
Perspective on the QKD vs. PQC debate
with Renato Renner
The rise of quantum computing introduces risks to classical encryption systems, emphasizing the need for more resilient alternatives. Post-quantum cryptography (PQC) offers a practical short- to medium-term solution but still relies on classical cryptographic principles, which may have inherent limitations. Quantum key distribution (QKD), on the other hand, aims to provide a fundamentally higher level of security—information-theoretic security—that classical methods cannot achieve. However, QKD faces several challenges, including scalability and cost, which require further technological progress to address. This chapter critically examines the key challenges associated with QKD and explores the potential for overcoming its current limitations through ongoing research and future advancements.
In: J. Jang‑Jaccard, P. Caroff, E. Blezinger, V. Mulder, A. Mermoud, V. Lenders (eds), Quantum Technologies, Springer, Cham (2026)

Defining security in quantum key distribution
with Carla Ferradini, Martin Sandfuchs, and Renato Renner
The security of quantum key distribution (QKD) is quantified by a parameter ε >0, which—under well-defined physical assumptions—can be bounded explicitly. This contrasts with computationally secure schemes, where security claims are only asymptotic (i.e., under standard complexity assumptions, one only knows that ε → 0 as the key size grows, but has no explicit bound). Here we explain the definition and interpretation of ε-security. Adopting an axiomatic approach, we show that ε can be understood as the maximum probability of a security failure. Finally, we review and address several criticisms of this definition that have appeared in the literature.
ArXiv: 2509.13405

Security of differential phase shift QKD from relativistic principles
with Martin Sandfuchs, Martin Haberland, and V. Vilasini
20 years after its invention, we provide a full security proof of the differential phase shift protocol for quantum key distribution! The proof combines the entropy accumulation theorem with relativistic principles and techniques from quantum optics.
Journal: Quantum 9, 1611 (2025)
ArXiv: 2301.11340

Entropy bounds for device-independent QKD with local Bell test
with Ernest Y.-Z. Tan
One of the main challenges in device-independent quantum key distribution (DIQKD) is achieving the required Bell violation over long distances, as the channel losses result in low overall detection efficiencies. Recent works have explored the concept of certifying nonlocal correlations over extended distances through the use of a local Bell test. Here, an additional quantum device is placed in close proximity to one party, using short-distance correlations to verify nonlocal behavior at long distances. However, existing works have either not resolved the question of DIQKD security against active attackers in this setup, or used methods that do not yield tight bounds on the keyrates. In this work, we introduce a general formulation of the key rate computation task in this setup that can be combined with recently developed methods for analyzing standard DIQKD. Using this method, we show that if the short-distance devices exhibit sufficiently high detection efficiencies, positive key rates can be achieved in the long-distance branch with lower detection efficiencies as compared to standard DIQKD setups. This highlights the potential for improved performance of DIQKD over extended distances in scenarios where short-distance correlations are leveraged to validate quantum correlations.
Journal: Physical Review Letters 133, 120803 (2024)
ArXiv: 2404.00792

The debate over QKD: A rebuttal to the NSA’s objections
with Renato Renner
A recent publication by the NSA assessing the usability of quantum cryptography has generated significant attention, concluding that this technology is not recommended for use. Here, we reply to this criticism and argue that some of the points raised are unjustified, whereas others are problematic now but can be expected to be resolved in the foreseeable future.
ArXiv: 2307.15116

Coherent attacks are stronger than collective attacks on DIQKD with random postselection
with Martin Sandfuchs
In a recent paper, the authors report on the implementation of a device-independent QKD protocol with random postselection, which was originally proposed in this work. Both works only provide a security proof against collective attacks, leaving open the question whether the protocol is secure against coherent attacks. Here, we report on an attack on this protocol that demonstrates that coherent attacks are, in fact, stronger than collective attacks.
ArXiv: 2306.07364

Quantum advantage in cryptography
with Renato Renner
We give an overview of the principles of quantum mechanics that enable information-theoretic security, why quantum cryptography is important, and discuss the state of the art of the field.
Journal: AIAA Journal 61 (5), 1895-1910 (2023)
ArXiv: 2206.04078

Quantum key distribution: An introduction with exercises
This textbook introduces the non-specialist reader to the concepts of quantum key distribution and presents an overview of state-of-the-art quantum communication protocols and applications. The field of quantum cryptography has advanced rapidly in the previous years, not least because with the age of quantum computing drawing closer, traditional encryption methods are at risk.
The textbook presents the necessary mathematical tools without assuming much background, making it accessible to readers without experience in quantum information theory. In particular, the topic of classical and quantum entropies is presented in great detail. Furthermore, the author discusses the different types of quantum key distribution protocols and explains several tools for proving the security of these protocols. In addition, a number of applications of quantum key distribution are discussed, demonstrating its value to state-of-the-art cryptography and communication.
This book leads the reader through the mathematical background with a variety of worked-out examples and exercises. It is primarily targeted at graduate students and advanced undergraduates in theoretical physics. The presented material is largely self-contained and only basic knowledge in quantum mechanics and linear algebra is required.
Book: Lecture Notes in Physics 988, Springer International Publishing (2021)

Device‑independent quantum key distribution with random key basis
with René Schwonnek, Koon Tong Goh, Ignatius W. Primaatmaja, Ernest Y.-Z. Tan, Valerio Scarani, and Charles C.-W. Lim
We present a simple variant of the original device-independent QKD protocol based on the CHSH inequality that uses for two randomly chosen key generating bases instead of one. This enables positive key rates in the high-noise regimes and significantly narows the gap between theory and experiment.
Journal: Nature Communications 12, 2008 (2021)
ArXiv: 2005.02691