What is Quantum Key Distribution? How can indigenous quantum-secure networks strengthen India's critical information infrastructure?

The IT Act, 2000 defines Critical Information Infrastructure (CII) as a computer resource whose destruction would have a debilitating impact on national security [1]. Future quantum computers could break today's encryption. CII therefore needs quantum-secure networks, and India should build them itself rather than import them.

Quantum Key Distribution (QKD)

• QKD is a way of sharing encryption keys using single photons (particles of light). Its security comes from quantum physics, not from a hard maths problem.
• Measuring a photon disturbs its quantum state. Any eavesdropping therefore shows up as errors, and the key is thrown away.
• This counters the "harvest now, decrypt later" threat, where data stolen today is decrypted once quantum computers are powerful enough.

Sender ──photons (fibre / free-space)──► Receiver
            ▲
     Eavesdropper measures → error rate rises → key discarded

Fig: How QKD detects interception

How indigenous networks strengthen CII

• Defence: QNu Labs supplied 25 QKD systems to the Indian Navy in 2024 [2]. It also ran a 500 km QKD trial with the Army's Southern Command in Rajasthan [3].
• Works on existing infrastructure: The 500 km network ran on existing optical fibre, so the current telecom backbone can be upgraded without laying new cable [3]. The National Quantum Mission (NQM) reached a 1,000 km milestone using indigenous technology meant for defence, financial systems and critical infrastructure [4].
• Trusted supply chain: Key parts are made in India: single-photon detectors, encryptors, a quantum hardware security module (QHSM) and a QKD controller [2]. This reduces the risk of backdoors in imported cryptographic hardware.
• National scale: The NQM has an outlay of ₹6,003.65 crore for 2023-24 to 2030-31. It targets 2,000 km of inter-city QKD and satellite-based QKD [5], which can reach border and remote areas.
• Institutional fit: NCIIPC is the nodal agency for CII under Section 70A of the IT Act [6]. It can build quantum-secure links into sector protection standards for banking, power grids and telecom.

Gaps to close

• QKD protects fixed links, not every phone or app. DST's Task Force therefore recommends hybrid Post-Quantum Cryptography (PQC) + QKD [7].
• Buyers need proof that a product is safe. A TEC-led sub-group is drafting a framework for testing and certifying quantum-safe products [7].

QKD makes physics the guarantee of security, and indigenous networks give India both the technology and control over it. The way forward is to pair QKD with a national PQC migration, put certification into practice, and have sector regulators set deadlines for switching. This would give India sovereign, resilient digital infrastructure, in line with Atmanirbhar Bharat and SDG 9.