• 7 mins read
  • Published

Quantum One-Time Pads Face a Key-Delivery Test

Daisy Shearer Physics and quantum technology editor Science.Report

Post by Daisy Shearer

Quantum One-Time Pads Face a Key-Delivery Test Science.Report © science.report
Quantum One-Time Pads Face a Key-Delivery Test © science.report

Symmatrics says it can generate and distribute one-use encryption keys at scale. The company reports trial installations, but the interview provides no independent security evaluation or performance measurements-and a random-number generator alone does not establish secure key delivery.

Symmatrics is pitching an old cryptographic idea as an answer to a future quantum threat: encrypt each transaction with a random key that is used once and destroyed. The company says its system is in trial installations, but it does not yet have NIST certification, and the interview provides no independent security test or performance data to verify its claims.

  • The one-time-pad premise

    Chairman and CEO Walter Raquet describes Symmatrics' approach as one-time-pad symmetric-key encryption. In a one-time pad, sender and recipient share a secret key that is truly random, independent of the message, at least as long as the message, and used only once. Under those conditions, the method provides perfect secrecy. The hard part is not the mathematical principle; it is securely provisioning matching key material and managing it without reuse.

    Raquet says US intelligence agencies used one-time pads for decades before abandoning the courier-based system in the early 2000s because couriers had to carry matching key material to both parties. Symmatrics' proposal replaces that physical handoff with electronic key generation and delivery. But a quantum random number generator (QRNG) addresses how random values are produced; it does not, by itself, explain how matching secret keys reach distant endpoints securely.

    The interview describes the company's distribution infrastructure as a key distribution center linked by dedicated hardware boxes, which Symmatrics calls a quantum protected network, or QPN. It does not describe a quantum communication protocol, photon transmission, entanglement distribution, or a security proof for the network. On the account given, QPN is a company term for its protected network architecture, not evidence that quantum mechanics secures the links. Quantum key distribution (QKD) requires specialized physical infrastructure; it is distinct from both QRNG and post-quantum cryptography (PQC), which can be deployed on conventional computing systems.

  • What the numbers show

    Raquet says the key distribution center can generate trillions of random numbers, store billions, and distribute about eight million per second. He also says three quantum random number generators, each costing $6,000 to $8,000, can produce about 10 trillion random numbers annually. These are company-reported capacity and cost figures; the interview supplies no test conditions, independent measurement, or explanation of how the figures map to complete keys and protected messages. Random-number throughput is not the same as the rate at which a system can securely deliver matching, usable keys.

    For comparison, an Indian government-reported QKD field test on September 27-28, 2026, used a 5.56-kilometer free-space channel and reported a quantum bit error rate below 5% and secure-key generation of 230-260 bits per second. The keys were used alongside the Vedic Kavach post-quantum encryption system, as described in the Indian government test report. Those figures illustrate the difference between measured QKD key generation and claims about electronic random-number throughput; they cannot be directly transferred to Symmatrics, for which independent measurements are not available in the material reviewed here.

    In the banking example, a customer receives a QR code and installs information in an app through what Raquet describes as a secret process. The device holds an identification number and a transaction key unknown to the user; each transaction is encrypted with as many one-time keys as its length requires. The bank destroys those keys after processing and sends a replacement transaction key. The interview does not specify how the initial credentials are authenticated, how replacement keys are securely delivered, or how the system handles lost devices, failed transactions, synchronization errors, and recovery.

    That gap matters because a one-time pad's guarantee depends on operational conditions, not just randomness. A reused key can expose information, while a compromised endpoint can reveal plaintext before encryption or after decryption. Removing passwords and reusable credentials may change the attack surface, but it does not establish that every attack path has been eliminated.

  • Certification is pending

    Raquet says the product was completed in June and is being installed on a trial basis at several companies. He also says Symmatrics is working with NIST toward certification, which the company hopes to obtain before a federal quantum-resistance deadline he describes as January 1, 2027. The interview does not identify a certification standard, a completed evaluation, or a government requirement document, so the deadline and the company's prospects should be understood as Raquet's account rather than an independently established status.

    NIST finalized its first post-quantum cryptography standards in August 2024: ML-KEM (FIPS 203) for key encapsulation, and ML-DSA (FIPS 204) and SLH-DSA (FIPS 205) for digital signatures. These are algorithms designed for conventional computing systems; they are not standards for one-time pads or QKD. A separate government network product illustrates how such approaches can be combined: C-DOT's Q-VIKRAM description specifies ML-KEM-1024, AES-256-GCM, a key-derivation mechanism based on NIST SP 800-56C Rev. 2, and support for external QKD key feeds. This Q-VIKRAM technical overview treats QKD as a source of key material that can complement, rather than replace, other cryptographic components.

    The company says it holds patents covering one-time-pad symmetric-key use and expects to sell hardware boxes, with pricing dependent on the application and customization. Patents establish claims to intellectual property, not the effectiveness of a cryptographic system. Similarly, trial installations are not evidence of broad deployment or successful independent review. A related analysis of Shor's algorithm considers the quantum-computing threat to conventional public-key cryptography; that threat does not make every alternative encryption proposal secure by default.

    Raquet argues that mathematical public-key systems face a quantum risk, but the interview provides no evidence that a quantum computer has broken them or that Symmatrics has demonstrated superiority over established methods. Nor does it supply a technical paper, protocol specification, measured attack resistance, or independent replication. Independent cryptographers, including researchers at institutions such as MIT, would need enough protocol and implementation detail to examine the full security claim; the appearance of a product or claim in a respected journal such as Nature would not replace a protocol-specific security proof.

  • Security depends on delivery

    A one-time pad is a symmetric method: both endpoints need the same secret key. "One time" is essential because using the same key again can reveal relationships between messages. Truly random key generation is necessary, but it is only one part of the system; authentication, distribution, endpoint security, and reliable key management remain part of the security case.

    That distinction is where Symmatrics' pitch remains unproven in the material available here. The company describes a potentially useful architecture and reports trials, but the interview does not establish that its network meets a recognized security standard or that it is ready to replace existing cryptography. Until the key-delivery mechanism and full-system evaluation are documented, the product is a proposal under test-not a demonstrated solution to quantum-era cybersecurity.

  • Related articles