.1.1, June 2026)[Ref. 38].
• ISO/IEC: ISO/IEC 23837-1:2023 (security requirements, test and evaluation methods for QKD, Part 1: requirements; August 2023) and 23837-2:2023 (Part 2: evaluation and testing methods; September 2023). They set out a framework for QKD security evaluation using Common Criteria (the ISO/IEC 15408 series)[Ref. 42, 43]. The texts are paid, so we checked only titles and abstracts. Separately, the joint ISO/IEC committee on quantum technologies (IEC/ISO JTC 3) includes quantum communications in its scope and has a working group, WG 16 "Quantum Communication" (checked 16 October 2026)[Ref. 46].

A standard is a recommendation or specification, not a guarantee that "conforming means safe". For example GS QKD 014 specifies the interface through which keys are received; how a QKD network shares keys is outside its scope (its scope states that how a QKD network generates key material between distant nodes is beyond the scope)[Ref. 39].

(2) Views of national agencies

Sourced. The agencies' views are judgements mainly about protecting government, military and nationally important communications; they do not deny the value of research, or of QKD in other uses. EuroQCI is a promotional programme with a different purpose from the agencies' views (our commentary).

10. QKD and PQC: differences and how they fit together

QKD and PQC both aim to keep key sharing safe even when quantum computers arrive, but they protect in different ways.

Sourced / Our calculation (organisation of the table). The PQC column is checked against primary sources in our next article on post-quantum cryptography.

"Quantum communication" other than QKD

"Quantum communication" is a broader term than QKD. The NCSC divides what is called "quantum networking" into three classes: (1) replacing classical security functions with quantum technology (QKD is an example), (2) extending classical networks with functions only quantum components can provide (such as networks of quantum sensors), and (3) inherently quantum networks that distribute entangled quantum states between quantum devices[Ref. 30]. Quantum random number generators (QRNGs), which use quantum unpredictability, are also being researched as a source of the random numbers from which keys are made[Ref. 30]. Class 3 could also become a future foundation for linking distant quantum computers. We cover it in the next article on quantum networks and repeaters.

11. How to read the yardsticks and standards

QKD's progress is measured by four yardsticks: (1) how fast and how far a key can be made (key rate and distance), (2) theoretical security (the assumptions of the security proof), (3) implementation security (checking device holes) and (4) operation as a network. (1) is reported as experimental numbers, but distance, scheme, "asymptotic or finite" and "per pulse or per second" differ from number to number. The meaning of (2) depends on the assumptions. (3) has begun to be handled by standards and evaluation schemes (Common Criteria and others). Checked 16 October 2026.

The organisation of the table is Our calculation (arrangement). Numbers, titles and status checked on the official ITU-T, ETSI and ISO pages (checked 16 October 2026).

Cautions in reading (for materials engineers)

• "Safe by the laws of physics" and "this device is safe" are different statements: the first concerns theory, the second the verification of the device. The material quality of what builds the device (source, detector, fibre) decides the second (Chapter 7).
• Read key-amount numbers with matching conditions: "success over 1000 km", "a few bits per second" and "10⁻¹¹ per pulse" are different quantities (table in Chapter 8).
• Standards and agency views differ in how binding they are: ITU-T, ETSI and ISO/IEC standards generally bind only when cited in law or contract (our commentary). Agency views bear on that country's government procurement and operations but do not necessarily bind other organisations directly.
• Separate plans from achievements: networks under construction or planned, such as EuroQCI, are to be read as "Not yet confirmed".

12. Glossary

13. References (primary sources)

1. Bennett C. H., Brassard G. "Quantum cryptography: Public key distribution and coin tossing", Theor. Comput. Sci. 560, 7–11 (2014), DOI 10.1016/j.tcs.2014.05.025 (reprint of the 1984 conference paper; arXiv:2003.06557) — doi.org/10.1016/j.tcs.2014.05.025
2. Scarani V. et al. "The security of practical quantum key distribution", Rev. Mod. Phys. 81, 1301–1350 (2009), DOI 10.1103/RevModPhys.81.1301 (arXiv:0802.4155) — doi.org/10.1103/RevModPhys.81.1301
3. Gisin N., Ribordy G., Tittel W., Zbinden H. "Quantum cryptography", Rev. Mod. Phys. 74, 145–195 (2002), DOI 10.1103/RevModPhys.74.145 — doi.org/10.1103/RevModPhys.74.145
4. Wootters W. K., Zurek W. H. "A single quantum cannot be cloned", Nature 299, 802–803 (1982), DOI 10.1038/299802a0 — doi.org/10.1038/299802a0
5. Shor P. W., Preskill J. "Simple Proof of Security of the BB84 Quantum Key Distribution Protocol", Phys. Rev. Lett. 85, 441–444 (2000), DOI 10.1103/PhysRevLett.85.441 — doi.org/10.1103/PhysRevLett.85.441
6. Ekert A. K. "Quantum cryptography based on Bell's theorem", Phys. Rev. Lett. 67, 661–663 (1991), DOI 10.1103/PhysRevLett.67.661 — doi.org/10.1103/PhysRevLett.67.661
7. Diffie W., Hellman M. "New directions in cryptography", IEEE Trans. Inf. Theory 22, 644–654 (1976), DOI 10.1109/TIT.1976.1055638 — doi.org/10.1109/TIT.1976.1055638
8. Rivest R. L., Shamir A., Adleman L. "A method for obtaining digital signatures and public-key cryptosystems", Commun. ACM 21, 120–126 (1978), DOI 10.1145/359340.359342 — doi.org/10.1145/359340.359342
9. Shannon C. E. "Communication Theory of Secrecy Systems", Bell Syst. Tech. J. 28, 656–715 (1949), DOI 10.1002/j.1538-7305.1949.tb00928.x — doi.org/10.1002/j.1538-7305.1949.tb00928.x
10. Wegman M. N., Carter J. L. "New hash functions and their use in authentication and set equality", J. Comput. Syst. Sci. 22, 265–279 (1981), DOI 10.1016/0022-0000(81)90033-7 — doi.org/10.1016/0022-0000(81)90033-7
11. Pirandola S., Laurenza R., Ottaviani C., Banchi L. "Fundamental limits of repeaterless quantum communications", Nat. Commun. 8, 15043 (2017), DOI 10.1038/ncomms15043 — nature.com/articles/ncomms15043
12. Lucamarini M., Yuan Z. L., Dynes J. F., Shields A. J. "Overcoming the rate–distance limit of quantum key distribution without quantum repeaters", Nature 557, 400–403 (2018), DOI 10.1038/s41586-018-0066-6 — nature.com/articles/s41586-018-0066-6
13. Lydersen L. et al. "Hacking commercial quantum cryptography systems by tailored bright illumination", Nat. Photon. 4, 686–689 (2010), DOI 10.1038/nphoton.2010.214 — nature.com/articles/nphoton.2010.214
14. Lo H.-K., Ma X., Chen K. "Decoy State Quantum Key Distribution", Phys. Rev. Lett. 94, 230504 (2005), DOI 10.1103/PhysRevLett.94.230504 (see also Hwang W.-Y., Phys. Rev. Lett. 91, 057901 (2003), DOI 10.1103/PhysRevLett.91.057901) — doi.org/10.1103/PhysRevLett.94.230504
15. Lo H.-K., Curty M., Qi B. "Measurement-Device-Independent Quantum Key Distribution", Phys. Rev. Lett. 108, 130503 (2012), DOI 10.1103/PhysRevLett.108.130503 — doi.org/10.1103/PhysRevLett.108.130503
16. Xu F., Ma X., Zhang Q., Lo H.-K., Pan J.-W. "Secure quantum key distribution with realistic devices", Rev. Mod. Phys. 92, 025002 (2020), DOI 10.1103/RevModPhys.92.025002 — doi.org/10.1103/RevModPhys.92.025002
17. Nadlinger D. P. et al. "Experimental quantum key distribution certified by Bell's theorem", Nature 607, 682–686 (2022), DOI 10.1038/s41586-022-04941-5 — nature.com/articles/s41586-022-04941-5
18. Zhang W. et al. "A device-independent quantum key distribution system for distant users", Nature 607, 687–691 (2022), DOI 10.1038/s41586-022-04891-y — nature.com/articles/s41586-022-04891-y
19. Boaron A. et al. "Secure Quantum Key Distribution over 421 km of Optical Fiber", Phys. Rev. Lett. 121, 190502 (2018), DOI 10.1103/PhysRevLett.121.190502 — doi.org/10.1103/PhysRevLett.121.190502
20. Chen J.-P. et al. "Sending-or-Not-Sending with Independent Lasers: Secure Twin-Field Quantum Key Distribution over 509 km", Phys. Rev. Lett. 124, 070501 (2020), DOI 10.1103/PhysRevLett.124.070501 — doi.org/10.1103/PhysRevLett.124.070501
21. Liu Y. et al. "Experimental Twin-Field Quantum Key Distribution over 1000 km Fiber Distance", Phys. Rev. Lett. 130, 210801 (2023), DOI 10.1103/PhysRevLett.130.210801 — doi.org/10.1103/PhysRevLett.130.210801
22. Liao S.-K. et al. "Satellite-to-ground quantum key distribution", Nature 549, 43–47 (2017), DOI 10.1038/nature23655 — nature.com/articles/nature23655
23. Yin J. et al. "Entanglement-based secure quantum cryptography over 1,120 kilometres", Nature 582, 501–505 (2020), DOI 10.1038/s41586-020-2401-y — nature.com/articles/s41586-020-2401-y
24. Chen Y.-A. et al. "An integrated space-to-ground quantum communication network over 4,600 kilometres", Nature 589, 214–219 (2021), DOI 10.1038/s41586-020-03093-8 — nature.com/articles/s41586-020-03093-8
25. Sasaki M. et al. "Field test of quantum key distribution in the Tokyo QKD Network", Opt. Express 19, 10387–10409 (2011), DOI 10.1364/OE.19.010387 — doi.org/10.1364/OE.19.010387
26. Hadfield R. H. "Single-photon detectors for optical quantum information applications", Nat. Photon. 3, 696–705 (2009), DOI 10.1038/nphoton.2009.230 — doi.org/10.1038/nphoton.2009.230
27. Marsili F. et al. "Detecting single infrared photons with 93% system efficiency", Nat. Photon. 7, 210–214 (2013), DOI 10.1038/nphoton.2013.13 (arXiv:1209.5774) — arxiv.org/abs/1209.5774
28. Reddy D. V., Nerem R. R., Nam S. W., Mirin R. P., Verma V. B. "Superconducting nanowire single-photon detectors with 98% system detection efficiency at 1550 nm", Optica 7, 1649–1653 (2020), DOI 10.1364/OPTICA.400751 — doi.org/10.1364/OPTICA.400751
29. NSA (National Security Agency) "Quantum Key Distribution (QKD) and Quantum Cryptography (QC)" (web page). The live page was not reachable from our environment on 16 October 2026; the text was read from an Internet Archive copy of the same URL — nsa.gov/Cybersecurity/Quantum-Key-Distribution-QKD-and-Quantum-Cryptography-QC/
30. NCSC (UK National Cyber Security Centre) "Quantum networking technologies" (white paper, version 1.0, published 5 August 2025) — ncsc.gov.uk/whitepaper/quantum-security-technologies
31. ANSSI, BSI, NLNCSA, Swedish NCSA "Position Paper on Quantum Key Distribution" (ANSSI page, published 25 January 2024) — cyber.gouv.fr/en/publications/jointly-led-international-publications/position-pa
32. ITU-T Recommendation Y.3800 (10/2019) "Overview on networks supporting quantum key distribution" (status: in force) — itu.int/rec/T-REC-Y.3800/en
33. ITU-T Recommendation Y.3801 (04/2020) "Functional requirements for quantum key distribution networks" (status: in force) — itu.int/rec/T-REC-Y.3801/en
34. ITU-T Recommendation Y.3802 (12/2020) "Quantum key distribution networks – Functional architecture" (status: in force; Amendment 1, 11/2023) — itu.int/rec/T-REC-Y.3802/en
35. ITU-T Recommendation Y.3803 (12/2020) "Quantum key distribution networks – Key management" (status: in force; Amendment 1, 11/2023) — itu.int/rec/T-REC-Y.3803/en
36. ITU-T Recommendation Y.3804 (04/2025) "Quantum key distribution networks – Control and management" (status: in force; supersedes the 09/2020 edition) — itu.int/rec/T-REC-Y.3804/en
37. ITU-T Recommendation X.1710 (10/2020) "Security framework for quantum key distribution networks" (status: in force) — itu.int/rec/T-REC-X.1710/en
38. ETSI Quantum Key Distribution (QKD) committee page, listing of ETSI group specifications and group reports (checked 16 October 2026) — etsi.org/committee/qkd
39. ETSI GS QKD 014 V1.1.1 (2019-02) "Quantum Key Distribution (QKD); Protocol and data format of REST-based key delivery API" — etsi.org/deliver/etsi_gs/QKD/001_099/014/01.01.01_60/gs_qkd014v010101p.pdf
40. ETSI GS QKD 011 V1.1.1 (2016-05) "Quantum Key Distribution (QKD); Component characterization: characterizing optical components for QKD systems" — etsi.org/deliver/etsi_gs/QKD/001_099/011/01.01.01_60/gs_QKD011v010101p.pdf
41. ETSI GS QKD 008 V1.1.1 (2010-12) "Quantum Key Distribution (QKD); QKD Module Security Specification" — etsi.org/deliver/etsi_gs/QKD/001_099/008/01.01.01_60/gs_qkd008v010101p.pdf
42. ISO/IEC ISO/IEC 23837-1:2023 "Information security — Security requirements, test and evaluation methods for quantum key distribution — Part 1: Requirements" (ISO page; published 2023-08, ISO/IEC JTC 1/SC 27) — iso.org/standard/77097.html
43. ISO/IEC ISO/IEC 23837-2:2023 "… — Part 2: Evaluation and testing methods" (ISO page; published 2023-09) — iso.org/standard/77309.html
44. Liu W.-Z. et al. "Long-lived remote ion–ion entanglement for scalable quantum repeaters", Nature 652, 51 (2026; published online 2 February 2026), DOI 10.1038/s41586-026-10177-4 — nature.com/articles/s41586-026-10177-4
45. ITU-T Recommendation X.1711 (03/2026) "Framework of quantum key distribution (QKD) protocols in QKD networks" (status: in force; checked 16 October 2026) — itu.int/rec/T-REC-X.1711/en
46. IEC/ISO JTC 3 "Quantum technologies" committee page on iso.org (scope includes quantum communications; working groups include WG 16 Quantum Communication; checked 16 October 2026) — iso.org/committee/10138914.html
47. European Commission "European Quantum Communication Infrastructure - EuroQCI" (Shaping Europe's digital future) — digital-strategy.ec.europa.eu/en/policies/european-quantum-communication-infrast

14. Claim-to-source audit

Last updated: 16 October 2026. Sources are limited to primary material (peer-reviewed papers; official pages of ITU-T, ETSI and ISO; official pages of the NSA, NCSC, ANSSI and the European Commission). The texts of standards are paid or were not checked, so we confirmed only titles and scope. The NSA's official page was not reachable from our environment, and we read an Internet Archive copy. Numerical examples are our own calculations, not measurements of a real device. We could not confirm, and therefore do not state: a standard setting a common pass level for key rate, a common benchmark for network operation, the repetition rate of the 1002 km experiment, or the contents of the requirements of each standard. All figures are explanatory concept diagrams or charts including our calculation; Figures 1 and 10 are ImageGen-generated conceptual illustrations. This article is neither legal nor investment advice, and not an explanation of how to carry out attacks.