Sentinel-Based Failover for QKD-Augmented IPsec Tunnels

• URL: http://arxiv.org/abs/2609.01121v1
• Date: Tue, 01 Sep 2026 11:59:13 GMT
• Title: Sentinel-Based Failover for QKD-Augmented IPsec Tunnels
• Abstract summary: tunnel that combines X25519, ML-KEM, and ETSI GS QKD 014 keys through the RFC 9370 multiple key exchange mechanism.<n>Our open-source StrongSwan plugin uses a sentinel-based coordination protocol.<n> tunnel survives a complete KME outage without any interruption of the protected traffic.
• Score: 30.508117880183832
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: Quantum-safe IPsec through hybrid key establishment is practical, but creates a critical operational challenge: how to maintain tunnel availability when the QKD infrastructure becomes unavailable. In this paper, we present the design, implementation, and experimental evaluation of a quantum-safe key establishment mechanism for an IPsec tunnel that combines X25519, ML-KEM, and ETSI GS QKD 014 keys through the RFC 9370 multiple key exchange mechanism, and that degrades gracefully when the QKD key delivery fails. Our open-source StrongSwan plugin uses a sentinel-based coordination protocol, thereby permitting us to complete the handshake even if the QKD leg fails, instead of aborting, restoring the QKD share at the next rekey. On a testbed connected to a metropolitan QKD link over 33 km of deployed fiber, we evaluated five configurations, from a classical X25519 with RSA baseline to a hybrid one that adds ML-KEM-1024 and a QKD key. The full hybrid authentication costs 103 ms against 61 ms for the baseline, the QKD retrieval itself adds only about 7 ms. Failure injection experiments confirm that the tunnel survives a complete KME outage without any interruption of the protected traffic.

Related papers

• Deploying and validating a metropolitan QKD secure network: architecture and field performance [76.02413102965598]
  Quantum Key Distribution provides information-theoretic security for key establishment.<n>A metropolitan-scale quantum-secure network between data centers in Milan is reported.<n>Results establish the technical and operational readiness of metropolitan QKD networks for production deployment.
  arXiv  Detail & Related papers  (2026-07-13T15:51:26Z)
• GHz-rate polarization-based QKD system for fiber and satellite applications [0.0]
  We present a 1550 nm QKD system realizing the efficient-BB84 protocol and based on the iPOGNAC scheme.<n>The system achieved repetition rates up to 1.5GHz and showed an intrinsic QBER of $sim 0.4%$.<n>Results demonstrate the system's suitability for highly lossy and time-constrained scenarios such as QKD from low Earth orbit satellites.
  arXiv  Detail & Related papers  (2026-02-09T17:08:59Z)
• Experimental Side-Channel-Secure Quantum Key Distribution over 200 km [18.189225381709278]
  Quantum key distribution enables two remote parties to share encryption keys with information-theoretic security based on physical laws.<n>Side-channel-secure quantum key distribution (SCS-QKD) has attracted considerable attention due to its immunity to both source and detector side-channel attacks.<n>We experimentally implement the practical SCS-QKD protocol using an imperfect whole-space source.<n>This allows us to extend the transmission distance to 200 km using fiber spools, achieving a secure key rate of 1.29E-7 bits per pulse while accounting for finite-key effects.
  arXiv  Detail & Related papers  (2025-05-06T13:36:24Z)
• Hybrid Implementation for Untrusted-node-based Quantum Key Distribution Network [16.242325482656927]
  Quantum key distribution (QKD) serves as a cornerstone of secure quantum communication.<n>We present a hybrid system that seamlessly integrates TF-QKD and MDI-QKD into one untrusted-node-based architecture.<n> Experiments demonstrate secure finite-size key rates for sending-or-not-sending QKD and MDI-QKD over fiber distances of 150 to 431 km.
  arXiv  Detail & Related papers  (2025-03-07T02:27:41Z)
• High-Fidelity Coherent-One-Way QKD Simulation Framework for 6G Networks: Bridging Theory and Reality [105.73011353120471]
  Quantum key distribution (QKD) has been emerged as a promising solution for guaranteeing information-theoretic security.<n>Due to the considerable high-cost of QKD equipment, a lack of QKD communication system design tools is challenging.<n>This paper introduces a QKD communication system design tool.
  arXiv  Detail & Related papers  (2025-01-21T11:03:59Z)
• Practical hybrid PQC-QKD protocols with enhanced security and performance [44.8840598334124]
  We develop hybrid protocols by which QKD and PQC inter-operate within a joint quantum-classical network. In particular, we consider different hybrid designs that may offer enhanced speed and/or security over the individual performance of either approach.
  arXiv  Detail & Related papers  (2024-11-02T00:02:01Z)
• Metropolitan quantum key distribution using a GaN-based room-temperature telecommunication single-photon source [54.32714639668751]
  Single-photon sources (SPS) hold the potential to enhance the performance of quantum key distribution (QKD) We have successfully demonstrated QKD using a room-temperature SPS at telecommunication wavelength.
  arXiv  Detail & Related papers  (2024-09-27T07:35:51Z)
• Long-distance continuous-variable quantum key distribution over 100 km fiber with local local oscillator [0.6524460254566905]
  Quantum key distribution (QKD) enables two remote parties to share encryption keys with security based on the laws of physics. Here, we report a long-distance CV-QKD experiment with a locally generated local oscillator over a 100 km fiber channel with a total loss of 15.4 dB. This record-breaking distance is achieved by controlling the phase-noise-induced excess noise through a machine-learning framework for carrier recovery and optimizing the modulation variance.
  arXiv  Detail & Related papers  (2023-05-14T13:34:20Z)
• Quantum Key Distribution Using a Quantum Emitter in Hexagonal Boron Nitride [48.97025221755422]
  We demonstrate a room temperature, discrete-variable quantum key distribution system using a bright single photon source in hexagonal-boron nitride. We have generated keys with one million bits length, and demonstrated a secret key of approximately 70,000 bits, at a quantum bit error rate of 6%. Our work demonstrates the first proof of concept finite-key BB84 QKD system realised with hBN defects.
  arXiv  Detail & Related papers  (2023-02-13T09:38:51Z)
• Single-emitter quantum key distribution over 175 km of fiber with optimised finite key rates [45.82374977939355]
  We perform fibre-based quantum key distribution with a quantum dot frequency-converted to telecom wavelength. We demonstrate positive key rates up to 175 km in the regime. This result represents major progress towards the feasibility of long-distance single-emitter QKD networks.
  arXiv  Detail & Related papers  (2022-09-07T18:03:36Z)
• Field Test of Twin-Field Quantum Key Distribution through Sending-or-Not-Sending over 428 km [15.390492764316264]
  Twin-field quantum key distribution (TF-QKD) has attracted considerable attention because of its outstanding key rates over long distances. Here, we demonstrate a field-test QKD over 428km deployed commercial fiber and two users are physically separated by about 300km in a straight line. We achieve a new distance record for the field test of both TF-QKD and all types of fiber-based QKD systems.
  arXiv  Detail & Related papers  (2021-01-01T17:35:59Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.