KETS warns US on quantum plan, urges PQC plus QKD mix

The US Department of War's move towards post-quantum cryptography for critical infrastructure security has prompted warnings from KETS Quantum Security, which argues that software-based methods create a single point of failure.

KETS Quantum Security, a UK-based company working on quantum-safe encryption technology, said the shift towards post-quantum cryptography, known as PQC, leaves national security exposed if future research undermines the underlying mathematical assumptions.

PQC uses new cryptographic algorithms designed to resist attacks from large-scale quantum computers. Governments and companies have begun preparing for a scenario often described as "Q-Day", when quantum machines could break widely used public-key encryption.

KETS Quantum Security said PQC remains difficult to validate in practice because the most powerful quantum computers capable of mounting relevant attacks do not yet exist. The firm said this leaves decision-makers relying on theory and confidence in current research results.

Software focus

The company's Chief Executive, Dr. Lisa Matthews, said an accelerated migration timetable indicates the seriousness of the threat. She also argued that a strategy based entirely on software raises the consequences of any future cryptographic breakthrough.

Matthews also called for a complementary approach that combines PQC with Quantum Key Distribution, known as QKD. QKD relies on specialised hardware and physical properties to distribute encryption keys between parties.

The company described QKD as a method that avoids dependence on the strength of a particular algorithm. It said QKD works alongside conventional encryption systems by changing how keys are shared rather than changing the encryption algorithm alone.

Defence in depth

Matthews said the country's security posture should include more than one class of protection. She framed that view as a defence-in-depth model, which security teams often use to limit the impact of any single compromise.

"The US Department of War's accelerated timeline for PQC migration highlights the severity of the quantum threat, but relying exclusively on software-based solutions creates a strategic blind sport. By relying solely on PQC we are effectively replacing one mathematical lock with another. While PQC is currently our best mathematical guess, it offers no guarantee against future algorithmic breakthroughs; we are leaving a single point of failure in the security of the network. "The argument that we must choose between PQC and QKD is a false dichotomy that stifles progress towards a quantum-safe future and endangers long-term security. The rigorous defense of our critical infrastructure, most confidential communications, and sensitive data requires a defense-in-depth approach, combining PQC with QKD to provide enduring, physics-based forward secrecy. "Dismissing QKD based on outdated views of the cost and size of legacy technology completely ignores the reality of modern, mass-deployable, chip-based QKD. If we want true information security dominance and control, we cannot afford to leave QKD and the laws of physics out of our arsenal," said Dr. Lisa Matthews, CEO, KETS Quantum Security.

Hardware claims

KETS Quantum Security said QKD has evolved from earlier systems that were bulky and expensive. The company said newer designs rely on chip-based components and fit inside networking equipment.

The firm said its own approach centres on chip-based QKD subsystems and integration with standard networking hardware. It positioned this as a route to wider deployment in environments that demand strong protection for sensitive data flows.

Policy backdrop

Governments have increased their focus on quantum-safe security measures as quantum research advances and geopolitical competition intensifies. PQC has become a central part of these plans, as it can roll out through software updates across large fleets of devices and services.

Some security teams also consider risks associated with "harvest now, decrypt later" attacks, where adversaries collect encrypted data today and aim to decrypt it in the future. That concern has pushed organisations to assess which data needs long-term confidentiality and which systems require upgrades first.

KETS Quantum Security's intervention reflects a broader debate about whether PQC alone offers enough resilience against future developments. The company argues that planners should consider the possibility of new mathematical attacks that reduce confidence in selected algorithms.

The company said QKD should sit alongside PQC in critical settings rather than compete with it. It said this approach reduces reliance on any single method as agencies and operators plan security upgrades for the coming years.