Every boardroom now has a quantum slide. It says the same thing: within a decade, a sufficiently large quantum computer will break the public-key cryptography that protects the internet, and we must act. The slide is correct about the threat. It is usually wrong about the fix.
Two very different technologies claim the title of "quantum-safe." One is quantum key distribution (QKD), which uses photons and physics to distribute a secret. The other is post-quantum cryptography (PQC), which uses new mathematics running on the computers and links we already own. They are often presented as equivalent options. They are not, and the gap is economic before it is technical. Both claim the title of quantum-safe, but only one can be deployed on the infrastructure you already own.
Part One: What each one actually protects
QKD protects a single link. It sends single photons down a fibre, measures them at the far end, and uses the disturbance an eavesdropper would cause to detect interception. If the physics holds, the key is secret. But the key only exists on that one fibre, between two endpoints that must be physically connected and carefully engineered.
PQC protects data everywhere. It replaces the vulnerable algorithms — the key exchange and the signatures — with new ones believed to resist quantum attack. It runs on existing hardware, over existing networks, at existing speeds. There is no new fibre, no new box, no new trust model. You update software, and the link becomes quantum-resistant.
That difference in scope drives everything that follows. QKD is a product you install. PQC is a patch you deploy.
Part Two: The cost structure nobody puts on the slide
A QKD link needs dedicated fibre, because the photons cannot pass through ordinary amplifiers and switches. It needs trusted nodes every hundred kilometres or so, because the signal decays. Each trusted node is a place where the key exists in the clear, which quietly reintroduces the very trust assumption QKD was meant to remove. And it needs specialised detectors, often cooled, that cost far more than the routers they sit beside.
The result is a capital cost per link that runs into the hundreds of thousands of dollars, and an operating cost that includes dark fibre, cooling, and skilled staff. PQC, by contrast, is a software change. Its cost is engineering time and a certificate migration, measured in weeks and in salaries, not in fibre and detectors.
The decisive number is not the price of secrecy but the price of the upgrade path, and on that measure PQC is roughly an order of magnitude cheaper per protected link.
This is why the adoption curves diverge so sharply. Enterprises are migrating to PQC because it fits their budgets and their existing networks. QKD remains a niche for governments, banks, and a handful of high-value links where a dedicated fibre is already in the ground and the threat model justifies the cost.
Part Three: Why physics loses to convenience
It is tempting to say QKD is "more secure" because it rests on physics rather than on unproven mathematics. That framing hides a subtlety. PQC's security rests on problems that are believed hard, and the belief could be wrong. QKD's security rests on the laws of quantum mechanics, which are not going to be revised. On paper, QKD has the stronger foundation.
In practice, security is a system property, not an algorithm property. A QKD link is only as strong as its trusted nodes, its detectors, and its endpoints. A compromised detector or a careless trusted node breaks the guarantee just as surely as a broken cipher. PQC has its own risks — implementation bugs, side channels, the long tail of forgotten devices — but those risks are managed with the same tooling the industry already uses for every other cryptographic migration.
The economics then decide the outcome. A technology that is ten times cheaper, deploys over existing infrastructure, and can be rolled out by a software team will win the bulk of the market even if its theoretical foundation is less elegant. Elegance does not survive a procurement review.
Part Four: What it costs the economy, and what changes at home
A market estimate grounds the argument. If enterprise PQC migration tracks the TLS 1.3 rollout — several years to cover the bulk of traffic — the addressable spend is not exotic hardware but services: cryptographic inventory, certificate re-issuance, firmware updates, and testing. A reasonable range for the global migration is low tens of billions of dollars over five to seven years, and most of that is labour rather than equipment. QKD hardware, by contrast, is a niche measured in the low billions, concentrated in government and financial links where a dedicated fibre already exists.
The social consequence is quieter than the market. Quantum safety is invisible when it works: a bank transfer, a medical record, a passport check all look the same to the person doing them. What changes is the baseline assumption that a conversation cannot be recorded now and decrypted later. Once PQC is standard, the long game of harvest-now-decrypt-later loses its payoff, and the incentive to hoard encrypted traffic collapses. That is a structural change in how secrets age, not a feature anyone will notice on a screen.
There is also a supply-side effect. The migration creates a durable demand for engineers who understand both classical cryptography and the new lattice-based schemes, and it pushes certificate authorities, browser vendors, and hardware makers onto a shared timeline. Standards bodies become the bottleneck, and the organisations that start inventory early avoid the panic that comes when a deadline is announced. The cost of being late is not a fine; it is a scramble.
What is actually transferable
The lesson is not "QKD is bad." It is that a security upgrade is judged by its migration cost as much as by its strength. The winning path is usually the one that reuses existing infrastructure and can be adopted incrementally, because the threat is real but the budget is finite.
For engineers, the practical takeaway is to inventory where public-key cryptography actually lives — in libraries, in devices, in certificates, in firmware — and to plan the PQC migration now, while the quantum computer is still a headline rather than a customer. QKD can be the right choice for a specific, high-value link, but it is not the general answer.
The organisation that treats quantum safety as a software migration will be protected years before the one still waiting for a photon to arrive.
The quantum threat is real. The cheapest defence is maths you can install on Monday, not fibre you have to dig on Tuesday.
SOL: HCqPmPJM3NVtS6YrmVaTZYnuP8XZ2PFgQZKT94VK1LkS
If this saved you time, a tip is appreciated.
Top comments (0)