Hybrid QKD & PQC Protocols implemented in the Berlin OpenQKD testbed

This paper introduces several hybrid protocols based on Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) implemented in the OpenQKD testbed Berlin to improve the security of the QKD nodes. Instead of following the ETSI QKD014 standard of a key management system based on classical security, i.e., RSA authentication and ECC encryption, we implemented a quantum-secure Key Management System based on PQC Key Encapsulation and Signature algorithms. The hardware and the software components of the QKD network authenticate themselves using a PQC trust chain and Pre-Shared Secrets, wherever supported. The communication between QKD nodes, as for the encryption key forwarding process, is hardened by Post-Quantum Cryptography to prevent cryptographic key exposure on intermediate network nodes. Using the two implemented key exchange processes, based on QKD and PQC, applications are able to request any kind of encryption key from the Key Management System and combine them arbitrarily to compute more reliable cryptographic keys.