A QKD-assisted quantum secure onion routing protocol

Abstract To ensure the long-term security of anonymous communication against quantum
computing threats, this paper proposes a QKD-assisted quantum secure onion routing
protocol. The scheme employs a hybrid architecture comprising a star-topology QKD
network, a classical onion routing network, and a blockchain-based pseudonym mechanism.
By splitting trust between the central cloud and blockchain, the system prevents any
single entity from compromising the complete path or session keys, thus balancing
anonymity with scalability. Specifically, a quantum secure key agreement sub-protocol is
designed: communicating parties XOR locally generated nonces with quantum keys and
employ a hash family to achieve trust splitting. This method prevents both the central
cloud and the blockchain from recovering session keys. Furthermore, a complete onion
packet encapsulation process is established for layered encryption. Comprehensive analyses
of correctness, security, and performance under practical QKD key rate constraints are
provided. The results indicate that, under semi-honest and non-colluding assumptions, the
proposed protocol achieves quantum secure anonymous communication while maintaining
practical scalability.