Hadamard Get the app

NSA Still Won’t Back Quantum Key Distribution: The 2026 Rewrite

NSA Still Won't Back Quantum Key Distribution: The 2026 Rewrite — Hadamard

The NSA still does not recommend quantum key distribution (QKD). According to reporting on its rewritten statement of October 1, 2026, the agency repeats its 2020 conclusion that QKD and other quantum cryptography should not be used for National Security Systems unless several technical limitations are overcome. The rewrite of the NSA quantum key distribution position adds two new caveats but no change in direction. Post-quantum cryptography (PQC) remains the recommended path.

A note on sourcing: every detail of the October 2026 statement below comes from secondary reporting by PostQuantum’s analysis of the NSA QKD rewrite, Mallory and HFS Research. We have not yet checked the wording against the NSA’s own page, so quotations are attributed to those reports. Treat exact phrasing as provisional until you read the primary text on nsa.gov.

What the NSA quantum key distribution statement says in 2026

Per PostQuantum, the QKD article is one of three pieces in a new NSA Post-Quantum Cryptography Resource Hub, launched on October 1, 2026. The hub is aimed at Department of War, National Security Systems (NSS) and Defense Industrial Base organizations.

The QKD article reportedly dates the NSA’s position to June 2026 without explaining why. The bottom line matches the 2020 version: the NSA does not recommend QKD for NSS until its limitations are resolved.

That 2020 version was blunt. As quoted by PostQuantum’s comparison of national QKD positions, it described quantum-resistant encryption as “more cost effective and easily maintained” than QKD and said the NSA did “not anticipate certifying or approving any QKD” products for national security use.

Why doesn’t the NSA recommend QKD? The five limitations

The rewrite keeps all five technical objections from 2020, according to PostQuantum’s report. They are worth reading closely, because most of them are engineering and operational problems rather than physics problems.

  • No source authentication. QKD does not, by itself, prove who is on the other end of the link. You still need classical authentication, which typically means classical or post-quantum cryptography anyway.
  • Special infrastructure. QKD needs dedicated fiber or free-space optical equipment. It cannot run as a software update on existing networks.
  • Trusted relays. Over long distances, QKD often depends on trusted relay nodes where keys exist in usable form. Each relay is a point an attacker or insider could target.
  • Hardware-dependent security. The theoretical guarantees only hold if the physical implementation behaves as modeled. Real security depends on the hardware and how it is engineered.
  • Easier denial of service. The same sensitivity that lets QKD detect an eavesdropper means an adversary can disrupt key generation by interfering with the channel.

The “provably secure” claim often attached to QKD refers to an idealized protocol. The NSA’s objections sit in the gap between that model and deployed systems.

What changed in the 2026 rewrite

Two passages are new, per PostQuantum.

Certification that wears off in the field

The statement reportedly notes that changing environmental conditions and physical wear can lower the security level a QKD system was certified at. In other words, a lab certification is a snapshot. Optical components drift, fibers age and temperatures change, so a system may not stay at its certified level once deployed.

The rewrite’s sources include a study of implementation attacks commissioned by Germany’s BSI, the federal information security office. According to PostQuantum and Mallory, that study found gaps in countermeasures and testing.

The “fully-quantum network” caveat

The second addition reframes where quantum cryptography might eventually matter. As quoted by PostQuantum, the strongest uses remain theoretical and belong in “a broader, fully-quantum network that may link quantum computers and quantum sensors.” We have not yet verified this quote against the NSA’s own text.

Read plainly, the NSA is not dismissing quantum networking as a field. It is saying that point-to-point key distribution is not the compelling use case, and that the interesting applications depend on a future quantum internet that does not yet exist at scale.

QKD vs post-quantum cryptography: where the US timeline points

The US deadlines all point to PQC algorithms, not QKD hardware. According to Mallory and PostQuantum, new NSS acquisitions must comply with CNSA 2.0 from January 1, 2027. These dates should also be checked against the NSA’s CNSA 2.0 documents.

Separately, HFS Research reports that a June 2026 US executive order sets federal migration deadlines that rely on NIST’s FIPS 203, 204 and 205. We have not yet reviewed the order’s text on whitehouse.gov or in the Federal Register.

Milestone Date (as reported) Technology
New NSS acquisitions must comply with CNSA 2.0 January 1, 2027 Quantum-resistant algorithms
New commercial NSS must support quantum-resistant algorithms From 2027 Quantum-resistant algorithms
Legacy NSS that cannot be upgraded phased out By 2030 Quantum-resistant algorithms
Federal key establishment moved to PQC (executive order) December 31, 2030 FIPS 203
Federal digital signatures moved to PQC (executive order) December 31, 2031 FIPS 204, FIPS 205

These dates sit alongside NIST’s own deprecation schedule for classical public-key algorithms, covered in our explainer on NIST IR 8547 and the 2030 RSA deadlines. None of these timelines includes a QKD requirement.

Allied positions and the QKD projects still moving

The UK and Europe

The UK’s NCSC also recommends PQC ahead of QKD, according to PasskeyBridge and PostQuantum’s coverage. We have not yet reviewed the NCSC’s own white paper for this article.

The EU is taking a more infrastructure-first approach. Its EuroQCI program, signed by all 27 member states, aims for a pan-European quantum communication network by 2027, though it is still in the testbed and cross-border link phase, per PostQuantum’s report on quantum networking.

Satellites

Space-based QKD is where several 2026 milestones sit:

  • Eagle-1, the EU/ESA QKD satellite built by SES, has been planned to launch on a Vega C in 2026 or 2027, according to Wikipedia and a May 2025 arXiv paper. We could not confirm its current status with ESA or SES.
  • QUBE-II, a German 8U CubeSat for QKD, launched on May 3, 2026 on a Falcon 9 rideshare, per Wikipedia; we have not seen primary confirmation.
  • INT-UQKD, an ESA project, plans a satellite QKD link between Luxembourg and Singapore in Q3/Q4 2026 using the SpeQtre satellite launched in November 2025, according to ESA’s project page.

Commercial satellite QKD has drawn speculation before, as in our piece on QKD via Starlink satellites.

Repeaters and metro networks

On February 5, 2026, USTC researchers led by Jian-Wei Pan reported in Nature what they describe as the first scalable building block for a quantum repeater: remote memory-to-memory entanglement that lasts longer than the time needed to create it (The Quantum Insider covered it the next day). Working repeaters are what would eventually reduce dependence on trusted relays.

On August 21, 2026, SUNY announced a free-space link for New York State’s quantum network, which connects eight nodes across 161 miles of Long Island. India has also demonstrated a 5.56 km QKD link.

None of this contradicts the NSA. Research progress is real; the agency’s point is that it does not yet address authentication, relays, field certification or denial of service in a way that justifies deployment for national security.

What developers, founders and CISOs should do now

For most organizations, the practical reading of the rewrite is straightforward.

  1. Prioritize PQC migration. Inventory where you use RSA and elliptic-curve cryptography for key exchange and signatures, and plan moves to FIPS 203, 204 and 205. This runs on existing networks and hardware.
  2. Treat QKD as research, not a compliance path. No US federal deadline cited here requires it, and the NSA does not expect to approve QKD products for NSS.
  3. If you evaluate QKD anyway, ask the NSA’s questions. How is the channel authenticated? Where are the trusted relays and who controls them? How is security maintained after certification as the hardware ages? What happens under deliberate disruption?
  4. Watch quantum networking separately. Repeater and satellite progress matters for future quantum networks, which is the context the NSA itself points to.

The same logic applies to blockchains, whose ECDSA signatures are a known quantum target. Hadamard builds BB84, a hash-based, ECDSA-free Layer 2 rollup on Ethereum mainnet that uses one-time addresses based on hash commitments, a software-level PQC approach rather than quantum hardware. Technical details are in the BB84 developer docs.

FAQ

Why doesn’t the NSA recommend quantum key distribution if it’s “provably secure”?

The proofs apply to idealized protocols. The NSA’s objections concern real deployments: no built-in source authentication, special infrastructure, trusted relays, hardware-dependent security and easier denial of service. The 2026 rewrite reportedly adds that field conditions and wear can erode certified security.

Is QKD better than post-quantum cryptography, or should I use both?

US and UK agencies recommend PQC. QKD still needs classical authentication, so it does not replace cryptographic algorithms. For most organizations, PQC is the practical priority and QKD is optional research.

Did the NSA’s 2026 update change its position on QKD?

No. Based on secondary reporting, the October 1, 2026 rewrite repeats the 2020 conclusion and adds two caveats: certification can degrade in the field, and the strongest quantum cryptography uses belong in a future fully-quantum network.

Does QKD still need classical authentication, and what are trusted relays?

Yes. QKD does not authenticate the other party, so a classical or post-quantum authentication method is still required. Trusted relays are intermediate nodes used to extend QKD over long distances; keys are exposed at those nodes, so they must be physically and operationally secured.

Sources