Why is QKD usually associated with OTP?
QKD is about key distribution, whereas OTP is about using a key as long as the message to get perfect secrecy. Can anyone explain how they are related?
Well, to understand why QKD is often associated with OTP, we need to review what Quantum crypto is, and why it claims to be secure.
Overall, we know of three implementable paradigms for cryptographical security:
Informational: the attacker does not have enough information to determine the plaintext from the ciphertext
Computational complexity: the process of deriving the plaintext from the ciphertext involves solving a mathematical problem that is just too difficult for the attacker.
Quantuum: the laws of physics forbids the attacker from learning the data needed to rederive the plaintext without disturbing the system detectably.
For example, OTP uses the "Informational" paradigm, while AES uses the "Computational complexity" paradigm.
Most of the cryptographical systems in use today rely on the "Computational complexity" paradigm. It appears to work well in practice; however, there is one troubling detail; there's an assumption that the underlying problem is too difficult for any attacker, and the only evidence we have of that is "lots of fairly bright people tried to solve the problem, and were unable to". Quantuum crypto attempts to get around this assumption by instead relying on the laws of physics; those laws have been fairly heavily tested, and it would appear to be a solider foundation than the assumption that a specific mathematical problem is difficult.
However, if you pair QKD with a symmetric cipher, well, you're no longer relying on something that is stronger than a computational complexity assumption; if the attacker can solve the mathematical problem associated with the symmetric cipher, he has broken the security. Indeed, in some sense, pairing QKD with a symmetric cipher gives a solution that is the worst of both worlds; you get the implementation difficulties (not to mention the potential side channel attacks) that we see with Quantuum Crypto, while giving a system that's guaranteed to be no stronger than conventional crypto.
In contrast, if you don't use a symmetric cipher at all, and instead you exclusive-or the distributed bits with the plaintext bits (analogous to what an OTP does), you do get a system that is potentially stronger than conventional crypto. Now, whether it is stronger in practice (because of the side channel attacks that have been found on QC implementations), and whether that increased strength is actually worth the considerably larger implementation cost, well, that's a different question.
The main problem with the OTP is key distribution. You must share a random (not pseudo-random) key of the length of the message to make the OTP possible. QKD is one way (and possibly the most promising) to solve the problem of sharing a large enough, random key to use with the OTP.
That said, QKD can be used with any cipher. My personal opinion is that most people associate QKD with the OTP (instead of other ciphers) is that it sounds better. One of the things I first learned in crypto classes is that the OTP is perfectly secure, can never be broken no matter what (in theory at least). We also learned that sharing the key is the major problem with the OTP. QKD gives a nice ending to this story. Key distribution with "regular" ciphers has been "solved" for ages.