Quantum Key Supply Shifts From One-Shot Delivery to Key-Stream Service

ITU-T, ETSI, and CCSA have standardized QKD application interfaces around one-shot retrieval and key-stream supply. Standards and service demand are moving key supply from per-request delivery toward continuous service for ongoing cryptographic applications.

Quantum key supply in QKD networks

As quantum confidential communication moves from point-to-point use toward networked, large-scale use, standards on quantum key distribution (QKD) network architecture, equipment, key management, and interfaces are taking shape. A remaining task is how to provide keys generated by a QKD network to upper-layer cryptographic applications in a stable and efficient way. That task is part of the shift from building networks to using them.

The International Telecommunication Union Telecommunication Standardization Sector (ITU-T), the European Telecommunications Standards Institute (ETSI), and the China Communications Standards Association (CCSA) have standardized key-supply mechanisms. Two technical modes have formed: one-shot retrieval and key stream. Existing standards and service demand point to a move from per-request delivery toward continuous service, with key supply and service assurance for ongoing business.

A quantum confidential communication network consists of a QKD network and a user network. The QKD network generates, stores, relays, and manages quantum keys. The user network uses shared keys for data encryption and other cryptographic applications. Generating keys is only the base. How those keys reach cryptographic devices and applications also affects results.

In current QKD network architecture, that capability is provided mainly through the Ak interface, the standardized interface through which a QKD network supplies quantum keys to upper-layer cryptographic applications. It connects downward to key management and supply and upward to cryptographic devices and security applications. Standardizing call methods and interaction flows decouples the QKD network from upper-layer applications and supports unified access for different application types.

Early work focused on whether keys could be obtained. Continuous encryption, high-frequency key replacement, and concurrent multi-service demand add questions of stable supply, continuous supply, and how the network coordinates key resources.

Two supply modes in current standards

ITU-T, ETSI, and CCSA have standardized QKD network application interfaces. The existing standards form an application-interface technical framework. Key supply falls into one-shot retrieval and key-stream modes.

One-shot retrieval

This mode treats a single key demand as the basic unit. After a key need arises, the user sends a request to the QKD network. QKD equipment (the key management system, KM) prepares and delivers keys for both communicating parties. The typical pattern is request-response. Each retrieval is relatively independent. The interface is simpler to implement and easier to call from existing cryptographic devices and security applications. It fits services whose key demand is relatively discrete and whose call frequency is limited.

Key-stream mode

This mode first establishes a continuing key-supply relationship between the application and the QKD network. Later retrievals are managed inside the same service session. While the service continues, both parties can obtain corresponding keys along a defined key stream. After the service ends, the service relationship is released. Independent retrievals become continuous supply tied to the service lifecycle.

One-shot retrieval addresses how a single key is obtained. Key-stream mode addresses how a service obtains a stable key supply over time.

The two modes differ as follows:

One-shot retrieval fits lower call-frequency services. The QKD network focuses on handling and delivering each request. Key-stream mode is aimed at continuing services. It establishes a stable supply relationship and asks more of key-resource state awareness, resource reservation, and continuing service assurance. Key-stream mode is an important direction for the Ak interface as use scales.

Why key stream matches scaled service use

One-shot retrieval still meets many basic application needs. As demand shifts from discrete calls to continuous use, key-stream properties become clearer.

Dedicated-line encryption and centralized quantum key-management equipment consume keys continuously. If each retrieval repeats a full apply-and-deliver flow, interface interaction and system processing overhead rise with frequency. After a continuing supply relationship is set, keys can be provided inside the existing session.

One-shot retrieval asks whether the needed key can be provided now. Continuing services ask whether enough keys can be obtained stably over a period, which tests reliability and stability of QKD network key service. Binding service lifecycle to the supply relationship lets the network sense continuing key-use demand in advance and prepare resources and assurance.

When different services each establish independent key streams, the network can see each service's key demand and duration, which supports later reservation, scheduling, and service management. That mapping lets the QKD network allocate key resources around service demand and supports treating quantum keys as a service.

Outlook

As quantum confidential communication moves from pilot construction toward large-scale use, quantum key supply is expected to move from a basic interworking interface toward a service-oriented interface. One-shot retrieval is simple and widely applicable and will remain a basic method. Key-stream mode better matches continuous encryption, high-frequency key replacement, and large-scale access, with further room in resource management and service assurance. Future work may add total-volume reservation and flow reservation on top of existing key-stream mechanisms, forming reservable, assurable, and measurable quantum key service and speeding QKD network service orientation.

Gao Ziqi and Tian Ye work at the Security Technology Institute of China Mobile Research Institute on quantum communication and related research. The article was reviewed by Yang Kai of the Security Technology Research Institute (China Mobile Artificial Intelligence Security Governance Research Center).