As quantum technologies advance, the security of popular cryptographic protocols becomes more threatened by the capabilities of Cryptographically Relevant Quantum Computers (CRQCs). In this scenario, Post-Quantum Cryptography (PQC) has become a potential solution to prolong the life of existing Public Key Infrastructure (PKI) systems. However, PQC protocols depend on high-quality randomness for key generation and encapsulation procedures, with the quality of the entropy source potentially having a profound impact on the security of the overall system. In this work, we demonstrate a proof-of-concept enabling the incorporation of Quantum Random Number Generation (QRNG) devices within communication networks using PQC-based Transport Layer Security (TLS).Using open-source cryptographic libraries and commercial QRNG hardware, we demonstrate their use as entropy sources via an Entropy-as-a-Service (EaaS) model. We highlight two particular use cases: a fully virtualized private PKI network and a connection to an external PQC-enabled server. Experimental results show that EaaS QRNG enables real-time entropy monitoring and quality assessment in cryptographic management systems, with negligible impact on TLS handshake time.
As quantum technologies advance, the security of popular cryptographic protocols becomes more threatened by the capabilities of Cryptographically Relevant Quantum Computers (CRQCs). In this scenario, Post-Quantum Cryptography (PQC) has become a potential solution to prolong the life of existing Public Key Infrastructure (PKI) systems. However, PQC protocols depend on high-quality randomness for key generation and encapsulation procedures, with the quality of the entropy source potentially having a profound impact on the security of the overall system. In this work, we demonstrate a proof-of-concept enabling the incorporation of Quantum Random Number Generation (QRNG) devices within communication networks using PQC-based Transport Layer Security (TLS).Using open-source cryptographic libraries and commercial QRNG hardware, we demonstrate their use as entropy sources via an Entropy-as-a-Service (EaaS) model. We highlight two particular use cases: a fully virtualized private PKI network and a connection to an external PQC-enabled server. Experimental results show that EaaS QRNG enables real-time entropy monitoring and quality assessment in cryptographic management systems, with negligible impact on TLS handshake time.
The rapid advancement of quantum computing poses a significant threat to conventional cryptography. Whilst post-quantum cryptography (PQC) stands as the prevailing trend for fortifying the security of cryptographic systems, the coexistence of quantum and classical computing paradigms presents an opportunity to leverage the strengths of both technologies, for instance, nowadays the use of Quantum Random Number Generators (QRNGs) – considered as True Random Number Generators (TRNGs) – opens up the possibility of discussing hybrid systems. In this paper, we evaluate both aspects, on the one hand, we use hybrid TLS (Transport Layer Security) protocol that leverages the widely used secure protocol on the Internet and integrates PQC algorithms, and, on the other hand, we evaluate two approaches to integrate a QRNG, i.e., Quantis PCIe-240M, in OpenSSL 3.0 to be used by TLS. Both approaches are compared through a Nginx Web server, that uses OpenSSL’s implementation of TLS 1.3 for secure web communication. Our findings highlight the importance of optimizing such integration method, because while direct integration can lead to performance penalties specific to the method and hardware used, alternative methods demonstrate the potential for efficient QRNG deployment in cryptographic systems.
In recent years, the advancement of quantum computing technology has posed potential security threats to RSA cryptography and elliptic curve cryptography. In response, the National Institute of Standards and Technology (NIST) published several Federal Information Processing Standards (FIPS) of post-quantum cryptography (PQC) in August 2024, including the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA). Although these PQC algorithms are designed to resist quantum computing attacks, they may not provide adequate security in certain specialized application scenarios. To address this issue, this study proposes quantum random number generator (QRNG)-based PQC algorithms. These algorithms leverage quantum computing to generate random numbers, which serve as the foundation for key pair generation, key encapsulation, and digital signature generation. A generalized architecture of QRNG is proposed, along with the design of six QRNGs. Each generator is evaluated according to the statistical validation procedures outlined in NIST SP 800-90B, including tests for verification of entropy sources and independent and identically distributed (IID) outputs. Experimental results assess the computation time of the six QRNGs, as well as the performance of QRNG-based ML-KEM, QRNG-based ML-DSA, and QRNG-based SLH-DSA. These findings provide valuable reference data for future deployment of PQC-based Transport Layer Security in web systems.
The random number generation capabilities of the GNU/Linux operating system are subject to certain limitations. As of Linux version 5.6, /dev/random operates in a non-blocking manner and, as such, no longer satisfies the criteria for a True Random Number Generator (TRNG). While dedicated quantum random number generator (QRNG) hardware is the preferred source of unpredictable entropy, it is often expensive and difficult to deploy in virtualized/cloud environments and Internet of Things (IoT) devices. Furthermore, hardware RNG integration typically requires cryptographic applications to adhere to vendor-specific APIs. This article proposes a user-space integration approach for a shared , potentially remote QRNG device. We develop a QRNG service on top of D-Bus, a ubiquitous inter-process communication framework. It serves as an interface for applications to retrieve true random numbers. Communication with the remote QRNG device occurs over mutually authenticated TLS 1.3 channels, protected by post-quantum cryptography (PQC) algorithms. We show, as a proof-of-concept, how the proposed D-Bus service can be integrated into the OpenSSL 3 cryptographic library, demonstrating the use of TRNG in a wide range of Linux applications. Our approach is resistant to entropy starvation attacks, supports sharing a QRNG across host and virtualized environments, requires no kernel-level or system-wide modifications, supports mixing multiple sources of entropy, and configuration of post-processing. It provides applications with a TRNG interface suitable for information-theoretically secure (ITS) use cases.
Quantum Random Number Generators (QRNGs) provide physically unpredictable entropy essential for cryptography, modeling, and scientific research. Local generation is preferred for the highest level of security, as it eliminates the risks associated with transmitting data over a network. At the same time, public QRNG web services accessible via the API serve as a valuable tool in cases where dedicated hardware is unavailable, enabling rapid integration into software prototypes, statistical testing, large-scale simulations, and educational projects. Combining local and remote sources makes it possible to optimize the balance between security, accessibility, and performance. This article helps to develop and justify a typical QRNG web service infrastructure, which includes functional components, security requirements, access interfaces (API), methods for quality control of randomness, and recommendations for scalability. The proposed infrastructure is intended to serve as a foundation for creating interoperable, secure, and efficient web services of quantum entropy sources.
Quantum Random Number Generators (QRNG), based on physical processes of quantum mechanics, provide a high level of entropy and unpredictability, making them a promising source of randomness for use in information and communication systems, particularly in the context of post-quantum cryptography. However, using the QRNG in the format of a web service (e.g., via public APIs or cloud platforms) introduces new attack vectors that may compromise the trust in the generated data. This work develops a threat model and an offender model for a QRNG web service. The methodological foundation of the study is based on modern risk analysis standards, including the ISO/IEC 27005, STRIDE, and Common Criteria. Critical system assets are identified, potential threats are classified considering the specifics of quantum generation, and an offender profile is constructed. Typical attack scenarios are considered, including random number interception, physical generator compromise, API service attacks, and insider threats. For each scenario, a risk assessment is performed based on the likelihood of occurrence and potential consequences. A comprehensive set of protection measures is proposed, including technical (TLS, post-processing, monitoring), organizational (access control, auditing), and procedural (incident response)solutions. The results of this work can be used to develop secure QRNG services integrated into critical cryptographic systems and serve as a basis for further research in the field of quantum technology security modeling.
The advancement of quantum computing creates a big threat to classical cryptographic protocols, including TLS, which is responsible for secure internet communications. While recent industry and academic efforts have focused on integrating lattice-based post-quantum key encapsulation mechanisms (KEMs) such as Kyber+X25519 into hybrid TLS handshakes, these approaches often prioritize performance at the cost of cryptanalytic diversity. Code-based KEMs, despite their proven security measure they remain underexplored in hybrid frameworks due to some limitations like large key sizes and integration complexity. This paper proposes a novel hybrid TLS framework that explicitly incorporates code-based post-quantum cryptography—specifically McEliece—alongside classical key exchange mechanisms. The framework introduces a dual-handshake mechanism, adaptive parameter selection, and seamless fallback negotiation, enabling flexible deployment across heterogeneous networks while ensuring backward compatibility. Integration with Quantum Random Number Generators (QRNGs) and multifactor authentication further increases entropy quality and session security. We implemented and evaluated the framework using an OpenSSL-OQS integration. We measure handshake latency, CPU utilization, memory usage, and throughput across emulated and real-world testbeds. Results show that the proposed hybrid approach achieves up to 30% lower latency and significantly reduced resource overhead compared to pure post-quantum TLS variants, while maintaining near-classical efficiency levels. Mathematical modeling formalizes these trade-offs which offers a foundation for optimizing deployment in both resource-constrained IoT devices and high-performance servers. By advancing cryptographic diversity and aligning with emerging NIST and IETF standardization efforts, the proposed framework provides a practical pathway toward quantum-resilient secure communication.It shows that code-based post-quantum cryptography can be added to current TLS systems without any problems, keeping security, performance, and compatibility in mind as we get ready for the quantum age.