Placement-Specific Sufficient QKD Block Sizes for Hybrid QKD–ML-KEM Systems: Finite-Key Planning and Split-Security Provisioning

Abstract

Hybrid quantum key distribution (QKD) and post-quantum cryptography (PQC) systems are often described as layered security architectures, yet deployments face a basic provisioning question: how many QKD bits are needed, and where should they enter an ML-KEM-based system? This article develops a placement-aware framework treating small authenticated QKD blocks as a bounded entropy-resilience resource rather than a wholesale replacement for traffic keys, addressing three placements: ML-KEM randomness hardening, DRBG compromise recovery, and hybrid master-key masking. The contribution is placement-aware QKD-bit provisioning, not a new QKD protocol, XOR combiner, HKDF construction, BB84 protocol, or finite-key method; each has prior literature. Under explicit assumptions on smooth conditional min-entropy, bounded leakage, authenticated QKD delivery, and composable parameter budgeting, we derive sufficient QKD-input bounds, deterministic-expansion ceilings, and placement-specific sufficient block sizes, where sufficient denotes a conditional, placement-specific requirement under the stated interface, not a universal minimum over all hybrid QKD–PQC constructions. For hybrid master-key masking (Architecture C), a same-length XOR combiner between a delivered QKD block and an HKDF-derived ML-KEM pad provides a QKD secrecy contribution at the master-key boundary even if ML-KEM is later broken; downstream traffic-key expansion remains computational, not an unbounded information-theoretically secure stream. Simulations covering entropy degradation, state exposure, biased-input extraction, finite-key BB84 planning, leakage-underestimation sensitivity, and QKD key-pool depletion support the analytical bounds; these are planning estimates, not physical measurements. No physical QKD hardware, measured detector data, side-channel or fault-injection experiments, or TLS interoperability testing were used or are claimed; all results are software simulations of a planning model.