Quantum Keys Move Onto Production Routers

Quantum Keys Move Onto Production Routers

I co-led the telecommunications curriculum for Verizon's Next Step New England program and directed National Science Foundation, or NSF, funded Centers of Excellence at Springfield Technical Community College and the University of Central Florida through the transition from my Dad's Plain Old Telephone Service, or POTS, landlines to Internet Protocol, or IP, based voice, video, and data over copper, fiber and wireless. Our center worked closely with Cisco through that transition. The physics and the protocols changed rapidly snd it was a wild ride. What made the transition real was not the standards documents. It was carriers running the new transport on switches and routers in the central office, and technicians who did not need an advanced degree to keep it running.

Quantum key distribution, or QKD, is a way to generate an encryption key using the behavior of individual photons instead of math. Two machines exchange specially prepared light particles over fiber. If anyone taps the line and looks at those particles, the particles change in a way both ends can detect. That gives you a key exchange where eavesdropping does not stay hidden, which is a different from anything conventional encryption offers.

Aliro Technologies, the Vienna based quantum networking firm zerothird, and Cisco just ran a live version of this over Cisco's production routers at Cisco's Photonics Center in Vimercate, Italy. The hardware was Cisco's 8000 Series routers, the same platform Cisco sells into data centers today. That detail is the news. QKD has existed in labs for years. Running it on hardware a customer can already buy is the harder problem.

The system runs on the BBM92 protocol, which uses paired entangled photons rather than a transmitted key to establish a shared secret. Entangled photons are pairs of light particles created together so that measuring one instantly tells you something about the other, no matter the distance between them. A source creates these pairs and sends one photon from each pair to each end of the link. Both ends measure what arrives and use those measurements to build an identical key, without the key itself ever traveling across the fiber. zerothird supplies the hardware that does this: the photon source, the equipment that keeps the light polarized correctly, synchronizing clocks, and the software that cleans up errors and strengthens the final key. Aliro's Orchestrator software sits on top and manages the link, the way network management software already watches a conventional router. It tracks error rates and photon counts in real time and can reroute traffic or shut a link down safely if something looks wrong. The finished keys reach the routers through Cisco's Secure Key Integration Protocol, a standard interface, where they secure encrypted sessions between routers the same way a conventional key would, just generated a different way.

Diagram Gemini AI Generated

Chapter 1 of Quantum from the Ground Up covers the fiber problem in quantum networking through the University of Illinois work on ytterbium-171 emitters built for existing telecom infrastructure. That chapter is about getting a quantum signal onto fiber that already exists. This deployment answers the other half of the problem: getting the output of that signal into a router that already exists, with the monitoring and failover a network operations center can actually run day to day.

Chapter 14 frames quantum security as a race between two approaches. Post quantum cryptography, or PQC, keeps using math for encryption, just math that a quantum computer cannot easily break, and the National Institute of Standards and Technology, or NIST, has already published standards for it. QKD, the approach in this demonstration, does not rely on hard math at all. It relies on physics: any attempt to intercept the entangled photons changes them in a way both ends can detect. That is also its limit. A QKD key only protects the specific fiber link between two endpoints, while PQC can protect data anywhere the software runs. That is why Cisco is running both approaches rather than picking one. AT&T's coming quantum resilient Software-Defined Wide Area Network, or SD-WAN, service runs PQC on that same 8000 Series router line, which puts both approaches on the same hardware within the same product family.

The public announcement described the deployment as moving QKD out of isolated research setups and into standard enterprise infrastructure. Coverage of the announcement also framed the three way pairing as proof that quantum networking gear from separate vendors can interoperate in a live deployment, which matters more for enterprise adoption than any single performance number. A separate technical paper from the zerothird team tested the same entanglement based approach over a 22 kilometer fiber link between two data centers, which gives the enterprise demonstration a research paper trail worth reading alongside the press coverage.

What This Changes in the Book

Chapter 1 currently ends at the physics of getting quantum signals onto standard fiber. This deployment extends that story into the network operations layer: orchestration, telemetry, and automated remediation running on hardware already shipping. Chapter 14's framing of PQC and QKD as separate paths still holds, but the AT&T and Cisco pairing on the same 8000 Series router line is worth adding as a concrete case where one operator runs both approaches at once instead of choosing sides.

This post will fold into the next edition of the book, due September 1. The current edition is at gordostuff.com/p/quantum-from-ground-up-hardware.html.

POTS to IP took a decade of this kind of work: new transport riding on racked equipment. Quantum key distribution is passing the same tesst. The obstacle was never the physics. Here it's whether the keys can ride on a router Cisco already sells, watched by software a network operations center knows how to run.