Secure Communications & PNT

Why these two domains are one battlefield

Secure communications and PNT are now linked by a single failure mode: modern systems trust time and position too much. Encrypted networks need precise time for TLS certificates, Kerberos tickets, financial ledgers, 5G scheduling, and satellite ground segments. GPS/GNSS provides that time as a free utility, but GPS is vulnerable to jamming and spoofing. At the same time, the cryptographic algorithms that protect PNT-aided networks are threatened by quantum computers. This note therefore covers three technical layers:

1. Quantum-resistant / post-quantum cryptography (PQC) — cryptographic primitives believed to resist quantum attacks.
2. Quantum key distribution (QKD) — physical-layer key transport using quantum states.
3. Resilient PNT — GPS/GNSS performance, holdover clocks, and alternative timing/positioning services.

The thesis under evaluation is:

Secure-communications and PNT value is shifting toward standards-based post-quantum cryptography and resilient PNT hardware/services, not toward QKD as a near-term mass deployment.

The disconfirming evidence section at the end gives the conditions that would break that thesis.

Source anchors

The strongest technical claims in this note rest on the following Tier 1 documents.

A granted patent is evidence of recorded claims only; it does not demonstrate commercial viability or real-world security. The Peev 2009 paper is peer-reviewed and DOI-verified, so it is stronger than an arXiv preprint. FIPS 203/204/205 are final NIST standards, not drafts.

Technology layer 1: Post-quantum cryptography (PQC)

NIST finalized three post-quantum cryptographic standards on 2024-08-13:

• FIPS 203 (ML-KEM, formerly CRYSTALS-Kyber) — a Module-Lattice-Based Key-Encapsulation Mechanism.
• FIPS 204 (ML-DSA, formerly CRYSTALS-Dilithium) — a Module-Lattice-Based Digital Signature Standard.
• FIPS 205 (SLH-DSA, formerly SPHINCS+) — a Stateless Hash-Based Digital Signature Standard.

These documents are normative standards-body documents and therefore Tier 1 for technical claims.

2.1 Concrete parameter sizes from FIPS 203

The FIPS 203 final standard specifies three parameter sets. The values below are from the standard itself.

Source: FIPS 203 final, NIST, 2024-08-13, csrc.nist.gov .

The ML-KEM-768 total public handshake overhead is 1,184 + 1,088 = 2,272 bytes per key encapsulation, excluding TLS framing and the signature certificate chain.

This is a load-bearing technical claim, but it is currently [SINGLE-SOURCE] to the NIST standard because I did not retrieve a second independent standard-body document or company implementation table that repeats all three sizes. NIST is the authoritative standards body, but the two-source rule for load-bearing claims is not met for this specific parameter table.

2.2 Why PQC matters for secure communications

The U.S. government’s stated concerns about quantum computers are embodied in the PNT executive order and broader critical-infrastructure policy. EO 13905 focuses on PNT, but the same federal logic applies to cryptographic transition: a critical service that is hard to replace must become resilient before the failure arrives. NIST’s final publication of FIPS 203/204/205 on 2024-08-13 creates a compliance-visible standards date, which is the primary catalyst for procurement.

NIST’s FIPS documents define algorithm security categories and parameter sets, but they do not provide commercial performance benchmarks; performance claims in vendor marketing require separate benchmark evidence.

Technology layer 2: Quantum key distribution (QKD)

3.1 The granted patent: US 5,307,410

US Patent No. 5,307,410, granted 1994-04-26, title “Cryptographic key distribution system and method,” is the foundational QKD patent. It describes a cryptographic key distribution process in which measurements of quantum states are used to establish a shared secret, with eavesdropping detectable from measurement-induced disturbance.

• Source: patents.google.com , granted 1994-04-26, accessed 2026-04-29.

This is a granted patent, not an application. It supports the claim that QKD has long been contemplated as an information-theoretic key-distribution mechanism. It does not prove that QKD is commercially viable or that modern implementations are side-channel-resistant.

3.2 The peer-reviewed field deployment

The SECOQC network paper, Peev et al., New Journal of Physics 11, 075001 (2009), DOI 10.1088/1367-2630/11/7/075001, is a peer-reviewed report of a field-deployed QKD network in Vienna.

• Source: iopscience.iop.org , published 2009-07-29, accessed 2026-04-29.

It is important because it moves QKD from a table-top patent concept to a metropolitan-area network demonstration. The paper reports trusted-node architecture, in which end-to-end keys are relayed through intermediate nodes. The existence of this network is a Tier 1 technical claim, but the specific point-to-point secret-key-rate figures are not reproduced in this note unless they are extracted directly from the paper; only the deployment fact is cited here.

The combination of the 1994 granted patent and the 2009 peer-reviewed paper gives the QKD concept two independent institutional lineages — IBM/Bennett-type patent and the European SECOQC consortium journal article — so the claim “QKD has been reduced to practice in a metropolitan network” is cross-institutionally supported.

3.3 QKD versus PQC contradiction

There is a material contradiction in how the two approaches support security:

• QKD offers information-theoretic security only if the physical implementation is ideal. Real implementations are subject to photon-loss, detector dead time, optical misalignment, and side-channel attacks. The Peev field trial demonstrates operational feasibility but also makes clear that trusted-node architecture is a practical requirement.
• PQC replaces vulnerable classical public-key algorithms with computational assumptions that are currently believed hard for quantum computers, but it does not offer information-theoretic security.

Thus a vendor claim that QKD is “provably secure” is true only in a mathematical protocol sense, not in the deployed physical sense. This distinction is critical for procurement. I did not retrieve a specific vendor marketing statement to quote; if a reader wants that quote, it needs primary source validation.

Technology layer 3: GPS/GNSS and resilient PNT

4.1 Civil GPS service standard

The U.S. Government’s GPS Standard Positioning Service Performance Standard, 5th Edition, April 2020, provides normative civil-service performance:

• Signal-in-space user range error (SIS URE): ≤ 7.8 m 95% (do not attribute this to a specific satellite; it is the standard).
• UTC time transfer accuracy: ≤ 30 nanoseconds 95%.

Source: gps.gov , 2020-04, accessed 2026-04-29.

These are Tier 1 government performance standards. They are measured/standard values derived from the U.S. Department of Defense’s GPS performance commitments.

4.2 Holdover clocks

When GPS is unavailable, a local frequency standard holds time. Microchip’s 5071A cesium primary frequency standard is a Tier 2 commercial product page used here only for deployment context.

• Source: microchip.com , accessed 2026-04-29.

The manufacturer’s stated fractional frequency offset for the 5071A is 5×10^-13. That is a self-reported Tier 2 specification and is [SINGLE-SOURCE] unless it is also independently benchmarked.

4.3 Alternative PNT: Iridium STL

Iridium Communications offers Satellite Time and Location (STL) as an alternative PNT service.

• Source: iridium.com , accessed 2026-04-29. Tier 2 company technical/service page.

STL is an adoption/deployment context example, not a Tier 1 performance claim. It is relevant because EO 13905 explicitly directs U.S. agencies to evaluate alternative PNT sources when GPS is unavailable.

Quantitative worked calculations

5.1 Calculation A: GPS holdover with a cesium clock

Formula:

time error = fractional frequency offset × elapsed time

Inputs:

• y = 5×10^-13 (Microchip 5071A cesium fraction frequency offset, Tier 2)
• ΔT = 86,400 seconds (24 hours)

Calculation:

Δt = 5×10^-13 × 86,400 = 4.32×10^-8 seconds = 43.2 nanoseconds

Sensitivity:

• If y = 1×10^-12, then 24-hour time error = 86.4 ns.
• If y = 1×10^-14, then 24-hour time error = 0.864 ns.

A 43 ns 24-hour holdover is comparable to, but worse than, the GPS SPS UTC time transfer accuracy of ≤30 ns 95% from the federal standard. A single cesium clock therefore cannot maintain GPS-quality time forever, but it keeps a system inside many network timing budgets for a day after GPS loss.

Source for cesium offset: microchip.com .

Source for GPS time transfer standard: gps.gov .

5.2 Calculation B: PQC handshake overhead at scale

Formula:

bytes per day = n_handshakes × (encapsulation_key_bytes + ciphertext_bytes)

Inputs:

• n_handshakes = 10,000,000 TLS-style key encapsulates per day
• ML-KEM-768 encapsulation key = 1,184 bytes
• ML-KEM-768 ciphertext = 1,088 bytes
• total per handshake = 2,272 bytes

Calculation:

10,000,000 × 2,272 = 2.272×10^10 bytes = 22.72 GB/day

Sensitivity:

• 1,000,000 handshakes/day = 2.272 GB/day
• 100,000,000 handshakes/day = 227.2 GB/day

This is a pure data-size calculation from standardized FIPS 203 parameters; it is not a latency or CPU benchmark.

Source: FIPS 203 final, NIST, 2024-08-13, csrc.nist.gov .

Parameter table

Company filing cross-reference

I did not retrieve a full 10-K/20-F text for each company in this pass, and I will not invent a risk-factor quotation. The proper cross-reference route for the public companies below is their SEC EDGAR form index, which is a primary SEC source:

• L3Harris Technologies, 10-K filings index: sec.gov
• Trimble Inc., 10-K filings index: sec.gov
• Garmin Ltd., 10-K filings index: sec.gov
• Broadcom Inc., 10-K filings index: sec.gov
• Qualcomm Inc., 10-K filings index: sec.gov
• Iridium Communications Inc., 10-K filings index: sec.gov
• Honeywell International Inc., 10-K filings index: sec.gov
• Microchip Technology Inc., 10-K filings index: sec.gov
• Viasat Inc., 10-K filings index: sec.gov
• EchoStar Corp., 10-K filings index: sec.gov
• CACI International Inc., 10-K filings index: sec.gov
• Kratos Defense & Security Solutions Inc., 10-K filings index: sec.gov

Discrepancy status: No discrepancy between marketing and filed disclosure is asserted here because the full risk-factor text was not retrieved. Any specific risk-factor quote or revenue figure would require pulling the exact accession identified in each index. That gap is marked needs primary source validation.

Unit economics / business model

Who monetizes:

• Semiconductor vendors (Broadcom, Qualcomm, Microchip) monetize via chip/module sales. Their margin profiles are not asserted here; they require the companies’ 10-K/10-Q segment disclosures, which were not retrieved.
• Equipment/integrators (Trimble, Garmin, Honeywell, L3Harris, CACI, Kratos) monetize through hardware sales, government contracts, and integration services.
• Satellite service operators (Iridium, Viasat, EchoStar) monetize recurring service/subscription revenue for alternative PNT and secure SATCOM.
• Standards bodies (NIST) do not monetize; they create compliance drivers that shift procurement.

How value is captured: The largest near-term value capture is likely at the integration layer — defense primes and PNT equipment makers that sell into federal resilience programs created by EO 13905 — and at the silicon layer for PQC-accelerated chips. QKD value capture is smaller and concentrated in photonics vendors, but no public-market margin data was retrieved.

Margin caveat: No segment-level gross margin or operating margin is asserted in this note because the relevant 10-K/10-Q line items were not pulled. To assert a margin would require pulling each SEC filing and citing the exact table. That task is marked needs primary source validation.

Disconfirming Evidence

The thesis would be wrong, or materially weakened, if any of the following were shown:

1. PQC adoption stalls in practice. If federal agencies miss FIPS 203/204/205 transition deadlines and private enterprises continue using vulnerable classical cryptography because of cost or backward-compatibility issues, then the PQC procurement wave will be smaller and later than the standards catalyst implies.

1. QKD becomes economically dominant. If QKD equipment cost falls sharply and trusted-node networks scale beyond the SECOQC-style metropolitan demonstrations, then QKD could capture secure-communications value that this note currently assigns to PQC and resilient PNT hardware.

1. GPS jamming/spoofing risk is overpriced. If resilient PNT systems fail to show operational superiority over improved GPS anti-jam receivers, or if GPS remains available enough that buyers do not pay for alternative PNT services, then the resilient-PNT demand thesis weakens.

1. The cited technical sources are invalidated. If US 5,307,410 is later shown to be mischaracterized, or if the Peev field trial is not accepted as a peer-reviewed deployment, then the QKD-specific claims in this note lose their Tier 1 support.

1. Single-source gaps are resolved against the thesis. The ML-KEM parameter sizes and cesium holdover specification are currently [SINGLE-SOURCE]. If independent benchmarks show materially different sizes or clock stability, the worked calculations and procurement assumptions would need revision.