A scalable quantum-safe authentication framework for multi-site QKD networks using post-quantum cryptography

Quantum Key Distribution (QKD) offers information-theoretic security for key exchange; however, its effective implementation is contingent upon the security of the classical communication channel, especially for authentication purposes. This work presents a system-level study of quantum-safe authentication for the classical channel in multi-site QKD networks, comparing two post-quantum cryptographic (PQC) approaches within a unified evaluation framework: one based on lattice-based digital signatures, and one based on message authentication codes (MACs) bootstrapped by PQC key establishment. We develop a multi-site network model to analyze the scalability and deployment limitations of traditional pre-shared key methods. The framework is evaluated using both simulations and hardware-based experiments, considering communication cost, computational overhead, and the impact on the key generation rate. The results show that signature-based authentication offers stateless per-message verification at a higher per-block cost, while MAC-based authentication is better suited to high-throughput environments, both at the same linear onboarding cost. The study quantifies the trade-offs between security, scalability, and performance, and provides practical guidance for deploying quantum-safe authentication in real-world QKD systems.