Quantum cryptography via satellite: separating fact from fiction

In 2016, the Chinese satel­lite Micius enabled research­ers to trans­mit quantum encryp­tion keys¹ from space over a dis­tance of up to 1,200 kilometres². This exper­i­ment demon­strated that it was pos­sible to exploit the prop­er­ties of quantum phys­ics to estab­lish encryp­tion keys over dis­tances that are dif­fi­cult to reach via ter­restri­al net­works. Nine years later, the tech­no­logy is now of dir­ect interest to the European Uni­on, which is devel­op­ing its own quantum com­mu­nic­a­tion infra­struc­ture. As such, the EuroQCI pro­gramme plans to com­bine fibre-optic net­works with satel­lites, in par­tic­u­lar to pro­tect com­mu­nic­a­tions between gov­ern­ment depart­ments and data relat­ing to crit­ic­al infrastructure³. The European Com­mis­sion has now announced that its first exper­i­ment­al satel­lite, Eagle‑1, is due to be launched by the end of 2027.

This devel­op­ment comes at a time when the pro­spects offered by quantum com­put­ing are prompt­ing cyber­se­cur­ity author­it­ies to review their pro­tec­tion meth­ods. Some digit­al com­mu­nic­a­tions rely on cryp­to­graph­ic sys­tems, the strength of which depends on the dif­fi­culty of solv­ing cer­tain math­em­at­ic­al prob­lems. Suf­fi­ciently power­ful quantum com­puters could one day com­prom­ise these pro­tec­tions, even though such machines are not yet avail­able. Inform­a­tion inter­cep­ted today could then be stored for years before being decryp­ted. This meth­od, known as ‘har­vest now, decrypt later’, mainly con­cerns data for which con­fid­en­ti­al­ity need to be guar­an­teed in the long term, such as trade secrets, cer­tain med­ic­al inform­a­tion or dip­lo­mat­ic communications.

Some digit­al com­mu­nic­a­tions rely on cryp­to­graph­ic sys­tems, the strength of which depends on the dif­fi­culty of solv­ing cer­tain math­em­at­ic­al problems.

To anti­cip­ate this threat, the Nation­al Insti­tute of Stand­ards and Tech­no­logy (NIST), a US fed­er­al agency respons­ible in par­tic­u­lar for devel­op­ing tech­no­lo­gic­al stand­ards, pub­lished the first three post-quantum cryp­to­graphy stand­ards in August 2024⁴. These algorithms are designed to strengthen com­mu­nic­a­tions using exist­ing IT equip­ment. Quantum key dis­tri­bu­tion, or QKD, takes a dif­fer­ent approach, as it util­ises the prop­er­ties of light particles to estab­lish a secret key between two parties. Any attempt at inter­cep­tion can then cause detect­able dis­turb­ances, provided that the pro­tocol and equip­ment oper­ate in accord­ance with their secur­ity require­ments. How­ever, this meth­od requires spe­cial­ised devices and is sub­ject to sig­nal loss as dis­tances increase.

The archi­tec­ture adop­ted by EuroQCI there­fore com­bines two means of trans­mis­sion. Optic­al fibres are to link sites nation­ally and across bor­ders, whilst satel­lites are inten­ded to extend the reach of quantum com­mu­nic­a­tions. The con­struc­tion of this net­work still requires the res­ol­u­tion of issues relat­ing to data rate, avail­ab­il­ity and equip­ment cer­ti­fic­a­tion, which determ­ine its use bey­ond sci­entif­ic exper­i­ments. These aspects lie at the heart of the research con­duc­ted by Romain Alléaume⁵, a lec­turer and research­er at Télé­com Par­is (IP Par­is) where he stud­ies, in par­tic­u­lar, quantum key dis­tri­bu­tion and the secur­ity of its devices. His insights, gathered by Poly­tech­nique Insights, come at a time when Europe’s space ambi­tions have yet to be trans­lated into oper­a­tion­al com­mu­nic­a­tion systems.

Romain Alléaume. The stand­ards final­ised by NIST in 2024 are based, like all pub­lic-key cryp­to­graphy, on plaus­ible but rel­at­ively recent com­pu­ta­tion­al con­jec­tures. And, as we have seen, recent his­tory calls for humil­ity. Can­did­ates for stand­ard­isa­tion such as SIKE or Rain­bow have been broken along the way using per­fectly con­ven­tion­al com­puters. Quantum key dis­tri­bu­tion offers a dif­fer­ent kind of guar­an­tee, as its secur­ity is based on the laws of phys­ics. A key estab­lished by QKD can nev­er be ‘recal­cu­lated’, even by an adversary with unlim­ited com­put­ing power. This is known as ‘ever­last­ing secur­ity’. Con­versely, it is illus­ory to think that quantum cryp­to­graphy (QKD and bey­ond) could replace clas­sic­al cryp­to­graphy.  The most robust approach in the short term is not to pit QKD against post-quantum cryp­to­graphy, but to com­bine them in a defence-in-depth strategy where the two rein­force each oth­er. In the longer term, it is to integ­rate the use of quantum tech­no­logy into cryp­to­graphy, to extend its func­tion­al­ity and security.

Yes, and there is a simple arith­met­ic argu­ment, often referred to as ‘Mosca’s the­or­em’. If data must remain con­fid­en­tial for x years, migra­tion takes y years and the quantum com­puter arrives in z years, as soon as x + y exceeds z, it is already too late for data inter­cep­ted today. For the vast major­ity of com­mu­nic­a­tions, x is small and the threat is the­or­et­ic­al. But for state secrets, health or gen­om­ic data, and indus­tri­al prop­erty – where x is meas­ured in dec­ades – inter­cep­tion with a view to future decryp­tion is a ration­al risk for a state-sponsored adversary. This is why both ANSSI and NIST recom­mend embark­ing on the trans­ition without delay, start­ing with these long-lived data streams.

Over fibre, sig­nal loss increases expo­nen­tially with dis­tance. Records stand at between 500 and 1,000 kilo­metres, and a quantum sig­nal can­not be amp­li­fied as the no-clon­ing the­or­em pro­hib­its this. Ter­restri­al net­works are cur­rently being exten­ded with inter­me­di­ate trus­ted nodes, each of which must be secured indi­vidu­ally. As for quantum repeat­ers, which would remove this con­straint, they remain a labor­at­ory concept. In the mean­time, satel­lites are the only viable option for inter­con­tin­ent­al quantum links, as sig­nal loss in the vacu­um of space increases much more slowly than in fibre. The two approaches are com­ple­ment­ary, with fibre used for met­ro­pol­it­an net­works and satel­lites for very long dis­tances. This is pre­cisely the archi­tec­ture adop­ted by EuroQCI.

Micius (2016) was a major sci­entif­ic break­through, with the dis­tri­bu­tion of entan­gle­ment over 1,200 kilo­metres and the exchange of keys between Beijing and Vienna, which estab­lished phys­ic­al feas­ib­il­ity. How­ever, there are still sev­er­al steps to be taken between a sci­entif­ic demon­stra­tion and an oper­a­tion­al secur­ity ser­vice. Data rates are low, and avail­ab­il­ity is con­strained by the satel​lite’s orbits and weath­er con­di­tions. Above all, the secur­ity of a com­plete sys­tem must be assessed and cer­ti­fied, as a satel­lite act­ing as a trus­ted node must be pro­tec­ted in the same way as cryp­to­graph­ic equip­ment. The tech­no­logy has there­fore been demon­strated but is not yet mature enough to secure com­mu­nic­a­tions on a large scale. Over­com­ing these chal­lenges – from indus­tri­al­isa­tion to increased data rates and cer­ti­fic­a­tion – is pre­cisely the aim of the gen­er­a­tion cur­rently under devel­op­ment in Europe, with Eagle‑1 fol­lowed by the space com­pon­ent of EuroQCI.

In terms of the key-exchange pro­tocol, yes. The secur­ity of QKD is proven in the sense of inform­a­tion the­ory, without any assump­tions about the adversary’s com­pu­ta­tion­al power – some­thing no com­pu­ta­tion­al mech­an­ism can offer. How­ever, secure com­mu­nic­a­tion also requires a pro­tocol ensur­ing authen­tic­a­tion, and a data encryp­tion pro­tocol. Using post-quantum cryp­to­graphy for these func­tions is the most prac­tic­al approach, but over­all secur­ity depends on the details of how clas­sic­al (post-quantum) and quantum stages are com­bined. When it comes to the sys­tem imple­ment­ing secure com­mu­nic­a­tion using QKD, cau­tion is war­ran­ted. Real-world imple­ment­a­tions may har­bour vul­ner­ab­il­it­ies, and my own team has demon­strated sat­ur­a­tion and detect­or-dazzling attacks on CV-QKD sys­tems. We must there­fore not con­clude that ‘QKD is unbreak­able’ – a slo­gan that has done the field a dis­ser­vice. QKD elim­in­ates the entire class of com­pu­ta­tion­al attacks, includ­ing ret­ro­act­ive ones, and shifts the prob­lem to imple­ment­a­tion secur­ity, which is addressed through eval­u­ation and cer­ti­fic­a­tion, as with HSMs (Hard­ware Secur­ity Mod­ules). Com­bined with post-quantum cryp­to­graphy, it offers a level of secur­ity that can be sig­ni­fic­antly great­er than either approach on its own.

In terms of cost per bit of key for a few gov­ern­ment links, this would be dif­fi­cult to jus­ti­fy. But this is not the cor­rect frame­work for ana­lys­is. EuroQCI, like Galileo in its day, is primar­ily driv­en by con­sid­er­a­tions of sov­er­eignty, as it involves build­ing a European indus­tri­al sec­tor in a mar­ket where China and oth­ers are invest­ing heav­ily. It also forms the found­a­tion for a future, more gen­er­al quantum infra­struc­ture, encom­passing the dis­tri­bu­tion of entan­gle­ment, clock syn­chron­isa­tion and the inter­con­nec­tion of quantum pro­cessors – in oth­er words, the quantum inter­net. The scope of applic­a­tions extends bey­ond the dip­lo­mat­ic sphere, ran­ging from crit­ic­al infra­struc­ture to dis­trib­uted data stor­age with very long-term secur­ity – an area on which we are cur­rently work­ing. The cost is there­fore jus­ti­fied as a shared stra­tegic invest­ment, provided that we main­tain high stand­ards regard­ing cer­ti­fic­a­tion and data rates, and that we integ­rate QKD and post-quantum cryp­to­graphy rather than pit­ting them against one another.

Interview by Aicha Fall