Quantum readiness without the quantum hardware
The term “quantum” now carries a lot of marketing weight, but for security teams the real question is simple: will your systems remain secure after quantum computers become powerful enough to break conventional public-key cryptography? That day, often called Q-day, is a matter of when, not if. Yet being quantum ready does not mean buying equipment built on quantum technology.
Post-quantum cryptography (PQC) is the practical answer. It is not a quantum technology itself; it runs on the same phones, laptops, and servers you already operate. PQC replaces the mathematical problems that quantum computers can solve efficiently — like factoring large numbers — with problems that remain hard for both classical and quantum machines, such as finding short vectors in algebraic lattices. NIST’s standardization process, which began in 2016, produced the first PQC standards in 2024, with more under consideration.
If you want to know how to protect your organization from security threats posed by quantum computers, you can stop reading now. Post-quantum cryptography is the solution.
PQC already operates at Internet scale and can outperform classical cryptography in some cases. Except in narrow situations — for example, when you need hardware acceleration in cheap smartcards or must replace legacy systems that cannot support cryptographic agility — there is no reason to purchase new hardware for a PQC migration.
What quantum hardware security actually does
Some vendors market hardware-based quantum technologies as necessary for defending against quantum adversaries. Two such technologies are quantum key distribution (QKD) and quantum random number generation (QRNG). Understanding what they do — and what they do not do — clarifies why they fall short of a complete security strategy.
Why QKD is not the answer
Quantum key distribution is frequently presented as a way to secure communications against quantum threats, but its role is narrow. QKD establishes a shared secret key between two parties, typically over dedicated optical fiber. That key must then feed into conventional symmetric cryptography to encrypt actual traffic.
The limitations are significant:
- QKD requires dedicated optical infrastructure; it does not work over the existing Internet routing model.
- It does not address authentication. QKD channels are vulnerable to man-in-the-middle attacks without additional classical authentication mechanisms.
- It does not protect stored data, such as encrypted files or recorded traffic that may be harvested today and decrypted later.
- The key rate and distance constraints are severe compared to established key exchange protocols.
In other words, QKD is neither necessary nor sufficient. It does not replace the public-key infrastructure that secures modern systems — it only augments one part of the key establishment problem, and only on a point-to-point link.
The limited role of QRNG
Quantum random number generation produces randomness from quantum mechanical processes, which can be genuinely unpredictable. Randomness is fundamental to cryptography because keys and nonces must be unpredictable to be secure.
However, strong randomness is not a quantum-exclusive capability. Classical systems with well-designed entropy sources — such as those following NIST standards for random number generation — are already secure against quantum adversaries for the purposes of key generation. QRNG hardware may be a useful source of entropy in constrained environments, but it is not a defense mechanism against quantum computing. An adversary with a quantum computer does not break randomness; they break the mathematical problems underneath the cryptography that uses that randomness.
Quantum technologies are an add-on, not a cure
The security industry often conflates two distinct ideas: products that use quantum effects and protections against quantum-enabled attacks. A QRNG chip generates random numbers using quantum physics, but that does not make a system resistant to a quantum attacker. Likewise, a QKD link protects one point-to-point connection’s key exchange, but does nothing for the broader cryptographic ecosystem that secures websites, databases, code signing, or stored data.
The systems that require protection — TLS connections, VPNs, digital signatures, and the like — all depend on public-key primitives that quantum computers can break. PQC replaces those primitives directly, so that the same protocols and infrastructure remain functional. Organizations should prioritize migrating to standards-based PQC across their public-key usage, while treating any quantum hardware purchase as an optional enhancement for specific operational needs rather than a security requirement.
If the goal is ensuring that your data and communications survive Q-day, the plan is clear: inventory your cryptographic usage, prioritize upgrades to PQC-compatible algorithms, and rely on the NIST-standardized primitives already available. Quantum hardware will not save you by itself, and you do not need it to be secure.
Why quantum security tech is not a quantum-readiness requirement
Quantum technologies are genuinely impressive. Quantum computers could transform drug discovery and materials science through molecular simulation, and measuring physical quantum processes can generate entropy with mathematically provable properties. But none of that makes quantum hardware a prerequisite for defending data against quantum attackers. If you are investing in quantum technology because you want to secure systems against quantum adversaries, that investment is based on a misunderstanding. Invest in quantum tech because you want better chemistry simulations or machine learning, not because you need it for security.
This position aligns with the guidance issued by the US NSA, the UK NCSC, the Dutch NCSC, and Germany’s BSI. The two quantum technologies most often marketed as security products are quantum key distribution (QKD) and quantum random number generation (QRNG). Neither is required for post-quantum security.
Quantum key distribution does not scale to the Internet
QKD secures a point-to-point link using quantum physics rather than hard math problems. Two parties with a direct physical connection can establish a shared secret and detect eavesdropping, then fall back on conventional symmetric cryptography for the actual communication. The security guarantees are based on the physics of the channel, which sounds appealing, but QKD cannot replace classical cryptography at Internet scale.
The core issue is architectural. QKD requires a direct physical link between the two parties exchanging a secret. That is feasible between datacenters or across major backbone links, but not for most pairs of devices on the Internet. An end-user device would need a dedicated physical connection to every server it wants to talk to securely.
The Internet does not work that way, and for good reason. Secure point-to-point links scale exponentially: adding a new device would require touching every other device it needs to communicate with. The OSI model solves this by letting two parties communicate over a chain of physical links without a direct one. Public-key cryptography, introduced in the 1976 paper “New Directions in Cryptography,” lets any two parties in the same public-key infrastructure establish end-to-end encrypted communication with no prior setup. That abstraction is why the secure Internet scales at all. QKD sidesteps the abstraction and lands back on the unscalable model.
Lack of scalability alone disqualifies QKD. But the problems do not stop there.
QKD’s theoretical guarantees are hard to realize in practice. Systems have suffered from implementation attacks, both classical side-channel attacks and novel attacks specific to QKD hardware. The technology also prefers specialized media — fiber or vacuum — and while over-the-air demonstrations exist, performance and implementation security degrade. Nobody has demonstrated QKD on a mobile phone or over Wi-Fi.
QKD also provides no authentication. It establishes a secret with whoever is on the other end of the link, and an active adversary can mount a monster-in-the-middle attack by establishing separate QKD links to both victim and destination. Preventing that requires conventional authentication — pre-shared keys or public-key cryptography. So even with QKD, you still need a solution for authentication against quantum-equipped attackers. That solution is post-quantum cryptography (PQC), which alone provides both authentication and key agreement. Once you have PQC, the case for adding QKD gets thin.
Proponents sometimes argue QKD should be layered on top of existing systems as extra protection against “harvest now, decrypt later” attacks. The idea is that an adversary who records classical key exchange messages today might decrypt them later with a quantum computer, whereas QKD’s eavesdropper detection prevents that recording. But this extra security layer only covers one physical link. As soon as traffic moves elsewhere — an Internet exchange point, the last mile to a user — it is protected by standard protocols like TLS. The QKD link protects a sliver of the path, and the value of that protection is questionable.
In short, QKD is neither necessary nor sufficient for security against quantum adversaries. PQC is sufficient, runs on existing hardware, and works everywhere.
Quantum random number generators are not a security upgrade
QRNGs are “true” random number generators that exploit quantum unpredictability, such as atomic decay or photons hitting a beam splitter. Classical TRNGs use other physical phenomena — thermal noise in electronics, lava lamps, double pendulums, wave machines. Both approaches can produce genuine randomness, and one is not inherently more secure than the other.
What cryptography actually requires from a randomness source is unpredictability and lack of bias. A small true-random seed (256 bits is plenty) fed into a cryptographically secure pseudorandom number generator (CSPRNG) yields an effectively limitless stream of output indistinguishable from true randomness. Whether the seed comes from a quantum or classical process is irrelevant, as long as the adversary does not know it. The CSPRNG is the essential component for cryptographic use, and no QRNG replaces it.
Quantum computers do not enable practical new attacks against the classical TRNGs already in widespread use. If you invest in QRNGs, do it because you believe the randomness quality is better for your use case — not because quantum computing threatens classical randomness sources. It does not.
Making post-quantum protection the default
Cloudflare has committed to providing post-quantum cryptography (PQC) for free and by default across its product line. That commitment is already visible in production traffic: more than 40% of human-generated requests to Cloudflare's network now negotiate post-quantum key agreement.
That percentage spans a broad surface area. PQC is enabled for all website and API traffic proxied through Cloudflare, for most of Cloudflare's internal network traffic, and for connections made over its Zero Trust platform. In each case, post-quantum key agreement protects against the "harvest now, decrypt later" attack, in which an adversary stores encrypted traffic today in the hope of decrypting it years from now with a sufficiently powerful quantum computer — or with any future cryptanalytic breakthrough. Key agreement is only the first phase of the transition, though. Cloudflare is also working with industry stakeholders on the forthcoming migration to post-quantum signatures, which will be needed to prevent active impersonation by an adversary operating after "Q-day," when quantum attacks become practical.
A practical readiness checklist
Organizations don't need quantum hardware to start preparing for the quantum era. The right preparatory work depends on the organization, but several measures are broadly useful:
- Solidify fundamentals. Basic security hygiene is the foundation; make sure the right expertise is in place before layering on new technology.
- Choose agile vendors. Prefer providers that already support post-quantum encryption and whose products are cryptographically agile, so that the move to post-quantum signatures and certificates is a smooth upgrade rather than a forklift migration.
- Tunnel your traffic. Routing application traffic through secure quantum-safe tunnels reduces the attack surface with minimal changes to existing systems.
- Leverage existing infrastructure. For Cloudflare customers, the Content Distribution Network and Zero Trust platform already provide a straightforward path to PQC-enabled connectivity.
More detail on Cloudflare's post-quantum offerings is available on its Post-Quantum Cryptography page.
