We present a layered and modular network architecture that combines Quantum Key Distribution (QKD) and Post-Quantum Cryptography (PQC) to provide scalable end-to-end security across long distance multi-hop, trusted-node quantum networks. To ensure interoperability and efficient practical deployment, hop-wise tunnels between physically secured nodes are protected by WireGuard with periodically rotated pre-shared keys sourced via the ETSI GS QKD 014 interface. On top, Rosenpass performs a PQC key exchange to establish an end-to-end data channel without modifying deployed QKD devices or network protocols. This dual-layer composition yields post-quantum forward secrecy and authenticity under practical assumptions. We implement the design using open-source components and validate and evaluate it in simulated and lab test-beds. Experiments show uninterrupted operation over multi-hop paths, low resource footprint and fail-safe mechanisms. We further discuss the design's compositional security, wherein the security of each individual component is preserved under their combination and outline migration paths for operators integrating QKD-aware overlays in existing infrastructures.

翻译：我们提出了一种分层模块化网络架构，该架构结合了量子密钥分发（QKD）和后量子密码学（PQC），以在长距离多跳、可信节点量子网络上提供可扩展的端到端安全性。为确保互操作性和高效的实际部署，物理安全节点之间的逐跳隧道由WireGuard保护，该协议使用通过ETSI GS QKD 014接口获得的周期性轮换预共享密钥。在此之上，Rosenpass执行PQC密钥交换以建立端到端数据通道，而无需修改已部署的QKD设备或网络协议。这种双层组合在实际假设下提供了后量子前向安全性和真实性。我们使用开源组件实现了该设计，并在模拟和实验室测试平台上进行了验证和评估。实验表明，系统在多跳路径上能实现不间断运行，具有低资源占用和故障安全机制。我们进一步讨论了该设计的组合安全性，即每个单独组件在组合后仍能保持其安全性，并概述了运营商在现有基础设施中集成QKD感知覆盖网的迁移路径。