The Dutch government praises its ground station for the EAGLE-1 QKD satellite, but does not use quantum key distribution (QKD) for its own security. The technology promises a key exchange that even a quantum computer cannot crack, but according to the government, it does not yet meet security requirements. The companies building QKD themselves also acknowledge that their technology still relies on intermediate stations that must be trusted, on classical authentication, and on connections of no more than a few hundred kilometers.
“QKD is not currently being used in relation to information security within the central government,” states the Government-wide Quantum Strategy presented by the cabinet on October 5. In the same document, however, the government is highly complimentary of the ground station for EAGLE-1, which SES and ESA describe as the first European satellite for quantum key distribution. That station “positions the Netherlands at the forefront” and is “an important stepping stone toward large-scale implementation.”
Both statements stem from the same threat: the quantum computer. Key exchange in virtually all encrypted connections relies on asymmetric cryptography such as RSA and Diffie-Hellman, and a sufficiently powerful quantum computer can break them. The national strategy anticipates such a computer will be available between 2029 and 2035. Traffic that is currently intercepted and stored could be decrypted by that time.
There are two solutions to this. The first is post-quantum cryptography (PQC). Despite its name, it is based on ordinary mathematics: PQC replaces the vulnerable algorithms with computational problems for which it is not known how a quantum computer could solve them quickly. NIST standardized the first PQC algorithms in 2024, and they run as software on existing systems.
The second solution is quantum key distribution (QKD). This is part of quantum communication, a different branch of quantum technology than the quantum computer. Whereas PQC relies on mathematics, QKD protects the key using physics. The key is constructed from individual photons, transmitted via fiber optics or through the air, and an eavesdropper disrupts those photons in a way that can be detected. In theory, this security does not depend on an attacker’s computing power, but QKD does require dedicated hardware and a dedicated connection. The Quantum Communication Fieldlab Rotterdam summarized the difference as “a more difficult puzzle” versus “a seal that shows when it has been broken.”
The government has opted for the first approach. Companies and research institutions in South Holland are working on the second. During the International Quantum Press Tour, organized by the province in late October in collaboration with Rotterdam, The Hague, Delft, and Leiden, they demonstrated the current state of QKD.
A supplement, not a replacement
None of the builders are presenting QKD as a replacement for existing encryption. Arthur Dallau, CEO of INSPIR8ION, the company that manages the Rotterdam field lab, believes that in certain situations, both are necessary. “I understand that PQC is currently the most obvious way for security professionals to add a new layer of security,” he says. “But the government holds a lot of highly classified information, think of the intelligence services or the Ministry of Defense. In those cases, you need both.”
Marc Hulzebos, innovation manager at Eurofiber, one of the partners in the field lab, places the emphasis slightly differently. According to him, QKD can indeed function without PQC, but not without the traditional network and the traditional encryption surrounding it. In his words, QKD provides a standard symmetric key, only one based on quantum principles. That key is sent via a key management system to the existing encryption equipment. “You should view QKD primarily as a semi-finished product of a good encryption solution,” he says. “Anyone who thinks that QKD alone is enough is mistaken. You have to evaluate your entire encryption setup and your data traffic.”
Moreover, Hulzebos emphasizes that QKD doesn’t help at all with certain issues. It won’t solve problems like an open back door or a password written on a Post-it note stuck to a monitor. The builders do, however, differ in their views on the division of roles between the two technologies. The field lab’s presentation prioritized PQC: “PQC everywhere. QKD only on the connections where the stakes are highest.” SES, the Luxembourg-based satellite operator with an office in The Hague, takes the exact opposite approach. Gabriele Riccardi, Optical Systems Engineer at the company, calls QKD the foundation of the service SES aims to provide, with PQC as an additional layer on top.
Distance requires intermediate stations
No matter how they stack the layers, none of the builders rely on QKD alone. This comes down to three factors: distance, authentication, and practical deployment. The first reason QKD isn’t used on its own is distance. Photons are lost as they travel through fiber-optic cables, and a quantum signal cannot be amplified like a conventional optical signal, because an amplifier would have to measure it to do so. Such a measurement alters the photon’s quantum state, and the original information is lost. It is this same property that gives away the presence of an eavesdropper. According to the field lab, a QKD connection over fiber-optic cable therefore currently has a maximum range of about 100 kilometers. Anyone wishing to go further must relay the key step by step via intermediate stations. Such a station holds the key for a brief moment. It is therefore called a “trusted node”: a node that you must trust and physically secure.
It is precisely these intermediate stations that security agencies object to. According to the U.S. NSA, they pose an insider risk, and the Government-wide Quantum Strategy cites “the limited ability to achieve end-to-end security” as an inherent limitation of QKD. The builders who spoke during the tour each chose a different approach to address this problem.
The Rotterdam field lab shifts trust away from the center of the network. It uses measurement-device-independent QKD (MDI-QKD) from Delft-based Falqon Systems (formerly Q*Bird). In this setup, the endpoints send their photons to a measurement station in the center. That station performs only a joint measurement and notifies the endpoints whether it was successful; once confirmed, the endpoints share the same key. The first installation in the test lab consists of four endpoints, intended for customer locations, arranged around a central node in Eurofiber’s data center. “The central node is an untrusted node,” says Hulzebos. “It never holds a key or any data at any time.”
Bridging the distance
This setup is also limited by distance. Eurofiber estimates about 100 kilometers between each endpoint and the central node, explains Hulzebos, meaning that two customer locations can be up to approximately 200 kilometers apart. There is also a practical limit for longer connections. In long fiber-optic connections, there is a regeneration point every 80 to 120 kilometers, where the light is captured and retransmitted. That capture is essentially a measurement, and a quantum signal cannot survive it. A QKD connection therefore ends at such a regeneration point. As a result, the systems are limited by the distance between customer locations, says Hulzebos. In Rotterdam, he says, this is hardly an issue, because the locations in the region are close enough to one another.
SES bridges long distances using a satellite. The company employs prepare-and-measure QKD, which Riccardi describes as the most mature variant. The satellite transmits qubits to each ground-based optical station and establishes a key with each station individually. The satellite then ensures that two stations, for example, in Amsterdam and Sydney, share the same key. Trusted nodes are also required in this setup: SES’s own diagram labels the user locations, which are connected to a ground station via fiber-optic links on both ends, as “Trusted Nodes.”
Quantum repeater
What is missing in both fiber-optic and satellite systems is an intermediate station capable of relaying quantum connections over longer distances. “There’s no such thing as a quantum repeater yet,” says Hulzebos. “Work is underway on it, but it’s not available yet.” With such a repeater, no intermediate station would ever have access to the key.
Sophie Hermans, group leader at QuTech, the quantum institute of TU Delft and TNO, explains why such a repeater cannot be built with current QKD technology. “The QKD systems available today use photons as qubits,” she says. “But as soon as you make a measurement, your detector absorbs the photon. Then your qubit is simply gone.” According to Hermans, the next step is a network with qubits made of matter. Light would then only be used to entangle two nodes with each other. “The two entangled parties would then be solid-state qubits, such as a single electron,” she says. “You could then signal that the entanglement exists and subsequently use it.” In her own lab, she uses rare-earth ions in crystals for this purpose. That ability to hold on to quantum information makes all the difference for the repeater. “Nodes with such qubits have memory,” says Hermans, “and can therefore also serve as quantum repeaters.” Such networks are more difficult to build, she says, but spin-offs are already working on them.
Authentication requires an additional layer
The second reason why QKD isn’t used as a standalone solution is authentication. QKD guarantees that no one has eavesdropped on the key exchange, but it doesn’t guarantee that the party on the other end is who they claim to be. To ensure that, the regular connection through which the QKD devices compare their measurement results must also be authenticated. Hermans also confirms that QKD does not handle this automatically: to achieve this, you have to “build a few more layers on top.” As for what those layers look like, the builders offer different answers.
Hulzebos from the Rotterdam field lab looks for the answer in the physical network. He cites PQC as one way to approach this. “If we build networks using dark fiber and locked cages in the data center, then the authenticity of the communication is more or less guaranteed,” he says. “It’s a two-point network. There’s little confusion about which systems are communicating with each other.” The field lab’s slides do show the PQC route: there, PQC authenticates the QKD devices.
Riccardi of the satellite company SES calls authentication “a fundamental problem” of QKD. “QKD is only as secure as the authentication,” he says. “If that fails, you can’t trust anything that comes after it.” EAGLE-1 therefore uses a portion of the keys generated via QKD to authenticate the parties. According to Riccardi, as the system grows and the number of connections increases, smarter solutions will be needed. The government takes a different view than SES. According to its strategy, QKD needs PQC for authentication, and the government refers to this “necessity to use PQC for authentication” as a limitation of the technology.
Practice keeps QKD niche technology
The third reason is practical deployment. Distances exceeding a few hundred kilometers require a satellite, which has its own limitations. EAGLE-1 will be placed in a low Earth orbit at an altitude of approximately 500 kilometers, Riccardi explains. This means the satellite will travel at a speed of about 27,000 kilometers per hour. A ground station then has only a few minutes to establish an optical connection, and if there are clouds, that connection isn’t even possible. “Photons don’t pass through a cloud,” says Riccardi. “There’s nothing we can do about that.” Because QKD isn’t a real-time service, SES stores keys when visibility is good, so customers can use them later.
How many keys SES needs to store depends on who is using the service. For now, the company does not foresee a service for the general public. “It’s intended for critical infrastructure, such as data centers, energy companies, and banks,” says Riccardi. “Not for someone who wants to encrypt their WhatsApp conversations using QKD.” Kees Buijsrogge, director of Semiconductor, Space, and Quantum Technologies at TNO, calls QKD “truly a niche market.”
The objections
This brings us back to the government-wide Quantum Strategy. The cabinet justifies its decision not to deploy QKD by citing some of the same challenges mentioned by the builders above. QKD “does not yet meet the established security requirements,” the government writes, and the concerns will not be resolved “in the short and medium term.” Trials in which the government participates therefore take place, as a starting point, in isolated environments, without production systems or real data.
This approach aligns with a position paper published by the AIVD in January 2024 in collaboration with German, French, and Swedish partners. According to the authors, QKD is suitable at most for niche applications, and PQC should take priority. The NSA advises against using QKD for national security systems, largely for the same reasons cited by the builders themselves: the intermediate stations, the lack of authentication, and the specialized equipment. According to the NSA, that equipment can also introduce vulnerabilities on its own.
Hulzebos took away from the position paper, above all, that QKD was too expensive and had too short a range. “That strikes at the heart of our work,” he says. “How do we make it affordable, and how do we extend the ranges? That’s exactly what we’ve been focusing on from the very beginning.” Behind the U.S. position, he sees a reason other than the one the NSA itself gives: in his view, the technology is so secure that intelligence agencies can no longer eavesdrop on it. The government also mentions this same characteristic in its strategy, but as a risk. Connections that are “very difficult to eavesdrop on,” according to the government, can also be used by adversaries “to evade detection and interception.”
Riccardi does not consider the criticism from governments to be unfounded. He calls it “a very common position,” and he, too, believes the main objection lies in the implementation. “On paper, QKD works perfectly,” he says. “But the devil is in the implementation, when you’re working with real devices that aren’t perfect.” According to Riccardi, QKD has thus become primarily a technical challenge: building a system that is secure not only in theory but also in practice. The fact that SES is taking on this challenge anyway stems from a limitation of PQC itself. No PQC algorithm can be proven to be uncrackable by a quantum computer, says Riccardi. PQC relies on the assumption that certain computational problems will remain difficult, but no one knows whether a new technique might still solve them in fifteen years. “In our view, only QKD can offer security that doesn’t depend on computing power,” he says, “so we have to make it work.”
Watching, not buying
The same strategy that keeps QKD at arm’s length describes the Dutch ground station for EAGLE-1 as “an important stepping stone toward large-scale implementation.” The government is therefore not deploying QKD, but it is not ignoring the technology either. Government agencies have already gained experience with MDI-QKD, the same variant used in the Rotterdam field lab, as part of the European EuroQCI program. In the European QKD project SEEWQCI, the Ministry of Foreign Affairs and the AIVD are part of the Dutch consortium. The ministry aims to gain experience with space-based QKD over long distances through this project. The AIVD supported the project proposal with a letter of endorsement. “It is relevant for our organization to gain insight into the functioning and properties of QKD technology,” the agency stated at the start of the project.
However, exploring is not the same as buying. According to the strategy, the government is indeed investigating whether it wants to act as the first buyer of quantum technology, but the example it cites is a quantum computer for research, not a QKD connection. The builders must therefore find their first customers elsewhere.
That is now the challenge in Rotterdam. There, the partners are largely funding the field lab themselves, possibly supplemented by money from regional development funds. The systems have been ready since late October, but no organizations have actually started testing them yet. The Dutch Pilotage Service and shipbuilder Royal IHC have expressed interest, and the first intake process with them will begin shortly. Dallau sees the lack of committed customers as a risk that extends beyond the field lab. According to him, the Netherlands has the universities and the expertise to create high-quality quantum products. “But if the Dutch government or large companies don’t become the first customers here,” he says, “the companies making them will likely move to another continent.”