A critical analysis of deployed use cases for quantum key distribution and comparison with post-quantum cryptography

While numerous QKD use cases exist, the currently available literature (including manufacturers’ resources and project reports) do not provide a comprehensive practical security analysis. Specifically, sources in the literature often fail to critically examine (or even frequently omit) key aspects we view as crucial. This encompasses aspects such as security requirements, the concrete usage of the generated keys, which kind of data they aim to protect (and for how long), the protocol with which the proposed solution operates, network topology, and the concrete targeted security guarantees. Further relevant aspects that are missing in such documents are whether the proposed solution involves additional cryptographic components (and the impact of potential failures of these components), and a discussion of/comparison with potential alternative approaches (such as pre-shared keys and PQC).

This paper addresses this gap by conducting a comprehensive, detailed and practical security analysis of available QKD-based use cases to evaluate their feasibility and effectiveness. We evaluated use cases deployed in optical fiber networks, focusing on those with sufficient publicly available information to enable detailed evaluation. We systematically selected use cases from the literature, sorting them chronologically from older to more recent examples. We critically analyze each use case based on parameters such as target sector, QKD system employed (including technical details provided by QKD providers and underlying technology), security goals, and type of data to be protected. We excluded use cases that lack adequate information for the analysis but listed them in thefor reference. Our analysis identifies strengths and gaps in the reviewed use cases, thus contributing to a general assessment of their practicality and effectiveness. Furthermore, we provide recommendations on how to improve the solutions discussed per use case and explore whether similar outcomes could be achieved using classical cryptographic systems, thus offering a comprehensive perspective on the applicability of QKD solutions. Appendix

We begin by providing necessary background in Sect.and compare different communication protocols in Sect.. We provide details on the use cases to be analyzed in Sect.and describe our approach to use case analysis in Sect.. In Sect., we apply this method to analyze use cases, critically comment on the use cases and offer recommendations for improvement. Finally, in Sect., we conclude the paper. 2 3 4 5 6 7

A cryptographic solution can provide different security properties. Our main focus in this work is on confidentiality and authenticity as the most commonly required ones, but we note that other properties such as anonymity may be as, or even more important, depending on the use case.

Cryptographic security notions can offer resistance against different classes of attackers. The most powerful notion in this respect is perfect security, which is defined as unconditional security against computationally unbounded adversaries in all cases. A slightly weaker version of this is statistical security, which allows an adversary to break security in a very small and random number of cases, but without any influence on whether he gets lucky. Both of these can be summarized as information-theoretical security, since they can be proven directly from information theory. However, information-theoretical security is sometimes also used to refer to perfect security only.

The more common alternative is computational security, in which computationally bounded adversaries should only have a negligible chance of breaking a scheme. This class can be further subdivided based on whether the adversary has access to a quantum computer or not: In the former case we call the adversary a quantum adversary and in the latter a classical adversary.

In the context of QKD, we gain one further class: Schemes whose security can be proven with quantum information theory, which adds quantum mechanical assumptions to information theory. We call notions that fall into this category quantum-information-theoretically secure.

OTPs (One-Time Pads) are a method in which a plaintext is XORed with a random key of equal length. The key is used only once before being discarded. OTPs at times are not even viewed as an encryption scheme in the stricter sense due to the inability to reuse keys, and since the length requirement on the key poses severe limitations. On the other hand, correctly used OTPs are the only way to achieve unconditional confidentiality that requires no further conditions or assumptions. A scheme with this level of security could be called perfectly confidential.

On their own, however, OTPs offer no authenticity – it is trivial to manipulate ciphertexts with (partially) known plaintexts in a way such that they decrypt to other messages. To prevent this, we require an authenticity mechanism, which is usually achieved via message authentication. The strongest possible way to achieve this is with MACs (Message Authentication Codes) based on universal hash families, originally introduced by Carter and Wegman [38, 39]. MACs based on universal hashing still can be attacked with a very small chance – the very small chance is that an attacker correctly guesses the authentication tag due to sheer luck, but there exist no successful attack strategies beyond guessing. While such schemes thus aren’t perfectly secure, they offer statistical authenticity.

Considering the significant cost of setting up quantum channels between two parties, it is worthwhile to investigate whether the cost of doing this exceeds the cost of simply exchanging the necessary key material directly (in person) between the endpoints. Although such an approach does not scale to universal use on the Internet, it can be viable with a small number of well-known endpoints and predetermined connectivity. Some of the use cases that we analyzed fall into that category, even when envisioned as fully deployed.

We distinguish two scenarios, depending on the encryption method. First, the OTP can be combined with a statistically secure MAC to achieve ITS. Since OTP requires a key that is at least as long as the data that is being transmitted, this requires an initial trusted offline distribution of a large number of pre-shared key bits, each of which has to be discarded after use. For example, this distribution could be done by a trusted courier. Moreover if more data needs to be transmitted, then additional trusted offline key distributions are required. The key material for an OTP must be deleted after use, both to prevent accidental reuse, but also to reduce the attack surface by preventing the decryption of past ciphertexts as a consequence of a later compromise of the keys (‘forward secrecy’). Once this is done on both ends, this method guarantees everlasting confidentiality. A second option is to use computationally secure symmetric cryptography, for example AES with GMAC, so that only a small number of pre-shared key bits are required. Only an initial offline distribution is required: as estimated below, one could simply distribute enough key bits initially to last for the effective lifetime of the system. Alternatively, a single small key can be distributed initially, which is stretched via a symmetric ratchet (the ratchet even be based on AES to minimize the computational assumptions in the system). This ratchet would also provide forward secrecy in case of key leakage via (for example) a device compromise.

Modern mass storage has become incredibly cheap, to the point where micro SD cards with a capacity of 1 TB are commercially available for under 100€. At the rate of consuming one 256-bit key per minute for AES, this would be enough capacity to store key material for almost 60.000 years1 at the cost of exchanging a physical item once, requiring no assumptions besides the availability of a good source of randomness and the correct identification of the peer when handing over the key material. We compare the usage of pre-shared keys with QKD in Table 3.

The downside of using pre-shared keys, compared to QKD and AKE, is that this method does not provide PCS, as key material cannot easily be generated on the fly. This is problematic after a breach that may have corrupted key material intended for later use, because this could result in the unavailability of key material until new key material is exchanged. We remark though that even QKD and AKE could run into issues in that scenario, as this kind of breach could also affect key material for authentication. Whether the cost of the new individual exchange is cheap or expensive heavily depends on the use case in question.

Traditionally, the problem of establishing a shared secret key between two parties is solved using asymmetric cryptography. Initially, this came mainly in the form of asymmetric encryption based on the RSA (Rivest-Shamir-Adleman) algorithm, a public-key cryptosystem that relies on the computational difficulty of factoring large composite numbers [40]. At this point, we also see a large number of protocols based on versions of the DHKX (Diffie-Hellman Key Exchange) [41]. We compare the usage of an authenticated key exchange using asymmetric cryptography with QKD in Table 3. These techniques scale exceptionally well and by now protect most of the communications infrastructure upon which the World Wide Web operates. Additionally, they also protects much of the Internet and most digital communication. On the other hand, like all asymmetric cryptography, RSA and DHKX rely on computational assumptions. Shor’s algorithm additionally renders them vulnerable to quantum attacks.

PQC is a name for classical algorithms that are expected to withstand quantum attacks. The first asymmetric PQC solutions have been standardized by NIST, encompassing ML-KEM [42] (based on Kyber [43]) and HQC [44] (FIPS to appear) for key establishment as well as several digital signing algorithms, called ML-DSA [45] (based on Dilithium [46]), SLH-DSA [47] (based on SPHINCS+ [48]), and FALCON [49] (FIPS to appear). Additionally, some European government agencies have approved the use of the conservative KEMs Classic McEliece [50] and Frodo [51]. Lastly the IRTF standardized the two stateful signature schemes XMSS [52] and LMS [53]. We provide an overview of all of these in Table 1.

QKD is a mechanism that uses a quantum channel, a channel that allows the transmission of quantum states (generally speaking qubits), to establish a shared secret between the endpoints. On its own, this mechanism would be inherently vulnerable to man-in-the-middle (MitM) attacks. It is thus necessary to perform the procedure in an authenticated way, by means of an authenticated channel (which may be classical). Usually, ‘QKD’ refers to the combined mechanism and encompasses the authenticated channel. The resulting shared secret is said to offer confidentiality based on the postulates of quantum mechanics, assuming that the authenticated channel is indeed information-theoretically secure and that executions of the protocol do not deviate from its abstract design. This is often claimed to offer ITS (Information-theoretic security), though we would argue that this can be confusing – security is based on the additional assumptions that underlie QKD, such as the postulates of quantum mechanics. We expand on the assumptions underlying QKD in Sect. 2.6.1. To make a clear distinction between information-theoretic security and its extension with quantum physics postulates, we will use the term Q-ITS (Quantum Information-theoretic security).

The keys established by QKD can be used with a OTP and a statistical authentication mechanism to achieve quantum-information-theoretic confidentiality and authenticity, but this requires a large amount of key material. Many real-world schemes will thus instead combine QKD with classical, computationally secure symmetric encryption mechanisms, resulting in computational security with additional quantum assumptions.

There are multiple ways in which a user can use QKD. Figure 1 shows which ones we encountered in our use case analysis and shows what is operated by the end-user and what is operated by the service provider. Horizontal dotted lines with a color have an accompanying service offering written in a box on the left. All components above the respective line are operated by the service provider, while the components below the respective line are operated by the end-user. Vertical communication lines are within a node and are assumed to be physically secured, while horizontal communication lines can be accessed by an attacker.

The purpose of a key exchange is that only two parties share the key material, which perfectly fits the basic P2P (Point-to-point) connections. However, when dealing with more complex network topologies, a device-based technology such as QKD requires a more complex architecture (see Fig. 2) [71]. Because deploying fibers is an expensive and time-consuming operation, any fiber operator would prefer sharing their pre-existing fiber infrastructure over deploying an entire new one only for QKD. A typical architecture of shared infrastructure includes two parallel optical networks [72, 73]: the classical network, which is based on the OSI model of 7 layers, and the QKD network, which includes two subnetworks referred as KM (Key Management) and quantum layers. The connection between the two classical and QKD networks is provided by an application layer that manages keys requests, which are managed by the QKD network. As the name suggests, the KM layer connects the KMSs assigned to each node. The KM and application layers can easily share the infrastructure with standard WDM (Wavelength Division Multiplexing). However, this is not the case for the quantum layer, which connects QKD Tx and Rx, because of the quantum channel. The sharing of fibers in classical networks presents numerous technical challenges, such as crosstalk, scattering, and additional filters so that quantum channels can bypass optical amplifiers [74].

QKD protocols are executed in the quantum layer. Typically, service channels must be synchronized with quantum ones, thus sharing the same or parallel fibers is preferred. However, no standardization has been proposed yet on the QKD protocol to adopt, making it difficult for fiber operators to integrate QKD into their infrastructure [75]. There are two main families of QKD protocols: DV-QKD (Discrete Variable QKD) and CV-QKD (Continuos Variable QKD). Table 2 reports some of the QKD protocols that are closest to being deployed on real networks.

We can observe that all proposed protocols are limited in SKR (Secret Key Rate) when compared to typical data rates on fiber communications, which are on the order of hundreds of gigabits. This limitation prevents the use in real time of QKD for ITS symmetric encryption schemes that require keys comparable in size to the data, such as OTP. SKRs are still sufficient for symmetric encryption algorithms with smaller keys such as AES, although this comes with a cost in terms of the overall security of the system. Despite sharing the same fiber infrastructure, classical data transmission and QKD are virtually separated into classical and quantum networks. One of the main motivations behind this separation is the incompatibility of QKD with some classic photonic components such as amplifiers. Other motivations are the difference of multiple orders of magnitude between SKR and standard data rates, and between the power of quantum and classic signals. Moreover, the distance limitation of QKD combined with the absence of quantum repeaters, makes the presence of chains of intermediate trusted nodes necessary [84].

DV-QKD protocols were the first to be formulated and demonstrated, thus they are currently the most mature technologically and are already available as commercial products as shown in Table 2. However, DV-QKD protocols have significant technological limitations and challenges that limit their deployment in realistic scenarios. The first limitation is the cost, mainly due to the single-photon detectors, which are expensive and are not standard telecom devices. The second limitation is the high sensitivity to crosstalk due to the extremely low power of the quantum channel compared to classic ones. There are, however, efforts to overcome this limitation [85]. A promising family of protocols are MDI-QKD (Measurement-Device-Independent QKD) protocols, which rely on an intermediate node for measuring two different streams of qubits. The main advantage of MDI-QKD is that the security does not depend on the implementation of the receiver, although the key rates are significantly lower compared to BB84 [78]. An additional benefit of MDI-QKD is the longer distances compared to other DV-QDK protocols. Another family of measurement independent protocols is Twin-Field (TF)-QKD, which enables to increase the distance between two nodes even further [86]. TF-QKD has been reported to have achieved more than 500 km on field deployment [79], although the SKR was significantly lower. The maturity of systems based on measurement-independent protocols is still limited to network deployments, which is promising but still behind compared to other DV-QKD protocols in Table 2.

CV-QKD protocols have the advantage of using coherent receivers with detectors more similar to those used for classical optical communications. This advantage enables not only the reduction of costs, but also the compatibility with equipment from telecom operators and WDM systems [87]. Another advantage is that CV-QKD is more resilient to classical noise [88]. CV-QKD protocols can be based on GM (Guassian Modulation) or DM (Discrete Modulation) such as QAM (Quadrature Amplitude Modulation) and QPSK (Quadrature Phase Shift Keying) [83]. DM based protocols show some advantages compared to GM: higher reconciliation efficiency of practical error correction schemes, simpler implementation, and higher capacity in the very low SNR (Signal to Noise Ratio) regime, which is a very common regime for CV-QKD schemes [89]. These properties make DM CV-QKD protocols optimal and scalable options for deployment into classical optical networks. However, the signal-to-noise ratio in CV-QKD protocols rapidly decreases with channel losses, thus limiting the use to shorter distances, as shown in Table 2. In terms of maturity, CV-QKD relies on standard photonic components for telecommunications, which make it easier to demonstrate and deploy [90]. However, significant effort is required in terms of signal post-processing and calibration. GM and QAM-DM CV-QKD system have been demonstrated in a field demonstrations [80, 82] over deployed fiber links below 20 km. DM CV-QKD systems have been shown to achieve key rates beyond 1 Mbps in short distances, although significant effort is still needed for deployment in a real optical network [91–93]. Compared to DV-QKD a significant limitation of CV-QKD protocols is their security that is based the assumption of perfect states separation, which cannot be guaranteed in a practical CV-QKD system [94].

This method is one of the most secure but least scalable cryptographic techniques. It provides perfect confidentiality due to the OTP and statistical authenticity through ITS MAC. However, it lacks PCS, meaning that if a key is exposed, all communications encrypted with that key are compromised. A significant drawback is the need to securely distribute and store extremely large keys, as each message requires a key of equal length. Additionally, due to the requirement for in-person key exchanges, this scheme is highly impractical for large-scale networks or frequent communications. The combination of high security and logistical difficulty makes it suitable for only highly sensitive, low-frequency communications.

This approach balances security and practicality better than OTP-based methods. While it provides computational confidentiality and authenticity, it does not offer PCS. Symmetric encryption reduces the key size requirement compared to OTP, making it easier to manage. However, the challenge of securely distributing and storing keys remains. This method requires pre-shared keys, meaning a trusted mechanism must exist for exchanging them beforehand. Key management complexity is moderate to high, depending on the size of the network. Scalability is still poor since secure key exchange must occur in advance and in a quadratic fashion for a fully connected network. This protocol is occasionally used in secure messaging applications where a fixed group of users communicates regularly.

This method provides Q-ITS confidentiality through OTP encryption and statistical authenticity via ITS MAC. Additionally, it achieves PCS, meaning that even if an encryption key is compromised, a new one can be generated, reestablishing confidentiality for future messages, as long as the MAC-key did not become corrupted. However, deploying QKD requires specialized quantum infrastructure, which adds significant complexity and cost. Moreover, scalability is severely limited due to the requirement for both quantum channels and a quadratic number of in-person key exchanges. This makes the approach feasible only in very specific environments, such as in some settings involving government and military communications.

This method offers Q-ITS confidentiality using OTP encryption and computational authenticity through digital signatures. It also ensures PCS, meaning security remains intact even if past encryption keys are exposed. QKD allows for the on-demand generation of OTP keys, eliminating the need for long-term key storage. The inclusion of digital signatures ensures authenticity. However, the overall complexity is high due to the reliance on quantum infrastructure. Scalability is constrained by the requirement for quantum channels, which are difficult to deploy over long distances. While star-network architectures can alleviate some of the challenges, they introduce a need for trust in the network operator.

This scheme uses QKD to generate encryption keys for symmetric encryption while relying on digital signatures for authentication. Unlike OTP-based approaches, symmetric encryption reduces the key size requirement, making storage and management easier. However, the confidentiality guarantee now depends on both computational assumptions and Q-ITS. PCS is ensured, meaning that future communications remain secure even if past keys are compromised. The major drawbacks are the reliance on QKD infrastructure, which significantly increases deployment complexity and the reliance on twos sets of security assumptions (computational and quantum information theoretical) instead of just one in the cases of both QKD and solutions that are based on classical authenticated key exchanges. Scalability remains poor due to the need for quantum channels, but some network architectures, such as star topologies, can improve feasibility.

This approach offers computational confidentiality and authenticity in a highly scalable and practical way. Most modern protocols offer PCS as a matter of course and generate dynamic encryption keys, eliminating the need for long-term key storage. Key management is relatively straightforward, making it a suitable choice for large networks. Scalability is excellent, particularly when combined with a PKI, which enables efficient and automated distribution of authentication-keys. Most modern secure communication systems, such as TLS and VPNs, rely on this kind of protocol for their security.

The State of Geneva, Switzerland, used QKD during its 2007 election process to secure transmission of the election count totals from the counting center to the location where the votes were stored [100–102]. The QKD keys were used in conjunction with AES-256 for confidentiality and HMAC-SHA-256 for authenticity [103, 104]. ID Quantique provided the QKD devices. The locations were directly connected using 4 km long fibers [105].

A private asset and wealth management company in Switzerland needed to secure its communication network between its headquarters and a DRC (Disaster Recovery Center) [106, 107]. To protect sensitive data long-term, they used Thales’ network encryptors and Cerberis QKD devices to combine layer 2 Ethernet encryption using AES-256 with keys from QKD. The success of this implementation led to the expansion of the encryption platform to other areas of the company for MAN and WAN applications.

In 2019, Toshiba and Quantum Xchange reported on a collaboration that augmented the encrypted connection between Wall Street’s financial markets and a data center in New Jersey, using the QXC Phio QKD network [108, 109]. The connection between Wall Street and the data center is usually used to transmit sensitive financial data like trading algorithms and customer settlement accounts. As a demonstration, the QKD-augmented connection was used to transmit an uncompressed live video stream. The fiber connection multiplexes the QKD channels, including the quantum one, and the commercial data over a single dark fiber. The multiplexing scheme was based on CWDM (Coarse Wavelength Division Multiplexing) with the quantum channel in the O-band and the rest of the channels in the C-band. Deploying new optical fibers is one of the most expensive operations for a network provider. Therefore, the capability of Toshiba’s system of avoiding a dedicated dark fiber for the quantum channel only is a significant improvement for the solution proposed in this use case.

We encountered several use cases in which actors wanted to store sensitive information, which we describe below. All use cases followed the principle of protecting that information against server breaks via a cryptographic protocol known as ‘Secret Sharing’, i.e., by splitting them into N many components (‘shares’) that cannot be used to reconstruct the original information without obtaining at least n many shares out of these N. The rationale is that by distributing the separate shares to spatially separated secure locations, it is ensured that an attacker cannot access the information without breaking into at least n many (secured) servers.

SIG (Services Industriels de Genève), a Swiss public utility company managing a fiber optical network, partnered with ID Quantique (IDQ) to secure a connection between two data centers using QKD and AES [113, Sect. 3.4]. SIG runs an encrypted connection between their two main data centers to secure sensitive data processed in their cloud applications [122]. They used QKD keys to augment the standard encryption key. Functionality in the case of unavailable QKD keys is maintained by falling back to the non-augmented encryption keys.

By 2020, Toshiba Corporation and Tohoku Medical Megabank Organization (ToMMo) finished a five-year trial in which they used Toshiba’s QKD system to encrypt sensitive large-scale genome sequence data [123–125]. Over two years, genome data produced with the Japonica Array tool was encrypted and transmitted from the Toshiba Life Science Analysis Center to the Tohoku Medical Megabank Organization over a distance of 7 km. Toshiba reported to have achieved stable communication with speeds exceeding 10 Mbps.

Toshiba furthermore reported that the sequencing of 24 genome data sets took over 117 hours to generate. During the generation of this data, the data was transmitted after being encrypted with OTP using keys from QKD. The transmission of this data finished in less than 4 minutes after the sequencing finished.

In 2020, the QKD network was extended with a connection between Tokohu University Hospital and ToMMo, which are a few hundred meters away from each other. The QKD keys were used to encrypt video conferences and exome sequence data using OTP. The exome sequence data was encrypted and transmitted while the sequencing was ongoing. One exome sequence produces approximately 344 GB of data.

Toshiba, BT, the Centre for Modelling and Simulation (CFMS), and the National Composites Centre (NCC) recently partnered to send production data between NCC and CFMS, encrypting this data using QKD-generated keys [126–128]. The data, which was sent over a 7 km long fiber, included quality and performance metrics of an overbraider machine.

In collaboration with QRate, researchers from Innopolis University, Russia, integrated QKD hardware into a self-driving car in 2021 [129], to facilitate the exchange of key material with QKD-enabled gas/charging stations over an optical fiber. The gained key material was to be used to launch an encrypted OpenVPN connection (4G LTE) with the vendor’s data center, in order to facilitate remote software updates and the transmission of telemetry data.

IDQ additionally partnered with SIG to connect two of SIG’s power stations to the OpenQKD testbed, as a demonstrator for an envisioned Smart Grid network connecting all of SIG’s power stations in Geneva with each other and the operations center by a peer-to-peer (p2p) architecture [113, Sect. 3.1]. According to the OpenQKD report [113, Sect. 3.1], the use case was motivated by the goal to ‘secure data transmission and detect intrusions such as hackers taking control of the electricity distribution network’.

In this use case, QKD was deployed over a distance of 3.4 kilometers between a power distribution center and an electrical substation in Tennessee, United States [130]. The keys from the Qubitekk QKD system were used to authenticate SCADA (Supervisory Control and Data Acquisition) traffic which was send using MQTT (Message Queuing Telemetry Transport). The SCADA traffic contains non-confidential control data and measurement data such as voltage, current, frequency and phase. The traffic was authenticated using the GMAC (Galois Message Authentication Code) with AES.

In the QuGenome project, the UPM (Universidad Politécnica de Madrid), the CSIC (Spanish National Research Council) and the Ciemat (Research Centre for Energy, Environment and Technology) had one or more genome sequences of which they would like to know how they are related to the genome sequences at the other institutions [131]. Using quantum oblivious transfer, secure multiparty computation and a distance-based method, the evolutionary distances between every pair of sequences were calculated without revealing the genome sequences at one institution to the other institutions [132]. The evolutionary distances were encrypted using OTP with QKD keys and shared with the other institutions to calculate the phylogenetic tree of the genome sequences. This tree can be used to visualize how family members or different variants of a virus are related.

While all use cases involve the use of keys provided by QKD, these keys are used in different protocols. The respective protocol determines

Different symmetric ciphers have different security guarantees. While AES provides computational security, OTP provides secrecy independent of the computational resources of the attacker, assuming the secrecy of the key does not depend on this as well and assuming the key is only used once. This has implications for the security guarantees that are provided by the system. To analyze the use cases in Sect., it is therefore important to keep the following questions in mind: 6

Understanding network topology is crucial because it directly impacts the security, scalability, and feasibility of QKD deployment. The choice of QKD protocols, devices, and the configuration of trusted nodes influences overall security guarantees and determines the practicality of implementing QKD in real-world scenarios. By examining these aspects, we can assess how well the system aligns with the intended use case and its security requirements. Therefore, we look for the following points:

The two primary properties that we discuss in this work are confidentiality and authenticity. Additionally we require correctness (the property that the scheme ‘works’ in the absence of an attacker) and availability, the property that a scheme can be used when needed. For the most part, the latter two are however less of an issue and none of the use cases that we analyzed seemed to encounter major issues with them.

We encountered several use cases that use QKD to protect the transmission of data with the goal to backup this data. QKD is primarily a replacement for key exchange mechanisms aiming for transport protection.

However, transported data should ideally also be protected at rest, i.e., while being stored as backups. Generally, this is not an ideal use case for dynamically created (or ‘non-static’) keys since such keys have to be stored along with the backup for eventual data recovery. For backup use cases, it may be desirable to use a pre-existing key to encrypt the to-be-transmitted data already before transmission since the storage facility then does not have to store the key material, making it harder for attackers to recover the encrypted data even if they gain digital or physical access to the storage facility. If the encryption scheme used for this long-term encryption is asymmetric, the generator of the data does not even need to maintain knowledge about the used secret key – it could be stored in a separate secure location, independent of the mass-data backup.

One way to then further strengthen such storage-encryption is to secret-share the key in a way that requires multiple parties to work together to decrypt the back-ups. Depending on the use-case this could for example involved all members of a company’s board of directors receiving a share.

All the use cases analyzed in this paper have been sourced from various research articles, company websites, and other references. In Sect., we outline the key information required for analyzing each use case. However, for some use cases, relevant data or information is unavailable for unknown reasons. To ensure completeness, we have listed these cases here. Since the necessary data is lacking, we are unable to assess their potential impact. 5

The authors declare no competing interests.

No datasets were generated or analysed during the current study.