Network-wide Quantum Key Distribution with Onion Routing Relay

TL;DR

The paper tackles the quantum-era security challenge in QKD networks by proposing Onion Routing Relay (ORR), a hybrid protocol that nests PQC-based key encapsulation within a KR framework and applies onion routing to achieve end-to-end confidentiality and anonymity. ORR leverages Kyber-768 for key encapsulation and Dilithium for authentication, while relying on QKD keys and a QRNG to generate a secret S and layered PQC encryption across a circuit of intermediate nodes. Through a C-based simulation and a hardware-backed setup, the authors compare ORR with traditional key-relay and trusted-node approaches, showing that ORR provides stronger protection against malicious intermediaries and improved anonymity, at the cost of higher encryption overhead. The results indicate ORR can maintain QoS comparable to KR in realistic topologies, supporting its feasibility for high-security environments, with future work focusing on integrating integrity and authenticity checks to further assess performance. This work advances practical quantum-resistant network security by combining QKD, PQC, and onion routing to enable secure, scalable, end-to-end key distribution in QKDNs.

Abstract

The advancement of quantum computing threatens classical cryptographic methods, necessitating the development of secure quantum key distribution (QKD) solutions for QKD Networks (QKDN). In this paper, a novel key distribution protocol, Onion Routing Relay (ORR), that integrates onion routing (OR) with post-quantum cryptography (PQC) in a key-relay (KR) model is evaluated for QKDNs. This approach increases the security by enhancing confidentiality, integrity, authenticity, and anonymity in quantum-secure communications. By employing PQC-based encapsulation, ORR pretends to avoid the security risks posed by intermediate malicious nodes and ensures end-to-end security. Results show that the performance of the ORR model, against current key-relay (KR) and trusted-node (TN) approaches, demonstrating its feasibility and applicability in high-security environments maintaining a consistent Quality of Service (QoS). The results show that while ORR incurs higher encryption overhead, it provides substantial security improvements without significantly impacting the overall key distribution time.

Figures (3)

• Figure 1: Simplified example of the Onion Routing Relay key distribution model
• Figure 2: Encryption time of the different models
• Figure 3: Key distribution time of the different models