What Is the Best Hybrid Quantum-Safe Network Strategy for Telecom Operators?
A 2025 Global Risk Institute survey of quantum-risk experts puts the probability of a cryptographically relevant quantum computer within ten years at 28 to 49 percent, and within fifteen years at 51 to 70 percent. Post-quantum cryptography, symmetric key infrastructure, and quantum key distribution are all methods for generating, distributing, or exchanging encryption keys. None of those three methods changes whether the encrypted payload itself, once transmitted, can be harvested off the fiber as ciphertext. We built Carmel to protect the transmitted signal itself, independent of whichever key-management technique a network already runs.
The strongest hybrid quantum-safe strategy for a telecom operator pairs a key-management layer with a separate layer that protects the transmitted payload directly. PQC, symmetric key infrastructure, and QKD are all key-management techniques, and an operator can combine them in whatever mix suits their network. Once the data is encrypted and put on the fiber, none of that combination can stop the ciphertext from being harvested.
Securing the data from decryption and securing the data from a harvest are two different jobs, and a security operation that does only the first, leaves the second wide open.
What PQC, symmetric key infrastructure, and QKD each secure
All three techniques answer the same question, which is how each end of a link obtains a key the other end can trust. Post-quantum cryptography - PQC - replaces the mathematical algorithms used to generate and exchange keys with ones resistant to a quantum computer. Symmetric key infrastructure assumes a trust anchor already exists and manages the distribution and rotation of shared keys from that sender across a network. Quantum key distribution relies on a physical property, since measuring a quantum particle disturbs it, an interception attempt during key exchange is detectable, and the affected key material get discarded.
What none of them do is follow the data past the moment of encryption. Once a key is established by any of the three, the payload is encrypted with it and put on the wire as conventional ciphertext. The technique that produced the key leaves no mark on that transmission, so the traffic crossing the fiber looks the same whichever one an operator chose.
QKD's range, and why it's a key-management constraint
QKD's distance limit is real, and it constrains the key-exchange channel rather than the data path. A 2025 peer-reviewed analysis in EPJ Quantum Technology states plainly that QKD is limited in distance, and that until quantum repeaters mature, it cannot provide end-to-end security over long distances without chains of intermediate trusted nodes. The same paper notes QKD's incompatibility with the standard inline amplifiers used across conventional optical links. Both constraints sit inside the quantum channel, which carries key material and nothing else. The payload under a QKD-secured link is unaffected by any of that. An operator that solves the range problem, through trusted nodes now or through repeaters eventually, ends up with a longer QKD link and the same harvestable ciphertext running on it.
The payload is harvestable regardless of key strategy
NIST's own technical work on fiber-based quantum key systems describes the architecture directly. A QKD system does not transmit secure messages; it creates a shared secret between users, and that secret is then used to encrypt messages sent over conventional channels. Swapping in PQC or symmetric key infrastructure changes the key and leaves that shape intact.
A tap on the fiber captures a copy of the ciphertext no matter which of the three techniques generated the key, and holds it until the key strength or algorithm protecting it no longer holds.
That wait is the part worth planning around now rather than later. The Global Risk Institute's 2025 survey puts the odds of a cryptographically relevant quantum computer at 28 to 49 percent within ten years and 51 to 70 percent within fifteen. Traffic harvested this year sits inside both of those windows. An operator selling a quantum-safe tier today is selling into a period where the harvesting happens well before the decryption capability arrives.
Where Carmel fits alongside any key-management stack
Photonic Layer Security (PLS) sits underneath the key-management layer rather than replacing any part of it. Carmel spreads the transmitted signal across a wide optical spectrum, modifies it with a continuously changing optical key, and buries it under true random optical noise. A tap on a link in that state captures a signal indistinguishable from noise instead of a recoverable copy of the ciphertext.
The table sets the two layers side by side.
| Feature | Key-management layer (PQC / SKI / QKD) | Carmel (Photonic Layer Security) |
|---|---|---|
| What it protects | The keys, not the payload | The transmitted signal itself |
| Payload once encrypted | Travels as conventional, harvestable ciphertext | Travels as optical noise, unharvestable |
| Distance | QKD: roughly 80 km without repeaters, incompatible with inline amplifiers | Up to 100 km unamplified, extending with EDFA or Raman amplification |
| Deployment | QKD needs dedicated quantum hardware and fiber; PQC and SKI are software-only | Plug-and-play just requires changing out the line cards; Quantum-Ready status in weeks |
| Relationship to the other layers | Works the same with or without Carmel; it does not protect the transmitted signal | Sits underneath whichever key-management stack an operator already runs |
Building a quantum-safe tier that covers both halves of the problem
Telecom operators are already moving on the key-management half. BT runs a QKD-secured metro network with Toshiba alongside a separate quantum-safe VPN partnership, and Deutsche Telekom ran a quantum teleportation demonstration over commercial Berlin fiber in January 2026. Each of those efforts strengthens how keys are generated and exchanged. A quantum-safe service tier that stops there still puts the payload on the fiber as harvestable ciphertext, Which does a lot to prevent decryption, but nothing to block a harvest..
Building a quantum-safe network offering for enterprise customers? Visit our technology page to see how Carmel adds payload protection alongside an existing key-management strategy.
FAQs
Q: Does combining PQC, symmetric key infrastructure, and QKD protect against harvest-now-decrypt-later attacks?
A: Not on its own. All three secure the key exchange, but the encrypted payload still travels as conventional, harvestable ciphertext once transmitted. An adversary can copy that ciphertext today and wait for the key or algorithm protecting it to weaken.
Q: What is the practical distance limit for quantum key distribution?
A: Roughly 80 km kilometers without repeaters, and QKD is incompatible with the inline optical amplifiers used to extend conventional fiber links, a constraint set out in a 2025 analysis in EPJ Quantum Technology.
Q: Is Carmel also limited to about 100 kilometers?
A: No. Carmel supports up to 100 km unamplified and extends further with standard EDFA or Raman amplification, so it isn't bound by the same distance ceiling that constrains QKD's dedicated quantum channel.
Q: Can Carmel work alongside an existing hybrid key-management deployment?
A: Yes. Carmel operates at the physical layer, underneath whichever combination of PQC, symmetric key infrastructure, or QKD a network already runs, so it doesn't require changing the key-management strategy already in place.
Q: How likely is a cryptographically relevant quantum computer within the next decade?
A: A 2025 Global Risk Institute survey of quantum-risk experts puts that probability at 28 to 49 percent within ten years, rising to 51 to 70 percent within fifteen years.
Q: Does Carmel replace the need for QKD or PQC on a telecom network?
A: No. Carmel is complementary to a network's key-management approach, not a substitute for it. Key management and payload protection are separate problems, and Carmel addresses the second one.
Q: How fast can Carmel be added to an existing telecom network?
A: Deployment can be achieved in weeks, with no changes required to existing systems, compared to the dedicated hardware and fiber a QKD deployment needs.