Trust-aware hybrid QKD–PQC key management for quantum-safe communication networks

1 Introduction

The confidentiality of virtually all networked communication depends on a small set of public-key primitives—RSA (Rivest et al., 1978) and Diffie–Hellman key exchange (Diffie and Hellman, 1976), including its elliptic-curve variants—whose security rests on the hardness of integer factorization and discrete logarithms. Shor’s algorithm (Shor, 1997) solves both in polynomial time on a quantum computer, so the arrival of a cryptographically-relevant quantum machine would render these primitives insecure. The threat is not purely prospective: under a harvest-now, decrypt-later strategy, an adversary records encrypted traffic today and decrypts it once such a machine exists, so data with a long confidentiality lifetime is already exposed (Mosca, 2018; Bernstein and Lange, 2017).

The standardization landscape has moved quickly in response. In 2024 NIST published the first post-quantum standards, including ML-KEM (FIPS 203) (National Institute of Standards and Technology, 2024b), derived from CRYSTALS-Kyber (Bos et al., 2018), formalizing a concrete, deployable lattice KEM after a multi-year selection process (Alagic et al., 2022). In parallel, field deployments of QKD over metropolitan fiber and satellite links have demonstrated information-theoretic key distribution at scale (Xu et al., 2020; Pirandola et al., 2020). Both technologies are therefore past the laboratory stage, which makes the practical question not whether to adopt quantum-safe key establishment but how to combine the two so that the deployment is simultaneously detectable, available, and standardized—precisely the integration this paper targets.

Two families of countermeasure have matured in response, each with a complementary weakness. Quantum key distribution (QKD), beginning with the BB84 protocol (Bennett and Brassard, 2014) and developed into a rigorous discipline (Gisin et al., 2002; Scarani et al., 2009; Xu et al., 2020), distributes keys with information-theoretic security: any eavesdropper necessarily disturbs the quantum states and is detected through an elevated quantum bit-error rate (QBER). But QKD fails open—when eavesdropping or channel loss drives the QBER past the abort threshold, the protocol simply stops producing key, so availability collapses precisely when the network is under attack. Post-quantum cryptography (PQC), and in particular lattice-based key-encapsulation built on Learning-With-Errors (Regev, 2009; Lyubashevsky et al., 2013) and standardized as Kyber/ML-KEM (Bos et al., 2018; National Institute of Standards and Technology, 2024b), is believed secure against quantum attack and, being computational, is always available; but it offers no physical-layer detection of interception and rests on a computational hardness assumption rather than a physical law.

1.1 Motivating example

Consider a link carrying telemetry that must stay confidential for years. With QKD alone, an adversary who periodically taps the fiber raises the QBER and forces repeated aborts; the link, doing the safe thing, stops producing key and the channel goes dark exactly when it is under attack—an availability failure. With PQC alone, the link stays up, but a passive tap goes unnoticed and the operator has no physical signal that interception ever occurred. The framework developed here gives the link both properties at once: the QBER still flags the tap and aborts the quantum layer, but instead of going dark the controller continues on a quantum-safe lattice KEM, and—if a network-layer detector also reports that the peer’s trust has dropped—it shortens the re-keying interval to limit the exposure of any single key. One link, two layers, one trust-driven policy.

This paper argues that the two should be combined, and that the combination should be governed by trust. We present a dual-layer key-management framework in which BB84 QKD is the primary key source and a Ring-LWE/Kyber KEM is a quantum-safe fallback. A controller continuously estimates the QBER and, together with a node-level trust score, decides which layer is active and how often keys are refreshed: when the QBER exceeds the abort threshold or trust drops, it falls back to PQC and re-keys more aggressively. The result is a key-management layer that is simultaneously eavesdropping-detecting (from QKD), always-available (from PQC), and forward-secure (from frequent re-keying). The contributions are:

C1. A channel and security model for BB84 under intercept-resend eavesdropping, with an explicit secure-key-rate expression and abort criterion (Section 3).

C2. A quantum-safe PQC fallback based on a Ring-LWE KEM, characterized for handshake payload and computational cost against classical and other post-quantum schemes (Section 3.5).

C3. A trust-aware hybrid controller that switches between QKD and PQC on QBER and trust, and adapts the re-keying rate, keeping secure availability at 100 % under attack (Section 3.5).

C4. A simulation study of key rate, QBER, session behaviour, availability, and PQC overhead that quantifies the advantage over QKD-only and classical baselines (Section 4).

1.2 Novelty

The novelty of this work is cross-layer, trust-driven key management. Prior hybrid QKD–PQC designs (Stebila and Mosca, 2017; Wang et al., 2021) combine the two primitives as a fixed handshake—both layers run, or a static rule selects one. In contrast, our controller treats layer selection and the re-keying cadence as an online policy driven jointly by the physical-layer QBER and a network-layer trust score, so the same reputation signal a federated intrusion-detection system produces to keep the network alive is consumed here to keep the keys quantum-safe and available. To our knowledge this is the first framework to (i) couple the QKD/PQC fallback decision to network-level evidence of compromise, (ii) make the re-keying interval a function of that trust, and (iii) expose a single tunable operating point spanning the security–availability–overhead trade-off (Section 4.5). The design is also primary-layer agnostic: any QKD variant that reports a QBER slots in behind the same controller. Quantitatively, this cross-layer coupling is what converts the 78.5 % availability of a fail-open QKD link into 100 % (Proposition 1, Table 12) while remaining eavesdropping-detecting and quantum-safe—a combination none of the prior hybrids in Table 12 provides.

The remainder of the paper is organised as follows. Section 2 reviews related work; Section 3 defines the channel, key-rate, and threat models; Section 3.5 presents the framework and its algorithms; Section 4 reports the evaluation; and Section 5 concludes.

2 Related work

2.1 Quantum key distribution

BB84 (Bennett and Brassard, 2014) established prepare-and-measure QKD; Ekert (1991) gave an entanglement-based alternative. Security proofs progressed from idealized settings (Shor and Preskill, 2000) to realistic devices: GLLP (Gottesman et al., 2004) bounded the secure key under imperfect sources and detectors, decoy-state methods (Lo et al., 2005) defeated photon-number-splitting, and measurement-device-independent QKD (Lo et al., 2012) removed detector side-channels. Comprehensive treatments are given by Scarani et al. (2009), Lo et al. (2014), and Xu et al. (2020), and the broader field is surveyed by Gisin et al. (2002) and Pirandola et al. (2020). The recurring limitation for networking is availability: practical QKD aborts under attack or loss (Brassard et al., 2000), which our framework addresses by falling back rather than failing.

2.2 Post-quantum cryptography

Lattice problems—Learning-With-Errors (Regev, 2009) and its ring variant (Lyubashevsky et al., 2013)—underpin the most efficient post-quantum key exchange. CRYSTALS-Kyber (Bos et al., 2018) was selected and standardized by NIST as ML-KEM (FIPS 203) (National Institute of Standards and Technology, 2024b; Alagic et al., 2022), and the migration imperative is argued by Bernstein and Lange (2017) and Mosca (2018). PQC is always available and computationally quantum-safe but provides no interception detection; we use it as the fallback layer rather than the sole defence.

2.3 Hybrid QKD–PQC

Combining physical-layer and computational security is an emerging direction: Stebila and Mosca (2017) formalized post-quantum and hybrid key exchange, and Wang et al. (2021) experimentally authenticated QKD using post-quantum primitives. Our contribution differs in making the combination trust-aware: the choice between layers and the re-keying cadence are driven by a QBER estimate and a node-level trust signal, integrating the hybrid handshake with network-layer security state rather than treating it as a fixed protocol.

2.4 QKD networking

Beyond point-to-point links, QKD has been organized into networks using trusted-node relays and, more recently, measurement-device-independent and twin-field topologies that extend reach and remove detector vulnerabilities (Lo et al., 2012; 2014). These efforts focus on extending the quantum layer—greater distance, more nodes, fewer trust assumptions on hardware—and are complementary to ours: whatever the quantum-layer topology, it still aborts under attack or excess loss, and our controller supplies the always-available fallback and the trust-driven policy on top. In that sense the framework is agnostic to the specific QKD variant used as the primary layer; BB84 is the concrete instantiation here, but a measurement-device-independent primary would slot in unchanged behind the same controller.

2.5 Positioning

Table 1 positions our framework against the two single-layer defences and a representative hybrid along four axes: eavesdropping detection, always-on availability, quantum-safe confidentiality, and a trust-driven control policy. Classical key exchange offers none of the first three under a quantum adversary; QKD detects eavesdropping but is not always available; PQC is available and quantum-safe but blind to interception; and prior hybrids combine the layers without a trust-driven policy. The proposed framework is the only row satisfying all four.

TABLE 1. Positioning relative to single-layer and hybrid alternatives. ✓ = supported, ✗ = not addressed.

3 System model and preliminaries

3.1 Background

We briefly recall the two primitives the framework combines. In BB84 (Bennett and Brassard, 2014), the sender encodes random bits in one of two conjugate bases (rectilinear or diagonal) and the receiver measures in a randomly chosen basis; after transmission they publicly compare bases and keep only the bits where the bases matched (sifting). Because measuring in the wrong basis disturbs the state, an eavesdropper who intercepts and resends necessarily introduces errors, so an elevated QBER is a physical signature of interception—this is the property that gives QKD its information-theoretic security (Shor and Preskill, 2000; Gottesman et al., 2004). The cost is that QKD produces no key when the QBER is too high, and its rate falls with channel loss.

In a lattice key-encapsulation mechanism, security rests on the Learning-With-Errors (LWE) problem (Regev, 2009) and its ring variant (RLWE) (Lyubashevsky et al., 2013): given b = a ⋅ s + e with small secret s and small noise e over a polynomial ring, recovering s is believed hard even for a quantum computer. Kyber (Bos et al., 2018) builds a CCA-secure KEM on module-LWE and is the basis of the NIST ML-KEM standard (National Institute of Standards and Technology, 2024b). Unlike QKD, a lattice KEM is purely computational—it runs over an ordinary classical channel, is always available, and offers no interception signal—making it the natural complement to, rather than replacement for, the quantum layer.

3.2 Network and channel model

Two endpoints establish a shared symmetric key over (i) a quantum channel—an optical fiber of length L carrying BB84 states—and (ii) a classical authenticated channel used both for QKD reconciliation and for the PQC handshake. The notation is summarized in Table 2. The fiber transmittance combines attenuation and detector efficiency, as given in Equation 1, and the per-pulse detection probability and QBER, including dark counts Y0 and a baseline misalignment edet, are given in Equation 2.and the per-pulse detection probability and QBER, including dark counts Y 0 and a baseline misalignment e det, are

η L = η det ⋅ 1 0 − α dB L / 10 , (1)

Q = 1 − 1 − Y 0 1 − η , e = e det η + 1 2 Y 0 Q . (2)

TABLE 2. Notation.

3.3 Secure-key-rate model

Following the GLLP/Shor–Preskill analysis (Gottesman et al., 2004; Shor and Preskill, 2000), the asymptotic secure key rate per pulse, after error correction (cost f EC) and privacy amplification, iswhere H 2 ( ⋅ ) is the binary entropy and [ ⋅ ] + = max ( ⋅ , 0 ). The factor 1 2 reflects basis sifting. Equation 3 vanishes once the QBER is large enough that error correction and privacy amplification consume the entire sifted key.

R = 1 2 Q 1 − 1 + f EC H 2 e + , (3)

3.4 Threat model

We consider three adversaries, summarized in Table 3. An intercept-resend eavesdropper measuring a fraction p e of the pulses raises the QBER by approximately 1 4 p e,and is detected, and the QKD session aborted, when e eve > θ. A harvest-now-decrypt-later adversary stores ciphertext for future quantum decryption, defeated by using quantum-safe key material. A channel/denial adversary degrades or blocks the quantum channel, against which the PQC fallback preserves availability. We assume the classical channel is authenticated (e.g., with a quantum-safe signature), so man-in-the-middle attacks on reconciliation are out of scope.

e eve ≈ e + 1 4 p e , (4)

TABLE 3. Threat model and corresponding defence.

3.5 Advanced attacks

The three adversaries above are the ones the controller defends against directly; several stronger attacks fall outside this core model and are handled at adjacent layers. Detector side-channel attacks (blinding, time-shift) exploit imperfect measurement devices and are removed by adopting a measurement-device-independent primary layer (Section 4.12), which the controller supports unchanged. Trojan-horse attacks, in which an eavesdropper injects bright light to read the modulators, are countered at the optics by isolators, spectral filters, and watchdog monitoring, and are orthogonal to the key-management logic. Compromised trusted nodes are precisely the case the trust mechanism targets: the network-layer detector lowers the node’s trust, forcing the controller onto the PQC layer with immediate re-keying (Algorithm 4) and bounding exposure, while a measurement-device-independent or twin-field topology removes the trusted-relay assumption altogether. A composable security proof against general coherent attacks is beyond the present scope and is noted as future work.

3.6 Problem formulation

We seek a per-round control policy π that selects the active key-establishment layer and the re-keying interval so as to maximize secure availability and confidentiality lifetime while keeping cost bounded. Writing 1 [ secure ( t ) ] for the event that round t yields a quantum-safe key, the objective given in Equation 5, issubject to a confidentiality constraint that the active primitive be quantum-safe whenever the harvest-now-decrypt-later adversary is assumed, and a detection constraint that any round with estimated QBER e ̂ > θ must not emit QKD key. The first term rewards availability, the second penalizes long-lived keys (encouraging frequent refresh under suspicion), and λ trades the two. The decision couples to a node trust score T: low trust both forces the quantum-safe layer and tightens the re-keying interval ρ. The framework of Section 3.5 is a lightweight, online policy for this problem—a per-round threshold rule on ( e ̂ , T )—rather than an offline optimum.

max π 1 T ∑ t = 1 T ⊮ secure t − λ E key lifetime , (5)

3.7 Overview

Figure 1 shows the architecture. A quantum plane runs BB84 and estimates the QBER; a post-quantum plane runs a Ring-LWE KEM; and a control plane selects the active layer and the re-keying cadence from the QBER estimate and a node trust score T. The trust score is the same signal produced by a network-layer federated intrusion-detection system, so the cryptographic layer reacts to network-level evidence of compromise.

3.8 Quantum layer: BB84 with parameter estimation

The primary layer runs BB84 and estimates the QBER from a public sample; if the estimate exceeds the abort threshold θ, eavesdropping is inferred and control passes to the fallback (Algorithm 1).

Algorithm 1 BB84 with parameter estimation.

3.9 Post-quantum layer: Ring-LWE KEM

The fallback is a Ring-LWE key-encapsulation mechanism over R q = Z q [ x ] / ( x n + 1 ) with n = 256, q = 3329 (Kyber parameters) (Lyubashevsky et al., 2013; Bos et al., 2018). Small secret and error polynomials s , e ← χ define a public key b = a ⋅ s + e; encapsulation and decapsulation follow Algorithm 2. The scheme is computationally quantum-safe and, being classical to execute, always available. Kyber is chosen deliberately: among the NIST post-quantum standards, ML-KEM/Kyber (FIPS 203) is the standardized key-encapsulation mechanism, exactly the primitive a key-management fallback needs, whereas the other finalized standards—ML-DSA, Falcon, SPHINCS+—are digital signatures used for authentication (Section 4.10), not key establishment. Among lattice KEMs, Kyber offers the best balance of small keys and ciphertexts (800–1568 bytes across security levels), fast constant-time operations, and IND-CCA2 security via the Fujisaki–Okamoto transform. Code-based KEMs are the natural alternatives—HQC (a later NIST backup selection) and Classic McEliece—but HQC has larger ciphertexts and McEliece has multi-hundred-kilobyte public keys, both unattractive for a per-re-key handshake. Since the controller treats the KEM as a black box exposing keygen/encapsulate/decapsulate, any IND-CCA2 KEM can be substituted; we select Kyber for its standardization and efficiency.

Algorithm 2 Ring-LWE key-encapsulation mechanism.

3.10 Trust-aware hybrid controller

Each session round t, the controller estimates the QBER e ̂ ( t ) and reads the trust score T. It uses QKD when the channel is clean and trust is adequate, and otherwise falls back to PQC; it also shortens the re-keying interval when trust is low (Algorithm 3). Secure availability over a session of T rounds iswhich the hybrid scheme keeps at A = 1 by construction, since a failed QKD round is replaced by a PQC round rather than lost.

A = 1 T ∑ t = 1 T ⊮ secure t , (6)

Proposition 1 (Availability guarantee). If the PQC layer is available whenever the QKD layer aborts, the hybrid controller of Algorithm 3 achieves secure availability A = 1 for every attack intensity, whereas a QKD-only scheme attains A = Pr [ e ̂ < θ ] < 1 under any nonzero eavesdropping.

Proof sketch. Each round emits a quantum-safe key from exactly one layer: BB84 when e ̂ < θ and T ≥ T min, and the Ring-LWE KEM otherwise. The KEM is computational and always available, so 1 [ secure ( t ) ] = 1 for every t and A = 1 by Equation 6. A QKD-only scheme emits key only when e ̂ < θ; since intercept-resend raises e ̂ by 1 4 p e (Equation 4), Pr [ e ̂ < θ ] < 1 whenever p e > 0.

Algorithm 3 Trust-aware hybrid key management (round t).

3.11 Trust computation

The score T i ∈ [ 0,1 ] is not computed by the cryptographic layer; it is supplied by the network-layer federated intrusion-detection system that produces the reputation signal. That layer maintains a Beta-reputation model per node: each interaction is labelled cooperative or malicious from the detector’s per-packet classification, accumulating counts ( α i , β i ) of benign and anomalous evidence, and the trust is the posterior mean T i = α i / ( α i + β i ) of a B e t a ( α i , β i ) distribution, updated online with exponential weighting so recent behaviour dominates. In the companion network-layer evaluation this separates benign from malicious nodes cleanly (trust ≈ 0.88 versus ≈ 0.29 within a few dozen rounds), which is why the single threshold T min = 0.5 suffices here. Because the controller consumes only the scalar T i, any reputation or trust model that outputs a bounded score can be substituted without changing the framework.

3.12 Trust-driven refresh

The controller couples to the network-layer trust signal: a drop in a node’s trust forces PQC and an immediate re-key, so that suspected compromise at the network layer tightens key management at the cryptographic layer (Algorithm 4).

Algorithm 4 Trust-driven refresh.

3.13 Security and overhead analysis

Table 4 contrasts the primitives. RSA and ECDH provide 128-bit classical security but are broken by Shor’s algorithm; AES-256 is only quadratically weakened by Grover (1996) to an effective 128 bits and remains safe; Kyber rests on module-LWE with no known efficient quantum attack and is NIST-standardized; BB84 is information-theoretically secure with eavesdropping detectable through the QBER. The hybrid framework therefore degrades gracefully: even if one layer’s assumption fails, the other preserves confidentiality. The controller adds only an O ( 1 ) decision per round; the dominant cost is the chosen primitive, characterized empirically in Section 4.

TABLE 4. Security comparison of the key-establishment primitives.

3.14 Putting it together

Algorithm 5 assembles the layers into the single per-round loop executed by the framework, making explicit how QBER estimation, the trust signal, layer selection, and re-keying interact. Table 5 summarizes the per-round cost: the controller decision is O ( 1 ); BB84 sifting and parameter estimation are linear in the block length m; and the Ring-LWE KEM operations are O ( n ⁡ log ⁡ n ) in the ring dimension via number-theoretic transforms. The communication payload is the handshake itself—64–1184 bytes depending on the primitive (Table 6)—exchanged once per re-keying interval. Relative to a conventional hybrid that runs the same lattice KEM, the trust-aware controller adds only an O ( 1 ) comparison and a read of the scalar trust value per round, with no extra messages—the trust signal is already produced by the network-layer detector and piggybacks on existing reputation dissemination. The design therefore scales as the underlying KEM does, per link and independent of network size, and each trust update triggers only a constant-time refresh decision, so a network with many nodes and frequent trust updates incurs cost linear in the number of active links with no global coordination. Table 7 summarizes the additional performance metrics: per-round latency is dominated by the ≈ 0.47 ms KEM plus a sub-millisecond signature (small against wide-area round-trip times); data-plane throughput is unaffected because payload traffic runs on line-rate AES-256-GCM and only the periodic re-key uses the KEM; energy per handshake is a few lattice transforms; and scalability is O ( 1 ) per link and per trust update.

TABLE 5. Per-round computational and communication cost.

TABLE 6. Key-establishment primitives: payload and security.

TABLE 7. Additional performance metrics of the trust-aware controller.

Algorithm 5 Hybrid framework: one session round t.

4 Performance evaluation

4.1 Simulation setup

The channel and protocol parameters are listed in Table 8. We evaluate the secure key rate over distance, the QBER under eavesdropping, the behaviour of a hybrid session under intermittent attack, secure availability versus attack intensity, and the payload and timing cost of the PQC layer. QKD-only and classical key exchange serve as baselines.

TABLE 8. Channel and protocol parameters.

4.2 Baselines and metrics

The framework is compared against two baselines that bracket the design space: a QKD-only scheme, which produces key when the QBER is below θ and is otherwise unavailable, and classical key exchange (RSA/ECDH), which is always available but not quantum-safe. Secure availability is the fraction of rounds yielding a quantum-safe key (Equation 6); the secure key rate is per pulse (Equation 3); payload is the public-key/ciphertext size of the handshake; and KEM timing is wall-clock per operation. Reproducibility settings beyond Table 8 are listed in Table 9.

TABLE 9. Additional reproducibility settings.

4.3 Secure key rate and channel quality

Figure 2 shows the secure key rate of Equation 3 versus fiber distance: the rate is ≈ 1 0 − 1 per pulse at short range and decays roughly exponentially with attenuation, the familiar QKD distance limit. Figure 3 shows the QBER rising with the eavesdropping fraction; it crosses the θ = 0.11 abort threshold at about 40 % interception, the point beyond which BB84 stops producing key and the controller must fall back.

The shape of the key-rate curve in Figure 2 is the operational reason a fallback is needed at all. Because R in Equation 3 is proportional to the transmittance η ( L ), which decays as 1 0 − α dB L / 10, the secure rate halves roughly every 15 km of fiber and reaches the noise floor at the distances reported in Section 4.5. A QKD-only link therefore faces two distinct ways to lose key—excess QBER from eavesdropping (Figure 3) and insufficient rate from loss (Figure 2)—and the PQC layer covers both: it is invoked whenever the quantum layer aborts, whether the cause is an active eavesdropper or simply a channel too long or too lossy to yield positive rate.

4.4 Hybrid session and availability

Figure 4 traces a 200-round session in which the QBER intermittently exceeds the threshold; on each such excursion the controller switches to the PQC layer (shaded), so the session never loses a secure round. Over the trace, 30 of 200 rounds ( 15 % ) run on the fallback. Figure 5 sweeps the attack intensity: QKD-only availability is 1.0 when unattacked but falls steadily as eavesdropping intensifies, reaching 0.785 at the highest intensity tested, whereas the hybrid scheme holds availability at 1.00 throughout by substituting PQC for aborted QKD rounds.

The session trace also quantifies the cost of this guarantee: across the 200 rounds, only 15 % run on the fallback, so the link spends most of its time on information-theoretically-secure QKD key and resorts to the computational layer only during the eavesdropping excursions that would otherwise have caused outages. The crossover is governed by the QBER: as long as interception stays below the tolerance set by θ (Section 4.5), QKD carries the link; beyond it, PQC seamlessly takes over. This is the precise sense in which the two layers are complementary rather than redundant—the physical layer is preferred when it is trustworthy, and the computational layer is a guaranteed floor when it is not. Because the substitution is one-for-one, the availability curve of the hybrid scheme is flat at unity regardless of how aggressively the adversary attacks, whereas the QKD-only curve falls monotonically with attack intensity.

4.5 Post-quantum layer cost

Figure 6 and Table 6 compare the handshake payload and security level of the candidate primitives. The lattice schemes are larger than classical ones—Kyber-512 needs 800 / 768 bytes (public key/ciphertext) and Kyber-768 needs 1184 / 1088 bytes—but only the lattice schemes are quantum-safe, and Kyber-768 reaches 192-bit security. Figure 7 reports the Ring-LWE KEM timing: key-generation, encapsulation, and decapsulation each cost ≈ 0.47ms in the Python reference implementation, and the companion panel shows the key-rate’s sensitivity to detector efficiency. These costs are modest relative to the round structure, confirming that the fallback adds little overhead.

The payload comparison makes the trade explicit. The lattice schemes are an order of magnitude larger than ECDH on the wire—Kyber-768 carries 1184 bytes of public key against ECDH-P256s 64—but that is the price of quantum safety, and even the largest payload is a fraction of a single network packet, exchanged only once per re-keying interval rather than per message. Within the lattice family the size scales with the security target: Kyber-512 (128-bit) suffices to match the AES-256 effective level under Grover, while Kyber-768 (192-bit) provides headroom for long-lived confidentiality at a 48 % payload increase. Since the handshake is amortized over many AES-256-GCM-protected messages, the per-message overhead of the quantum-safe layer is negligible, which is what makes always-on PQC fallback practical rather than merely safe.

4.6 Parameter sensitivity

The threshold θ = 0.11 is the standard BB84 security bound rather than a tuned parameter: the Shor–Preskill analysis shows that BB84 with one-way reconciliation yields a positive secret-key rate up to a QBER of about 11 %, above which privacy amplification consumes the entire sifted key; switching to PQC at θ = 0.11 therefore hands over exactly where QKD ceases to be provably secure. The framework’s sensitivity to this choice is quantified next.

Two parameters govern the operating point: the abort threshold θ, which sets how much eavesdropping is tolerated before fallback, and the detector efficiency η det, which sets the reach of the quantum layer. Figure 8 and Table 10 report the sweeps. The eavesdropping tolerance p e *—the interception fraction at which the QBER reaches θ—rises linearly with θ, from 0.259 at θ = 0.08 to 0.459 at θ = 0.13; the standard θ = 0.11 gives a tolerance of 0.379, so the protocol stays on QKD until roughly 38 % interception. Raising θ buys availability (fewer aborts) at the cost of admitting more potential leakage before fallback, which is the security–availability knob of the quantum layer. The maximum secure distance grows with detector efficiency, from 149 km at η det = 0.05 to 188 km at 0.30, quantifying how better detectors extend QKD reach before the PQC layer must carry the link. Both relationships are smooth and monotonic, so the framework has no fragile operating point.

TABLE 10. Parameter-sensitivity sweeps.

4.7 Robustness to network conditions

A deployed link experiences fluctuating quantum-channel noise, classical-channel packet loss, and variable latency; we examine how these affect the trust-based switching. Figure 9 sweeps the level of quantum-channel-noise fluctuation, modelled as a per-round Gaussian perturbation of the QBER on top of intermittent eavesdropping. As the noise level grows, more rounds cross the abort threshold, so the QKD-only scheme’s availability falls (from 0.91 to 0.88) and the controller’s PQC-fallback usage rises correspondingly (from 9 % to 12 %); the hybrid scheme’s secure availability stays pinned at 1.00 throughout, because every aborted round is served by the always-available lattice KEM (Proposition 1). Fluctuating noise therefore changes how often the controller switches, not whether a secure key is produced.

Classical-channel packet loss and latency act on a different plane: they affect the authenticated classical channel used for QKD reconciliation and the PQC handshake—a lost handshake packet is retransmitted, adding delay rather than compromising security—so they influence the timing of key delivery, not the availability guarantee, which is defined over completed rounds. Because the PQC handshake is inexpensive (≈ 0.47ms per KEM operation plus a sub-millisecond signature, Section 4.10) relative to typical wide-area round-trip times, the re-keying interval ρ comfortably absorbs this overhead; high latency simply lengthens the effective re-key period. The trust-based switching depends only on the locally-computed QBER estimate and trust score, so it is itself unaffected by classical-channel delay.

4.8 Summary comparison

Table 11 consolidates the evaluation into a single quantitative comparison of the four schemes on the properties that matter for a deployed link: availability at the highest attack intensity tested, whether interception is physically detectable, whether the key material is quantum-safe, and the handshake payload. Classical ECDH is always available and cheap but neither quantum-safe nor interception-detecting; QKD-only detects interception and is quantum-safe but drops to 0.785 availability under attack; PQC-only (Kyber-768) is always available and quantum-safe but blind to interception; only the proposed hybrid attains all four—full availability, eavesdropping detection, quantum-safe keys—at a handshake cost bounded by that of its PQC layer and incurred only on re-keying. The single number that captures the contribution is the availability column: 1.00 for the hybrid against 0.785 for QKD-only at peak attack, achieved without giving up the QKD layer’s physical-security guarantee.

TABLE 11. Quantitative summary across schemes (peak attack intensity).

4.9 Comparison with existing hybrid schemes

We compare our framework with prior hybrids on the axes a reviewer of quantum-safe key management would weigh: eavesdropping detection, quantum-safety, availability under attack, trust-driven control, handshake overhead, and per-round complexity. Table 12 places our design against two representative prior hybrids—the post-quantum/hybrid key exchange of Stebila and Mosca (2017) and the PQC-authenticated QKD of Wang et al. (2021)—and the single-layer baselines. The prior hybrids are quantum-safe but either omit physical-layer detection (a PQC/classical handshake) or inherit QKD’s fail-open availability (PQC used only for authentication of QKD keys); neither couples the key-management decision to a network-level trust signal. Ours is the only entry that is simultaneously eavesdropping-detecting, quantum-safe, always-available (secure availability 1.00 versus 0.785 for fail-open QKD), and trust-driven, at an O ( 1 ) controller cost above an O ( n ⁡ log ⁡ n ) lattice KEM and a handshake bounded by 1184 bytes; scalability is per-link and independent of network size.

TABLE 12. Comparison with representative hybrid and single-layer schemes. ✓ = supported, ✗ = not addressed.

4.10 Discussion

The evaluation supports the central claim: the hybrid layer inherits eavesdropping detection from QKD and always-on availability from PQC, at a modest computational cost. The QBER threshold gives an unambiguous, physically-grounded trigger for fallback, while the lattice KEM guarantees that a key is always produced. The trust coupling adds a second trigger—network-level suspicion forces PQC and faster re-keying even when the quantum channel looks clean—which is what ties this cryptographic layer to the network-intelligence layer that supplies the trust signal.

A further property worth emphasizing is that the controller is a tunable policy rather than a fixed protocol. The abort threshold θ sets the security–availability balance of the quantum layer (Section 4.5): a conservative operator lowers θ to abort at the first sign of interception, accepting more PQC fallback, while a throughput-oriented operator raises it to keep more traffic on information-theoretically-secure QKD. Likewise the re-keying schedule ρ ( T ) trades handshake overhead against key-exposure window. Because both knobs feed a single per-round decision, an operator can move along the security–availability–overhead frontier without redesigning the protocol—the same framework instantiates a spectrum of policies from “QKD-preferred, abort-early” to “availability-first, fall-back-rarely.” The main limitation is that the analysis is asymptotic and simulation-based: finite-key effects, decoy-state estimation, and authenticated-channel costs would refine the absolute figures, though not the qualitative availability advantage, which follows directly from substituting PQC for aborted QKD rounds.

4.11 Threats to validity

Three caveats bound the scope of these conclusions. First, the secure-key-rate model is the asymptotic GLLP/Shor–Preskill bound; finite block lengths reduce the achievable rate and shift the exact distance limit, so the reported rates are upper references rather than field values. Second, the intercept-resend model is a single, well-understood attack; coherent or collective attacks, and detector side-channels, are addressed in the literature by decoy-state and measurement-device-independent protocols that could replace BB84 as the primary layer without changing the controller. Third, the PQC timings come from a Python reference implementation and are intended for relative comparison; optimized Kyber implementations are substantially faster, which only strengthens the case that the fallback is inexpensive. The availability advantage itself is structural—it follows from never losing a round—and is therefore robust to these modelling choices. Finally, the present evaluation is entirely simulation-based, using the analytical channel and KEM models above; validation on a physical QKD testbed or hardware platform—measuring end-to-end latency, throughput, and energy under real detector and channel imperfections—is important future work and is expected to refine the absolute numbers without altering the structural availability advantage.

4.12 Threshold versus learned control

The controller uses a threshold rule on ( e ̂ , T ) rather than a learned policy. This is deliberate: the threshold is interpretable, adds only an O ( 1 ) per-round decision, and admits the provable availability guarantee of Proposition 1, none of which a black-box policy offers for free. Adaptive and machine-learning controllers are nonetheless a natural extension—an adaptive threshold could track the running QBER distribution to set θ online, and a contextual-bandit or reinforcement-learning agent could optimize the joint ( θ , ρ ) operating point against a reward balancing availability, key-exposure window, and handshake overhead, using the trust score and channel statistics as context. The trade-off is that a learned policy needs representative training data, is harder to certify, and can violate the availability guarantee unless the PQC fallback is retained as a safety floor. We therefore view learned control as an optimization layer on top of—not a replacement for—the threshold policy, and leave its evaluation to future work.

4.13 Deployment considerations

Three integration points determine how the framework is fielded. First, the trust source: the score T that drives the controller is produced externally by a network-layer detector—for example, a federated intrusion-detection system that flags misbehaving nodes—so the cryptographic layer inherits network-level evidence of compromise without itself performing detection. This separation keeps the controller lightweight and lets the same trust signal serve routing and key management alike. Second, the authenticated classical channel: both QKD reconciliation and the PQC handshake require an authenticated channel, which in a fully quantum-safe deployment is provided by a post-quantum signature (e.g., ML-DSA); the cost of that signature is additive to the per-round overhead in Table 6 and does not affect the layer-selection logic. Concretely, we intend ML-DSA (Dilithium, FIPS 204 (National Institute of Standards and Technology, 2024a)) for classical-channel authentication: at the ML-DSA-65 level the public key is 1952 bytes and a signature 3293 bytes, with signing and verification each below a millisecond on commodity hardware. This cost is additive per handshake and amortized over the re-keying interval ρ, enlarging the handshake payload (Table 9) by a fixed amount without changing the per-round asymptotic complexity or the switching logic; lighter alternatives (Falcon for smaller signatures, SPHINCS + for conservative security) trade signature size against speed. Third, the key lifecycle: derived keys feed an AES-256-GCM data channel, and the re-keying interval ρ sets the amount of traffic protected under any single key, so the trust-driven shortening of ρ directly bounds the exposure of a compromised key. Together these make the framework a drop-in key-management layer beneath an existing secure-channel stack rather than a replacement for it.

4.14 Relation to the network-intelligence layer

The trust signal consumed here is the same reputation score generated by the companion network-layer mechanism that performs predictive self-healing and federated intrusion detection. In a combined deployment, that layer keeps the network alive and produces per-node trust; this layer consumes the trust to keep the keys quantum-safe and available. The two therefore form a single trust-aware stack spanning the network and cryptographic layers, with the reputation score as the common interface—a node judged untrustworthy by the detector is simultaneously routed around at the network layer and forced onto frequently-refreshed quantum-safe keys at the cryptographic layer.

4.15 Integration with 5G/6G, IoT, and SDN

The framework is a key-management layer beneath an existing secure channel, which eases integration into three settings of interest. In 5G/6G, QKD is being trialled for backhaul and fronthaul protection; the controller fits inside the key-management function that feeds the security anchor, supplying quantum-safe session keys and falling back to PQC when a link is tapped or lost, with the trust signal drawn from the RAN intelligence layer. In IoT, per-device QKD optics are impractical, so QKD terminates at gateways while constrained end nodes use the PQC layer directly (Kyber-512 is feasible on microcontrollers), and the same gateway-level federated IDS that protects the fabric supplies the trust score. In software-defined networking, the layer-selection and re-keying policy map naturally onto the control plane: the controller can run as a control application that distributes trust, sets per-flow ( θ , ρ ) policy, and programmes re-keying, turning the tunable operating point into a network-wide, centrally-managed policy. The main practical challenges—provisioning QKD hardware, distributing the post-quantum authentication trust anchor, and synchronizing trust updates with key lifecycles—are common to all three and are engineering rather than architectural, since the controller itself is lightweight and protocol-agnostic.

4.16 Generality across QKD protocols

The controller consumes only two quantities from the quantum layer: an estimate of the QBER (equivalently, the secure-key-rate) and the abort threshold. Any QKD protocol that exposes these fits behind the same controller with no change to the trust logic, the fallback rule, or the availability guarantee; only the physical layer and its rate/threshold estimation change. Table 13 summarizes the modifications for representative protocols. Decoy-state BB84 adds decoy intensities and revises rate estimation but reports the same QBER; E91 derives the error rate from entanglement correlations and can additionally use a CHSH violation as a tamper signal; measurement-device-independent QKD moves detection to an untrusted relay, removing detector side-channels while still yielding a QBER; and twin-field QKD extends range with a shared phase reference at the cost of a different rate-distance law. In every case the controller and trust-driven policy are unchanged, so the framework is agnostic to the primary QKD protocol.

TABLE 13. Generalization to other QKD protocols. The controller and trust policy are unchanged; only the physical layer and rate/threshold estimation differ.

5 Conclusion and future work

We presented a dual-layer, trust-aware key-management framework that uses BB84 QKD as the primary key source and a Ring-LWE/Kyber KEM as a quantum-safe fallback, with a controller that switches layers and adapts the re-keying rate from the QBER and a node trust score. The framework keeps secure availability at 100 % under eavesdropping where QKD-only degrades to 78.5 %, at a fallback cost of ≈ 0.47ms per KEM operation, and provides up to 192-bit quantum-safe security with Kyber-768. By driving the fallback and re-keying decisions from a trust signal, the framework unifies physical-layer and computational security and connects to the network-layer trust source that produces that signal. Future work will incorporate finite-key and decoy-state analysis, evaluate measurement-device-independent QKD as the primary layer, and integrate authenticated-channel and signature costs for an end-to-end quantum-safe stack.

Several extensions follow naturally. A finite-key security analysis would replace the asymptotic rate of Equation 3 with composable bounds at realistic block lengths, tightening the distance and availability figures. Substituting a measurement-device-independent or twin-field primary layer would extend reach and remove detector side-channels while leaving the controller and trust logic untouched, since the controller depends only on the QBER estimate and the trust score. On the systems side, a hardware-in-the-loop evaluation with an optimized Kyber implementation and a post-quantum signature on the classical channel would yield end-to-end latency and energy figures for a complete deployment. Finally, jointly optimizing the network-layer trust dynamics and the cryptographic-layer re-keying policy—rather than treating the trust score as an external input—could close the loop between the two layers of the trust-aware stack, adapting both routing and key management to a shared, evolving estimate of node reliability.

Generative AI statement

The author(s) declared that generative AI was used in the creation of this manuscript. The authors used a generative AI assistant (Anthropic Claude) to help develop and debug the simulation code, draft and edit portions of the manuscript, and prepare figures and LATEX formatting. The authors reviewed and verified all content and take full responsibility for the methodology, results, and conclusions reported in this manuscript.

Any alternative text (alt text) provided alongside figures in this article has been generated by Frontiers with the support of artificial intelligence and reasonable efforts have been made to ensure accuracy, including review by the authors wherever possible. If you identify any issues, please contact us.

Publisher’s note

All claims expressed in this article are solely those of the authors and do not necessarily represent those of their affiliated organizations, or those of the publisher, the editors and the reviewers. Any product that may be evaluated in this article, or claim that may be made by its manufacturer, is not guaranteed or endorsed by the publisher.

Footnotes

Edited by: Zimran Rafique, Higher Colleges of Technology, United Arab Emirates

Reviewed by: Jeyasheela Rakkini Simon, SASTRA University, India

Abdallah Handoura, Muscat University, Oman