Certifying Hidden Paths: Scalable Topology Assurance for QKD Networks
Abstract
Large-scale Quantum Key Distribution (QKD) networks rely on trusted repeaters, making the security properties of the selected communication path an essential part of end-to-end assurance. At the same time, network operators may be unwilling to disclose their internal topology. We present a topology-certification mechanism that lets a provider prove in zero knowledge that policy-compliant routes between two endpoints exist, without disclosing the routes in an individual presentation. Our main idea is to certify nodes and edges independently using multi-message signatures, rather than signing the complete graph as one object. For a route chosen in advance, proof size and cryptographic proving and verification work depend on its positions and attributes, independently of the overall network size, whereas route discovery and certification have separate graph-dependent costs. The construction hides the actual route length up to a public bound and sketches extensions to node-disjoint routes and monotonic additions within a graph epoch. We give a formal security model and conditional proofs of unforgeability and graph hiding for a generic construction. For a BBS-based construction, presentation-size estimates remain below $300$\,KiB at ℓ=m=n=50, and measured generation and verification times remain below $400$\,ms at ℓ=64 and m=n=8.
Related
- Certifying Hidden Dissipation from Observed Current Fluctuations
- Hidden transverse-flow topology in partially coherent structured light
- The Hidden Topology of Network Entanglement
- KnottedGraph: Scalable knotted-graph topology for scientific and mathematical discovery
- A scalable entanglement distribution framework for hybrid quantum networks
BibTeX
@misc{colombo2026certifying,
title = {{Certifying Hidden Paths: Scalable Topology Assurance for QKD Networks}},
author = {Alessandro Colombo and Margherita Cozzolino and Stephan Krenn and Thomas Lorünser},
howpublished = {arXiv},
year = {2026},
month = oct,
doi = {10.48550/arxiv.2610.11513},
eprint = {2610.11513},
archivePrefix = {arXiv},
url = {https://arxiv.org/abs/2610.11513},
}
RIS
TY - UNPB
TI - Certifying Hidden Paths: Scalable Topology Assurance for QKD Networks
AU - Alessandro Colombo
AU - Margherita Cozzolino
AU - Stephan Krenn
AU - Thomas Lorünser
PY - 2026
DA - 2026/10/08
PB - arXiv
DO - 10.48550/arxiv.2610.11513
UR - https://arxiv.org/abs/2610.11513
AB - Large-scale Quantum Key Distribution (QKD) networks rely on trusted repeaters, making the security properties of the selected communication path an essential part of end-to-end assurance. At the same time, network operators may be unwilling to disclose their internal topology. We present a topology-certification mechanism that lets a provider prove in zero knowledge that policy-compliant routes between two endpoints exist, without disclosing the routes in an individual presentation. Our main idea is to certify nodes and edges independently using multi-message signatures, rather than signing the complete graph as one object. For a route chosen in advance, proof size and cryptographic proving and verification work depend on its positions and attributes, independently of the overall network size, whereas route discovery and certification have separate graph-dependent costs. The construction hides the actual route length up to a public bound and sketches extensions to node-disjoint routes and monotonic additions within a graph epoch. We give a formal security model and conditional proofs of unforgeability and graph hiding for a generic construction. For a BBS-based construction, presentation-size estimates remain below $300$\,KiB at ℓ=m=n=50, and measured generation and verification times remain below $400$\,ms at ℓ=64 and m=n=8.
ER -