A hybrid quantum-safe strategy combines post-quantum cryptography, symmetric key infrastructure and quantum key distribution, but all three manage keys. A complete strategy also needs protection for the traffic a fiber tap can copy.
This guide explains what each part of a hybrid strategy does, where each one stops, and how a physical-layer approach fits beside them. It also compares three representative technologies in a table and ends with a verdict.
What a hybrid quantum-safe strategy includes
A hybrid strategy combines several technologies because no single one covers every link and every risk. Telecom operators typically evaluate three:
- Post-quantum cryptography (PQC): New key-exchange algorithms designed to resist quantum attack.
- Symmetric key infrastructure (SKI): Pre-shared symmetric keys, provisioned and managed between sites.
- Quantum key distribution (QKD): Key delivery using the quantum properties of photons.
Quantum computers threaten public-key algorithms such as RSA and Diffie-Hellman through Shor’s algorithm. They do not directly threaten the symmetric ciphers that encrypt the payload. NIST has standardized ML-KEM as the replacement for vulnerable key exchange (EPJ Quantum Technology).
What each technology secures
All three technologies establish or deliver keys. That is their shared function, and it is the reason they work together.
PQC applies in software and can cover a wide range of links once equipment is updated. SKI suits fixed sites where keys can be provisioned in advance. QKD suits specific links within its physical range and needs dedicated hardware.
None of the three changes whether the data crossing the fiber can be copied. Each one governs what happens to the keys that protect it.
QKD range and trusted nodes
QKD is typically limited to metro spans under 100 km and is incompatible with optical amplifiers (arXiv). Without quantum repeaters, longer distances require chains of trusted nodes. Those nodes handle key material and introduce vulnerabilities, and the same research concludes that QKD alone cannot protect information (EPJ Quantum Technology).
The distance limit is therefore a key-management constraint. It applies to the key-delivery layer, not to the data layer.
For more on the conceptual split between the two, see 3 Things Security Leaders Get Wrong About Post-Quantum Migration.
Why captured traffic is a separate exposure
Harvest now, decrypt later (HNDL) is the attack that makes timing important. An adversary records encrypted traffic and its key exchange today, then decrypts it once a cryptographically relevant quantum computer (CRQC) exists (EPJ Quantum Technology).
No one can name the date. In the Global Risk Institute’s 2025 survey, 26 experts estimated the likelihood of a CRQC within ten years at 28 to 49 percent and within fifteen years at 51 to 70 percent (Global Risk Institute).
A fiber tap makes the recording possible. It copies the optical signal without interrupting service. Stronger key management lowers the later value of the recording but cannot prevent the capture.
This is why a complete strategy has two layers:
- Key management: PQC, SKI and QKD.
- Payload protection: controlling what a tap captures.
Do you know What Post-Quantum Encryption Doesn’t Fix? Hear what remains exposed after a key upgrade.
What operators have already deployed
BT operates a QKD metro network in London. Toshiba supplies the QKD hardware and key management software, and EY was the first customer of the commercial trial.
Nokia offers symmetric key management through its 1830 SMS and encryption on select 1830 PSS and PSI interfaces for data center interconnect, metro, regional and long-haul links. The company also received the first FIPS 140-3 Security Level 2 certification for Layer 1 optical transport.
These deployments are key-layer and encryption-layer programs. They show where the market has moved first.
Criteria for evaluating a hybrid design
Five questions separate a complete design from a partial one:
- Scope: Which links and which layer does the technology cover? Ask whether it applies to wide area network routes, local networks or both.
- Range: What distance does it support without repeaters, trusted nodes or special amplification?
- Interoperability: Does it require changes to existing key management, or does it work alongside it?
- Capture outcome: What does an attacker hold after copying the signal from the fiber?
- Deployment effort: What equipment is required, and what existing systems must change?
Answers to the fourth question vary most between vendors, and it is the one most proposals leave blank.
Carmel, Toshiba QKD and Nokia Layer 1 encryption compared
Photonic Layer Security (PLS) is the category for protecting the optical signal itself. The table compares one representative of PLS with one QKD provider and one Layer 1 encryption provider across six dimensions.
| Dimension | Carmel (CyberRidge) | Toshiba QKD | Nokia Layer 1 encryption |
|---|---|---|---|
| Category | Photonic Layer Security | Quantum key distribution | Layer 1 optical encryption |
| What it protects | Wide area network (WAN) data in transit at the optical layer | Key distribution between two points | Data on select optical transport interfaces |
| Key establishment | Continuously changing optical key, independent of the existing key-management stack | Quantum states of photons | Symmetric key management through 1830 SMS |
| What a tap captures | A signal that the vendor states is indistinguishable from noise | Ciphertext of data encrypted separately with the delivered keys | Encrypted traffic |
| Range | Up to 100 km unamplified, extended with EDFA (erbium-doped fiber amplifier) or Raman amplification | Typically metro spans under 100 km, no amplifiers (arXiv) | Data center interconnect, metro, regional and long-haul |
| Deployment | Matched pair of units placed over existing systems, in weeks | Dedicated QKD hardware and key management software | Select 1830 PSS and PSI interfaces |
| Notable strength | Works with any key-management stack | BT London trial with EY as first customer | FIPS 140-3 Security Level 2 certification |
The three technologies address different questions. Toshiba addresses key delivery, Nokia addresses certified encryption on its own transport, and Carmel addresses the signal a tap would capture. CyberRidge describes Carmel as complementary to PQC, SKI and QKD, so the PLS layer can be added without replacing the key-management program.
Carmel’s scope is WAN data in transit only. It is not intended for local area networks (LAN) or personal area networks (PAN). Operators with mixed environments should treat it as one layer for long-distance routes, and plan separate controls for traffic inside buildings and campuses.
Bottom line
- A hybrid strategy built from PQC, SKI and QKD addresses key management and leaves captured traffic unaddressed.
- QKD range limits and trusted nodes are key-management constraints.
- Payload protection is a second layer, and PLS is the category designed for it.
- Evaluate vendors by asking what an attacker holds after tapping a link.
FAQ
Q: What is a hybrid quantum-safe strategy?
A: It is a plan that combines several technologies, usually PQC, SKI and QKD, because no single one covers every link or risk.
Q: How do PQC, SKI and QKD differ?
A: PQC replaces vulnerable key-exchange algorithms in software. SKI provisions symmetric keys between sites in advance. QKD delivers keys using photons over short, supported links.
Q: How soon could quantum computers threaten current encryption?
A: Experts surveyed by the Global Risk Institute estimated 28 to 49 percent likelihood within ten years (Global Risk Institute).
Q: How does Carmel differ from Nokia Layer 1 encryption?
A: Nokia encrypts data on its optical interfaces. Carmel changes the optical signal itself so a tap captures noise, and works with any key-management stack.
Q: How does Carmel differ from Toshiba QKD?
A: Toshiba QKD delivers keys over fiber. Carmel protects the data signal on WAN links and does not depend on QKD.
Q: How long does it take to deploy Carmel?
A: CyberRidge states that it deploys in weeks without changes to existing systems.