Fernando De La Iglesia

Current quantum key distribution (QKD) networks focus almost exclusively on transporting secret keys with the highest possible rate. Consequently, they are built as mostly fixed, ad hoc, logically, and physically isolated infrastructures designed to avoid any penalty to the quantum channel. This architecture is neither scalable nor cost-effective and future, real-world deployments will differ considerably. The structure of the MadQCI QKD network presented here is based on disaggregated components and modern paradigms especially designed for flexibility, upgradability, and facilitating the integration of QKD in the security and telecommunications-networks ecosystem. These underlying ideas have been tested by deploying many QKD systems from several manufacturers in a real-world, multi-tenant telecommunications network, installed in production facilities and sharing the infrastructure with commercial traffic. Different technologies have been used in different links to address the variety of situations and needs that arise in real networks, exploring a wide range of possibilities. Finally, a set of realistic use cases have been implemented to demonstrate the validity and performance of the network. The testing took place during a period close to three years, where most of the nodes were continuously active.

We feature the interplay of classical cryptography and quantum technologies, highlighting the importance of the coexistence of both paradigms in practical quantum-safe networks. We motivate the use of QRNGs in PQC protocols, showing that they can potentially increase the security of the system without affecting the performance. We continue proposing some guidelines on the alternatives for QKD authentication methods depending on the use case, the available resources, and the security needs, to improve the practicality of QKD deployment in PKI networks. Moreover, we present a novel authentication scheme for QKD, designed to reduce the key drain from the authentication, showing the results of its implementation in an experimental QKD prepare-measurement BB84 protocol with polarization encoding and decoy states.