Webinar: Protecting Data in Motion: Layer 1 Encryption, QKD, PQC, and Hybrid Protection

Data no longer lives in one place. It moves constantly, between data centers, cloud regions, AI clusters, financial platforms, government systems, and critical infrastructure and every one of those handoffs is a potential point of exposure. As more decisions, workflows, and services depend on that constant movement, the optical transport network itself has become part of the trust model, not just the plumbing underneath it. Attackers know this too: encrypted traffic intercepted today can be stored and decrypted later once quantum computing matures, putting long-lived sensitive data at risk right now, well before that threat fully arrives.

Speaker

Nino Shaptoshvili, VP Sales
PacketLight Networks
Nino Shaptoshvili is a seasoned leader with 20+ years in global high-tech, specializing in optical transport. With deep expertise in scaling sales teams and opening new markets, she brings both strategic vision and hands-on industry insight. Fluent in four languages, Nino combines global perspective with a proven track record of delivering results.

Who will benefit from this webinar?

• Network, security & infrastructure teams managing optical transport and DCI
• CIOs, CTOs, CISOs & infrastructure executives
• Network architects & optical transport engineers
• Data center, colocation & cloud infrastructure teams
• Security, compliance & risk teams planning quantum-safe readiness

Key takeaways

• 1. The optical network is now part of the trust model

  Networks used to be judged mainly on connectivity and uptime. Today they are built on three pillars:

  • Performance: full line rate and throughput.
  • Availability: resilience and redundancy.
  • Trust: data integrity and protection of users and sensitive information.

  Trust is critical in financial services, healthcare, government, AI data centers, GPU clusters, cloud replication, storage synchronization and disaster recovery.

  2. Layer 1 encryption secures everything above it

  Security at MACsec, IPsec and application layers remains necessary. Layer 1 encryption adds protection at the physical transport layer, so every layer above it is covered. It is an additional layer, not a replacement for upper-layer security.

  PacketLight Layer 1 encryption:

  • Maintains line-rate performance, with zero throughput penalty and no packet overhead
  • Delivers ultra-low latency for real-time traffic such as financial transactions
  • Is protocol-independent, covering Ethernet, Fibre Channel and OTN
  • Is transparent to applications, operating systems and network protocols
  • Protects 100G, 200G and 400G services, and scales to 800G per service

  3. "Harvest now, decrypt later" makes quantum risk a current risk

  Attackers capture encrypted traffic today and store it until a quantum computer can break it. Data that must stay confidential beyond 2030 is already exposed. This includes intellectual property, health records, financial information and government data.

  The risk starts when the data is collected, not on Q-Day.

  4. QKD and PQC strengthen the keys; AES-256 encrypts the data

  PacketLight encrypts data with AES-256 and uses Diffie-Hellman key exchange. QKD and PQC add a stronger key-exchange layer on top of that encryption.

  • QKD uses quantum physics to generate and distribute keys. Any eavesdropping attempt disturbs the quantum state and is detected.
  • PQC uses quantum-resistant algorithms to secure key exchange over standard channels.

  5. Crypto-agility is the goal, not a single algorithm

  Crypto-agility is the ability to update, replace or rotate cryptographic algorithms without rebuilding applications, replacing devices or taking systems offline. Algorithms change over time. SIKE was a strong candidate in the NIST post-quantum process until researchers broke it, and NIST is evaluating around 45 additional algorithms.

  6. Five-step roadmap to quantum-safe security

  Step	Action	Typical duration
  1. Discovery and inventory	Build a cryptographic bill of materials. You cannot migrate what you don't know exists.	6–9 months (large organizations)
  2. Harden the network	Protect the optical transport layer with Layer 1 encryption. This is the fastest way to reduce risk, and it runs in parallel with the other steps.	Can start immediately
  3. Pilot and test hybrid PQC	Validate performance, integration and vendor compatibility in a controlled environment.	6–12 months
  4. Phased migration	Start with the highest-risk systems, then expand across the organization and supply chain.	2–5 years
  5. Maintain crypto-agility	Keep architecture and governance ready for future changes.	Ongoing

  7. Hybrid quantum-safe architecture: three layers

  • Governance and compliance: crypto-agility policies, migration timelines, vendor requirements and audit trail.
  • PQC and key management: classical and post-quantum cryptography run side by side, so no single algorithm is a point of failure.
  • Physical transport: QKD together with Layer 1 optical encryption. This keeps key delivery separate from the traffic lane.

  8. Adoption differs by region and industry

  • North America: standards-driven, with PQC migration.
  • Europe: strong interest in QKD for highly sensitive communications.
  • Asia-Pacific: hybrid architectures that combine QKD, PQC and multi-vendor integration.

  Telco and finance are moving first:

  • Telco: GSMA has published PQC guidance for telcos, including satellite and non-terrestrial networks.
  • Finance: DORA has been in force in Europe since January 2025. PCI DSS requires an inventory of cryptographic assets, and SWIFT has published a quantum-safe migration roadmap.

  Starting in 2026 leaves more time to influence vendor roadmaps, manage costs and build skills than starting in 2028.

  How PacketLight and Quantum Xchange Work Together

  • PacketLight provides the physical-layer security. AES-256 Layer 1 encryption runs natively on its DWDM/OTN platforms, and they are QKD-ready through ETSI key-delivery interfaces.

  • Quantum Xchange Phio TX provides out-of-band key management and crypto-agility. It supports PQC, QKD or a hybrid of both, and keeps key distribution separate from the data path.

  • Together they add quantum-safe protection to existing optical networks without replacing infrastructure.

FAQs

1. How do QKD and PQC work with AES-256 Layer 1 encryption?
AES-256-GCM Layer 1 encryption on the PacketLight transponder or muxponder encrypts all the data. QKD or PQC replaces or strengthens only the key exchange, which by default uses Diffie-Hellman. Keys are delivered to the PacketLight devices over the ETSI QKD key-delivery interface. Quantum Xchange Phio TX manages the keys out-of-band, separate from the data path.

2. How is the QKD quantum channel separated from the data channel, and what transport does PQC need?
The QKD quantum channel runs either on a separate wavelength over the same fiber or over a dedicated fiber, depending on the design. PQC key exchange has no dedicated transport requirement. It runs over the customer's existing link, whether dark fiber, MPLS or Layer 3.

3. When should you use QKD, PQC or a hybrid of both?
QKD is typically deployed on data center interconnect links, where dedicated fiber or wavelengths are available. PQC is software-based and fits branch connectivity as well as DCI, with no fiber constraints. Hybrid deployments derive keys from both sources, so security does not depend on a single method. Hybrid is common in Asia-Pacific.

4. Which PacketLight platforms support QKD and PQC integration?
All PacketLight transponders and muxponders with Layer 1 encryption support integration with third-party QKD and PQC systems. PacketLight has completed integrations with four QKD vendors and has an open integration path for others. PQC is supported through the Quantum Xchange Phio TX integration.

5. Is PacketLight Layer 1 encryption FIPS 140-3 certified, and how is it licensed?
Yes. PacketLight Layer 1 encryption is FIPS 140-3 certified and deployed in production networks. It is activated by a software key sold for a one-time fee, with no recurring license.

6. Can Layer 1 encryption and QKD/PQC be added to a network that is already deployed?
Yes. The encryption software key can be loaded on PacketLight devices at installation or at any point after deployment. QKD or PQC integration can follow at a later stage, with no hardware replacement and no network redesign.