Physical and quantum random number generators (QRNGs) do not emit uniform bits: detector bias, dead time, after-pulsing, and environmental drift leave their raw output biased, correlated, and partially predictable to an adversary who models the device. Deployable generators therefore include a conditioning (randomness-extraction) stage that distils near-uniform keys from a source of certified min-entropy, and the cryptographic workhorse of that stage is the Leftover Hash Lemma (LHL). This paper analyses two ways in which real deployments depart from the textbook LHL. First, a physical source has no fixed min-entropy: continuous health tests, as standardised in NIST SP 800-90B, produce a runtime lower-bound estimate that varies from block to block and can occasionally be optimistic. Driving the extractor output length from this estimate, we prove an online adaptive extraction theorem whose security bound cleanly composes the estimator soundness error with the extractor error, yielding a (δ+ε)-secure key and separating how often the entropy estimate is optimistic from how uniform the hash output is, as two independently tunable budgets. Second, for settings that publish or reuse the extractor seed — public randomness beacons, reproducible pipelines, and seed-constrained devices — we prove that publishing the seed costs nothing, since this is the defining property of a strong extractor, and that reusing a single seed across m independent source blocks costs at most mε in statistical distance. A corollary bounds the security loss when the extracted key is consumed by a downstream symmetric primitive, and a worked instantiation with realistic QRNG parameters reports the achievable secret-key rate. A reproducible numerical simulation on a synthetic biased source corroborates all four claims. Throughout, we are explicit about the single load-bearing unproven premise — empirical min-entropy certification of the physical device — which belongs to entropy-source validation and lies outside the scope of the analysis.
Physical and quantum random number generators (QRNGs) do not emit uniform bits: detector bias, dead time, after-pulsing, and environmental drift leave their raw output biased, correlated, and partially predictable to an adversary who models the device. Deployable generators therefore include a conditioning (randomness-extraction) stage that distils near-uniform keys from a source of certified min-entropy, and the cryptographic workhorse of that stage is the Leftover Hash Lemma (LHL). This paper analyses two ways in which real deployments depart from the textbook LHL. First, a physical source has no fixed min-entropy: continuous health tests, as standardised in NIST SP 800-90B, produce a runtime lower-bound estimate that varies from block to block and can occasionally be optimistic. Driving the extractor output length from this estimate, we prove an online adaptive extraction theorem whose security bound cleanly composes the estimator soundness error with the extractor error, yielding a (δ+ε)-secure key and separating how often the entropy estimate is optimistic from how uniform the hash output is, as two independently tunable budgets. Second, for settings that publish or reuse the extractor seed — public randomness beacons, reproducible pipelines, and seed-constrained devices — we prove that publishing the seed costs nothing, since this is the defining property of a strong extractor, and that reusing a single seed across m independent source blocks costs at most mε in statistical distance. A corollary bounds the security loss when the extracted key is consumed by a downstream symmetric primitive, and a worked instantiation with realistic QRNG parameters reports the achievable secret-key rate. A reproducible numerical simulation on a synthetic biased source corroborates all four claims. Throughout, we are explicit about the single load-bearing unproven premise — empirical min-entropy certification of the physical device — which belongs to entropy-source validation and lies outside the scope of the analysis.
Random number generators (RNGs) are foundational to modern cryptographic systems.While quantum random number generators (QRNGs) leverage inherently stochastic quantum measurements, practical deployments still exhibit implementation artifacts (e.g., detector dead time, afterpulsing, drift) that can introduce bias, correlation, and non-stationarity.This paper presents a unified validation framework for both CMOS true random number generators (TRNGs) and QRNGs under NIST SP 800-90B entropy source validation.Rather than simulating quantum physics, we model observable raw-output behaviors of practical implementations and evaluate them using a consistent pipeline: raw capture constraints, IID screening, conservative min-entropy bounding, and online health testing (repetition count test and adaptive proportion test).Using synthetic sources that emulate typical CMOS and QRNG failure modes, we demonstrate how similar artifacts drive the IID versus non-IID decision and tighten entropy bounds, motivating a vendor-agnostic, reproducible validation methodology.
Random numbers play a crucial role in cryptography since the security of cryptographic protocols relies on the assumption of the availability of uniformly distributed and unpredictable random numbers to generate secret keys, passwords, initialization vectors, nonces, salt, etc. True Random Number Generators (TRNGs) extract random numbers from physical processes (such as radioactive decay, thermal noise, and atmospheric noise) that are inherently unpredictable. However, real-world random number generators sometimes fail and produce outputs with low entropy, leading to security vulnerabilities. It is commonly observed that the TRNG outputs have statistical biases and dependencies that make them unsuitable to be directly used for cryptographic purposes. There are some standards and guidelines on generating and testing random numbers that are suitable for cryptographic applications. The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-90 series provide guidelines and recommendations for generating random numbers for cryptographic applications and describes statistical randomness testing, estimating min-entropy with 10 black-box entropy estimation methods. In this thesis, we evaluate the effectiveness and limitations of the SP 800-90B methods by exploring the accuracy of these estimators using simulated random numbers with known entropy, investigating the correlation between entropy estimates, and studying the impacts of deterministic transformations on the estimators. To understand the unpredictability of the outputs, it is important to estimate their entropy accurately. The National Institute of Standards and Technology (NIST) Special Publication (SP) 800-90B specifies ten min-entropy estimators ranging from simple frequency-based estimators to more advanced approaches. Each estimator has specific assumptions, making them suitable for different types of sources. The minimum of these estimates is assumed to be the min-entropy of the TRNG. We propose a new entropy estimator (estimates min-entropy and also Shannon entropy) called index-value coincidence estimate that is suitable for outputs that might include some dependencies and we also provide some experimental results that demonstrate the effectiveness of the estimator. Additionally, TRNGs may be affected by outside conditions such as temperature, humidity, etc. Health tests are an integral part of the noise source of TRNG, defined to detect unexpected changes in the working process and dramatic changes in the amount of entropy generated by the noise source. Existing health test suites are examined, and a health test suite for cryptographic TRNGs is introduced by using random variables weight, run, runs of length 1 and overlapping templates. Some suggested parameters and experimental results are given.
Extraction of uniform randomness from (noisy) non-uniform sources is an important primitive in many security applications, e.g. (pseudo-)random number generators, privacy-preserving biometrics, and key storage based on Physical Unclonable Functions. Generic extraction methods exist, using universal hash functions. There is a trade-off between the length of the extracted bit string and the uniformity of the string. In the literature there are proven lower bounds on this length as a function of the desired uniformity. The best known bound involves a quantity known as smooth min-entropy. Unfortunately, there exist at least three definitions of smooth entropy. In this paper we compare three of these definitions, and we derive improved lower bounds on the extractable randomness.\nWe also investigate the use of almost universal hash functions, which are slightly worse at extracting randomness than universal hash functions, but are preferable in practice because they require far less resources in devices. We show that using them has negligible effect on the extractable randomness.\nKeywords: Leftover Hash Lemma; Universal hash function; Randomness extraction
This paper considers two challenges faced by practical quantum networks: the bootstrapping of seedless Quantum Random Number Generators (QRNGs) and the resilient combination of Post-Quantum Cryptography (PQC) and Quantum Key Distribution (QKD) keys. These issues are addressed using universal hash functions as strong seeded extractors, with security foundations provided by the Quantum Leftover Hash Lemma (QLHL). First, the 'randomness loop' in QRNGs -- the requirement of an initial random seed to generate further randomness -- is resolved by proposing a bootstrapping method using raw data from two independent sources of entropy, given by seedless QRNG sources. Second, it is argued that strong seeded extractors are an alternative to XOR-based key combining that presents different characteristics. Unlike XORing, our method ensures that if the combined output and one initial key are compromised, the remaining key material retains quantifiable smooth min-entropy and remains secure in exchange of longer keys. Furthermore, the proposed method allows binding of transcript information with key material in a natural way, providing a tool to replace computationally based combiners to extend ITS security of the initial key material to the final combined output. By modeling PQC keys as having HILL (Hastad, Impagliazzo, Levin and Luby) entropy, the framework is extended to hybrid PQC-QKD systems. This unified approach provides a mathematically rigorous and future-proof mechanism for both randomness generation and secure key management against quantum adversaries.
How to generate provably true randomness with minimal assumptions? This question is important not only for the efficiency and the security of information processing, but also for understanding how extremely unpredictable events are possible in Nature. All current solutions require special structures in the initial source of randomness, or a certain independence relation among two or more sources. Both types of assumptions are impossible to test and difficult to guarantee in practice. Here we show how this fundamental limit can be circumvented by extractors that base security on the validity of physical laws and extract randomness from untrusted quantum devices. In conjunction with the recent work of Miller and Shi (arXiv:1402:0489), our physical randomness extractor uses just a single and general weak source, produces an arbitrarily long and near-uniform output, with a close-to-optimal error, secure against all-powerful quantum adversaries, and tolerating a constant level of implementation imprecision. The source necessarily needs to be unpredictable to the devices, but otherwise can even be known to the adversary. Our central technical contribution, the Equivalence Lemma, provides a general principle for proving composition security of untrusted-device protocols. It implies that unbounded randomness expansion can be achieved simply by cross-feeding any two expansion protocols. In particular, such an unbounded expansion can be made robust, which is known for the first time. Another significant implication is, it enables the secure randomness generation and key distribution using public randomness, such as that broadcast by NIST's Randomness Beacon. Our protocol also provides a method for refuting local hidden variable theories under a weak assumption on the available randomness for choosing the measurement settings.
For quantum random number generators (QRNGs), strong security guarantees can be obtained under various assumptions. The most well-known assumptions are the non-signalling assumption (needed for device-independent (DI) QRNG) and post-quantum computational assumptions (needed for computationally bounded single-prover QRNG protocols). In this work, we study a third model: a simple prepare-and-measure QRNG whose security relies on physically motivated energy constraints. This physically motivated set-up allows for easier implementations of QRNGs and can supply better rates.
So far, previous works that studied the energy-constrained model either assumed that the adversary is classical in their security proof or supplied relatively weak bounds on the certified randomness, by bounding the conditional min-entropy. In this work, we prove a new, essentially tight, lower bound on the single-round von Neumann entropy against adversaries holding both classical and quantum side-information. Our work reveals that working with the von Neumann entropy, rather than the min-entropy, in the quantum case can lead to a major improvement, nearly matching the classical bound in many cases. We further study the robustness of our entropy bound. Since the single-round von Neumann entropy is the main quantity of interest when characterizing the key rate of QRNGs, our bound establishes the main ingredient for rigorous security proofs against general quantum attacks in this framework.