Quantum computing: secure in the long term thanks to QKD

Orange Business, the enterprise services division of the French Orange Group, presented Quantum Defender at the recent VivaTech trade fair in Paris. This is a quantum-secure network service based on Toshiba technology. The Defender combines PQC algorithms (post-quantum cryptography) with QKD hardware (quantum key distribution).

The offering includes consulting services from Orange Cyberdefence to help companies become crypto-agile. This refers to the ability to adapt cryptographic defense measures to new threats. Added to this is quantum security “as-a-service” based on Orange's Evolution connectivity platform. According to Benjamin Vigouroux, Vice President, Digital Infrastructure at Orange Business, it should be possible to “secure all systems and the entire IoT area in a production plant with one API call”.

The third area is infrastructure with PQC and QKD. According to Vigouroux, the inherent advantage of QKD is that it offers “more robust protection than PQC, where the long-term functionality of the algorithms is less certain”. His basic argument is: “It is impossible to know whether the algorithms approved by NIST can actually withstand attacks by quantum computers in the long term. QKD, on the other hand, is based on qubits – the basic information units of quantum computing – which change value when intercepted, making it obvious that someone has tampered with the transmission.”

Store now, decrypt later

With this technology, the new Defender is primarily intended to protect sensitive data from potential attacks according to the motto “store now, decrypt later”. It is generally accepted that hackers have already spied on a lot of data unnoticed to decrypt it later, as soon as quantum computing technology makes this possible. Although this data will be obsolete by then, it can be assumed that some sensitive information – such as personal data or business secrets – will still be relevant. “In ten years' time, important data will still be stored; even if it is only metadata that will then lead to newer data,” says Frank de Jong, Head of Quantum Secure Networks at Orange Business.

In Paris, the Defender is now commercially available via the existing fiber optic network. According to Orange Business, a major French financial services provider has already connected several sites to the network to protect its critical financial data.

The Defender is the latest result of years of collaboration between Orange and Toshiba in validating QKD for commercial applications. In late 2023, for example, Orange worked with optical network infrastructure provider Adtran and Toshiba to deploy a QKD-secured 100 Gbps data stream on a coherent 400 Gbps DP-16QAM channel running over 184 km of standard single-mode fiber (SSMF) with three QKD links and two trusted nodes.

In early 2024, Orange and Toshiba provided further insight into their ongoing trials, noting that “QKD-secured signals can coexist alongside traditional data transmissions on the same fiber network.” This showed how QKD technology can be used in fiber optic networks alongside existing traditional data services. This results in significant cost savings and speeds up deployment, as dedicated fiber is no longer required for QKD transmission.

European expansion

There are also corresponding cooperations in Germany. Earlier this year, Toshiba announced the successful completion of coherent, secure quantum communications over Deutsche Telekom's regular network using standard fiber optic cables at normal room temperature. This is a significant breakthrough for the use of this technology in the existing telecommunications infrastructure.

Toshiba has also worked with BT Group on their quantum-safe network developments and was instrumental in their launch in 2022. According to Hiroshi Tsukino, Vice President of the ICT Solutions Division at Toshiba Digital Solutions, “the quantum age is no longer a marginal issue”. Vigouroux also sees a growing interest in quantum security. One of the reasons for this is the final validation of the three PQC algorithms by NIST. Another reason is standardization, which is due to be completed in the USA and UK by 2035. According to Vigouroux, it is likely that the EU will announce a similar deadline this year.

The next stage of expansion is to connect the network to other European networks as part of the EuroQCI project. The terrestrial QKD technology used in the Paris section of the project currently has a distance limitation of around 150 km. Although Toshiba is working on doubling the distance, this is not enough for a pan-European network. To overcome this limit, the project relies on satellites – in particular the IRIS2 constellation, which is being set up as part of another EU project to be completed by around 2028.

(dahe)