Beyond the Quantum Promise: A Security Analysis of Classical Control in Quantum Key Distribution

The Quantum–Classical Boundary

QKD is inherently hybrid: a quantum phase establishes raw key material, and a classical phase executes sifting, error estimation, error correction, and privacy amplification. ETSI and ITU-T specifications standardize architectures and interfaces, yet security arguments frequently treat the layers in isolation rather than as one integrated protocol. Cross-layer attack patterns, such as replayed basis reconciliation and deferred sifting, exemplify the threat class that a strictly quantum or strictly classical model cannot capture.

Both QKD families share the same shape: quantum exchange, then classical sifting, parameter estimation, reconciliation, and privacy amplification. In PM QKD, Alice prepares qubits from random bits and bases and Bob measures in random bases; the standards leave the order of basis announcement underspecified. In EB QKD, an untrusted source distributes entangled pairs, and CHSH tests over mismatched-basis outcomes certify that correlations really came from shared entanglement. Timing and synchronization between the parties are therefore security-relevant.

Methodology

We interpret 23 ETSI and ITU-T documents to extract procedures, variants, and underspecified choices, and build symbolic protocol models that tie classical messages to quantum observations for both PM and EB QKD. Probabilistic quantum operations are abstracted as symbolic functions, uninterpreted terms whose algebraic properties preserve the causal dependency between quantum measurements and classical post-processing without Hilbert-space semantics:

measure(q_A, b_Eve) := k_A^raw   ⇔   EveKnows(b_A) ∧ b_Eve = b_A

The threat model is Eve⁺, a quantum Dolev–Yao adversary: she can store, measure, and inject qubits on the quantum channel and drop, modify, or inject messages on the classical channel, but cannot forge authenticated messages or clone unknown qubits. Linear (non-persistent) state enforces no-cloning: measuring or forwarding a stored qubit deletes it from her knowledge.

From one m4 template we instantiate nine target models (EB and PM, basis order A2B or B2A, reconciliation TWEC, REC, or FEC) and check each against secrecy and agreement lemmas with the Tamarin Prover.

Results: Verification under Eve⁺

Across the nine configurations, verification exposes three classes of specification-level gaps (timing, ordering, and role direction) that break secrecy or authentication. ✓ = verified, ✗ = falsified; superscripts attribute each falsification to a vulnerability.

Table 1(a). EB-QKD verification under Eve⁺ across error-reconciliation configurations.

Table 1(b). PM-QKD verification under Eve⁺ across basis-announcement (A2B, B2A) and reconciliation (TWEC, REC, FEC) configurations.

¹ V1 subverted entanglement injection · ² V2 basis-deferred measurement · ³ V3 message reflection

V1: Subverted Entanglement Injection

EB QKD has no native mechanism to verify that both parties receive qubits at consistent timestamps. Synchronization depends on classical control signals that are vulnerable to time-shift manipulation. Eve⁺ exploits this by controlling the entanglement source: she keeps one branch of each pair, sends the other to Bob, reads Bob’s basis announcement, measures her retained qubits in matching bases, and re-encodes a fresh qubit stream for Alice. The sampled strings stay statistically consistent, CHSH checks pass, and the classical post-processing Eve⁺ replays on her own raw string yields the final session key, recovered undetected.

V2: Basis-Deferred Measurement

PM specifications leave the ordering of basis announcement to the implementation. Under the A2B ordering (Alice announces her basis before Bob measures), Eve⁺ buffers the qubit stream, waits for Alice’s announcement, measures in the correct basis, and forwards re-encoded qubits to Bob. No cloning is attempted, parameter estimation sees no extra errors, and Eve⁺ derives the final key. Every A2B configuration in Table 1(b) falsifies key secrecy. The protocol’s security therefore depends on an ordering the standards do not enforce.

V3: Message Reflection

QKD standards mandate MAC authentication for classical post-processing but do not require role, direction, or session binding in the MAC input. Eve⁺ can therefore reflect a valid MAC-tagged message back to its originator, who accepts it: the party completes a session effectively talking to itself while believing it talks to its peer. This breaks every agreement property in Table 1 marked ✗³, and in some configurations key secrecy as well.

Results: Validation in Simulation

V2 and V3 are purely classical control failures, and their counterexamples need no quantum layer. V1 is different: it is a quantum-side maneuver enabled by a classical timing gap. To test whether V1 would evade detection in a realistic setting, we simulate honest and adversarial EB sessions in Qiskit Aer (240 Bell pairs per circuit, 120 shots, four random-basis trials; depolarizing noise on the honest baseline) and compare relative CHSH violation error against a 10% detection threshold.

Standard CHSH-based parameter estimation cannot detect sessions compromised through adversarial alignment of forwarded quantum states.

Countermeasures

Two specification additions close all three gaps without modifying any quantum subroutine:

• CM1: Measurement commitment. After measuring, both participants transmit a MAC-protected commitment before any basis is announced, eliminating the timing window behind V1 and V2.
• CM2: Identity-bound MAC. MAC computations must include explicit sender and receiver identities, role metadata, and session context (mac_pskAB(Sender_id, Receiver_id, session_t, data)), so reflected or replayed messages can no longer verify, fixing V3.

With CM1 and CM2 in place, all nine Eve⁺ target models verify every secrecy and agreement lemma.

Disclosure and Impact

Between March and May 2025 we shared these results with ITU-T contributors and the ETSI ISG-QKD community. ITU-T acknowledged the gaps and pointed to ongoing ETSI formal-methods activity; industry partners including Qunnect are evaluating integration of lemma-level checks into their engineering workflows via QVerify. QKD security is not settled at the quantum layer alone: classical ordering, authentication binding, and timing assumptions need the same scrutiny as the optical channel.

Artifact

QVerify packages everything needed to reproduce the analysis: the unified Tamarin theories, the m4 template and its nine instantiations, batch verification scripts with HTML proof summaries, counterexample trace exports, and the Qiskit simulation package behind the validation experiments.

BibTeX

@inproceedings{malik2026beyond,
  author    = {Malik, Ali Hamza and Anwar, Raja Hasnain and Raza, Muhammad Taqi},
  title     = {Beyond the Quantum Promise: A Security Analysis of Classical
               Control in Quantum Key Distribution},
  booktitle = {2026 IEEE International Conference on Quantum Computing and
               Engineering (QCE)},
  year      = {2026},
  note      = {To appear},
}