Sorbonne and Edinburgh Authenticate Entanglement-Based QKD With a Hybrid Entangled Physical Unclonable Function and No Pre-Shared Key, Accepted by Physical Review Research, 1 November 2026: TRL 3
Quentir Defense Monitor
Evidence-based insights for quantum defense and security. Published by Quentir Systems LLC · November 4, 2026.
Four researchers at Sorbonne Université and the University of Edinburgh have run an entanglement-based quantum key distribution protocol in which the two parties held no shared secret before the session began. Nicolas Laurent-Puig, Mina Doosti, Adriano Innocenzi and Eleni Diamanti had the result accepted by Physical Review Research on 1 November 2026, after a preprint of 6 May 2026 and a contributed talk at QCrypt 2026 in Ottawa in August. That date records acceptance, not publication of the version of record. The authentication every QKD session needs came from a hybrid entangled physical unclonable function, a device whose manufacturing disorder answers challenges in a way no copy can reproduce, with each answer encoded into one of two Bell states that an eavesdropper holding a single photon cannot tell apart. The experiment ran at telecom wavelength over 50 dB of simulated channel loss, held the quantum bit error rate below 0.6 percent, and spent 237 bits of the initial key on authentication per session in the general case.
The missing pre-shared key is the objection national security agencies have raised against QKD for a decade. This post reads the paper as quantum key distribution capability in the networking pillar, defensive in posture, and lists what separates a bench in Paris from a link a signals unit could field.
What the Physical Review Research paper accepted on 1 November 2026 establishes: a Wegman-Carter authentication key grown from a PUF challenge instead of a courier
Every QKD protocol needs an authenticated classical channel, because an adversary who can impersonate Alice to Bob and Bob to Alice runs two separate sessions and reads both keys. Standard practice authenticates that channel with Wegman-Carter message authentication codes, which consume a short key per session, and the first such key has to arrive by courier or be installed at manufacture. The paper replaces that first delivery with a hardware primitive. The hybrid entangled PUF holds a weakly secure classical PUF inside a tamper-proof box together with its encoding and measurement optics. In Mode 0, usable once, the verifier queries the device and builds a classical challenge-response database. The device is then locked into Mode 1 and sent to the prover, where it answers each challenge by evaluating the PUF and emitting an entangled pair in the Bell state Φ+ when the selected response bit is 0 and Ψ− when it is 1. The verifier, who holds the database, measures and checks.
The quantum part does the security work. The two Bell states are locally indistinguishable: either photon on its own is in the maximally mixed state, so a party holding one half learns nothing about which state was sent. The authors bound the failure probability of one round by a function of the PUF bias δ and the number of states m per round; with δ at most 0.1 and m equal to 44 the bound falls below 2.5 times 10 to the minus 11. Across 290 to 351 rounds the device yields an initial key that seeds the basis choices of the QKD subroutine and feeds the Wegman-Carter scheme protecting all later classical post-processing. The information-theoretic security claim permits unbounded channel adversaries during authentication but assumes quantum polynomial-time adversaries during the pre-protocol setup stage, an uncompromised manufacturer and the specified hardware protections. The theory came from Edinburgh, where Doosti introduced the hybrid entangled PUF with Suchetana Goswami and Elham Kashefi in April 2025, and the authors describe the present work as the first experimental realization of hybrid hardware-based authentication.
What the Paris bench shows and what it emulates: a ppKTP Sagnac source, ID Quantique ID281 detectors, 50 dB of attenuator loss, and a permutation-PUF model standing in for the device
The source is type-II spontaneous parametric down-conversion in a 30 millimeter periodically poled KTP crystal inside a Sagnac interferometer, pumped at 775 nanometers and emitting pairs at telecom wavelength. State tomography gave a Bell-state fidelity of 99.17 plus or minus 0.14 percent at a raw pair rate near 300 kilohertz. Detection used ID Quantique ID281 superconducting nanowire detectors, and two Thorlabs variable optical attenuators stood in for the fiber. At the 0.2 decibel per kilometer loss of standard single-mode fiber, 50 dB corresponds to about 250 kilometers, a Quentir conversion that attenuators reproduce only in loss, never in dispersion or polarization drift.
In the general scenario the HEPUF key also hides the measurement bases; at 30, 40 and 50 dB the QBER was 0.56, 0.52 and 0.55 percent with secret key rates of 0.381, 0.310 and 0.270 bits per second, the authentication key being 237 bits in each case. In the efficient scenario the parties announce their bases publicly and rely on the non-local correlations of the pairs; the QBER was 0.45, 0.51 and 0.51 percent and the secret key rate 4.79, 4.28 and 1.19 bits per second, with 270 authentication bits. The rates are low because the state choice in the authentication subroutine ran through a mechanically rotated wave-plate sequence at 1 hertz and the optical switch in the QKD subroutine gave an effective 13 hertz; the authors call these limits of the components used and say gigahertz modulators would remove them. One more substitution matters: the challenge-response pairs of the classical PUF were emulated with a permutation PUF model to build the verifier's database, so the tamper-proof box with a physical PUF inside it has not yet been built.
Quantum pillar: networking (quantum key distribution links). Use posture: defensive. Technology readiness: TRL 3 of 9. For the reader this means a real entangled source and real detectors ran the full authenticated protocol on a laboratory bench, with the PUF emulated in software and the fiber replaced by attenuators, so it is an experimental proof of concept and not yet a laboratory-validated unit.
Why the panel reads networking (quantum key distribution links), defensive and TRL 3
The pillar is networking because the deliverable is a secret key shared across a quantum channel between two nodes, and the sub-branch is quantum key distribution links, which Quentir's capability map defines as terrestrial fiber and free-space key distribution. The posture is defensive. Authentication of a channel is a protective function: it stops an impersonation attack and adds no capability to find, follow or strike anything, and every owner of a quantum link benefits in the same way. The readiness level is 3. The shared ladder places a run on real hardware at that level, and this run used a physical entangled source, physical detectors and the complete protocol stack with finite-size security analysis. It stays below level 4 because the system the protocol describes, a classical PUF sealed in a tamper-proof enclosure with its own optics, was represented by a software model, and because the channel was a pair of attenuators. The funding is European and British: the Quantum Secure Networks Partnership, a European Quantum Flagship project with 42 partners in 14 countries and 25 million euro over three and a half years aimed at the European Quantum Communication Infrastructure, together with the France 2030 PEPR program and the UK Engineering and Physical Sciences Research Council's Integrated Quantum Networks Hub.
What it would let a force do: bring up an authenticated quantum link between two parties who never exchanged a key, and address the NCSC's initial-authentication objection
The NCSC, the UK's national cyber security authority, states the objection plainly in its paper "Quantum networking technologies": "QKD does not provide authentication, nor do any other quantum techniques." It describes QKD with symmetric pre-shared keys for authentication as something that "can work in some controlled environments," and then says such systems lack general applicability because "the distribution and management of these authentication keys makes scaling and managing systems difficult in practice." It expressly does not support QKD in government or military applications, and its objections also include implementation complexity and elevated threats. Addressing initial authentication therefore does not establish NCSC acceptance. The key-management objection describes military key management exactly. Fill devices, key lists and couriers are the cost that keeps symmetric cryptography working in the field, and every node or coalition partner added to a network adds another key to deliver and protect. This lane read the same objection in supervisory form when the UK and Singapore financial authorities restated the NCSC and MAS positions on QKD in October 2026.
What the Paris experiment changes is the object that has to be delivered. Instead of a secret that anyone in the chain of custody could copy, the prover receives a device in Mode 1 whose responses cannot be read out and duplicated, while the verifier keeps the database. A mobile node joining a quantum network, a ship pairing with a shore station or an allied headquarters joining a coalition link could in principle authenticate its first session from device custody alone and run the session key forward from there. The authors note the construction carries over to prepare-and-measure QKD, so the hybrid fiber and free-space links this lane has followed, such as the Tel Aviv channel that carried a quantum key from fiber to open air without a trusted node, could be authenticated the same way. The work was presented as a contributed talk at QCrypt 2026 in Ottawa on 24 to 28 August 2026, one of 32 selected that year, and the journal version carries the DOI 10.1103/9mjz-fddy.
What stands between the paper and a program office relying on it: a physical PUF in a sealed enclosure, custody of the device in transit, gigahertz modulators, real fiber, and an outside security review
Six items separate this result from a requirement a communications program could write. The first is the device itself: a classical PUF with measured bias, sealed with its optics in the tamper-proof enclosure the proof assumes, and a database built from that hardware rather than from a permutation model. The second is custody. The foundation models transfer of the locked device over a potentially insecure channel and adversarial device queries within its setup assumptions. Permanent theft, compromised endpoints and operational revocation remain separate questions, and a program office needs the threat model for a stolen prover and the revocation path that follows. The third is speed: 1 hertz actuation and a 13 hertz switch yield single-digit bits per second, and the information-theoretic security of the construction has to survive the move to the gigahertz modulators commercial QKD already uses. The fourth is a real channel, with the polarization drift and dispersion that deployed fiber and free-space paths add. The fifth is the PUF model: the bound rests on a bias of at most 0.1 per device, so each unit needs characterization and a supply chain that can attest to it. The sixth is review by someone other than the authors. The NCSC asks that organizations using QKD "ensure that robust quantum-resistant mechanisms for authentication are implemented alongside them," while expressly withholding support for QKD in government or military applications. Whether a hardware assumption of this kind satisfies an accreditor is a question for an evaluation scheme rather than a physics journal; addressing authentication alone does not establish NCSC acceptance.
What the sources support is this. A peer-reviewed paper from Sorbonne and Edinburgh shows a complete entanglement-based QKD session authenticated from a physical unclonable function with no pre-shared secret, at telecom wavelength, through 50 dB of loss, with the error rate below 0.6 percent and the security parameters set at 2.5 times 10 to the minus 11. The capability a force would gain, a first authenticated quantum session established from device custody rather than key custody, is demonstrated in principle on a bench and at bits per second. A sealed hardware PUF, an operational custody threat model and an independent evaluation are the next three pieces of evidence to wait for.
Sources
Primary source: Nicolas Laurent-Puig, Adriano Innocenzi and Eleni Diamanti (Sorbonne Université, CNRS, LIP6, Paris) and Mina Doosti (School of Informatics, University of Edinburgh), "Unconditional Authentication in Quantum Key Distribution via Hybrid Entangled Physical Unclonable Functions," arXiv 2605.04650, submitted 6 May 2026; journal version in Physical Review Research, published 1 November 2026, DOI 10.1103/9mjz-fddy. Other material: the NCSC (UK) white paper "Quantum security technologies"; the QCrypt 2026 contributed-talk page; the Quantum Secure Networks Partnership project site. The April 2025 theory paper by Goswami, Doosti and Kashefi, arXiv 2504.11552, is cited in the text. The capability reading, the posture argument, the readiness placement and the buyer items are Quentir analysis.