Quantum-safe dual-link architecture with PQC-based authentication and CV-QKD

This work presents a dual-link hybrid cryptographic architecture combining post-quantum cryptography (PQC) with Quantum Key Distribution (QKD) for secure classical channel authentication and key establishment. The first link targets resource-constrained aerial or mobile scenarios, using ASCON-80pq for authentication with session keys established via ML-KEM-768. A proof-of-concept free-space implementation demonstrates the feasibility of this lightweight solution. The second link focuses on terrestrial fiber networks, employing ContinuousVariable QKD (CV-QKD) for key distribution, Kyber-based authentication, and AES-256-GCM encryption within a TLS context. Designed under composable security principles, the architecture supports integration into dynamic network environments such as SDN and multi-tenant infrastructures. Experimental results highlight key performance indicators including energy consumption, authentication latency, and resilience to attacks. The work demonstrates the practicality of hybrid PQC–QKD systems for civilian and defense use, advancing readiness of dual-use quantum-safe communications.