Exploiting Quantum Key Distribution for Physical-Layer Security on OFDM MIMO Communications

Abstract

A Quantum Key Distribution (QKD)-assisted Physical Layer Security (PLS) scheme for Multiple-Input Multiple-Output (MIMO) wireless links is proposed and numerically evaluated. The framework utilizes high-rate quantum keys to generate unitary precoding matrices for channel estimation preamble encryption, alongside a constellation-based encryption methodology for the data payload. Integration of the QKD is facilitated by a practical Key Management System (KMS) that orchestrates key synchronization and ensures seamless interoperability with the QKD infrastructure. By securing both the preamble and payload portions of the transmission frame, the proposed scheme prevents unauthorized entities from acquiring critical knowledge of transceiver functionalities. Furthermore, the framework leverages high-entropy QKD-derived keys to reseed a pseudo-random number generator (PRNG), providing a symmetric-key encryption layer that enhances data confidentiality. Numerical evaluation results obtained within a simulated residential wireless environment demonstrate that the proposed architecture yields enhanced security at the cost of a minor degradation in reception performance, driven by a small noise amplification penalty and a marginal elevation in the peak-to-average power ratio (PAPR).

1. Introduction

Traditionally, communication security is implemented at the bit level within the upper layers of the protocol stack. While these conventional methods are widely adopted, they remain susceptible to “Store Now, Decrypt Later” (SNDL) attacks [1,2,3], where adversaries intercept and store encrypted traffic for future exploitation. Consequently, the advent of large-scale quantum computing poses a significant risk to data with long-term sensitivity, particularly in wireless, optical, and hybrid optical–wireless network architectures.

Conventional security relies on classical encryption techniques as the primary method for securing communications, providing protection based on computational complexity rather than information-theoretic principles. In contrast, quantum cryptography fundamentally limits an adversary’s ability to obtain information by exploiting the principles of quantum mechanics [4]. Specifically, QKD provides a robust mechanism for secure communication, enabling the generation and sharing of private keys between distant parties with provable information-theoretic security. QKD has historically faced significant challenges regarding its practical utility and operational reliability. However, after decades of intensive research, experimental validation, and the development of increasingly robust protocols and implementations, QKD technology has matured to a stage that is approaching practical deployment in corporate and enterprise environments. In [5], the gap between theoretical QKD security and practical implementation is examined through experimental progress, quantum hacking attacks, and proposed countermeasures, while [6,7] review progress toward global QKD networks, focusing on imperfect device security, metropolitan and backbone fiber networks, satellite-based links, long-distance protocols, and the practical security of commercial devices. In [8], QKD-secured optical networks are surveyed, focusing on the coexistence of quantum and classical traffic within the same wavelength division multiplexing (WDM) fiber, alongside an analysis of network architectures, routing and spectrum assignment (RSA), and resource allocation strategies. Optical fibers currently carry the vast majority of global Internet traffic and are widely deployed, particularly in terrestrial backbone networks. After the secret keys are generated through the QKD process, they can be used by legitimate users to encrypt sensitive information using conventional cryptographic algorithms. Depending on the available key length and application requirements, encryption schemes such as the one-time pad (OTP) [9] and the Advanced Encryption Standard (AES) [10,11,12] are commonly employed, with OTP providing stronger security guarantees [6]. Consequently, these encryption methods are widely used in conjunction with QKD systems [13,14,15,16,17,18]. From a security perspective, a QKD system is considered ε-secure if the probability that any adversarial attack or measurement can distinguish the generated key from an ideal perfectly secret key is bounded by ε. Since the secret key serves as a resource for subsequent cryptographic protocols, the overall security of the system is determined by the composable security of both the QKD protocol and the cryptographic scheme that utilizes the key. As shown in [4,19,20,21], QKD protocols provide composable security when combined with subsequent cryptographic protocols.

Physical-layer security is a prominent and supplementary solution that can address data exposure and overhead. PLS refers to a class of techniques that exploit the inherent physical behavior and properties of communication systems to limit the information accessible to an adversary. In principle, PLS can provide confidentiality without relying solely on secret cryptographic keys but rather by also exploiting properties of the transmission medium and transceiver mechanisms to create conditions under which unauthorized observation yields limited or no useful information. In some PLS approaches, physical-layer parameters are further leveraged to enhance security by enabling encryption key generation or by shaping transmitted signals according to channel or hardware characteristics [22,23,24,25,26]. Schemes that rely on the communication medium itself to achieve security are often complex and difficult to integrate into practical systems. Physical-layer encryption (PLE), a subset of the broader concept of PLS, is a key-based cryptographic technique that provides security at the physical layer by conventionally encrypting the physical parameters of the transmitted signal and therefore requires reliable cryptographic keys [27,28,29,30,31,32,33,34,35,36].

PLS is recognized as an essential paradigm for ensuring robust information protection in contemporary communication frameworks, particularly within MIMO architectures. Specifically, chaos-based time-varying unitary matrices have been integrated into differential MIMO encoding to eliminate the need for channel estimation [37], while multilevel chaotic encryption (MCE) schemes for MIMO-OFDM utilize sequential precoding and phase-selective mapping to enhance security and reduce the PAPR [34,35]. Further advancements include dynamic constellation rotation based on channel reciprocity [33], key-based random unitary rotation for beyond-5G signal obscuration [38], and power-efficient directional modulation integrating multiple parameters weighted-type fractional Fourier transform (MP-WFRFT) with chaotic scrambling for co-directional eavesdropper mitigation [39]. In massive MIMO, the chaotic antenna-index three-dimensional modulation and constellation points rotated (CATMCPR) scheme leverages chaotic sequences for randomized antenna selection and constellation rotation [31]. Additionally, biometric-based multi-parameter fractional Fourier transform (MPFrFT) frameworks facilitate simultaneous authentication and high-dimensional encryption [40]. Recent trends also incorporate post-quantum lattice-based projections for 6G resilience [41] and integrated sensing and communication (ISAC) frameworks that employ chaotic seeds for distance deception and enhanced confidentiality [42].

To mitigate interception risks in wireless and optical communications, PLS has been integrated into signal pilots and preambles. Key strategies include the mathematical decomposition of MIMO-OFDM channels to shield both data and pilots through phase-shifting properties [43] and dynamic pilot manipulation based on unique channel characteristics [44]. A significant research thrust focuses on Discriminatory Channel Estimation (DCE), utilizing artificial noise (AN) to create channel state information (CSI) mismatches for eavesdroppers [45,46,47,48,49]. This is further enhanced in full-duplex architectures, where receivers transmit secret pilots or jamming signals to “blind” unauthorized nodes [50,51,52,53]. Additionally, randomized training sequences have been deployed to mitigate active pilot spoofing [54,55]. In massive MIMO contexts, information-theoretic security has been achieved by encrypting pilot assignments and employing δ-conjugate beamforming to neutralize pilot contamination [56], while the superposition of security tags allows for blind physical-layer authentication in fast-fading environments [57], which has evolved to embed user-defined encrypted bits directly into standard WiFi training fields [58,59]. Further advancements involve subcarrier obfuscation via dummy data insertion [60] and preamble-based security.

This paper presents a PLE scheme that leverages dual, optical fiber QKD terminals to derive information-theoretically secure keys, which secure a MIMO wireless data channel by generating unitary matrices for preamble precoding and performing low-complexity, symmetric constellation-based scrambling for payload encryption to protect against unauthorized synchronization and adversarial exploitation. To bridge the gap between QKD secure key rate and the demands of high-speed encryption, the distilled QKD keys are utilized as seeds for a PRNG to generate computationally secure, multi-Gb/s secondary key streams. Key synchronization and distribution are orchestrated by a KMS integrated into the QKD-assisted PLS architecture. Unlike existing approaches utilizing comparable encryption schemes, such as those in [31,32,33,34,35,36,37,38,44], the proposed framework delivers an end-to-end operational architecture that provides mitigation against diverse adversarial threats while maintaining low implementation complexity. In addition, we investigate how payload encryption degrades signal quality via the decryption-stage noise amplification penalty, and how elevated PAPR threatens signal integrity. Through a numerical evaluation, it is demonstrated that the proposed encryption schemes that use information-theoretically secure QKD keys, expanded via PRNGs, can mitigate downstream physical-layer attacks by preventing adversaries from acquiring channel state information (CSI) and decrypting data.

The remainder of this paper is organized as follows. Section 2 introduces the proposed framework for the integration of PLS and QKD. This section further details the encryption mechanisms for the channel estimation preamble and payload portions, and analyzes the KMS designed to handle secondary key generation and QKD rate fluctuations. Section 3 presents the numerical evaluation of the QKD-assisted PLS system over a wireless communication link. Finally, Section 4 concludes the paper.

2. A PLS Framework Utilizing QKD

2.1. System Architecture

The proposed system architecture, illustrated in Figure 1, comprises a transmitter (Tx) and a receiver (Rx) serving as the primary communication endpoints connected via a classical wireless channel. Security is facilitated by two QKD terminals, Alice and Bob, which are linked through a fiber-based quantum channel and managed by a KMS. To ensure data confidentiality, the framework employs a symmetric-key encryption scheme.

Figure 1. Architectural block diagram of the proposed QKD-assisted PLS framework.

The QKD transmitter, Alice, provides a sequence of cryptographic keys used to secure both the channel estimation preamble and the payload portions. In MIMO-OFDM systems, these keys can facilitate various encryption techniques, such as subcarrier-level symbol encryption or permutation, bitwise XOR operations, and secure space-time encoding, depending on the available key length. To ensure cryptographic agility and overcome potential QKD rate limitations, the initial QKD keys serve as seeds for a PRNG, enabling the derivation of a larger key set independent of the raw quantum key rate.

The communication system employs an open-loop architecture where the transmitter generates modulated envelopes compliant with MIMO format specifications. Only the legitimate receiver, possessing a theoretically unbreakable shared key, can successfully reverse the transmitter’s process. This enables the critical initial step of channel estimation, which is required for subsequent signal demodulation. Conversely, an unauthorized adversary lacking the key is unable to perform these processes, rendering the signal unintelligible. Security is enforced by encrypting the channel estimation preamble portion via a unitary matrix, alongside the encryption of the payload portion.

This work implements a signal format and packet structure based on the IEEE 802.11 standards, more specifically the IEEE 802.11n-2009 amendment [61]. The proposed encryption of the channel estimation preamble is also applicable to closed-loop systems, where channel estimation at the receiver is a necessary preliminary requirement. By encrypting both the preamble and payload portions, this robust PLS scheme prevents unauthorized nodes from acquiring physical-layer characteristics, thereby mitigating higher-layer attempts to compromise the communication link.

2.2. Unitary Matrix-Based Precoding for Preamble Encryption

To prevent potential attackers from extracting information regarding the transmitted bits, a precoding-based encryption method is applied to the channel estimation preamble. This approach secures the initial processing stages against external attacks, ensuring that only the intended receiver can decrypt the corresponding preamble portion and complete the data recovery process. This method enhances physical-layer security without altering the signal’s fundamental properties or introducing further degradation in quality. Generally, encrypting the channel estimation preamble (or pilots) provides superior security in time-varying channels by limiting the time available for an adversary to successfully estimate the channel state. Conversely, an adversary may employ blind channel estimation techniques. However, these methods are generally ineffective against encrypted constellations where the underlying symbol mapping cannot be readily determined or predicted [62]. In this manner, semi-blind and blind channel estimation becomes far more complex to accomplish. Furthermore, encrypting the channel estimation preamble serves a dual purpose: it secures the message against eavesdropping and mitigates future spoofing attacks by preventing the adversary from localizing the transmitter or receiver.

Channel estimation is performed by inserting pilot symbols either into a dedicated preamble portion or periodically interleaving them with data symbols. This configuration is adapted based on the channel’s time-selectivity to balance estimation accuracy against spectral efficiency. For this implementation, a packet structure inspired by the frame formats used in wireless standards such as IEEE 802.11 was adopted. This design choice ensures compatibility with well-established framing principles while maintaining implementation simplicity. In addition, the selected packet format facilitates potential future integration of this method in the closed-loop systems (during the sounding phase).

In a typical MIMO communication system, the orthogonality of the subcarriers ensures that each individual subcarrier adheres to a discrete-time block-fading model. Under this model, the channel coefficients remain constant over a specific time interval before transitioning to independent values. During the transmission of a preamble consisting of $p$ training symbols for channel estimation, the received signal vector of the $k-th$ subcarrier is expressed as:

$$R^{\left(k\right)}=H^{\left(k\right)}{S}^{\left(k\right)}+V^{\left(k\right)}$$

(1)

where $R^{\left(k\right)}$ is the $N_r x p$ received complex signal matrix, with $N_r$ representing the number of receive antennas. $S^{\left(k\right)}$ is the $N_t x p$ transmitted complex signal matrix, containing training symbols, with $N_t$ representing the number of transmit antennas. The collection of $S^{\left(k\right)}$ matrices across all subcarrier indices constitutes the channel estimation preamble. $V^{\left(k\right)}$ is the $N_r x p$ additive noise matrix, and $H^{\left(k\right)}$ is the $N_r x N_t$ complex random channel matrix. Based on this model, it was shown in [63] that for a specific SNR, the data rate is maximized when $p=N_t$.

Our proposed scheme encrypts the channel estimation preamble by employing precoding, driven by a shared secret key, to ensure legitimate user-only access. This method maps a series of keys to a precoding matrix via QR decomposition by specifically employing the Householder transformation. To ensure consistency across different hardware implementations, which may yield varying but valid unitary matrices, the “zero-rotation” intermediate state is adopted as a deterministic criterion for matrix selection. The necessity for a deterministic selection criterion arises from the inherent non-uniqueness of the QR decomposition. Any matrix $A$ with a valid decomposition can be expressed as follows:

$$A=QR$$

(2)

However, there are infinitely many alternative pairs {$Q^{\prime }$,$R^{\prime }$} that can be generated such that:

$$A=Q^{\prime }{R}^{\prime }=\left(QD\right)\left(D^{H}R\right)$$

(3)

where $D$ is a diagonal unitary matrix, specifically a ‘phasor’ matrix in the complex domain, where:

$$D=diag\{e^{i{\theta }_1}, e^{i{\theta }_2}, \dots ,e^{i{\theta }_n}\}$$

(4)

In the context of Householder transformations, different algorithmic implementations or floating-point sensitivities may result in different phase rotations (or sign flips in the real case, where $D=diag\{\pm 1\}$ for each column of $Q$. Since the precoding matrix must be identical at both the transmitter and receiver to ensure signal alignment, the ‘zero-rotation’ state is enforced to fix these phase degrees of freedom. By convention, this is typically achieved by requiring the diagonal elements of $R$ to be real and positive $r_{ii}>0$, effectively ‘locking’ the phase of each column in $Q$ and ensuring a bit-exact mapping from the shared secret key to the unitary precoder. Also, the proposed method requires $A$ to be of full column rank to ensure the uniqueness of the unitary matrix $Q$. If $A$ is rank-deficient, the resulting $R$ matrix contains zero diagonal elements $r_{ii}=0$, making it impossible to have a unique solution and cause the system to fail.

To generate the random complex matrix $A$, a set of complex values is required with dimensions matching those of the channel estimation preamble matrix. While various methods exist, this work utilizes a phase component ($\theta$) and an amplitude component ($b$), both derived from keys provided by the QKD framework. The phase range is partitioned into $2^N$ discrete intervals, where $N$ denotes the bit length of the phase encryption key. This discretization yields a resolution of $u=2\pi /2^N$ rad, where $k\in [0,2^N-1]$ represents the decimal value of the phase key. Similarly, the amplitude component is quantized into $2^L$ discrete levels using an $L$-bit key. The magnitude is scaled by a factor of $1+(m/(2^L-1)$), where $m\in [0,2^L-1]$ represents the dynamic scaling value.

$$\theta =\left(k·{\displaystyle \frac{2\pi }{2^N}}\right), where k\le 2^N-1$$

(5)

$$b=\left(1+{\displaystyle \frac{m}{2^L-1}}\right), where m\le 2^L-1$$

(6)

$$\theta ~Uniform\left(\left\{{\theta }_0,{\theta }_1, \dots ,{\theta }_{2^{{\rm N}}-1}\right\}\right), b~Uniform\left(\right\{b_0,b_1, \dots ,b_{2^{{\rm N}}-1}\left\}\right)$$

$$\theta , b are i.i.d.$$

The number of required keys corresponds to the total number of elements in matrix $A$, which is defined by the dimensions of the preamble matrix, $N_t x p$. The elements of matrix $A$, denoted by $a_{ij}$., are defined as follows:

$$a_{ij}=b_{ij}·e^{j{\theta }_{ij}}$$

$$A=\left[\begin{array}{ccc}{a}_{\mathrm{1,1}}& \dots & a_{1,p}\\ ⋮& \ddots & ⋮\\ a_{N_t,1}& \dots & a_{N_t,p}\end{array}\right]$$

(7)

The resulting complex transmission matrix is determined by the specific training matrix defined within each protocol. For example, IEEE 802.11 standards utilize variations of the following matrix, with dimensions adjusted according to the specific implementation:

$$P=\left[\begin{array}{cc}\begin{array}{cc}1& -1\\ 1& 1\end{array}& \begin{array}{cc}1& 1\\ -1& 1\end{array}\\ \begin{array}{cc}1& 1\\ -1& 1\end{array}& \begin{array}{cc}1& -1\\ 1& 1\end{array}\end{array}\right]$$

In our proposed method, the resulting per-subcarrier matrix is derived from the aforementioned encryption scheme and defined as follows:

$$S^{\left(k\right)}=P{Q}^{\left(k\right)}$$

(8)

Algorithm 1 outlines the procedure for generating the unitary matrix $Q^{\left(k\right)}$.

Algorithm 1: Construction of a Unique Unitary Matrix via Keys and QR Decomposition

Applying Algorithm 1 to the channel estimation preamble effectively encrypts the signal, preventing unauthorized users from compromising the authentication phase. By encrypting the preamble, the amplitude and phase information remain inaccessible to any attacker, even if the original preamble sequence is known. Conversely, the legitimate receiver utilizes the secret key, established via QKD, to derive the specific precoding matrix applied to the preamble symbols. This precoding maps the original, BPSK-like constellation into a higher-order, complex alphabet and computationally secure constellation against unauthorized users. An example of how the unitary matrix precoding maps the original constellation of the channel estimation preamble to a new constellation is illustrated in Figure 2. Upon successful channel estimation, the legitimate receiver can then employ standard detectors, such as the Maximum Likelihood Detector (MLD), Linear Minimum Mean-Square Error (LMMSE) detector and Inverse Channel Detector (ICD), to the payload portion.

Figure 2. Constellation comparison between the original and the encrypted channel estimation symbols.

2.2.1. Performance Analysis of LS Estimation

The optimal design of the preamble matrix has been extensively investigated in [63,64]. These studies demonstrate that the selection of a specific preamble or pilot structure is fundamentally dictated by the receiver’s detection architecture. Most practical systems employ the Least Squares (LS) estimator due to its flexibility and low computational complexity, as it requires no prior statistical knowledge of the communication link. To evaluate the performance of a given channel estimation preamble format, the Mean Square Error (MSE) is typically used as the primary metric. While different estimation techniques yield varying MSE performance, their implementation is subject to specific operational constraints and requirements.

The LS estimation aims to minimize the squared error between the actual received signal $R^{\left(k\right)}$ and the estimated received signal ${\widehat{R}}^{\left(k\right)}={\widehat{H}}^{\left(k\right)}{\widehat{S}}^{\left(k\right)}$, while it uses the pseudoinverse of $S^{\left(k\right)}$ to achieve that. The LS and maximum likelihood (ML) estimates are identical under the Gaussian noise vector assumption because maximizing the likelihood function for a Gaussian distribution is mathematically equivalent to minimizing the sum of squared errors. In LS channel estimation, the estimation quality is quantified by the MSE, denoted as:

$${MSE}^{\left(k\right)}=E\left\{{‖H^{\left(k\right)}-{\widehat{H}}^{\left(k\right)}‖}_F^2\right\}$$

$$\to {MSE}^{\left(k\right)}={\sigma }_V^2{N}_{r}Tr\left\{{\left(S^{\left(k\right)}{S^{\left(k\right)}}^H\right)}^{-1}\right\}$$

(9)

In [64], it was shown that in order to minimize the channel estimation error under a total transmit power constraint ${‖S^{\left(k\right)}‖}_F^2=\mathcal{P}$, the optimal training matrix $S^{\left(k\right)}$ must satisfy the condition $S^{\left(k\right)}{S^{\left(k\right)}}^H={\displaystyle \frac{\mathcal{P}}{N_t}}I$. Such a configuration ensures that the estimation error is receiver-independent and proportional to the number of transmit antennas $N_t$, effectively simplifying the optimization to a scaled identity matrix. This optimal configuration results in a minimum MSE of:

$$\underset{S^{\left(k\right)}}{\min }{MSE}^{\left(k\right)}={\displaystyle \frac{{\sigma }_V^2{N_t}^2{N}_r}{\mathcal{P}}}$$

(10)

This demonstrates that the error scales linearly with the number of receive antennas $N_r$ and quadratically with the number of transmit antennas $N_t$.

Consequently, a unitary precoding matrix is generally considered the optimal choice for channel estimation preambles. Our proposed method adheres to that requirement, since:

$$P{Q}^{\left(k\right)}{\left(P{Q}^{\left(k\right)}\right)}^H=P{Q}^{\left(k\right)}{Q^{\left(k\right)}}^H{P}^H=I$$

(11)

In practical applications, however, arbitrary unitary matrices can increase the PAPR of the symbol. To mitigate this, IEEE 802.11 standards utilize constant-amplitude pilots, typically based on Hadamard or Discrete Fourier Transform (DFT) matrices, during the channel estimation and sounding phases. While this PAPR reduction may slightly degrade estimation quality, the overall impact is negligible given the typically large packet lengths.

2.2.2. Computational Cost Analysis

In terms of computational complexity, for the channel estimation preamble encryption process, the system overhead is primarily dominated by the generation of the unitary matrix, whereas subsequent matrix multiplications incur negligible costs. The QR decomposition via Householder transformations entails a computational cost of $O\left(N^3\right)$ operations.

While this value may appear significant for practical implementation, the computational load is intrinsically linked to the number of antennas defined by the 802.11 or LTE standards. Consequently, the resulting complexity remains relatively low compared to other mandatory processing tasks. Specifically, while the complexity of a Fast Fourier Transform (FFT) is defined as $O\left(NlogN\right)$, a 256-point FFT requires approximately $2048$ operations $\left(256·8\right)$. In contrast, for a configuration with $N=8$ antennas, the Householder transformation incurs a lower computational overhead of approximately $512$ operations $\left(8^3\right)$. Thus, while the algorithm may become inefficient as the antenna count scales, a common characteristic of many high-performance detectors, such conditions only arise with an excessively large number of antennas that exceeds the practical specifications of 802.11 or LTE protocols.

2.3. Implementation of a Robust PLE Scheme for Payload Protection

To further enhance security and prevent unauthorized message recovery, the payload is encrypted using a constellation-based amplitude and phase scrambling scheme. This encryption approach has been extensively documented in the literature, such as in [32,33,34,35,36], utilizing various key generation methodologies. The specific approach presented in this paper integrates two techniques: the constellation-based phase scrambling procedure described in [65,66] and a constellation-based amplitude scrambling method. This process maps each original M-QAM constellation point $S=r·e^{j\phi }$ (where $r=\sqrt{I^2+Q^2}$ and $\phi ={\tan }^{-1}\left(Q/I\right)$) into a new constellation scrambled point $S_{APS}$ via the following mechanisms.

The phase encryption key is generated in a similar fashion to the phase component ($\theta$) that was explained in the previous channel estimation preamble encryption process. The constellation-based phase scrambling involves a phase rotation of each constellation point, which is partitioned into $2^N$ discrete intervals, where $N$ denotes the length of the phase encryption key in bits. This discretization yields a phase resolution of $u=2\pi /2^N$ rads. For each symbol, a phase rotation of $k·u$ rads is applied, where $k\in [0,2^N-1]$ represents the dynamic value of the phase encryption key. The phase of the newly generated encrypted symbol is given by:

$${\phi }^{\prime }=\phi +\left(k·{\displaystyle \frac{2\pi }{2^N}}\right), where k\le 2^N-1$$

(12)

Similarly, the constellation-based amplitude scrambling is generated like the amplitude component ($b$) of the channel estimation preamble process. This method employs a linear scaling transformation applied to the radial component $r$ of each constellation point. For that, an amplitude encryption key of length $L$ bits is utilized, providing $2^L$ discrete scaling levels. The magnitude is scaled by a factor of $(1+\alpha )$, where the scaling parameter $\alpha$ is defined as $a=m/(2^L-1)$. Here, $m$ represents the dynamic amplitude encryption key value, subject to the constraint $m\in [0,2^L-1]$. The amplitude of the newly generated encrypted symbol is given by:

$$r^{\prime }=\left(1+{\displaystyle \frac{m}{2^L-1}}\right)·\mathrm{r}, where m\le 2^L-1$$

(13)

By integrating the constellation-based amplitude and phase scrambling techniques, the resulting scrambled constellation point is expressed in its final polar form as:

$$S_{APS}=\left(1+a\right)·\mathrm{r}·e^{j\left(\phi +k·\mathrm{u}\right)}$$

$$\to S_{APS}={\mathrm{r}}^{\prime }·e^{j{\phi }^{\prime }}$$

(14)

At the receiver, the OFDM demodulator reverses the phase and amplitude transformations to restore the original symbol values. Under ideal conditions, this process yields a symbol identical to the one prior to encryption. The reliability of this restoration is fundamentally contingent upon accurate channel estimation and the precise application of the decryption keys. Any estimation errors or key mismatches will prevent the demodulated symbol from aligning with the transmitted one, thereby resulting in symbol errors. The structure of the transmitted frame for each antenna is illustrated in Figure 3.

Figure 3. Custom packet structure and frame segmentation for the proposed scheme.

The overall constellation scrambling procedure is illustrated in Figure 4. Similar to the channel estimation preamble encryption, analyzed previously, this method generates a more complex alphabet of potential constellation points. In this case, the density and depth of the resulting alphabet are determined by the key length. Specifically, the resolution and computational complexity of this constellation-based encryption are functions of the available phase and amplitude encryption bits, denoted by $N$ and $L$, respectively. Alternative approaches proposed in [67,68,69,70,71,72,73] utilize finer resolutions to mask constellation points within quantum noise. In this work, the resolution selected exceeds the phase and amplitude noise floors of the received constellation. Since the security of the proposed scheme fundamentally relies on the QKD exchange, noise masking is not strictly mandatory. However, a finer discretization step can be employed to further enhance security. To increase the complexity for potential adversaries, the constellation-based encryption could incorporate larger key bits $L, N$. In our paradigm, we use ${\rm N}=5$ bits and $L=4$ bits corresponding to $32$ phase encryption steps and $16$ amplitude steps, respectively, in the payload portion.

Figure 4. Payload scrambling mechanisms for 64-QAM via (a) phase encryption and (b) amplitude encryption.

It is important to note that while amplitude encryption significantly enhances physical-layer security, our method introduces a dual penalty on the bit-error-rate (BER) performance through distinct linear and non-linear mechanisms. First, a statistical penalty arises at the receiver due to noise amplification. Because the scaling parameter α varies within the interval 0 ≤ α ≤ 1, the amplitude encryption expands the constellation grid non-uniformly. Therefore, since the inverse amplitude scaling function is applied during decryption, the expected value of the decrypted noise power systematically exceeds the baseline channel noise. Ultimately, this leads to overall BER degradation. Second, a non-linear penalty is concurrently introduced by the altered signal statistics. The maximum potential amplitude of the scrambled symbols is effectively doubled while the minimum remains identical to the unencrypted symbol. The proposed amplitude encryption algorithm was specifically selected to achieve a slight PAPR elevation in the time-domain OFDM waveform. This localized spike in PAPR increases the likelihood of hardware clipping and quantization noise during the digital-to-analog (DAC) and power amplification stages. While amplitude encryption inherently affects the PAPR, alternative PAPR-reduction techniques, such as Selective Mapping (SLM) [74,75,76], coding-based methods [77,78], and Partial Transmit Sequences (PTS) [79,80], could be integrated into the proposed framework to mitigate this penalty and further optimize system performance.

In general, the PAPR of the MIMO-OFDM signals at each antenna is defined as:

$${PAPR}_i={\displaystyle \frac{max{\left|x_i\left(n\right)\right|}^2}{E\left[{\left|x_i\left(n\right)\right|}^2\right]}}$$

(15)

$$PAPR=\mathrm{m}\mathrm{a}\mathrm{x}\left\{{PAPR}_i\right\}$$

(16)

To evaluate the statistical characteristics of the PAPR in OFDM systems, the Complementary Cumulative Distribution Function (CCDF) is commonly employed as a performance metric comparison. The CCDF of the PAPR is defined as:

$$\mathrm{P}\mathrm{r}(PAPR>z)$$

(17)

where $z$ denotes a predefined threshold based on the original unencrypted signal. This formulation demonstrates that the proposed method results in a localized increase in the PAPR.

2.4. Architectural Frameworks for Key Management

The QKD key generation and exchange module comprises two Toshiba QKD4.2-MB (Quantum Technology Division, Toshiba Europe Limited, Cambridge, UK) terminals, designated as Alice and Bob, connected via a 10 km single-mode fiber (SMF) spool. End-user applications, or Secure Application Entities (SAEs), access the network services through the standardized ETSI GS QKD 014 interface [81], which facilitates secure communication with Key Management Entities (KMEs). These terminals implement an efficient decoy-state BB84 protocol utilizing phase encoding [82]. Performance metrics for this configuration include a maximum secret key rate (SKR) of 1.7 Mbps, a quantum bit error rate (QBER) of approximately $2.4\%$, and a secure key failure probability of less than ${10}^{-10}$.

The experimental QKD network architecture comprises four primary nodes: KME A, SAE A (acting as the initiator), KME B, and SAE B (the responder). To initiate a secure session, SAE A requests a key of a specified length from KME A. Upon receiving the key and its associated key IDs, SAE A establishes a TCP/IP-based communication channel with SAE B. The Key IDs are then transmitted to SAE B over a classical network. Using these identifiers, SAE B retrieves the identical key material from KME B. Consequently, both application entities obtain synchronized keys from their respective local storage pools, ensuring cryptographically secure subsequent operations.

While modern optical fiber links support multi-gigabit per second throughput per wavelength, contemporary QKD systems typically achieve SKRs only in the Mbps range. To bridge this performance gap, a PRNG is employed to expand the high-entropy QKD material into a high-rate keystream. In this work, we implement the Xoshiro256++ PRNG, a 64-bit generator with 256-bit state that operates using a series of linear xor, shift, and rotate (Xoshiro) operations followed by a non-linear plus-rotate-plus (++) scrambler [83]. Xoshiro256++ provides an ideal balance of statistical quality and extreme throughput for high-speed encryption schemes. When seeded with high-entropy QKD data, the Xoshiro family of generators offers a massive period and passes the most stringent statistical suites [84], such as BigCrush, while maintaining a significantly lower computational overhead than block-cipher-based designs. While Xoshiro256++ is not classified as a cryptographically secure PRNG in the same vein as the DRBGs specified in NIST SP 800-90A, it is utilized in this high-speed QKD-seeded context for its exceptional statistical properties, massive period, and ability to maintain throughput parity in very high link speeds. Specifically, our scheme utilizes a 256-bit QKD-derived seed to initialize the state of a Xoshiro256++ instantiation, enabling the generation of a high-speed, non-linear keystream. Alternative methodologies, such as those utilizing the CTR_DRBG algorithm, offer higher cryptographic strength and throughput for subsequent encryption schemes, as specified in [85]. When properly seeded and frequently reseeded, CTR-based DRBGs offer robust security proofs [86] against modern cryptanalysis.

To maintain high redundancy and ensure operational resilience against fluctuations in the QKD rate, the system key consumption rate is designed to be lower than the generation capacity of the PRNG. In the event of a QKD link disruption, whether due to hardware failure or denial-of-service (DoS) attacks, pre-stored keys in the pool bridge the gap until service restoration. The KMS architecture relies on the QKD terminals and the classical TCP/IP session to manage the initial key synchronization between the Tx and Rx communication endpoints. While this procedure ensures that both the Tx and Rx have access to an identical key pool, the correct key utilization on the Rx must be verified because of the unpredictable wireless link, where low SNR and carrier-sense failures can induce frame loss. To achieve this, our custom control signaling preamble includes the first key ID, key length, and the total number of keys used by the Tx. This mechanism operates similarly to the Signal (SIG) family of preambles, which guarantee synchronization in IEEE 802.11 protocols (Figure 3). This aligns with the Key-on-Demand (KoD) framework proposed in [87] for software-defined optical networks, where a KMS virtualizes quantum keys into centralized pools for dynamic allocation across control and data channels. The hardware architecture of the proposed scheme and the KMS logic are illustrated in Figure 5 and Figure 6, respectively. If the QKD link is compromised, the system maintains encrypted communication by utilizing redundant shared key sequences or predefined permutations of existing keys. Furthermore, for high-resolution constellation-based scrambling requiring longer keys, the system can concatenate successive pre-stored keys to meet the necessary bit length. The comprehensive key supply architecture is detailed in Figure 7.

Figure 5. KMS architecture for multi-Gbps secondary key generation.

Figure 6. Operational flowchart of the Key Management System (KMS) logic.

Figure 7. Schematic of segment-specific key distribution using the combined QKD/PRNG system.

When a single PRNG cannot sustain the bit rates required for multi-Gbps encryption [88], a parallelized PRNG bank may be employed. In general, the throughput in symmetric-key schemes can be scaled either by increasing the number of concurrent PRNG instances or by implementing hardware-accelerated algorithms. Within this architecture format, the PRNG bank consumes primary QKD keys as seeds to generate secondary keys at the required transmission rate. Then, each PRNG sequentially processes QKD keys, ensuring each key is used to produce a high-volume stream of secondary key material. Finally, a time-division multiplexer can be used to aggregate these parallel outputs into a single secondary key stream. To maintain continuous operation, QKD keys are exchanged asynchronously between terminals and buffered in a localized key pool.

In [4,19,20,21], it was shown that QKD protocols provide composable security when combined with subsequent cryptographic protocols. Therefore, the overall security follows the combination of the QKD system and Xoshiro256++. Several schemes have been proposed to improve key delivery efficiency. In [89], a novel KMS with an optimized key storage organization is introduced to reduce key construction time and facilitate the integration of QKD services into critical infrastructure applications, whereas [90] analyzes the key size and refresh rate.

3. Numerical Evaluation and Results

3.1. Setup and Performance Metrics

The implemented setup of the proposed QKD-assisted PLS scheme consists of applying the aforementioned channel estimation preamble encryption and the constellation-based encryption of the payload portion in a MIMO communication link with OFDM modulation. The numerical evaluation is conducted in MATLAB (version R2025b), where the encrypted signal is transmitted through a simulated channel and subsequently processed by the receiver to evaluate system performance. Channel impairments are modeled using the TGn Model-B delay profile, which is a standard multi-cluster tapped-delay-line model designed by the IEEE 802.11n working group [61] for typical residential or small office environments. The numerical evaluation is consistent with the methodology in [66]. The QKD system was experimentally realized and interfaced with the broader architecture, but hardware limitations precluded full real-time integration. Consequently, an offline generation approach was employed to produce the frame-specific secondary keys. In this configuration, exchanged primary QKD keys serve as seeds or entropy inputs for subsystems such as the PRNG, which are implemented to facilitate the numerical evaluation.

The system configuration is depicted in Figure 8. The primary communication medium is the simulated wireless link, characterized by a residential environment that introduces significant path loss and multi-path fading. This setup evaluates the system’s resilience against the stochastic noise typical of indoor propagation. The operational workflow integrates the QKD-based key generation layer with the PRNG-driven key expansion and KMS logic previously detailed. By situating this QKD-assisted PLS scheme in a high-noise residential context, this setup validates the robustness of the encrypted OFDM-MIMO transmission under realistic channel impairments.

Figure 8. System framework for the QKD/PRNG-secured MIMO-OFDM communication under residential channel impairments.

The framework’s resilience against passive attacks, such as eavesdropping, wiretapping, and channel fingerprinting, depends directly on its vulnerability to data interception and channel exploitation. In this context, adversaries cannot execute these attacks because QKD-derived keys encrypt both the channel estimation preamble and the payload. Without the real-time encryption key, attackers cannot estimate the channel or decode data. Active attacks are evaluated across three primary operations, namely pilot spoofing, jamming, and preamble replay attacks. While pilot spoofing contaminates the legitimate receiver’s CSI by disrupting preamble coherence, the proposed channel estimation encryption prevents any spoofing action. Because this spoofing signal is completely uncorrelated with the encrypted channel estimation preamble, structural channel contamination is mitigated, reducing the attacker to a basic jammer. Regarding jamming vulnerabilities, although wireless architectures remain susceptible to continuous high-power attacks, this framework eliminates energy-efficient reactive jamming. Encrypting the channel estimation preamble prevents the jammer from performing the synchronization needed for low-power operation. Furthermore, if the wireless link is disrupted, the fiber-based QKD link maintains continuity to accumulate redundant keys in localized pools. Lastly, to neutralize preamble replay and session hijacking, the receiver can enforce a strict single-use mechanism for key IDs. Consequently, a unique key ID is valid only for the initial decryption request, causing the system to reject secondary requests with duplicate key IDs.

Figure 9 illustrates the performance impact of the proposed encryption techniques, including their individual and combined variations. Notably, encrypting only the channel estimation preamble yields a negligible impact on the BER. The communication link parameters and the corresponding BER results of the numerical evaluation are summarized in Table 1. The BER values have been evaluated through Monte Carlo simulations. The evaluation models a 4 × 4 open-loop MIMO system across random channel realizations, adhering to the previously defined channel properties. The number of simulation runs was dynamically adjusted based on the SNR, ranging from 0 to 45 dB, to guarantee statistically reliable results under an MMSE detector at the receiver. Due to hardware constraints, the security key is refreshed asynchronously. To evaluate this operational constraint, an analysis of a realistic scenario, focusing on rate, complexity, and latency, is presented later in this paper. As previously noted, in a real implementation scenario, the overall system BER is primarily influenced by the selected payload encryption methodology. The Monte Carlo simulation results capture the performance degradation stemming from the noise amplification penalty. In order to quantify the elevated PAPR of the constellation-based encryption scheme, the PAPR-CCDF curves with and without encryption are depicted in Figure 10. The PAPR effect on BER, which introduces hardware clipping and quantization errors due to ADC/DAC sensitivity, has been thoroughly studied and evaluated in [91,92]. We observe that our system introduces a small performance degradation. This relationship is consistent with the findings in [91,92], which indicate that PAPR reduction in optical OFDM systems significantly enhances BER performance. An analytical framework for evaluating Total Degradation (TD) in OFDM systems subject to nonlinear amplification was presented in [93].

Figure 9. BER versus SNR performance for the proposed preamble and payload encryption schemes.

Table 1. The MIMO-OFDM communication link parameters used in the simulations.

MIMO-OFDM Link Parameters
Baseband sampling frequency	20 MHz
Carrier sampling frequency	2.4 GHz
Interpolation–decimation factor	240 (multiple steps)
FEC (Forward Error Correction) coding rate	2/3
$N_t$ (number of transmit antennas)	4
$N_r$ (number of receive antennas)	4
STBC (Space–Time Block Coding)	-
Modulation	OFDM
Input symbols	16-QAM
FFT size	64
Data subcarriers	52
Cyclic prefix	25%
Subcarrier spacing (baseband)	312.5 KHz
Bandwidth	16.25 MHz
Symbol duration	4 μs
PHY data rate	208 Mbps
PHY spectral efficiency	12.8 bits/s/Hz

Figure 10. CCDF curves evaluating the PAPR impact.

Each PRNG instance is initialized with a 256-bit seed derived from high-entropy QKD keys, ensuring that the resulting sequences are statistically uncorrelated. By utilizing QKD-derived keys rather than conventional sources, the Xoshiro256++ PRNG leverages a source of true randomness for its initial state, maximizing the unpredictability and robustness of the generator’s output [94].

For the signal parameters specified in Table 1, the architecture yields a throughput of $208$ Mbps, corresponding to a symbol rate of $52$ MBaud under 16-QAM mapping (4 bits/symbol). Assuming a conservative SKR of 50 kbps, the quantum link generates approximately 195 primary keys per second (calculated as $50·{10}^3$ divided by the 256 bits needed to form a key). These keys seed a PRNG, which is used asynchronously to produce the required secondary keys. Thus, the PRNG must expand the 195 primary keys per second into $52·{10}^6$ secondary keys per second. With the $N+L=9$ bit requirement for each secondary key, in both the channel estimation preamble and payload portion, the PRNG must achieve a total key generation rate of $9·52·{10}^6=468$ Mbps. The PRNG needs to generate up to $468·{10}^6/195=2.4·{10}^6$ bits per seed. Xoshiro256++ operates as a word-oriented generator, producing 64 bits per iteration. To satisfy the demand of $2.4·{10}^6$ bits per seed, the generator performs 37,500 iterations per seed. Given its massive period of $2^{256}-1$, this volume of data is generated without any risk of sequence repetition or degradation of statistical properties. Benchmarks for Xoshiro256++ on an Intel Core i7-8700B CPU show a software-only emission time of $0.86$ ns per 64-bit word, or $0.34$ cycles per byte [83]. This performance translates to a throughput far exceeding $70$ Gbps in software, comfortably surpassing our $468$ Mbps requirement and ensuring the PRNG remains a negligible overhead in the key expansion process. Other approaches, like CTR_DRBG AES-256, permit up to $2^{19}$ bits per generation request and up to $2^{48}$ requests prior to requiring a reseeding, thus providing enough bits per seed. However, it is seen in wolfCrypt benchmarks [95] that only about 1191.4 Mbps can be expected through the use of medium- to high-performance CPUs in software-only approaches for AES-256-based DRBGs, resulting in a practical bottleneck for a single DRBG use. In instances where throughput requirements exceed the capacity of a single generator or higher encryption resolution is required, the parallel PRNG architecture described previously should be utilized. It should be noted that the key consumption for channel estimation preambles is considered negligible, as the preamble duration is significantly shorter than the duration of the payload portion. The parallel PRNG architecture is highly suitable for scenarios requiring high-resolution keys and robust security guarantees. However, this architectural approach demands substantial computational resources, which inherently escalates system complexity and processing latency.

3.2. Security Validation

The efficacy of channel estimation preamble encryption in preventing future attacks is difficult to quantify theoretically. However, the total system’s security can be effectively evaluated through common measurable metrics, such as key space analysis and computational complexity. The Xoshiro256++ PRNG maintains an internal state of 256 bits, providing a state space of $M=2^{256}$, which effectively defines the key space of the QKD-initialized system. Unlike block-cipher-based constructions, Xoshiro256++ leverages a highly optimized series of linear operations and a non-linear scrambler to achieve superior throughput while maintaining high statistical quality [83]. The QKD terminal supplies sufficient high-quality entropy [96] to periodically reseed the generator, maintaining a security posture that is computationally infeasible for both classical and quantum adversaries to compromise within the QKD key refresh interval (1/50 kbps). Furthermore, while QKD-based schemes may be susceptible to partial key leakage, notably with a failure probability of ${10}^{-10}$ for Toshiba QKD terminals, the use of a 256-bit high-entropy seed for initialization ensures that any partial knowledge of the raw material is effectively diffused across the resulting keystream, rendering it cryptographically negligible to an attacker.

The total entropy is maintained at 256 bits, constrained by the size of the QKD seed. By initializing the 256-bit state with a unique QKD key material, the probability of two independent Xoshiro256++ instances generating identical output sequences is $2^{-256}$, a value that is cryptographically negligible. While the statistical robustness is anchored by the 256-bit entropy input, the underlying Xoshiro256++ primitive generates output in 64-bit words, which achieve the required multi-gigabit throughput.

The hardware implementation of the proposed encryption methods introduces marginal computational complexity and latency. Following the analysis of hardware requirements across various platforms in [97], the channel estimation preamble encryption necessitates approximately ${\displaystyle \frac{4}{3}}{N}_t^3+3N_t^2$ floating-point operations, while the phase and amplitude encryption of the payload portion requires approximately nine floating-point operations per symbol, involving basic arithmetic and a single phase-to-complex mapping. Overall, the hardware overhead and latency incurred by the proposed PLS scheme are negligible, with an insignificant impact on total system performance. Furthermore, the complexity and latency overhead of the encryption process are minimal relative to those of the Xoshiro256++ operation.

The Xoshiro256++ PRNG utilizes a series of linear transformations and a non-linear scrambler as its fundamental primitives. In high-throughput applications, the computational overhead is primarily dictated by the execution of these bitwise operations. Specifically, each generation step requires invoking the Xoshiro256++ transition function $(N/8)$ times to produce N bytes of output, where each invocation produces a 64-bit word by updating the 256-bit internal state through a sequence of shifts, rotations, and XOR operations. Given that a single Xoshiro256++ iteration consists of only a few processor instructions, it is significantly more efficient than block-cipher-based designs like AES or iterative compression functions such as DRBGs. Xoshiro256++ naturally evolves its state as part of the word-generation process, resulting in a total computational complexity of N bytes in precisely $(N/8)$ iterations. Consequently, the complexity for a k-bit generation request is $O\left\{\right(k/64·C_{Xo}\}$, where $C_{Xo}$ denotes the operational cost of a single 64-bit word generation. Due to its hardware-friendly architecture, the software overhead of Xoshiro256++ is substantially lower than other PRNG implementations. While the system’s initialization latency remains tied to the 5.12 msec required to retrieve a 256-bit seed from the QKD terminal (at 50 kbps), the operational latency is negligible. For a processor with a 1 GHz clock frequency, the processing time for a Xoshiro iteration is typically less than one nanosecond, facilitating real-time encryption at multi-gigabit rates. By contrast, the security guarantees of the CTR_DRBG rely entirely on the underlying AES-256 primitive, while its computational overhead is primarily dictated by the execution of the block cipher encryption function. Specifically, each generation step requires invoking the AES-256 encryption operation $(N/16)$ times to produce N bytes of output, where each invocation processes a 128-bit block. An individual AES-256 operation consists of 14 substitution–permutation rounds. To guarantee backtracking resistance, the architecture integrates a state update phase immediately after generating the output bitstream. The total computational complexity for generating N bytes is precisely $(N/16)+2$ AES-256 encryption calls. Consequently, the complexity for a k-bit generation request is $O\left\{\right(k/128·C_{AES}\}$, where $C_{AES}$ denotes the operational cost of a single AES-256 encryption.

4. Conclusions

This work introduced a QKD-assisted PLS framework, evaluated within a simulated wireless OFDM MIMO communication link. Through numerical evaluation, we demonstrated the efficacy of this system using encryption strategies based on unitary precoding matrices and constellation-level encryption. A key contribution of this work is the joint application of channel estimation preamble encryption and QKD-derived keys managed by a KMS, which effectively mitigates payload information leakage. Furthermore, we established a methodology for enabling high-rate PLS by leveraging the high-entropy output of QKD terminals to reseed the PRNG. Ultimately, the successful integration of key generation, distribution, and management within standard transceiver architectures demonstrates that QKD can be seamlessly deployed in wireless systems while maintaining marginal performance degradation, as verified by the evaluated BER and PAPR figures of merit.