Quantum key distribution uses single photons or weak optical signals to let two parties agree a shared secret key whose security rests on physics rather than computational hardness, and the 2026 literature shows the hardware is now rack-mountable and field-stable while the security proofs are still catching up with real devices.
Summary
QKD is a protocol family, not a single device. Alice encodes random bits in properties of very weak light (polarisation, time bins, phase, or the quadratures of a laser field), Bob measures them, and the two then run a classical exchange over an authenticated public channel to sift, error-correct and privacy-amplify what remains into a shared key. Any eavesdropper measuring the quantum signal disturbs it, which shows up as excess error or noise, so the parties can bound how much an adversary could know and hash the key down until that knowledge is negligible. The output is key material, typically consumed by symmetric encryption or, in the limit, a one-time pad.
Two hardware families dominate. Discrete-variable (DV) systems use single-photon detectors and decoy-state BB84 with attenuated lasers; continuous-variable (CV) systems use coherent or squeezed states with homodyne detection and reuse standard telecom optics. Variants proliferate: entanglement-based schemes such as BBM92 and E91, measurement-device-independent and twin-field protocols, mode-pairing protocols that beat the repeaterless rate-loss bound without global phase locking, and high-dimensional encodings using orbital angular momentum to raise bits per photon.
The parameters that decide QKD are channel loss, background noise, clock rate and the fidelity of the device model. Loss sets reach: metropolitan fibre links of tens of kilometres sit at roughly 10 dB, free-space CV work is being pushed to 23.5 dB, and geostationary satellite downlinks are an extreme-loss, high-background regime. Rate is chased by raising the repetition rate, which is exactly what creates the practical security problems: pulses at GHz clocks correlate with their neighbours and leak encoding settings, breaking a founding assumption of the decoy-state method.
The decisive variable is therefore not physics but characterisation. The security is information-theoretic only relative to a model of the boxes; when the boxes deviate, the proof does not apply. Much of the current work is closing that gap, either with numerical finite-key frameworks that admit non-IID signals and partially characterised hardware or by finding the next side channel in deployed components.
Evidence base
- A 1.25 GHz integrated-photonics QKD prototype in 19-inch rack units held continuous key exchange over more than 4 km of metropolitan fibre across more than 12 day-night cycles without manual intervention, with no chromatic dispersion compensation needed below 100 km, reported 29 May 2026.
- Free-space CV-QKD with self-referenced passive state preparation and a local local oscillator reached an asymptotic secret key rate of 10.34 Mbps at up to 23.5 dB channel loss under turbulence, 8 May 2026.
- Intensity correlations measured in two industrial decoy-state BB84 prototypes leak encoding settings and significantly reduce the asymptotic key rate, with higher-order correlations having greater impact than nearest-neighbour ones, contrary to prior conjecture, 4 May 2026.
- An avalanche single-photon detector sinusoidally gated at 312.5 MHz showed click timing shifting by more than 2 ns as pulse energy varied over 50 dB, enabling two proposed attacks that violate an implicit assumption in security proofs, 14 May 2026.
- Sequential time-bin entangled photon pairs generated from GHz modulated laser pulses were distributed over about 30 km and 9.5 dB of the Vienna fibre network using off-the-shelf components, 14 May 2026.
- A survey published 28 May 2026 catalogues nine practical QKD problem classes across device, channel, protocol, machine-learning and network layers, reporting DBSCAN-based CV attack detection at precision 99.7% and recall 99.8% but adversarial robustness recovery only up to 79.5%.
- A geostationary decoy-state BB84 downlink feasibility study using variable-length finite-key security forecast annual secret-key yield across Europe from historical cloud data, establishing trade-offs rather than a demonstrated link, 29 May 2026.
Open questions
- Do the new numerical finite-key frameworks that admit non-IID signals and partially characterised devices still yield commercially useful key rates once real modulator bandwidth limits, intensity correlations and detector timing effects are all included?
- Which family wins on cost per certified bit at metropolitan distance: DV with integrated photonics and single-photon detectors, or CV reusing standard telecom optics and squeezed or coherent states?
- Can the detector energy-time superlinearity be closed by countermeasure or must it be absorbed into the security proof, and at what key-rate cost?
- Do the sub-quadratic authentication and adaptive routing results hold under real metropolitan traffic and real loss, or only under the sparse-mixing assumptions used to derive them?
Assessment drafted 2026-08-31 from up to 18 KB sources using the technology-scorecard framework; scores are a draft read pending review.