Quantum computing is moving beyond the research lab. As the technology advances, one question is becoming increasingly difficult for organizations to ignore: what happens to the data, communications and systems that rely on today’s widely used cryptographic algorithms?
In particular, the emergence of sufficiently powerful quantum computers capable of running algorithms such as Shor’s poses a direct threat to RSA and elliptic curve cryptography (ECC), which continue to protect digital identities, transactions, communications, and critical infrastructure. This challenge has prompted a global effort across academia and industry to develop security solutions that can withstand quantum attacks. Two distinct technologies stand out: Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD). For organizations, keeping up with advances in quantum computing is only part of the challenge. The more immediate questions are:
- Which data, communications, and systems require long-term protection;
- Which cryptographic dependencies exist today;
- Which technologies make sense in each environment.
Post-Quantum Cryptography and the shift to quantum-safe algorithms
Post-Quantum Cryptography is based on classical cryptographic algorithms whose security relies on mathematical problems for which no efficient quantum algorithms are currently known.
These include problems associated with lattice-based cryptography, error-correcting codes, cryptographic hash functions, and multivariate systems.
The standardization process led by the National Institute of Standards and Technology (NIST) culminated between 2022 and 2024 in the selection of algorithms such as CRYSTALS-Kyber for key encapsulation and CRYSTALS-Dilithium for digital signatures, with the goal of progressively replacing RSA and ECC in widely used security protocols. One of PQC’s biggest practical advantages is its high level of compatibility with existing digital infrastructure. Post-quantum algorithms can be integrated into protocols such as TLS 1.3, IPsec and SSH, as well as public key infrastructure(PKI), through software updates, without requiring changes to the physical network layer.
This makes PQC particularly well suited to protecting:
- data in transit and at rest;
- digital signatures;
- identity authentication;
- software updates.
There are, however, technical challenges to consider. Post-quantum algorithms can involve larger keys and signatures, as well as different computational performance profiles, which may affect systems with bandwidth constraints or limited resources.
Quantum Key Distribution and physics-based security
Quantum Key Distribution relies directly on fundamental principles of quantum mechanics, including the no-cloning theorem and the collapse of a quantum state when it is measured.
Protocols such as BB84 and E91 allow two parties to establish a shared secret key through the transmission of quantum states, making any interception attempt detectable.
Unlike PQC, QKD security does not depend on computational assumptions. It is often described as providing unconditional security, provided that the underlying physical model is implemented correctly.
Despite its strong theoretical foundations, QKD has significant technical limitations. Its role is limited to the secure distribution of cryptographic keys. It does not replace complete data encryption mechanisms, authentication, or digital signatures, which are still required at the classical layer.
Practical QKD deployments also require specialized quantum hardware, including photon sources, highly sensitive detectors, and dedicated quantum channels, typically based on fiber-optic connections.
These requirements lead to high implementation and maintenance costs, together with scalability and distance limitations that become especially relevant in large or geographically distributed networks.
Different paths to PQC and QKD adoption
The technical differences between PQC and QKD also have a direct impact on cost and adoption.
Implementing PQC primarily involves software migration, interoperability testing, technical training, and compliance with emerging standards. This makes it a scalable and economically viable solution for most organizations.
QKD requires a much greater investment in physical infrastructure and specialized equipment. As a result, its use is generally limited to specific scenarios such as government communications, defense, critical infrastructure, or strategically important point-to-point connections.
Standards bodies and researchers generally see PQC and QKD as complementary rather than competing technologies.
For most Internet services and large-scale distributed systems, PQC offers the more practical path toward post-quantum security. QKD has a more specialized role, particularly in highly sensitive communications where the additional infrastructure, complexity, and investment can be justified.
This view is reflected in standardization initiatives led by organizations such as ETSI, which develops specifications for both post-quantum cryptography and quantum communications.
In practice, PQC is likely to be the priority for organizations that need to prepare applications, protocols, digital identities, and long-term data for a post-quantum environment. QKD is more relevant in cases involving critical links, exceptionally high confidentiality requirements, or strategic infrastructure where dedicated quantum channels make sense.
PQC and QKD in real-world deployments
Both technologies are already being deployed, although at very different levels of maturity and scale.
Several technology vendors and critical infrastructure operators are testing PQC, and some have begun rolling it out in production environments.
Companies such as Google and Cloudflare have tested and deployed hybrid PQC mechanisms in TLS protocols to protect web traffic at scale. Security hardware and software vendors, including Fortinet, Palo Alto Networks, Check Point, Cisco, IBM, and Thales, have also begun integrating NIST-standardized post-quantum algorithms into VPNs, next-generation firewalls, PKI systems, hardware security modules, HSMs, and firmware signing and validation mechanisms.
Industries such as banking and telecommunications are also running pilot projects to protect long-term data against the harvest now, decrypt later threat.
That creates a security issue today, not just in the future. Encrypted information can be intercepted and stored now, then decrypted years later when sufficiently powerful quantum systems become available. Data with long-term strategic, legal, or reputational value therefore needs protection before the quantum threat becomes operational.
At the same time, Quantum Key Distribution is already operational in more limited environments, primarily in dedicated networks with highly critical security requirements.
Specialized companies such as ID Quantique, working with manufacturers including Fortinet and Cisco, have deployed QKD systems across metropolitan networks and point-to-point connections. Institutional initiatives such as EuroQCI in the European Union and China’s quantum communications network between Beijing and Shanghai also demonstrate the practical use of QKD in government communications and strategic infrastructure.
Warpcom’s role in quantum communications in Portugal
A concrete example of QKD deployment in Portugal is Warpcom’s participation in the PTQCI consortium, the Portuguese Quantum Communications Infrastructure, a national project aligned with EuroQCI to develop quantum communications infrastructure.
Its initiatives include quantum key distribution demonstrations and active participation in PTQCI activities, helping prepare Portugal’s infrastructure for secure quantum communications.
For Warpcom, this work brings quantum communications out of the theoretical domain and into real network environments. It complements broader efforts to implement Post-Quantum Cryptography across corporate and government infrastructures and provides first-hand experience of where QKD can add value alongside PQC migration strategies.
It also reinforces the idea that the two technologies can work together to strengthen long-term protection.
This experience gives Warpcom direct insight into how quantum communications are evolving, as well as the practical challenges involved in integration, operation, and deployment across real-world infrastructure.
Preparing for post-quantum security
The transition toward a digital ecosystem that is resilient to quantum computing will require a balanced combination of solutions.
Post-Quantum Cryptography offers a pragmatic, interoperable, and scalable path for replacing today’s cryptographic systems. QKD provides a different security model, based on the laws of physics, that can add value in highly demanding and specialized environments.
There is no single adoption model that will work for every organization. The right mix of PQC and QKD will depend on the systems involved, the sensitivity and lifespan of the data, operational constraints, and the level of investment that can be justified.
For many organizations, the first step will not be to deploy QKD or immediately migrate every system to PQC. It will be to understand their current exposure:
- Which cryptographic algorithms are currently in use?
- Which data needs to remain protected for years?
- Which systems rely on certificates, digital signatures, or critical communication channels?
That assessment is what turns post-quantum security from a future concern into a practical part of the organization’s cybersecurity, networking and data protection roadmap.
