XOR-QKD is a QKD scheme based on trusted relays that requires full trust in them. Its core concept involves using the lightweight XOR operation to preprocess the key at the trusted relay node, then relaying it hop-by-hop to adjacent nodes. It enables efficient reconstruction of the shared key at the target QKD node, achieving end-to-end key distribution. As shown in Fig. 1, each pair of adjacent nodes shares the same quantum key based on the BB84 protocol, denoted as K1,K2,K3. Alice needs to share the key K1 with Bob. Trusted relay A first computes K1⊕K2 and then transmits it to trusted relay B. Trusted relay B computes (K1⊕K2)⊕K2 to obtain K1, then calculates K1⊕K3 and sends it to Bob. Upon receiving it, Bob computes (K1⊕K3)⊕K3 to obtain K1. At this point, Alice and Bob securely share the same quantum key K1. When transmitting data over classical communication networks, both parties can directly use the quantum key K1 to encrypt information. Notably, this key employs the OTP algorithm, as validated by Shannon, ensure its theoretical security.

MDI-QKD is a QKD protocol based on untrusted relays, proposed by Hoi Kwong et al. The protocol innovatively installs quantum measurement devices within untrusted relays, ensuring that even if an eavesdropper takes control, the overall security of the system remains unaffected. As illustrated in Fig. 2, its core concept involves delegating quantum measurement to an untrusted third party (typically Charlie). Alice and Bob independently and randomly select BB84-encoded basis vectors (linear polarization basis or diagonal basis) and bit values. They prepare corresponding quantum states using phase-randomized weak light pulses and transmit them to Charlie via a channel. Subsequently, Charlie performs Bell state measurements and publicly discloses the results. Finally, Alice and Bob generate the key based on these measurements.

Multipath-QKD is a QKD scheme based on partially trusted relays, as illustrated in Fig. 3. The communication parties are Alice and Bob. Alice divides the key K to be distributed to Bob into several key fragments (K1,K2,K3,K4,K5) and distributes them simultaneously via multiple independent paths, rather than relying on a single path. The relay nodes on these paths are categorized as trusted nodes and untrusted nodes. Trusted nodes possess extremely high security, effectively resisting eavesdropper attacks; untrusted nodes have lower security and may be successfully intercepted. Furthermore, relay nodes along different paths do not overlap—i.e., no relay node appears on more than one path—further reducing the risk of a single point being compromised. Ultimately, upon receiving these key fragments, Bob reconstructs them into a global key through key assembly. Unless an attacker can simultaneously eavesdrop on all paths, they cannot obtain the complete key.

Briegel et al. first proposed the concept of quantum repeaters [13] and analyzed their role in long-distance quantum communication. Quantum repeaters are key devices for extending the range of quantum communication. In long-distance quantum communication, quantum repeaters divide the path into multiple short-distance segments. Each relay establishes quantum entangled pairs with its neighboring node. Subsequently, the relay performs Bell state measurements to link the entangled states of adjacent segments. Each node stores the received quantum states in quantum memory, awaiting the completion of entanglement swapping across all segments. Ultimately, the two segments generate a shared key via the entangled state. Due to the nonlocality of entangled states, any eavesdropping attempt is detected, eliminating the need for trust in relay nodes. However, under current technological constraints, quantum repeater technology remains immature. Without employing trusted relay techniques, long-distance QKD cannot be achieved [14]. Future QKD advancements hinge on quantum repeater technology, which is the key solution to overcoming QKD’s distance limitations [15,16].

Homomorphic encryption is a cryptographic technique that enables specific computations to be performed directly on encrypted data while preserving the functional and structural properties of the data. The decrypted result matches the outcome of operating directly on the plaintext. Taking additive homomorphic encryption as an example, as shown in Eq. (1), for sample messages x and y, encrypting them using the homomorphic encryption function Encryption(Enc) yields Enc(x) and Enc(y). Adding these results produces Enc(x+y), with the entire encryption process requiring no explicit knowledge of x and y. (1)Enc(x)+Enc(y)=Enc(x+y)

This differs significantly from traditional encryption schemes. Homomorphic encryption does not require decrypting encrypted data beforehand; instead, it enables mathematical operations and data processing while the plaintext remains unknown. It effectively safeguards user privacy, eliminating concerns about data leaks even when stored in the cloud or on servers. It aligns perfectly with our enhanced solution. Applying homomorphic encryption to QKD effectively prevents key leakage caused by relay attacks.

Looking back at the history of homomorphic encryption, this technology was first named “privacy homomorphism” by Rivest et al. in 1978 [17]. Subsequently, researchers worldwide built upon this foundation to design numerous homomorphic encryption schemes, including: RSA cryptosystem (1978) supporting multiplicative homomorphic operations [18], the encryption algorithm proposed by Goldwasser and Micali (1982) [19], the ElGamal algorithm for randomized encryption (1985) [20], Benaloh’s (1994) [21], the widely used additive homomorphic Paillier algorithm (1999) [22], and the encryption algorithm proposed by Boneh et al. (2005) [23], which supports both additive and multiplicative operations. Goh and Nissim’s cryptographic scheme (2005) [23], which supports both additive and multiplicative operations, allowing infinite additive homomorphisms but only a single multiplicative homomorphism. However, it was not until 2009 that Gentry constructed the first fully homomorphic encryption scheme supporting arbitrary circuit evaluation in his doctoral dissertation [24]. The scheme is based on ideal lattices and innovatively introduces Bootstrapping technology to reduce ciphertext noise. Building upon this foundation, various novel homomorphic encryption schemes have been proposed. Among the most representative are BGV (2012) [25], BFV (2012) [26,27], GSW (2013) [28], TFHE (2016) [29,30], CKKS (2017) [31]. Among these, the TFHE algorithm excels at Boolean operations (XOR), aligning with key operations in QKD relays. It enables faster computation of key bits while maintaining resistance to quantum attacks. We attempted to apply it to QKD scenarios and achieved significant results through simulation experiments.

LWE was proposed by American computer scientist Oded Regev in 2005 [32,33], and remains one of his most significant contributions to date. The LWE problem is a computationally complex problem whose security relies on worst-case lattice problems (such as the Shortest Vector Problem, SVP). It serves as a core tool in post-quantum cryptography. Its fundamental concept is to recover the original secret vector from a set of linear equations deliberately corrupted by errors. It is precisely the presence of these errors that renders the LWE problem computationally challenging.

The formal definition is given below: Dimension n, modulus q, noise distribution χ (typically a Gaussian distribution over Zq). Noise term e←χ. Several samples (ai,bi)∈Zqn×Zq, each containing a secret vector s∈Zqn. (2)b=as+e  mod  q

Given a genuine sample (a,b) that satisfies equation Eq. (2). Intuitively, when (a,b) is known, it is difficult to determine whether b is the inner product of a and a secret vector s with added noise, or a completely random value. This computational difficulty underlies cryptographic applications of LWE. By exploiting this difficulty, public-key cryptography can be constructed.

Although LWE is secure and versatile, homomorphic operations cause rapid noise expansion and require frequent mod  q operations, potentially introducing additional noise. It presents a significant flaw in fully homomorphic encryption. The TFHE algorithm ingeniously resolves this issue by incorporating the Torus. The TLWE problem replaces the integer modulus space Zq of LWE with the Torus, as detailed in Section 3.3.1. Similar to LWE, the TLWE problem involves samples (ai,bi)∈Tn×T satisfying equation Eq. (3). (3)b=as+e  mod  1

TFHE is a Fast Bootstrapping fully homomorphic encryption framework based on the torus, reducing bootstrapping time from seconds to under 0.1 seconds and enabling millisecond-level homomorphic computations. This framework was first proposed by Chillotti et al. in 2016 [29]. In 2020, Chillotti et al. systematically expanded and optimized the 2016 work [30], formalizing the TFHE framework under its official name and open-sourcing it. This scheme represents the third generation of fully homomorphic encryption technology, achieving significant breakthroughs in computational efficiency and practicality compared to previous generations. Next, we will introduce some key features of TFHE.

The TFHE algorithm stands as a quintessential example of efficient fully homomorphic encryption technology. However, it is noteworthy that its encryption and decryption processes rely on the same set of keys, fundamentally constituting a symmetric-key-based encryption system. This characteristic limits TFHE’s applicability in scenarios requiring shared keys and identity authentication, such as multi-party secure communication and cloud storage. To address this issue, Marc Joye proposed a public-key version of TFHE [39], which overcomes this limitation and is particularly suited for untrusted relay scenarios in QKD networks. Public-key TFHE transforms TLWE’s symmetric-key architecture into an asymmetric form via a key-separation mechanism, while preserving TFHE’s torus structure and noise-control advantages to maximize efficient fully homomorphic computation. To facilitate the description of the TQKD scheme, we define the algorithm below.

Definition 1: TQKD comprises five algorithms: Setup, SecretKeyGen, Encreption, Decryption, and HomXOR.

Setup: Generate the public parameter set (pp) for the QKD scenario (Algorithm 1).

These algorithms are based on the work of Chillotti, Joye, and others [29,30,39], and we do not elaborate on the specific proofs and details here. Throughout the TQKD scheme, both the public-private key pairs and ciphertexts are derived from the integer modulus field (Z/qZ). It does not conflict with Torus but rather represents a complementary relationship between theoretical models and engineering applications. Torus and TLWE provide the theoretical foundation for cryptographic security and noise control, while (Z/qZ) serves as the carrier for discretizing the Torus, enabling data storage and computation. For any Torus element x∈T, it can be discretized in the integer modulus as ⌊xq⌋ mod q. This mapping quantizes the continuous Torus space into an integer space, enabling computers to process Torus elements through integer operations while avoiding precision issues associated with computing continuous real numbers.

We divide the QKD network into three layers: Quantum Layer at the bottom, Key Network Layer in the middle, and Key Service Layer at the top [40,41], as shown in Fig. 4. The network is described in detail as follows:

1.

Quantum Layer: It serves as the physical foundation and primary source of TQKD networks, composed of optical nodes interconnected via optical links (fiber-optic cables). Based on quantum mechanical principles (the no-cloning theorem and the uncertainty principle), as well as QKD protocols such as BB84, E91, and B92 [1,42,43], it primarily involves the preparation, detection, and post-processing of quantum states to achieve secure key agreement between adjacent nodes. Its core function is to generate unconditionally secure quantum keys between two directly connected nodes.

During the key generation phase, the Optical Node in the Quantum layer generates quantum keys using a quantum random number generator (QRNG) [44], which exploits the inherent randomness of quantum mechanics (e.g., superposition states, measurement collapse). This randomness stems from the depletion of quantum coherence, enabling the generation of truly random numbers—a capability unavailable in classical physical schemes. Leveraging the uncertainty principle and the no-cloning theorem, eavesdropping during key exchange is prevented, ensuring attackers cannot intercept or alter information. When the key is transmitted to the Key Network Layer, each Relay (labeled A through F) connects via QKD links. Each QKD link shares a QKD key, termed the QKD Link Key, represented by the same color in the diagram. At this layer, keys are transmitted via Relays using homomorphic encryption. Intermediate Relays remain unaware of the key information, enhancing key privacy. Within the Key Service Layer, each user possesses a corresponding public-private key pair (the diagram illustrates two users, Alice and Bob). These pairs are used to encrypt the QKD link keys from the Key Network Layer, ensuring the smooth operation of homomorphic encryption. After obtaining the recipient’s QKD Key, the sender encrypts the message using OTP (a theoretically unbreakable encryption method proposed by information theory founder Shannon [45]), thereby enabling secure communication.

Next, we will demonstrate a complete encrypted communication process using this scheme to understand how public-key TFHE works in conjunction with QKD and the role of homomorphic encryption in this process. As shown in Fig. 5, Alice wishes to communicate with Bob via QKD and plans to send the generated quantum key qkey to Bob. The specific steps are as follows:

1.

During the initialization phase, each user generates a TFHE public-private key pair (pk,sk) and a bootstrapping key bk (Algorithm 1). Simultaneously, adjacent relay nodes share a quantum key keyab,keybc... via QKD, preparing for peer-to-peer QKD.

In this example, we have not described the Fast Bootstrapping process nor depicted it in the diagram. The process occurs during the HomXOR procedure. It is worth noting that Alice and Bob merely represent the communicating parties. For explanatory purposes, only these two users are highlighted in the network. However, each user corresponds to a relay and a QRNG. These nodes can not only generate quantum keys but also act as relays to forward quantum keys from other users, regardless of their position within the network topology.

The network model of TQKD is based on a quantum-classical hybrid channel architecture, whose security proof encompasses both the information-theoretic security at the quantum layer and the computational security at the key management layer. Since the security at the quantum layer is grounded in fundamental principles of quantum mechanics, independent of any computational assumptions, and is widely regarded as unconditional, this paper does not delve into its security proof in detail. Instead, it focuses on demonstrating the computational security involving the homomorphic encryption algorithm. Below, we will prove that the TQKD scheme is IND-CPA secure based on Definition 2.

Definition 2: We define an honest but curious adversary 𝒜, a challenger 𝒞, and the rules governing their behavior.

𝒜:

Possessing probabilistic polynomial-time(PPT) computational capabilities, it cannot resolve fundamental problems in quantum mechanics or those that are hard on lattices.

𝒞:

Generate pp←Setup(λ) and provide it to 𝒜.

Definition 3: For any PPT adversary 𝒜 and two challenge plaintexts m0,m1∈M, 𝒜 outputs a guess b′∈{0,1}. The advantage of game Gi is defined as: AdvGi=|Pr[𝒜(pk,c)=1|c=Enc(pk,m0)]−Pr[𝒜(pk,c)=1|c=Enc(pk,m1)]|, where the function negl(λ) is negligible: for any polynomial P(λ), when λ is sufficiently large, negl(λ)<1/P(λ).

We have demonstrated that TQKD is IND-CPA secure through the following series of Games. Game0 is the baseline game, fully reproducing the original scheme’s encryption logic. Both the public key and ciphertext components are TLWE samples. The advantages of Game0 are shown in Eq. (13). (13)AdvG0=|Pr[𝒜(pk,Enc(pk,m0))=1]−Pr[𝒜(pk,Enc(pk,m1))=1]|

Game 1 substitutes the public key with a randomly selected pk′ from the TLWE sample, rather than using the actual public key from the original scheme. The advantage of Game 1 is shown in Eq. (14). (14)AdvG1=|Pr[𝒜(pk′,Enc(pk′,m0))=1]−Pr[𝒜(pk′,Enc(pk′,m1))=1]|

Since the public keys of Game0 and Game1 are distribution-equivalent, any PPT attacker cannot distinguish between their public keys. |AdvG0−AdvG1|⩽negl(λ), G0↔G1 are indistinguishable.

Game2 samples a public key pk′′ from a uniform random distribution, with Game2’s advantage as shown in Eq. (15). (15)AdvG2=|Pr[𝒜(pk′′,Enc(pk′′,m0))=1]−Pr[𝒜(pk′′,Enc(pk′′,m1))=1]|

Given the TLWE assumption that pk′′ sampled from a uniform random distribution is indistinguishable from pk′ sampled from the TLWE distribution, then |AdvG1−AdvG2|⩽negl(λ), and G1↔G2 are indistinguishable.

Finally, using the triangle inequality, the advantage differences across games are combined, as shown in Eq. (16): (16)AdvG0⩽|AdvG0−AdvG1|+|AdvG1−AdvG2|⩽negl(λ)+negl(λ)=negl(λ)

Through this series of games, the security of the TQKD scheme is reduced to the computational hardness of the TLWE problem, thereby proving the IND-CPA security of TQKD.

Currently, the open-source community has developed multiple mature toolkits with distinct functionalities. Among them, the most prominent and active open-source homomorphic encryption libraries include: Simple Encrypted Arithmetic Library(SEAL) [46] developed by Microsoft, OpenFHE [47] released by the open-source community, Homomorphic Encryption library(HElib) [48] developed and maintained by IBM, and concreteML [49] developed by Zama. However, our approach involves bit-level homomorphic encryption operations and requires support for BGV, BFV, and TFHE algorithms. OpenFHE supports most mainstream algorithms, including BGV, BFV, CKKS, FHEW, and TFHE, making it suitable for our experimental requirements.

OpenFHE is an open-source, fully homomorphic encryption library written in C++. Maintained by a community comprising experts from multiple universities and industry, it can be regarded as the official continuation and significant evolution of the early renowned HE library PALISADE [50]. A standout feature of OpenFHE is its comprehensive support for homomorphic encryption schemes, encompassing nearly all mainstream fully homomorphic encryption protocols. Furthermore, it provides comprehensive Application Programming Interface(API) documentation [51] and extensive code examples, significantly lowering the learning curve. OpenFHE delivers a modern, fully-featured, modular, high-performance, and user-friendly homomorphic encryption development platform suitable for both academic research and industrial applications.

To highlight the speed advantage of the TFHE algorithm in QKD, we designed two experimental scenarios for verification: 1.

Single-Pass Homomorphic Encryption: This experimental scenario simulates a HomXOR operation performed on encrypted keys within a single relay node, without forwarding to subsequent nodes or the recipient. Specifically, it involves a single HomXOR operation between two encrypted keys. Its core objective is to validate fundamental performance differences among BGV and BFV technical solutions on the shortest path by comparing their key performance metrics. The process aims to eliminate path-length-related performance interference (such as the number of relay nodes and physical distance), ensuring that performance differences stem solely from the inherent design of the technical solutions rather than topological complexity. It establishes a baseline for subsequent multi-relay, multi-hop performance analysis.

The specific experimental hardware environment is shown in Table 2:

In the experiments, we disregarded the time spent on model initialization and key initialization, recording only the duration from the start to the completion of the bit-homomorphic computation in the code. To ensure the accuracy and scientific rigor of the experimental data, we repeated the experiments multiple times and filtered the data from each run. Based on the variance and mean, we discarded data points that deviated excessively from the mean, thereby approximating a normal distribution. For the TFHE algorithm, a dedicated API for XOR logic gates is available. However, for the BFV and BGV algorithms, no specialized XOR logic gates exist. Consequently, the XOR functionality must be implemented through additive and multiplicative operations (Eq. (17)). (17)a ⊕ b=(a+b)−2∗a∗b

Furthermore, in practical engineering applications, quantum bits in QKD are continuously generated and encrypted. This means that the sender or relay typically does not wait for a certain number of quantum bits to accumulate before performing operations; instead, operations are conducted bit by bit. Therefore, we also simulated this scenario without using the batch-processing capabilities of the BFV and BGV algorithms in OpenFHE (specifically, acceleration via Python’s list data structure). Both algorithms process only one quantum bit at a time, rather than a string of quantum bits, and TFHE operates similarly. Consequently, the experimental data in Section 5.2 are based on single-quantum-bit operations, not the computation time for entire strings of quantum bits.

We conducted simulation experiments with OpenFHE to demonstrate the feasibility of the proposed TQKD scheme. TQKD not only achieves faster HomXOR computation speeds than BGV and BFV algorithms but also supports accommodating more relays in QKD network while maintaining the original encryption efficiency compared to the other two algorithms. Notably, we also observed an interesting phenomenon: under specific parameter settings, the XOR operation efficiency of TFHE algorithms is lower than that of BGV and BFV algorithms. However, the special case above is uncommon in practical applications and therefore does not affect our conclusions.

First, we analyze the first experimental scenario: performing a single homomorphic encryption operation on two distinct ciphers. The algorithms used in the experiment are TFHE, BFV, and BGV. Due to the construction principles of the BFV and BGV algorithms, it is necessary to set the maximum number of consecutive multiplications allowed in homomorphic operations, known as the multiplicative depth. In other words, it represents the maximum number of consecutive homomorphic operations (including multiplication, where addition does not consume a count) that can be performed on the same ciphertext while still guaranteeing successful decryption. As shown in Eq. (17), BFV and BGV require two multiplications to perform a single XOR operation. Therefore, we set the multiplicative depth of BFV and BGV to 2. Interestingly, at this point, the computational efficiency of BFV and BGV surpasses that of TFHE, requiring less time—contrary to previous theoretical analysis. Subsequently, we progressively increased the multiplicative depth of BFV and BGV. The experimental results, shown in Fig. 6, reveal that the computation time is positively correlated with the multiplicative depth. When the multiplicative depth reaches 7, the TFHE algorithm achieves higher computational efficiency than BFV and BGV, consuming less time—a result consistent with the theoretical analysis. Subsequently, we conducted comparative experiments on CPU and RAM usage across the three algorithms at different multiplicative depths, with results shown in Figs. 7 and 8.

Regarding CPU usage, TFHE remained consistently around 5.8%. When the multiplicative depth was set to 2, BGV and BFV exhibited slightly lower CPU usage than TFHE, indicating higher computational efficiency. However, as the multiplicative depth increased, their CPU usage exceeded TFHE’s, while TFHE maintained superior performance. Regarding RAM usage, although the optimized XOR operation in TFHE increases memory consumption, it only requires slightly more RAM compared to BGV and BFV algorithms. This trade-off yields a significant reduction in computation time, making homomorphic XOR more efficient. This approach, sacrificing a small amount of space for substantial time savings, is worthwhile.

Through analysis, we identified discrepancies between the experimental results and the theoretical analysis. These discrepancies stem not from flaws in the theoretical framework itself, but from the strong correlation between the computational overhead of the BFV and BGV algorithms and their multiplicative depth. The multiplicative depth of both algorithms directly determines the complexity of the cryptographic context, thereby impacting computational speed. Within the parameter generation logic, a greater multiplicative depth necessitates a larger Ring Dimension (RingDim), increasing the number of polynomials involved in the computation and consequently elevating computational overhead. Simultaneously, the multiplicative depth impacts the allocation of the initial noise budget. With a smaller multiplicative depth, there is no need to reserve noise space for subsequent rounds of multiplication or perform additional noise control. Conversely, a larger multiplicative depth necessitates reserving a substantial noise budget for future rounds, thereby increasing the overhead of noise control and slowing down computation speed. However, the BFV and BGV algorithms exhibit faster performance because their parameters are over-optimized, operating within an optimal performance range. At this point, both the RingDim of the algorithm model and noise control operate at minimal overhead. It effectively streamlines BFV and BGV algorithms to support only the current task, thereby maximizing computational speed.

In practical applications, sender encryption and receiver decryption each require one HomXOR operation, consuming a total of four multiplicative depths. Each relay node performs two HomXOR operations; if there are n relay nodes, the multiplicative depth for the BFV and BGV algorithms is 4+4n. A QKD network includes multiple relay nodes, and once the number of nodes exceeds 1, the computational efficiency of BFV and BGV falls behind that of TFHE. Therefore, the advantages of these two algorithms under lightweight implementations are not significant in practical applications. It does not affect the conclusion that our proposed TQKD scheme achieves higher computational efficiency. In Table 3, we summarize the overall performance of TFHE algorithms vs. BFV/BGV for the variable multiplicative depth. When the multiplicative depth is small, BFV/BGV algorithms perform better because shallower depths require fewer initialization parameters. However, in actual HomXOR, the multiplicative depth increases with the number of relays, rendering shallow depths impractical. When the multiplicative depth is large, TFHE demonstrates superior overall performance, enabling the reliable operation of QKD networks with a certain number of relays.

In the second experiment, due to limitations in the experimental environment, we simulated only the scenario in which ciphertexts undergo homomorphic operations and are forwarded across two relays. The experimental results are shown in Fig. 9, where the BFV and BGV algorithms have a multiplicative depth of 12 (each relay performs two homomorphic XOR operations on each ciphertext, thus requiring 4 multiplicative depth operations). It can be observed that TFHE demonstrates a significant speed advantage in practical applications. Furthermore, due to its unique algorithmic design, Fast Bootstrapping technique, and optimized XOR logic gates, TFHE eliminate the limitation on multiplication depth, accommodating a certain number of HomXOR operations. It allows TFHE to accommodate more relay nodes joining the key distribution process. In contrast, QKD based on BFV and BGV algorithms requires pre-calculating the necessary multiplicative depth based on the number of relay nodes in the QKD network. It not only reduces computational efficiency but also limits the addition of relay nodes, thereby diminishing the node scalability of the QKD network.