Radiotekhnika

Threat and adversary models for QRNG web services

D.M. Morhul, Олексій Нарєжній, T.O. Hrinenko

Published Jun 19, 2025• 0 citations

Abstract

Quantum Random Number Generators (QRNG), based on physical processes of quantum mechanics, provide a high level of entropy and unpredictability, making them a promising source of randomness for use in information and communication systems, particularly in the context of post-quantum cryptography. However, using the QRNG in the format of a web service (e.g., via public APIs or cloud platforms) introduces new attack vectors that may compromise the trust in the generated data. This work develops a threat model and an offender model for a QRNG web service. The methodological foundation of the study is based on modern risk analysis standards, including the ISO/IEC 27005, STRIDE, and Common Criteria. Critical system assets are identified, potential threats are classified considering the specifics of quantum generation, and an offender profile is constructed. Typical attack scenarios are considered, including random number interception, physical generator compromise, API service attacks, and insider threats. For each scenario, a risk assessment is performed based on the likelihood of occurrence and potential consequences. A comprehensive set of protection measures is proposed, including technical (TLS, post-processing, monitoring), organizational (access control, auditing), and procedural (incident response)solutions. The results of this work can be used to develop secure QRNG services integrated into critical cryptographic systems and serve as a basis for further research in the field of quantum technology security modeling.

DOI: 10.30837/rt.2025.2.221.04

Related papers

Classification of attacks and cyber security requirements for the QRNG web resource

D.M. Morhul, Олексій Нарєжній, T.O. Hrinenko

Web services of quantum random number generators (QRNG) open new opportunities for enhancing the resilience of cryptographic systems due to their ability to generate true random numbers based on quantum effects. Unlike pseudo-random number generators (PRNG), the QRNG ensures a high level of unpredictability in output data, making them critical components in modern security systems. However, their implementation is accompanied by significant challenges, particularly due to potential attacks at the software level and during integration with hardware infrastructure. At the software level, major threats include attacks on cryptographic libraries, substitution or manipulation of runtime output data, and side-channel attacks exploiting information leaks from physical number generation processes. At the hardware level, risks arise from equipment defects, failures in integration processes, or improper operation of the QRNG in combination with other systems. This study provides a classification of the main types of attacks on QRNG web services, presents an analysis of existing attacks, and introduces modern approaches to their prevention. Among the key solutions are the certification of the QRNG during development and deployment, multi-factor verification of output data to ensure unpredictability, and the use of monitoring systems with artificial intelligence algorithms for anomaly detection. Special attention is given to hybrid protection methods that combine the QRNG with quantum key distribution (QKD) and post-quantum cryptographic algorithms, allowing for the mitigation of risks from both classical and quantum attacks. Thus, a comprehensive combination of software and hardware security methods will enhance the reliability of QRNG and their resilience to modern threats. Further research should focus on the implementation of unified standards for QRNG and the optimization of their integration into existing cryptographic systems.

RadiotekhnikaApr 10, 20250 citations

Development of a typical infrastructure for a quantum random number generator web service

D.M. Morhul, O.P. Nariezhnii, T.O. Hrinenko

Quantum Random Number Generators (QRNGs) provide physically unpredictable entropy essential for cryptography, modeling, and scientific research. Local generation is preferred for the highest level of security, as it eliminates the risks associated with transmitting data over a network. At the same time, public QRNG web services accessible via the API serve as a valuable tool in cases where dedicated hardware is unavailable, enabling rapid integration into software prototypes, statistical testing, large-scale simulations, and educational projects. Combining local and remote sources makes it possible to optimize the balance between security, accessibility, and performance. This article helps to develop and justify a typical QRNG web service infrastructure, which includes functional components, security requirements, access interfaces (API), methods for quality control of randomness, and recommendations for scalability. The proposed infrastructure is intended to serve as a foundation for creating interoperable, secure, and efficient web services of quantum entropy sources.

RadiotekhnikaSep 18, 20250 citations

AI-BASED QUANTUM RANDOM NUMBER GENERATION FOR SECURE COMMUNICATIONS

Narayana Gaddam

One of the solutions to the problem of secure communication is the Quantum Random Number Generators (QRNGs) which generate true randomness based on quantum mechanical principles.QRNGs are different from conventional pseudo random number generator in that they use quantum uncertainty to generate outputs which are very unpredictable.This work attempts to examine different QRNG architectures, study the possible integration of cryptographic frameworks with these architectures and highlight potential vulnerabilities in the integration of cryptographic frameworks with QRNG architectures.Post-processing techniques, i.e.Zero-Phase Component Analysis (ZPCA) and neural network based techniques are also studied to increase entropy and suppress environmental noise in QRNG systems.Key findings show that system jitter models based QRNG architectures are more scalable and less expensive for use in real world applications.Additionally, incorporating cryptographic protocols with the QRNGs endows them with the ability to resist quantum threats, and hence, provide better key distribution in the secure IoT communication frameworks.However, as security problems such as side channel attacks and hardware manipulation are still big issues.It also points out some of the emerging research trends including hybrid QRNG architectures, i.e., QRNG with classical PRNG to increase the entropy rate.As such, the proposed methodologies attempt to enhance QRNG scalability, security, and energy efficiency in cloud infrastructures, in mobile systems and in critical security environments.The advancement of these technologies will assume a crucial function in the advancement of quantum-safe frames for current advanced computerized foundation.

May 10, 20230 citations

Quantum Random Number Generators for NIST Post-Quantum Cryptography Standard Algorithms

Abel C. H. Chen

In recent years, the advancement of quantum computing technology has posed potential security threats to RSA cryptography and elliptic curve cryptography. In response, the National Institute of Standards and Technology (NIST) published several Federal Information Processing Standards (FIPS) of post-quantum cryptography (PQC) in August 2024, including the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA). Although these PQC algorithms are designed to resist quantum computing attacks, they may not provide adequate security in certain specialized application scenarios. To address this issue, this study proposes quantum random number generator (QRNG)-based PQC algorithms. These algorithms leverage quantum computing to generate random numbers, which serve as the foundation for key pair generation, key encapsulation, and digital signature generation. A generalized architecture of QRNG is proposed, along with the design of six QRNGs. Each generator is evaluated according to the statistical validation procedures outlined in NIST SP 800-90B, including tests for verification of entropy sources and independent and identically distributed (IID) outputs. Experimental results assess the computation time of the six QRNGs, as well as the performance of QRNG-based ML-KEM, QRNG-based ML-DSA, and QRNG-based SLH-DSA. These findings provide valuable reference data for future deployment of PQC-based Transport Layer Security in web systems.

arXiv:2507.21151Journal of Web EngineeringJul 6, 20260 citations

The Role of Quantum Random Number Generators in Cybersecurity

Mmaduekwe Ebuka Paul, Ugochukwu Mmaduekwe, Tolu-iloriIyanuoluwa Tolu-iloriIyanuoluwa

The success of cybersecurity security depends on cryptographic protocols because they shield sensitive information as well as communication channels and serve to authenticate procedures. These protocols derive their foundation from producing robust random numbers because these numbers serve as the basis for encryption key creation and digital signature generation along with secure access protocols. Random number generators used traditionally such as PRNGs and HRNGs suffer from determinism, and predictability flaws combined with the risk of outside tampering thus affecting their reliability. The weaknesses in cryptographic security become dangerous because of the rising quantum computer threats that would break current encryption methods. Quantum Random Number Generators (QRNGs) introduce revolutionary changes through the quantum mechanics properties of quantum superposition and photon polarization and vacuum fluctuations for truly random number generation. The use of QRNGs brings high-security benefits by giving algorithms unpredictable outputs that hackers cannot predict nor alter without being detected. Implementing QRNGs in cybersecurity networks enables better encryption algorithms as well as securely protected communication systems with strong resistance against contemporary cyber attacks. This article outlines the advantages of QRNGs over traditional RNGs, applications in cryptographic systems, and how they can protect against threats from emerging quantum computing technologies. It also covers the challenges in implementing QRNGs, including hardware complexity, cost, and integration into existing security infrastructures. As cyber threats continue to evolve, QRNGs represent an important milestone in ensuring robust and future-proof cryptographic security

International Journal of Advances in Engineering and ManagementFeb 1, 20250 citations

Integration of quantum random number generators with post-quantum cryptography algorithms

Paula Alonso Blanco, Luis Trigo Vidarte, Marc Romeu Casas +4 more

As quantum technologies advance, the security of popular cryptographic protocols becomes more threatened by the capabilities of Cryptographically Relevant Quantum Computers (CRQCs). In this scenario, Post-Quantum Cryptography (PQC) has become a potential solution to prolong the life of existing Public Key Infrastructure (PKI) systems. However, PQC protocols depend on high-quality randomness for key generation and encapsulation procedures, with the quality of the entropy source potentially having a profound impact on the security of the overall system. In this work, we demonstrate a proof-of-concept enabling the incorporation of Quantum Random Number Generation (QRNG) devices within communication networks using PQC-based Transport Layer Security (TLS).Using open-source cryptographic libraries and commercial QRNG hardware, we demonstrate their use as entropy sources via an Entropy-as-a-Service (EaaS) model. We highlight two particular use cases: a fully virtualized private PKI network and a connection to an external PQC-enabled server. Experimental results show that EaaS QRNG enables real-time entropy monitoring and quality assessment in cryptographic management systems, with negligible impact on TLS handshake time.

arXiv:2507.00658International Conference on Transparent Optical NetworksJul 6, 20250 citations