Quantum Key Distribution (QKD) offers information-theoretic security but relies critically on authenticated classical channels for post-processing steps (e.g., basis sifting and key reconciliation). Without authentication, these channels are vulnerable to man-in-the-middle attacks. Traditional methods require Alice and Bob to pre-share symmetric keys via physical meetings—a solution incompatible with multi-user QKD networks. We experimentally demonstrate a practical solution using post-quantum signature algorithms to authenticate QKD classical channels. This approach was validated under multiple QKD network topologies in laboratory environments and a real-world metropolitan QKD network operating continuously for 36 days. Our implementation provides quantum-resistant security while uniquely requiring only short-term security (e.g., ~1 second during authentication), contrasting with long-term security assumptions for post-quantum encryption. Additionally, we propose a quantum-teleportation-based protocol for message authentication that simultaneously ensures confidentiality—enabling secure key reconciliation in QKD.
