Random number generators (RNGs) are foundational to modern cryptographic systems.While quantum random number generators (QRNGs) leverage inherently stochastic quantum measurements, practical deployments still exhibit implementation artifacts (e.g., detector dead time, afterpulsing, drift) that can introduce bias, correlation, and non-stationarity.This paper presents a unified validation framework for both CMOS true random number generators (TRNGs) and QRNGs under NIST SP 800-90B entropy source validation.Rather than simulating quantum physics, we model observable raw-output behaviors of practical implementations and evaluate them using a consistent pipeline: raw capture constraints, IID screening, conservative min-entropy bounding, and online health testing (repetition count test and adaptive proportion test).Using synthetic sources that emulate typical CMOS and QRNG failure modes, we demonstrate how similar artifacts drive the IID versus non-IID decision and tighten entropy bounds, motivating a vendor-agnostic, reproducible validation methodology.
Random number generators (RNGs) are foundational to modern cryptographic systems.While quantum random number generators (QRNGs) leverage inherently stochastic quantum measurements, practical deployments still exhibit implementation artifacts (e.g., detector dead time, afterpulsing, drift) that can introduce bias, correlation, and non-stationarity.This paper presents a unified validation framework for both CMOS true random number generators (TRNGs) and QRNGs under NIST SP 800-90B entropy source validation.Rather than simulating quantum physics, we model observable raw-output behaviors of practical implementations and evaluate them using a consistent pipeline: raw capture constraints, IID screening, conservative min-entropy bounding, and online health testing (repetition count test and adaptive proportion test).Using synthetic sources that emulate typical CMOS and QRNG failure modes, we demonstrate how similar artifacts drive the IID versus non-IID decision and tighten entropy bounds, motivating a vendor-agnostic, reproducible validation methodology.
Abstract We present a quantum random number generator (QRNG) based on vacuum fluctuations that meets the statistical and structural entropy source validation criteria defined in NIST standards. We measured how optical imbalance in a balanced homodyne detector affects the dominance of vacuum fluctuations over the quadrature-phase noise of the local oscillator. Based on this analysis, we developed a simple and direct method to quantify the relative strength of vacuum noise, enabling precise balancing of the detector to maximize the vacuum fluctuation contribution. Our approach ensures that the raw entropy exhibits negligible auto-correlation and that the output samples are independent and identically distributed (i.i.d.), without relying on external post-processing beyond standard NIST-approved conditioning. Following a symbol-space reduction strategy guided by NIST SP 800-90B, we extract high-quality 8-bit entropy samples from 16-bit raw data. To produce full-entropy outputs, the samples are processed using the 384-bit version of the Secure Hash algorithm 3 (SHA3-384). The resulting quantum random numbers successfully pass all tests in the NIST statistical test suite (NIST SP 800-22) and achieve a generation rate of approximately 4 Gbps. This work demonstrates a practical and fully standards-aligned QRNG implementation using only vacuum fluctuations and vetted conditioning.
Physical and quantum random number generators (QRNGs) do not emit uniform bits: detector bias, dead time, after-pulsing, and environmental drift leave their raw output biased, correlated, and partially predictable to an adversary who models the device. Deployable generators therefore include a conditioning (randomness-extraction) stage that distils near-uniform keys from a source of certified min-entropy, and the cryptographic workhorse of that stage is the Leftover Hash Lemma (LHL). This paper analyses two ways in which real deployments depart from the textbook LHL. First, a physical source has no fixed min-entropy: continuous health tests, as standardised in NIST SP 800-90B, produce a runtime lower-bound estimate that varies from block to block and can occasionally be optimistic. Driving the extractor output length from this estimate, we prove an online adaptive extraction theorem whose security bound cleanly composes the estimator soundness error with the extractor error, yielding a (δ+ε)-secure key and separating how often the entropy estimate is optimistic from how uniform the hash output is, as two independently tunable budgets. Second, for settings that publish or reuse the extractor seed — public randomness beacons, reproducible pipelines, and seed-constrained devices — we prove that publishing the seed costs nothing, since this is the defining property of a strong extractor, and that reusing a single seed across m independent source blocks costs at most mε in statistical distance. A corollary bounds the security loss when the extracted key is consumed by a downstream symmetric primitive, and a worked instantiation with realistic QRNG parameters reports the achievable secret-key rate. A reproducible numerical simulation on a synthetic biased source corroborates all four claims. Throughout, we are explicit about the single load-bearing unproven premise — empirical min-entropy certification of the physical device — which belongs to entropy-source validation and lies outside the scope of the analysis.
Random number generators (RNGs) are essential for cryptographic applications. In most practical applications, the randomness of RNGs is provided by entropy sources. If the randomness is less than the expected, the security of cryptographic applications could be undermined. Accurate entropy estimation is a critical method for the evaluation of RNG security, and significant overestimation and underestimation are both inadvisable. The NIST Special Publication 800-90B is one of the most common certifications for entropy estimation. It makes no assumption of the entropy source and provides min-entropy estimation results by a set of entropy estimators. It estimates the entropy sources in two tracks: the IID (independent and identically distributed) track and non-IID track. In practice, non-IID entropy sources are more common, as physical phenomenon, sampling process or external perturbation could cause the dependency of the outputs. In this paper, we prove that the Collision Estimate and the Compression Estimate in non-IID track could provide significant underestimates in theory. In order to accurately estimate the min-entropy of non-IID sources, we provide a formula of minentropybased on conditional probability, and propose a new estimator to approximate the result of this formula. Finally, we perform experiments to compare our estimator with the NIST estimators using simulated non-IID data. Results show that our estimator gives close estimates to the real min-entropy.
This work examines how thermal stress (0 • C to 60 • C) affects the physical entropy of commercial Quantum (QRNG) and True (TRNG) Random Number Generators.Using the NIST SP 800-90B test suite, we show that elevated and extreme temperatures induce hardware-level structural asymmetries.With the macroscopic chi-square test, we find that TRNG deteriorate approximately linearly with temperature, while QRNG displays more complex but effectively temperatureinvariant behavior due to active hardware compensation.We further show that fixed-rate cryptographic extractors can mask these physical degradations, silently weakening information-theoretic security.These findings highlight the need for adaptive and environment-sensitive randomness extraction to ensure robust cryptographic security under realistic operating conditions.
In recent years, the advancement of quantum computing technology has posed potential security threats to RSA cryptography and elliptic curve cryptography. In response, the National Institute of Standards and Technology (NIST) published several Federal Information Processing Standards (FIPS) of post-quantum cryptography (PQC) in August 2024, including the Module-Lattice-Based Key-Encapsulation Mechanism (ML-KEM), Module-Lattice-Based Digital Signature Algorithm (ML-DSA), and Stateless Hash-Based Digital Signature Algorithm (SLH-DSA). Although these PQC algorithms are designed to resist quantum computing attacks, they may not provide adequate security in certain specialized application scenarios. To address this issue, this study proposes quantum random number generator (QRNG)-based PQC algorithms. These algorithms leverage quantum computing to generate random numbers, which serve as the foundation for key pair generation, key encapsulation, and digital signature generation. A generalized architecture of QRNG is proposed, along with the design of six QRNGs. Each generator is evaluated according to the statistical validation procedures outlined in NIST SP 800-90B, including tests for verification of entropy sources and independent and identically distributed (IID) outputs. Experimental results assess the computation time of the six QRNGs, as well as the performance of QRNG-based ML-KEM, QRNG-based ML-DSA, and QRNG-based SLH-DSA. These findings provide valuable reference data for future deployment of PQC-based Transport Layer Security in web systems.
Quantum random number generators (QRNGs) play a crucial role in cryptography, secure communications, and stochastic simulations. This study presents the metrological characterization of a QRNG implemented on the Quandela photonic quantum computer, available via the cloud. The system generates random sequences using single photons and beam splitters, where quantum superposition ensures a fundamentally probabilistic outcome. A key aspect of this characterization involves defining the sample size and the number of qubits used. The Quandela quantum processor operates with up to six qubits, corresponding to six photons in twelve optical modes. However, the simultaneous use of multiple photons can introduce unintended correlations due to quantum interference, affecting the quality of randomness. To ensure independent bit generation, experiments were conducted with a single photon per measurement, producing one-bit outcomes per detection event. The analysis focuses on repeatability and reproducibility, examining the statistical properties of the generated sequences. Raw sequences underwent randomness testing using NIST SP800-22 and entropy assessment with NIST SP800-90B. Initial results indicate that raw sequences exhibit biases due to imperfections in single-photon sources and optical elements. The sequences generated by the Quandela photonic quantum processor failed most NIST SP800-22 tests, including Frequency (Global and Block), Runs, and Approximate Entropy, with six tests showing a 100% failure rate. Additionally, under the NIST SP800-90B evaluation, 100% of the raw sequences failed the independence and identically distributed (IID) test, highlighting strong correlations and statistical dependencies. To enhance randomness quality, post-processing techniques were applied, including Von Neumann and the combination Samuelson + Von Neumann extractors. These methods significantly improved bit balance and reduced statistical dependencies. After post-processing, all sequences passed the NIST SP800-90B IID test, and the entropy per bit increased to 0.771 ± 0.005 for the Ascella processor, ensuring improved randomness quality. The findings highlight the metrological challenges in QRNGs based on photonic quantum processors, emphasizing the need for rigorous statistical validation. Despite system-specific noise, the quantum origin of randomness remains preserved, ensuring that the extracted sequences retain their fundamental unpredictability. Additionally, limitations associated with photonic quantum systems, such as hardware imperfections, photon losses, and optical misalignment, are discussed in the context of their impact on randomness quality. Despite these limitations, rigorous statistical validation and post-processing enable the generation of high-quality random sequences suitable for cryptographic protocols, secure key distribution, and high-performance computing This study reinforces the importance of metrology in quantum technologies, providing a structured methodology for optimizing QRNG reliability and performance.