Overview
U.S. company QuSecure conducted an experiment using a Starlink satellite to advance encryption for space-to-ground communication and to test post-quantum cryptography (PQC) techniques. On March 9, QuSecure announced it had demonstrated end-to-end encrypted communications via satellite that it says are resistant to quantum-computing attacks, representing the first reported U.S. use of post-quantum cryptography to protect satellite data links.
Background
Rapid advances in quantum computing pose a clear threat to existing cryptographic systems. Widely used public-key algorithms could be broken, and the effective security of symmetric algorithms would be reduced. The "Steal Now, Decrypt Later" (SNDL) threat model is also a practical concern: adversaries can capture encrypted data now and decrypt it later once quantum-capable resources are available. As a result, post-quantum cryptographic algorithms that resist quantum attacks are a major focus of cryptographic research.
In May 2022, U.S. President Joe Biden signed National Security Memorandum 10 (NSM-10), which directed a transition to post-quantum cryptography by 2035 and asked federal agencies to take concrete steps to address quantum threats. The memorandum called for agencies such as NIST, NSA, CISA, and the Office of Management and Budget to define requirements and assessment processes for inventorying cryptographic assets and tracking transition progress.
In July 2022, the National Institute of Standards and Technology (NIST) announced the completion of the third round of the PQC standardization process, selecting four algorithms for standardization and advancing four more to the fourth round. In September 2022 the U.S. National Security Agency published CNSA 2.0, which provided transition timelines for national security systems. A fourth PQC standardization meeting was held in November 2022, with draft standards expected to be published for public comment starting in 2023 and formal standards anticipated from 2024 onward.
Satellite-to-ground data links rely on wireless transmission and are therefore vulnerable to interception, creating additional security challenges compared with wired links.
Experiment Details
The satellite used in the experiment belonged to SpaceX's Starlink constellation. Starlink comprises more than 3,500 low Earth orbit satellites and provides internet access to users in over 45 countries. QuSecure stated that the constellation's growing user base and the potential of near-Earth orbit as a communications resource motivated the selection of a Starlink satellite for PQC testing.
In the experiment, encrypted data was sent from a server on the U.S. East Coast to a laboratory on the U.S. West Coast, then to a Starlink user terminal. The terminal transmitted the data via an uplink to a Starlink satellite, which relayed it back down via a downlink to the ground. QuSecure said the entire communication path was protected by its Quantum SecureLayer (QSL), which it describes as providing encryption meant to resist quantum-computing attacks.
According to QuSecure, its QuProtect software is intended to deliver post-quantum-resistant encryption across devices. The company describes the software as implementing an end-to-end "Quantum SecureLayer" architecture that aligns with zero-trust and proactive defense principles and applies post-quantum encryption techniques to protect data during storage, use, and transmission.
Impact and Analysis
Aaron Moore, vice president at QuSecure, said the demonstration would enable the U.S. to build what he described as a global satellite communication network resistant to quantum-computing attacks, and that this would be an important step toward achieving post-quantum security at a national level. QuSecure also stated that its approach requires only simple upgrades to existing encryption equipment rather than physical replacement.
If adopted, post-quantum encryption for satellite links could allow government and commercial entities to use real-time satellite communications without relying solely on legacy cryptographic protections. Systems outside conventional wired networks—such as servers, edge devices, IoT equipment, and field systems—could potentially employ quantum-resistant satellite links to reduce the risk of data exfiltration.
However, migration to post-quantum cryptography will not be immediate. In May 2022 it was reported that U.S. Northern Command had implemented a QuSecure post-quantum encryption solution. Given that standards for PQC algorithms are still being finalized, vendor claims should be assessed cautiously. Nonetheless, demonstrations of PQC in operational scenarios represent a milestone in applying post-quantum techniques to real-world communications.
