## 2 Background
### Quantum Key Distribution  
Quantum Key Distribution (QKD) is a key-exchange method based on quantum mechanics [24]. It enables two parties to securely share a key by transmitting quantum states that reveal any eavesdropping through observable disturbances. The BB84 protocol [54] is most widely used, using qubits (i.e., single photons) encoded in two bases (e.g., rectilinear and diagonal). After transmission, the parties compare part of the results over a classical channel to detect interception. Unlike classical methods (e.g., Diffie-Hellman [55] or RSA [22]), QKD provides information-theoretic security against quantum attacks.  
Figure 1 shows a symmetric encryption architecture integrated with QKD. This architecture is composed of four key components: a client that initiates requests, a symmetric-key  
encryptor that performs the encryption operation, a symmetric-key decryptor that recovers the original file, and QKD modules that handle quantum key generation and distribution. The encryptor and decryptor are connected through classical and quantum channels. The quantum channel enables the secure exchange of a session key using quantum states, while the classical channel carries the encrypted data. This ensures that the data path from the key path allows the encryption and key-exchange processes to proceed independently.  
Specifically, as shown in the figure, the client first sends a request to initiate encryption. The symmetric-key encryptor then generates the cipher file using a symmetric encryption algorithm. Simultaneously, a quantum key is generated and transmitted from the QKD Transmitter to the QKD Receiver through a quantum channel. The generated key is used to encrypt the file, and the resulting cipher file is sent to the decryptor via a classical channel. The symmetric-key decryptor retrieves the corresponding key from the QKD Receiver and applies it to decrypt the file. Once decryption is complete, the original file (Decryption) is returned to the client. While QKD offers strong security against quantum threats, it requires specialized hardware and is noise sensitive [56; 57; 58]. To improve practicality, recent efforts aim to enhance protocol efficiency and integrate QKD into classical infrastructures [59; 60].  
However, in real-world cloud systems, where communication may occur over untrusted classical networks, authentication mechanisms are required to prevent active attacks. In such cases, post-quantum digital signatures such as Dilithium [61] can be integrated to provide quantum-secure authentication and ensure session integrity. Although physical QKD systems face challenges such as channel noise and hardware constraints, our proposed scheme avoids these limitations by adopting a software-emulated QKD model using Qiskit Aer 0.6.0 [62]. The software-based approach enables practical integration and reproducible evaluation, while preserving the conceptual security guarantees of QKD. Thus, our proposed scheme adopts a software-based approach that combines QKD with PQC using the Qiskit Aer simulator [62]. This layered architecture enhances the overall robustness of key management in cloud systems by integrating cryptographic techniques that address both classical and quantum threats.