Quantum key distribution (QKD) networks require relaying when distant key management entities share no direct quantum link. Most relay strategies, however, rely on centralized control or globally maintained routing state. This paper asks whether useful security and efficiency can still be obtained with topology-oblivious stochastic forwarding. It studies the security-overhead trade-off in a model in which fragmented key material is relayed via random-walk variants and reconstructed under privacy amplification. The analysis asks whether strictly local forwarding can retain useful information-theoretic security (ITS). Evaluation on the GÉANT topology, representing a European academic backbone network, shows clear differences between random-walk variants. The proposed highest-score-neighbor local path-diversification heuristic reduces the probability that relayed key material passes through a compromised node. The evaluation also shows that scouting-based loop erasure significantly shortens sampled routes and improves throughput in the model. Against one- to three-node cartels, random flow protects slightly more source–target pairs than a static disjoint-multipath method on the evaluated topologies. These findings position topology-oblivious stochastic forwarding as a simpler decentralized design for QKD relaying without centralized orchestration or gossip protocols.

Quantum Key Distribution (QKD) is a process to establish a symmetric key between two parties using the principles of quantum mechanics. Currently, commercial QKD systems are still expensive, they require specific infrastructure, and they are impractical for deployment in portable or resource-constrained devices. In this article, we introduce the Butterfly Protocol (and its extended version) that enables QKD to be offered as a service to non-QKD-capable (portable or IoT) devices. Our key contributions include (1) resilience to the compromise of any single classical link, (2) protection against malicious QKD users, (3) implicit mutual authentication between users without relying on large post-quantum certificates, and (4) the Double Butterfly extension, which secures communication even when the underlying QKD network cannot be fully trusted. We also demonstrate how to integrate the Butterfly Protocol into TLS 1.3 and provide its initial security analysis. We present preliminary performance results and discuss the main bottlenecks in the Butterfly Protocol implementation. We believe that our solution represents a practical step toward integrating QKD into classical networks and extending its use to portable devices.

Quantum key distribution (QKD) networks require relaying when distant key management entities share no direct quantum link. Most relay strategies, however, rely on centralized control or globally maintained routing state. This paper asks whether useful security and efficiency can still be obtained with topology-oblivious stochastic forwarding. It studies the security-overhead trade-off in a model in which fragmented key material is relayed via random-walk variants and reconstructed under privacy amplification. Under a restricted model with at most one compromised relay, the analysis asks whether strictly local forwarding can retain useful information-theoretic security. Evaluation on the GÉANT topology, representing a European academic backbone network, shows clear differences between random-walk variants. The proposed highest-score-neighbor local path-diversification heuristic reduces the risk that relayed key material passes through a compromised node. The evaluation also shows that a preliminary loop-erasure step significantly shortens sampled routes and improves throughput in the model. These findings position topology-oblivious stochastic forwarding as a decentralized alternative to global-state maintenance or centralized orchestration in QKD networks.

The random number generation capabilities of the GNU/Linux operating system are subject to certain limitations. As of Linux version 5.6, /dev/random operates in a non-blocking manner and, as such, no longer satisfies the criteria for a True Random Number Generator (TRNG). While dedicated quantum random number generator (QRNG) hardware is the preferred source of unpredictable entropy, it is often expensive and difficult to deploy in virtualized/cloud environments and Internet of Things (IoT) devices. Furthermore, hardware RNG integration typically requires cryptographic applications to adhere to vendor-specific APIs. This article proposes a user-space integration approach for a shared , potentially remote QRNG device. We develop a QRNG service on top of D-Bus, a ubiquitous inter-process communication framework. It serves as an interface for applications to retrieve true random numbers. Communication with the remote QRNG device occurs over mutually authenticated TLS 1.3 channels, protected by post-quantum cryptography (PQC) algorithms. We show, as a proof-of-concept, how the proposed D-Bus service can be integrated into the OpenSSL 3 cryptographic library, demonstrating the use of TRNG in a wide range of Linux applications. Our approach is resistant to entropy starvation attacks, supports sharing a QRNG across host and virtualized environments, requires no kernel-level or system-wide modifications, supports mixing multiple sources of entropy, and configuration of post-processing. It provides applications with a TRNG interface suitable for information-theoretically secure (ITS) use cases.