Quantum Key Distribution (QKD) provides key exchange whose secrecy rests on physics rather than computational hardness, a long-term defence against the "harvest now, decrypt later" threat to today's public-key cryptography. But a QKD network is confined to a single operator until its key-management systems can hand keys across operator boundaries. This talk covers extending eduKMS, the open-source Key Management System maintained by SURF, to do exactly that.

The work took place during an internship at the Restena Foundation, within its network and systems activity, in the context of BENELUX-QCI, the foundation's experimental quantum-communication-infrastructure project. At the start, eduKMS implemented only the application-to-local-KMS interface (ETSI GS QKD 014); it had no way to deliver a key across the boundary between two independently operated networks. Implementing that missing inter-operator layer (ETSI GS QKD 020), with the routing, acknowledgement, and security machinery to make a multi-operator network function end to end, was the project.

I will walk through the architecture and the decisions that mattered: enforcing one-time-pad masking so no key crosses a conventional network readable, and the single reasoned exception to that rule; extending mutual TLS to every interface; multi-boundary forwarding so a key reaches an operator that is not a direct neighbour; and a set of real security findings surfaced by review and realistic testing (improper certificate validation, missing per-peer authorisation, and an SSRF-exposed acknowledgement callback that the ETSI standard requires you to honour, closed by validating it against known peers).

No quantum-physics background is assumed; the focus is systems, standards, and security engineering.