Europe’s latest quantum-communications research program contains a useful signal for enterprise security leaders: quantum key distribution is not being treated as a standalone replacement for post-quantum cryptography or ordinary cryptographic management.
On August 13, the European High Performance Computing Joint Undertaking opened its Next-Generation QKD Systems call. The program seeks applied research and experimental validation of advanced quantum key distribution technologies.
Crucially, proposals must also address integration with classical and optical networks, compatibility with routers and switches, interfaces for software-defined orchestration, enterprise-grade key management, and hybrid QKD-PQC frameworks demonstrated in realistic use cases.
That integrated framing is more useful than presenting QKD and PQC as competing labels.
QKD and PQC solve different parts of the problem
Post-quantum cryptography uses algorithms designed to run on conventional computing and networking systems while resisting known attacks from classical and quantum computers. It can be incorporated into protocols, software libraries, applications, certificates, and devices.
Quantum key distribution uses properties of quantum communication to help parties establish key material and detect certain forms of interception. It requires specialized infrastructure and does not by itself provide every function an enterprise cryptographic system needs.
QKD does not eliminate the need for authentication, endpoint security, key lifecycle management, authorization, inventory, policy, or migration governance. It also does not automatically replace the public-key mechanisms embedded throughout software, identity, signing, and supply-chain processes.
The EuroHPC call implicitly recognizes these boundaries by requiring QKD systems to work with existing networking infrastructure and enterprise-grade services, and by asking for hybrid QKD-PQC demonstrations.
The integration points belong in the cryptographic inventory
A QKD deployment introduces more components and relationships that must be governed. Depending on the design, these may include quantum transmitters and receivers, optical paths, trusted nodes, key-management systems, application interfaces, orchestration platforms, conventional network equipment, and post-quantum or traditional authentication mechanisms.
An inventory should not record only “QKD present.” It should connect:
- The endpoints and communication path
- The QKD protocol and implementation
- The mechanism used to authenticate participants
- The key-management system receiving or distributing key material
- The applications and services consuming those keys
- Any PQC and traditional algorithms used alongside QKD
- Hardware, software, vendors, and ownership
- The source, scope, and freshness of supporting evidence
Those relationships determine the actual security and operational properties. A QKD link can be functioning while a classical authentication dependency remains. A key-management interface can become a concentration point. A specialized optical path can create availability and recovery constraints that do not exist in ordinary software-only deployment.
Hybrid does not mean “add every technology”
The call asks projects to demonstrate hybrid QKD-PQC frameworks with benefits over classical-only solutions. That requirement should not be generalized into a claim that every organization needs both technologies.
Architecture should follow the use case, threat model, data lifetime, operational environment, regulatory requirements, cost, and ability to maintain the system. For many organizations, standardized PQC deployed through existing protocols will be the practical migration path. Specialized QKD may be relevant to particular high-value links or research environments.
A hybrid design also needs explicit security reasoning. Teams should identify which property each component supplies, which assumptions remain, and how failure of one component affects the whole. More components can provide defense in depth, but they can also add configuration, interoperability, monitoring, and lifecycle complexity.
The question is not whether a design contains more advanced cryptography. It is whether the design has demonstrable benefits and can be operated safely.
Enterprise key management remains central
The EuroHPC call specifically requires secure key management compatible with enterprise-grade services. That is an important constraint because key establishment is only the beginning of a key’s operational lifecycle.
Organizations still need controls for generation or receipt, association with identities and services, storage, distribution, activation, rotation, revocation, expiration, recovery, destruction, auditing, and incident response.
They also need to know which data and services depend on each mechanism. Without that context, teams cannot prioritize migration, evaluate impact, or prove that a change reached the intended systems.
Experimental programs should preserve this evidence from the start. A successful demonstration should record its exact scope, components, configuration, dependencies, results, and limitations. Otherwise, a research outcome can be mistaken for production readiness.
What security teams should do now
Organizations evaluating quantum communications should begin with a bounded use case and explicit threat model. Identify the data, communication path, retention horizon, availability requirement, endpoints, and current cryptographic dependencies.
Compare standardized PQC, QKD, and hybrid approaches against the same operational criteria. Include authentication, key management, interoperability, monitoring, recovery, supplier dependency, and lifecycle cost—not only confidentiality during transmission.
Record proposals, pilots, and deployed systems with distinct status. Preserve the difference between a laboratory demonstration, an approved architecture, an available product capability, and an observed production mechanism.
Finally, connect every experiment to an exit decision: expand, revise, retain for a specialized use, or stop. Proof should include both technical results and the operational conditions under which they were obtained.
How Vista Platform can help
Vista Platform is a self-hosted cryptographic system of record organized around discovery, canonical inventory, evaluation, action, and proof.
Vista can bring observed cryptographic evidence from connected discovery channels into a canonical inventory, evaluate cryptographic and PQC state, connect decisions to accountable work, and generate scoped CBOM evidence. This helps organizations govern the conventional cryptography and dependencies surrounding specialized quantum-communications projects.
Vista does not deploy QKD, generate PQC keys, or perform every migration. It is not a vulnerability scanner. Coverage reflects the discovery channels connected to the platform, and missing observations remain visible as uncertainty. Teams can explore the source-available Core edition through the Vista evaluation paths.
The EuroHPC call gets an essential point right: quantum-secure communications must integrate with real networks, real key-management systems, and post-quantum cryptography. Technology selection is only one part of the work. The rest is inventory, interoperability, operations, governance, and evidence.
Sources
- Next-Generation QKD Systems, European High Performance Computing Joint Undertaking, August 13, 2026.
- European Quantum Communication Infrastructure, European Commission.
- Post-quantum cryptography, National Institute of Standards and Technology.