Cryptographic Protocols
Quantum Cryptographic
Protocols
Key distribution gets all the attention, but it solves only one problem: two people who trust each other want a shared secret. Most of cryptography is about people who don't trust each other — signing a contract, running an auction, proving you know something without revealing it. Quantum physics changes what is possible in those situations too: some tasks become achievable with guarantees no amount of computing power can break, and some turn out to be provably impossible no matter how clever the protocol.
Beyond Key Distribution
Two Different Kinds of Distrust
Key distribution assumes Alice and Bob are on the same side and the enemy is somewhere out on the wire. That covers a lot of real communication, but it is not the situation most cryptography is designed for. When two companies negotiate a price, when a buyer bids in an auction, when someone signs a contract they might later want to deny signing — the other party is the adversary. Protocols for that setting need something key distribution never provides: guarantees that hold even when the person you are talking to is trying to cheat you.
Quantum physics helps in two distinct ways. Sometimes it upgrades a task that was already possible: digital signatures exist classically, but their security rests on a maths problem being hard, and a quantum computer breaks that. Quantum signatures rest on physics instead, so no amount of computing power forges them. Other times it makes possible something that has no classical version at all — a coin flip between mutual enemies where neither can rig the result beyond a provable limit.
Almost all of it descends from one idea. In 1968 Stephen Wiesner wrote an unpublished note proposing that you could encode information in quantum states chosen from two incompatible sets of measurements (conjugate coding). Because a quantum state cannot be copied and measuring the wrong way destroys the information, anyone who tampers leaves a trace. Key distribution, quantum banknotes, oblivious transfer, and the first signature schemes all grew from that single observation.
What “Information-Theoretic” Actually Means
Most cryptography in use today is computationally secure: breaking it is possible in principle, just far too slow to be worth attempting. That guarantee has an expiry date built in, because it depends on how fast computers get and how clever mathematicians are.
Information-theoretic security is a different promise. There is no computation the attacker could run, however long they ran it, that would recover the secret, because the information simply is not present in what they hold. Quantum protocols get this by leaning on physical facts — states cannot be cloned, measurement disturbs — rather than on unsolved maths problems.
The catch is cost. Information-theoretic protocols need specialised hardware, dedicated optical links, and they run slowly. Post-quantum algorithms like ML-KEM and ML-DSA are only computationally secure, but they are software, they are fast, and they work over the internet as it exists. Both have a place, and the practical answer is usually to use each where it fits.
The Protocol Landscape
Quantum Digital Signatures
Signing Something Nobody Can Forge or Disown
A digital signature has to do three things at once. Nobody else can produce one that passes as yours (unforgeability). You cannot later claim you never signed (non-repudiation). And if someone you sent it to forwards it, the next person can check it too and will reach the same verdict (transferability). That last one is what distinguishes a signature from a simple authenticated message, and it is the hardest to get right.
Classical signatures buy all three with a hard maths problem. RSA and ECDSA rest on factoring and discrete logarithms — exactly the problems Shor's algorithm dismantles. Anything signed today with those schemes is forgeable by anyone who eventually builds a large enough quantum computer, which matters for documents meant to hold up for decades.
The quantum version rests on physics instead. The original scheme (Gottesman and Chuang, 2001) had the signer hand out many copies of a quantum state as a public key. Since quantum states cannot be copied, nobody could manufacture the extra copies a forgery would require. The problem was storage: recipients had to keep those fragile states intact until a signature arrived, and quantum memory good enough for that did not exist.
The fix was to stop storing quantum states at all. Dunjko, Wallden and Andersson showed in 2014 that the quantum part could happen up front, be converted immediately into ordinary classical data, and the signing could then proceed with that data alone. Modern schemes work this way, which is why they run on today's fibre networks. A 2017 field test signed messages across a metropolitan network using a design immune to attacks on the detectors, and the 2025 chip-based network above pushed it to 200 km with hardware small enough to mass-produce. A 2026 preprint reports a further jump in rate and reach, to 250 km.
The honest limitation: signature rates are still measured in fractions per second, and the quantum stage has to be authenticated by a key the parties already share. These are useful for high-value, low-volume things — a contract, a software release, a settlement instruction — not for signing every packet on a network.
Oblivious Transfer — The Universal Building Block
Why This Odd Little Task Matters So Much
Kilian proved in 1988 that oblivious transfer is complete for secure computation: give two parties a reliable OT and they can compute any function of their private inputs without revealing those inputs. Everything downstream follows — two hospitals finding shared patients without exposing their records, a sealed-bid auction with no auctioneer to trust, private voting, genomic comparison on encrypted data. All of it reduces to OT.
Classically, OT needs a hardness assumption, usually the same factoring or discrete-log problems that quantum computers break. So the entire secure-computation stack inherits the quantum threat.
The disappointing news: quantum mechanics does not rescue it for free. The same argument that kills unconditional bit commitment also kills unconditional OT. Wanting it badly does not make it available.
The workable news: Damgård, Fehr, Salvail and Schaffner showed in 2005 that OT becomes information-theoretically secure the moment you assume the attacker cannot store an unlimited number of qubits (the bounded quantum storage model). Send n qubits; if the adversary can hold fewer than about half of them, they are stuck. This is an unusually comfortable assumption to make, because quantum memory is genuinely hard — the best systems hold a handful of qubits for seconds, not billions for hours. The assumption is about engineering reality rather than about a maths problem staying unsolved, which makes it age differently.
A quantum-only curiosity: in the quantum setting, bit commitment and oblivious transfer imply each other. Classically they do not — commitment is strictly weaker. It is one of the places where the quantum landscape has a genuinely different shape rather than just different numbers.
Coin Flipping and Bit Commitment
Flipping a Coin With Someone You Don't Trust
Two parties, no referee, and they need a random bit that neither can rig. Over a phone line this is hopeless: whoever announces last can simply lie, and whoever announces first has already given the game away. Classical cryptography can only make cheating computationally difficult, not impossible.
Quantum protocols get a partial win. Not a perfect one — Lo and Chau showed in 1998 that a perfectly fair quantum coin flip is impossible too. But quantum protocols can put a hard ceiling on cheating that classical protocols cannot. The best achievable is a cheating probability of 1/√2 ≈ 0.707, meaning a bias of about 0.207 above the fair half-and-half. A cheat can tilt the coin; they cannot own it.
That bounded guarantee is worth more than it sounds. Plenty of real situations only need “neither side can reliably force the outcome” — deciding who moves first, allocating a contested slot, seeding a shared random value. Fibre demonstrations exist, though the protocols remain finicky to run.
Bit Commitment — The Impossibility That Shaped the Field
Bit commitment is the digital version of sealing a prediction in an envelope. You lock in a value now; the other party cannot see it (hiding); and when you open it later you cannot have swapped it for something else (binding). It underpins zero-knowledge proofs, secure computation, and verifiable voting.
It cannot be done unconditionally with quantum mechanics. Mayers, and independently Lo and Chau, proved this in 1996–97, and the reason is elegant enough to be worth stating plainly: if the receiver truly cannot learn anything about your value, then you can keep the system in a superposition of having committed to both values at once, entangled with something you kept. When the time comes to open the envelope, you measure your half in whichever way produces the answer you now prefer. Perfect hiding and perfect binding are in direct conflict — the very entanglement that hides your choice from the receiver also lets you postpone actually making it.
Four ways out, each with a price. Accept computational security (a one-way function is enough). Bound the adversary's quantum memory. Add a trusted setup both parties agree on. Or use relativity: put the parties far enough apart that the speed of light physically prevents the committer from coordinating a change between committing and revealing. That last one has been demonstrated between continents, and it is the only workaround whose assumption is enforced by the universe rather than by an estimate of someone's hardware.
These impossibility results are worth reading as maps rather than as failures. They tell you precisely which extra assumption you have to buy, and what it buys you.
Device-Independent Protocols
Security Even If Your Equipment Was Built by the Attacker
Every ordinary quantum protocol quietly assumes you trust your own hardware: the source emits what the specification says, the detectors detect honestly, the random number generator is actually random. History suggests this is optimistic. Most successful attacks on deployed quantum systems have targeted exactly these gaps — blinding detectors with bright light, exploiting timing quirks, exploiting a laser that emits slightly the wrong state.
Device-independent protocols throw the assumption away. They rest on one thing you can check from the outside: whether the measurement results violate a Bell inequality. Certain patterns of correlation are impossible for any system whose outcomes were determined in advance. If you observe them, genuine entanglement was present and the results were genuinely unpredictable — and that holds even if the attacker manufactured every piece of equipment in the room. You do not need to know how the box works; you only need to see it do something no dishonest box could.
The price is brutal experimental demands. A convincing Bell test needs to detect a very high fraction of the particles sent, because every one that goes missing is a hole an adversary could hide in. That is why device-independent key distribution took until 2022 to demonstrate at all, and then only over metres to a few kilometres.
It moved significantly in 2026. A group at USTC ran device-independent key distribution between two single-atom nodes joined by 100 km of fibre, converting the atoms' light to telecom wavelengths so it could survive the journey. The rate is tiny — on the order of a twentieth of a bit per second, with a fully finite-key-secure result at 11 km rather than the full 100 — but the distance is roughly three orders of magnitude beyond earlier fibre results. That closes much of the gap between “strongest security guarantee available” and “usable outside a single laboratory”.
Protocol Comparison
Practical Feasibility
What the Channel Has to Provide
Signatures and oblivious transfer need the same physical plumbing as key distribution: low-loss fibre or a clear line of sight, single-photon sources and detectors, plus an ordinary classical channel alongside. Measurement-device-independent designs let you stop trusting the detectors, at the cost of needing a central relay with very good ones. Fully device-independent designs need detection efficiency close to perfect, which is why they remain laboratory work despite the 2026 distance record.
Rate Against Guarantee
The stronger the guarantee, the slower it runs. Device-independent protocols manage fractions of a bit per second. Standard key distribution manages megabits. Signature schemes sit in between and are capped by the slowest quantum link in the chain. This maps cleanly onto what each is good for: high-value low-volume items get the strong guarantee, and bulk traffic gets a quantum-distributed key feeding ordinary fast symmetric encryption.
Scaling to More Than Two Parties
A protocol for two people does not become a protocol for eight by repetition. The 2022 eight-user signature demonstration needed a link between every pair, which grows as the square of the number of users. The star arrangement in the 2025 chip network is the fix: one shared central node, one cheap transmitter each, and an optical switch to pair people up on demand. City-scale quantum networks now operate in Tokyo, Beijing, Geneva, Cambridge and elsewhere, with China's national backbone running past 12,000 km using trusted relay nodes.
The Bootstrap Nobody Advertises
Every one of these protocols, key distribution included, needs an authenticated classical channel or an attacker can simply sit in the middle impersonating both sides. Authentication needs a shared secret. So the quantum protocol can refresh a key indefinitely, but it cannot conjure the first one — that has to arrive by courier, pre-installation, or some other trusted route. Device independence loosens what you must trust about the hardware; it does not remove this requirement.