Beyond the Quantum Promise: A Security Analysis of Classical Control in Quantum Key Distribution

Quantum Physics arXiv:2608.07626 (quant-ph) [Submitted on 7 Aug 2026] Title:Beyond the Quantum Promise: A Security Analysis of Classical Control in Quantum Key Distribution Authors:Ali Hamza Malik, Raja Hasnain Anwar, Muhammad Taqi Raza View a PDF of the paper titled Beyond the Quantum Promise: A Security Analysis of Classical Control in Quantum Key Distribution, by Ali Hamza Malik and 2 other authors View PDF HTML (experimental) Abstract:Quantum Key Distribution (QKD) protocols provide information-theoretic security by using quantum mechanical principles. Yet QKD is fundamentally a hybrid protocol: its security depends on the correct integration of the quantum phase with classical post-processing. While ETSI and ITUT specifications standardize QKD architectures and interfaces, they evaluate protocol security in isolation, leaving cross-layer interactions as an underexplored attack surface. This paper introduces a formal verification framework that holistically models QKD protocols based on ETSI and ITUT QKD specifications. Our model is the first hybrid QKD protocol model that supports automated analysis of protocollevel security focusing on how classical operations influence the security guarantees provided by the quantum phase of the QKD protocol. We formalize a comprehensive symbolic model of QKD protocols, based on ETSI and ITU-T QKD specifications, in Tamarin, an automated protocol verifier. Applying this framework, we obtain formal evidence of three specification-level vulnerabilities in ETSI- and ITU-T-grounded protocol models under adversary Eve+: subverted entanglement injection, basis-deferred measurement, and message reflection. Each arises from a classical control-plane omission in the procedure text and is established under a symbolic abstraction rather than as a claim about all practical deployments. We introduce two protocol improvements: measurement commitment and identitybound message authentication codes (MACs). Tamarin verification confirms that these countermeasures eliminate the identified vulnerabilities under Eve+. We have communicated our results and recommendations to relevant standardization organizations. Subjects: Quantum Physics (quant-ph); Cryptography and Security (cs.CR); Symbolic Computation (cs.SC) MSC classes: 81P10, 68Q60, 68M25 Cite as: arXiv:2608.07626 [quant-ph] (or arXiv:2608.07626v1 [quant-ph] for this version) https://doi.org/10.48550/arXiv.2608.07626 Focus to learn more arXiv-issued DOI via DataCite (pending registration) Submission history From: Ali Hamza Malik [view email] [v1] Fri, 7 Aug 2026 10:18:05 UTC (861 KB) Full-text links: Access Paper: View a PDF of the paper titled Beyond the Quantum Promise: A Security Analysis of Classical Control in Quantum Key Distribution, by Ali Hamza Malik and 2 other authorsView PDFHTML (experimental)TeX Source view license Current browse context: quant-ph new | recent | 2026-08 Change to browse by: cs cs.CR cs.SC References & Citations INSPIRE HEP NASA ADSGoogle Scholar Semantic Scholar export BibTeX citation Loading... BibTeX formatted citation × loading... Data provided by: Bookmark Bibliographic Tools Bibliographic and Citation Tools Bibliographic Explorer Toggle Bibliographic Explorer (What is the Explorer?) Connected Papers Toggle Connected Papers (What is Connected Papers?) Litmaps Toggle Litmaps (What is Litmaps?) scite.ai Toggle scite Smart Citations (What are Smart Citations?) Code, Data, Media Code, Data and Media Associated with this Article alphaXiv Toggle alphaXiv (What is alphaXiv?) Links to Code Toggle CatalyzeX Code Finder for Papers (What is CatalyzeX?) DagsHub Toggle DagsHub (What is DagsHub?) GotitPub Toggle Gotit.pub (What is GotitPub?) Huggingface Toggle Hugging Face (What is Huggingface?) ScienceCast Toggle ScienceCast (What is ScienceCast?) Demos Demos Replicate Toggle Replicate (What is Replicate?) Spaces Toggle Hugging Face Spaces (What is Spaces?) Spaces Toggle TXYZ.AI (What is TXYZ.AI?) Related Papers Recommenders and Search Tools Link to Influence Flower Influence Flower (What are Influence Flowers?) Core recommender toggle CORE Recommender (What is CORE?) Author Venue Institution Topic About arXivLabs arXivLabs: experimental projects with community collaborators arXivLabs is a framework that allows collaborators to develop and share new arXiv features directly on our website. Both individuals and organizations that work with arXivLabs have embraced and accepted our values of openness, community, excellence, and user data privacy. arXiv is committed to these values and only works with partners that adhere to them. Have an idea for a project that will add value for arXiv's community? Learn more about arXivLabs. Which authors of this paper are endorsers? | Disable MathJax (What is MathJax?)