Pakistan’s Armed Forces Can Become Quantum-Safe Without a Single Qubit

NATO and the Pentagon chose post-quantum cryptography over quantum key distribution this year, giving Pakistan a clear and affordable place to begin.

Within three days this autumn, NATO and the US National Security Agency said much the same thing. NATO’s first Quantum Technology Roadmap, published on 29 September, commits the Alliance to post-quantum cryptography standards and never mentions quantum key distribution. On 1 October the NSA reissued its view that it “does not recommend” QKD for national security systems “unless several technical limitations are overcome.” Of all the sectors where Pakistan must make the post-quantum transition, defence carries the highest stakes and, somewhat to my surprise, offers the clearest road ahead.

Where the Leading Militaries Have Landed

QKD encodes keys in faint pulses of light, close to single photons, sent over dedicated fibre or satellite links so that an eavesdropper disturbs whatever they measure. Post-quantum cryptography is ordinary software built on hard mathematical problems, chiefly the lattices behind NIST’s ML-KEM and ML-DSA standards, and reaches existing equipment as an update.

The Pentagon’s post-quantum strategy of 1 April says QKD “should not be used” as a security solution for quantum resistance and expects post-quantum cryptography across its systems by the end of 2031, while the NSA requires new commercial national security systems to support quantum-resistant algorithms by 2027. One Pentagon line belongs above every procurement desk: “Quantum resistance is not achieved when PQC is rolled out but when quantum-vulnerable solutions are deprecated.”

Europe reached the same verdict in January 2024, when the cybersecurity agencies of France, Germany and the Netherlands, joined by the Swedish Armed Forces, concluded that QKD suits only niche cases and that “the clear priority should therefore be the migration to post-quantum cryptography in hybrid solutions.”

China is the genuine outlier, and the one Pakistan most needs to understand. Its fibre QKD network, more than 10,000 kilometres across 80 cities, is the largest anywhere, and in 2025 its Jinan-1 microsatellite generated keys between ground stations in China and South Africa 12,900 kilometres apart. Yet one Chinese supplier now pairs QKD with chips that run ML-KEM-1024 and ML-DSA-87 alongside China’s own SM algorithms, according to its own product material, and a leading Chinese cryptographer expects Beijing’s own national post-quantum standards within about three years. Türkiye’s defence industry quantum roadmap, published in June, likewise pairs QKD with PQC, and India’s DRDO reported completing military field trials of a fibre-based QKD system in July.

Read together, these positions describe a consensus that rarely makes headlines. Post-quantum cryptography is becoming the common foundation, China included, and where QKD appears, the trend is to run it beside PQC rather than in place of it.

What Pakistan Already Has in Place

Pakistan starts this transition from firmer ground than is often assumed. NTISB’s Pakistan Security Standard already reaches defence buyers, with new defence procurement expected to comply from December 2025, and because it grades primitives by parameters such as key length instead of fixing a whitelist, post-quantum algorithms can enter as new graded rows without a rewrite. The standard even promises that such algorithms “will be incorporated in next update of PSS.” The Army Cyber Command, raised in 2022 with an Army Center of Emerging Technologies, was meant to link progressively at tri-services level, and a National Centre for Quantum Computing is planned with help from China’s CETC.

China supplied 80 per cent of Pakistan’s arms imports between 2021 and 2025, according to SIPRI, and the Mecca Joint Defence Agreement signed in August ties Pakistan to Türkiye, a NATO member, and to Saudi Arabia, which keeps its own national cryptographic standards. Pakistan therefore sits where separate cryptographic ecosystems meet, and I see an opening there, because a military that designs for several standards from the start acquires the crypto-agility others are now retrofitting at great cost.

What My Research Adds

The first of two strands in my own work, a paper now under peer review, models an adversary who hides attacks on a military QKD link inside its normal noise and strikes only key blocks chosen by a concealed mathematical rule. In simulation a classical monitor scored about 0.5 at finding those blocks, coin-toss territory, while a quantum-kernel detector separated them almost perfectly, and a small probe on IBM’s Heron processors showed the kernel can be estimated on real hardware. That advantage awaits fault-tolerant machines and holds only when defenders anticipate the attacker’s kind of rule, yet the planning lesson applies today: a QKD link is only as secure as the monitoring around it.

The second strand concerns trust in what arrives in a crate. My arXiv paper on static detection identifies ML-KEM and ML-DSA inside compiled, stripped binaries from constants those algorithms cannot run without, so a country that imports most of its equipment can confirm at home whether a vendor’s quantum-safe claim is true.

Where Pakistan Can Start

Nothing below depends on knowing what Pakistan’s forces run today, which is rightly private. The cheapest first step is the update the standard already promises, written as a short defence annex naming ML-KEM-1024 and ML-DSA-87, the highest-strength Category 5 sets the NSA prescribes for all classification levels, alongside the hash-based LMS and XMSS schemes for firmware signing. It should permit hybrid operation during the transition and treat algorithms as negotiable suites, which keeps links open to partners on both sides of the coming divide between NIST-based and Chinese standards.

Firmware signing deserves to move first, even ahead of encrypting messages. Aircraft and ships bought this decade will serve into the 2050s, and the keys that authorise their software updates are often fixed in hardware at the factory. Harvest now, decrypt later has a quieter sibling here, call it trust now, forge later: if those keys are RSA or elliptic-curve, a future quantum-capable adversary could sign updates the platform accepts as genuine. It is one reason the NSA put software and firmware signing at the head of its CNSA 2.0 schedule.

Each new defence contract can then require a cryptographic bill of materials listing every algorithm delivered, and algorithms that a software update can replace, with the standard’s accredited laboratories verifying both at binary level before acceptance.

QKD belongs in a narrow pilot rather than a national programme. A short fibre link between two fixed sites in one city, authenticated with post-quantum signatures and monitored for intrusion from the first day, would build real expertise at modest cost and teach far more per rupee than matching foreign trials kilometre for kilometre.

All of this needs one owner with reach across the services. A joint cell drawing on NTISB and the Army Center of Emerging Technologies could steer both the inventory and the annex, and carry post-quantum questions into the new trilateral pact. Agreeing quantum-safe profiles with Ankara and Riyadh now costs a meeting, whereas agreeing them after the links exist costs a re-engineering programme.

None of this asks Pakistan to win a race in quantum hardware. For its armed forces, tomorrow’s cryptography arrives as software, and the years before a cryptographically relevant quantum computer exists are the only ones in which that migration can happen calmly.

Sources

1. NATO, “Quantum Technology Roadmap,” 29 September 2026. https://nato.int/en/about-us/official-texts-and-resources/official-texts/2026/09/29/quantum-technology-roadmap
2. National Security Agency, “Quantum Cryptographic Solutions are Limited Compared to Post-Quantum Algorithms,” 1 October 2026. https://www.nsa.gov/Cybersecurity/Post-Quantum-Cryptography-Resource-Hub/Article-Display/Article/4616320/quantum-cryptographic-solutions-are-limited-compared-to-post-quantum-algorithms/
3. National Security Agency, “Post-Quantum Cryptography Resource Hub.” https://www.nsa.gov/cybersecurity/post-quantum-cryptography-resource-hub/
4. US Department of War, “Post Quantum Cryptography Strategy,” 1 April 2026. https://dodcio.defense.gov/Portals/0/Documents/Library/DoW-PQC-Strategy.pdf
5. National Security Agency, “Commercial National Security Algorithm Suite 2.0 and Quantum Computing FAQ.” https://media.defense.gov/2022/Sep/07/2003071836/-1/-1/1/CSI_CNSA_2.0_FAQ_.PDF
6. ANSSI, BSI, NLNCSA and the Swedish Armed Forces, “Position Paper on Quantum Key Distribution,” January 2024. https://cyber.gouv.fr/en/publications/jointly-led-international-publications/position-paper-on-quantum-key-distribution/
7. DFN WiN-Labor, “QKD network in China extends over 10000 km,” 17 November 2025. https://www.win-labor.dfn.de/en/2025/11/17/qkd-network-in-china-extends-over-10000-km/
8. ScienceDaily, “Microsatellite-based real-time quantum key distribution” (Stellenbosch University release on the Nature paper), 19 March 2025. https://sciencedaily.com/releases/2025/03/250319142833.htm
9. Valentin Weber, “The State of PLA Quantum Security,” China: Technosphere, 14 October 2026. https://chinatechnosphere.substack.com/p/the-state-of-pla-quantum-security
10. CSO Online, “Beijing wants its own quantum-resistant encryption standards rather than adopt NIST’s,” 19 March 2026. https://www.csoonline.com/article/4147736/beijing-wants-its-own-quantum-resistant-encryption-standards-rather-than-adopt-nists.html
11. The Quantum Insider, “Türkiye Lays Out a National Quantum Roadmap, Naming 85 Priority Technologies Across Computing, Sensing and Communication,” 27 June 2026. https://thequantuminsider.com/2026/06/27/turkiye-lays-out-a-national-quantum-roadmap-naming-85-priority-technologies-across-computing-sensing-and-communication/
12. The Tribune, “DRDO completes military trials of secure, intercept-proof quantum communication system,” 15 July 2026. https://www.tribuneindia.com/news/defence/drdo-completes-military-trials-of-secure-intercept-proof-quantum-communication-system/
13. NTISB, Cabinet Division, “Pakistan Security Standard for Cryptographic and ITSec Devices: Cryptographic Guide Book.” https://cabinet.gov.pk/SiteImage/Downloads/Crypto-GuideBook.pdf
14. Profit by Pakistan Today, “Pakistan makes adoption of national cybersecurity standards mandatory for all sectors,” 28 October 2025. https://profit.pakistantoday.com.pk/2025/10/28/pakistan-makes-adoption-of-national-cybersecurity-standards-mandatory-for-all-sectors/
15. Radio Pakistan, “Chief of Army Staff General Qamar Javed Bajwa visits newly raised Army Cyber Command,” 6 August 2022. https://www.radio.gov.pk/06-08-2022/chief-of-army-staff-general-qamar-javed-bajwa-visits-newly-raised-army-cyber-command
16. The Quantum Insider, “Pakistan, China to Deepen Quantum Technology Collaboration,” 27 October 2025. https://thequantuminsider.com/2025/10/27/pakistan-china-to-deepen-quantum-technology-collaboration/
17. SIPRI, “Trends in International Arms Transfers, 2025,” March 2026. https://www.sipri.org/sites/default/files/2026-03/fs_2603_at_2025.pdf
18. France 24, “Saudi Arabia, Pakistan and Turkey sign mutual defence agreement,” 7 August 2026. https://www.france24.com/en/middle-east/20260807-saudi-arabia-pakistan-and-turkey-sign-mutual-defence-agreement
19. Digital Policy Alert, “National Cybersecurity Authority closed public consultation on updated National Cryptographic Standards (NCS-2:2025),” December 2025. https://digitalpolicyalert.org/event/36914-national-cybersecurity-authority-closed-public-consultation-on-updates-to-the-national-cryptography-standards-ncs-22025
20. Muhammad Shaheer Bin Junaid, “Ghillie,” open-source simulator accompanying the QKD paper, Zenodo. https://doi.org/10.5281/zenodo.22906856
21. Muhammad Shaheer Bin Junaid, “Static Detection of Post-Quantum Cryptographic Algorithms in Stripped Binaries for Digital Forensic Examination and Migration Assurance,” arXiv:2608.25122. https://doi.org/10.48550/arXiv.2608.25122