Quantum Random Number Generators

I. MOTIVATION

• QRNGs use quantum effects to produce random numbers, are simpler and mature enough for practical use, and include commercial products, online services, and extensive research on extraction and certification.The review focuses especially on QRNGs based on quantum optics.Source: §I · p. 2
• The review covers QRNG architectures, randomness measures, radioactive decay, electronic noise, quantum optics, non-optical phenomena, extraction, amplification, statistical testing, and future challenges.It also surveys protocols that process or certify random strings and complements earlier surveys with a focus on quantum optics.Source: §I · p. 2

II. RANDOM NUMBERS AND THEIR APPLICATIONS

• Random numbers are essential in science, technology, and everyday life, supporting applications such as cryptography, simulation, network coordination, and lotteries.This section focuses on generating random numbers for computers and uses operational definitions suited to different applications.Source: §II · p. 2

A. Pseudorandom number generators and true random number generators

• PRNGs use deterministic algorithms and typically expand a short seed into a long sequence with uniform-distribution statistics, making them fast and reproducible despite not being truly random.Large periods are sought so repetition does not appear during intended operation; MT19937 has period 2^19937 −1 and is widely used.Source: A. Pseudorandom number generators and… · p. 3
• Applications requiring outputs that cannot be guessed generally use TRNGs, which measure unpredictable physical processes or gather entropy from physical and system events.Physical sources include electronic thermal noise, oscillators, biometric parameters, and processor-integrated generators with conditioning circuits.Source: A. Pseudorandom number generators and… · pp. 3–4
• QRNGs are physical TRNGs whose bits arise from inherently random quantum events rather than uncertainty caused by incomplete knowledge of a classical system.They therefore provide well-defined intrinsic randomness, whereas classical physical generators may rely on unpredictability, chaotic behavior, or incomplete models.Source: A. Pseudorandom number generators and… · p. 4
• Advanced QRNGs address traditional TRNG limitations by offering trusted sources and generation rates normally above the megabit per second, enabling applications requiring continuous random streams.Traditional physical generators may suffer limited rates, difficult randomness justification, external-device inconvenience, and hard-to-detect failures.Source: A. Pseudorandom number generators and… · p. 4

B. Random numbers in simulation

• Simulation models use random numbers to represent omitted effects, making sound random sampling essential across engineering, science, business, and computer science.Monte Carlo and Quasi-Monte Carlo methods solve complex problems by averaging many random instances, often using PRNGs that follow the required statistics.Source: B. Random numbers in simulation · p. 5
• Faulty PRNGs can yield incorrect simulation results through long-range correlations or bad initialization, including documented failures in Ising-model calculations.Generators that pass usual statistical tests may still exhibit structural bias, while a poor seed can produce correlated output.Source: B. Random numbers in simulation · p. 5
• True RNGs are seldom used for simulation because they are slower and difficult to reproduce, but QRNGs can support Monte Carlo runs and may become viable as generation rates improve.Current QRNG rates remain a few orders of magnitude below good PRNGs, and direct use requires storing sequences for repeatability and efficient processor interfacing.Source: B. Random numbers in simulation · p. 5

C. Random numbers in cryptography

• Cryptographic randomness must be uniform, unpredictable, and resistant to recovery of either future or previous outputs, while limiting damage after key compromise.These requirements are commonly framed as forward security, backward security, and polynomial-time unpredictability.Source: C. Random numbers in cryptography · p. 6
• Most ordinary PRNGs are unsuitable for cryptography because their internal states or outputs can be predicted, whereas CSPRNGs use number-theoretic or cryptographic constructions under computational assumptions.Blum Blum Shub preserves unpredictability toward preceding bits unless quadratic residuosity is efficiently solved, but a quantum computer using Shor’s algorithm could break it by factoring N.Source: C. Random numbers in cryptography · p. 6
• Weak seeding and initialization have caused serious cryptographic vulnerabilities, including predictable SSL keys, low-entropy OpenSSL keys, weak RSA keys, repeated smart-card keys, and predictable Android sequences.If a secure transformation receives too little entropy, attackers can brute-force possible seeds and reconstruct generated keys.Source: C. Random numbers in cryptography · p. 7
• QRNGs can provide additional entropy for CSPRNG seeding or directly generate keys after postprocessing, provided environmental sensitivity, targeted attacks, and online health testing are addressed.In QKD, biased or controlled measurements can enable attacks; QRNGs supply the assumed true randomness and can be integrated with modest cost and equipment changes.Source: C. Random numbers in cryptography · pp. 6–7

D. Random numbers in fundamental science

• Quantum randomness removes possible bias in foundational experiments and supports decisions independent of prior system states, reflecting quantum mechanics’ privileged status as a source of true randomness.This role is especially important in experimental tests of quantum foundations and was historically applied to remove bias in parapsychology experiments (Schmidt, 1970a,b).Source: D. Random numbers in fundamental science · p. 7
• QRNGs enable rapid random basis choices in Bell-inequality tests, using either an external QRNG-driven switch or passive photon-path separation under suitable conditions.The cited experiments include Weihs et al. (1998), Scheidl et al. (2010), Jennewein et al. (2000), Tittel et al. (1999), and Gisin and Zbinden (1999).Source: D. Random numbers in fundamental science · pp. 7–8
• Wheeler’s delayed-choice experiments require a fast, truly random decision after photon entry, implemented with detector switching or QRNGs based on amplified white-light shot noise.The photon can exhibit wave, particle, or intermediate behavior with different visibility and distinguishability; implementations include Alley et al. (1984) and Jacques et al. (2007, 2008).Source: D. Random numbers in fundamental science · p. 8
• QRNGs also support delayed-choice entanglement swapping and quantum-erasure experiments, including decisions about entanglement and the erasure of path information using the QRNG of Jennewein et al. (2000).These experiments are associated with Yurke and Stoler (1992), Zukowski et al. (1993), Peres (2000), Ma et al. (2012), and Ma et al. (2013a).Source: D. Random numbers in fundamental science · p. 8

III. BLOCK DESCRIPTION

• More sophisticated randomness extraction preserves more available random bits but runs more slowly, so overall bit rate depends on the tradeoff between extraction efficiency and processing complexity.Some generators omit postprocessing when raw bias is negligible, whereas others use faster or more complex hardware to remove bias.Source: §III · p. 8
• A physical random number generator measures an unpredictable physical quantity, converts it into a potentially biased raw bit sequence, and postprocesses it into a smaller ideally bias-free sequence.Figure 1 attributes residual bias to measurement and quantization noise and bases extraction on an estimate of the raw sequence’s available randomness.Source: Figure 1 · p. 8, §III · p. 8
• The review surveys radioactive decay, quantum-optical, and non-optical entropy sources, alongside entropy measures, classical postprocessing, quantum protocols, and device-independent generators that link measurement, estimation, and extraction.Device-independent generators are discussed together because their physical measurement process and randomness estimation and extraction are intimately linked.Source: §III · pp. 8–9

• Shannon entropy measures the average bits needed to describe outcomes, reaching log2 N for a uniform alphabet and decreasing for biased distributions.For four-sided dice, the fair distribution has H(X) = 2, while the loaded distribution has H(X) = 1.75.Source: §IV · p. 9, Table I · p. 9
• Min-entropy k bounds every outcome probability by 2^-k and represents the number of uniform bits extractable from a distribution.Explicit extractors such as Trevisan’s can produce almost k nearly uniform bits when supplied with ancillary random bits of good quality.Source: §IV · p. 10
• Conditional min-entropy measures how well an adversary holding correlated system B can guess outcomes generated by system A, including quantum side information.Without side information, it reduces to ordinary min-entropy; classically, 2^-H∞(A|B)ρ is the optimal guessing probability.Source: §IV · p. 10
• Smooth min-entropy gives single-sample bounds on extractable bits that remain nearly uniform and uncorrelated with an external system.It is therefore useful for estimating randomness from sources correlated with an attacker rather than relying only on asymptotic parameters.Source: §IV · p. 10
• Min-entropy estimation is generally intractable for unknown sources, but quantum random sources offer precise physical models for conservative bounds even with classical noise or eavesdroppers.Memory effects and correlations between consecutive experimental runs still require care to ensure independence and avoid experimental bias.Source: §IV · p. 10

A. The first quantum random number generators

• Radioactive decay offered an accessible source of quantum randomness, typically detected through β radiation using Geiger–Müller tubes that amplify particles into pulses.The detected event times are independent under stable source–detector conditions, with exponential interarrival times and Poisson-distributed pulse counts.Source: A. The first quantum random number… · p. 11
• Early generators converted detector pulses into digits using digital counters and either fast clocks, read at each detection, or slow clocks, read at fixed intervals.Fast-clock counter values require correction because their distribution is nonuniform, while slow-clock modulo-M outputs can reduce bias through contraction.Source: A. The first quantum random number… · p. 11, Figure 2 · p. 11
• Radioactive-decay QRNGs also generated analog noise by switching a voltage signal at each detection and low-pass filtering it into broadband Gaussian noise.These systems supported analog computation, testing, communications, and simulation applications.Source: A. The first quantum random number… · pp. 11–12

B. Evolution

• HotBits refined radioactive QRNGs by comparing consecutive Geiger-counter intervals and alternating the bit criterion to compensate for small systematic biases.The method outputs 0 when t1 > t2 and 1 when t1 < t2, reversing the assignment for successive pairs.Source: B. Evolution · p. 12, Figure 4 · p. 12
• Semiconductor detectors replaced Geiger counters in some designs, reducing voltage requirements while relying on amplification and event registration rather than precise particle-rate calibration.PIN photodiodes can detect radioactive decay, but their weaker signals and differing sensitivities require low-noise amplification and calibration.Source: B. Evolution · p. 12
• Alkassar et al. (2005) used a fast-clock level sampled at each pulse arrival, producing a bit directly from the clock state without postcorrection when time resolution was sufficient.The least significant bit of the digitized arrival time should then be random.Source: B. Evolution · p. 12
• Duggirala et al. (2010) proposed converting exponential arrival times to uniform outputs with an RC circuit or a fast-clock N-bit counter sampled at detection.The RC approach has specialized-hardware and noise limitations, whereas the counter requires ν ≫ λ so samples are uniform across 2^N values.Source: B. Evolution · p. 12

C. Limitations

• Radioactive-decay QRNGs provide high-quality randomness but usually below a few hundred kilobits per second, require hazardous sources, and face detector dead time and radiation damage.They remain suitable for low-speed applications such as seeding pseudorandom generators, whereas high-rate systems can use optical QRNGs.Source: C. Limitations · p. 13

VI. RANDOM NUMBER GENERATORS BASED ON NOISE

• Electronic-noise generators amplify and threshold voltage fluctuations or threshold-crossing times to produce random bits, but environmental variation, thermal-noise mixing, and memory effects limit their treatment here.Shot noise is quantum in origin, while thermal and flicker noise can contribute; some commercial and Zener-diode systems isolate quantum shot noise under suitable conditions.Source: §VI · pp. 13–14

VII. OPTICAL QUANTUM RANDOM NUMBER GENERATORS

• Most QRNGs use quantum optics because light sources and detectors are accessible, and optical implementations can be classified by generation mechanism, bit rate, and limitations.The review summarizes representative optical generators and their typical rates and constraints in Table II.Source: §VII · p. 14, Table II · p. 15

A. Quantum optics in random number generators

• Optical QRNGs commonly use photons in Fock or coherent states, with LEDs, weak lasers, or single-photon sources paired with PMTs, SPADs, or superconducting detectors.Binary detection is common because photon-number resolution remains limited, while detector cost and recovery dead time constrain implementations.Source: A. Quantum optics in random number… · p. 14

B. Branching path generators

• Balanced beam splitters convert a single photon’s path superposition into equiprobable detector clicks, which can directly encode 0 and 1 bits in branching-path QRNGs.Related implementations use interferometers, polarization-to-path conversion, fiber couplers, entangled photons, or passive basis selection in QKD systems.Source: B. Branching path generators · pp. 15–16, Figure 6 · p. 15
• Branching-path QRNGs suffer from detector dead time, unequal efficiencies, afterpulsing, multiphoton detections, and dark counts, limiting practical rates to a few Mbps.Calibration can compensate efficiency and coupling differences, while unbiasing algorithms remove bias at the cost of discarding bits.Source: B. Branching path generators · p. 16
• Time-bin conversion can use one detector, while multi-path W-state generators can produce more than one bit per measurement; integrated silicon circuits offer scalable eight-output demonstrations.The reported integrated generators produce 3 bits per measurement with 8 outputs and could extend to 16 outputs (Gräfe et al., 2014).Source: B. Branching path generators · pp. 16–17
• Alternative branching designs use brighter or antibunched single-photon sources, spatial detector arrays, and postprocessing such as Huffman coding or XOR extraction to address rate and non-uniformity.Single-photon sources can provide the best overall random-bit rates under the considered conditions, while arrays must also manage crosstalk.Source: B. Branching path generators · p. 17

Basic time-comparison generation

• Comparing consecutive photon-arrival intervals yields a uniform bit by assigning 1 when t2 > t1 and 0 when t1 > t2.Weak-photon detection produces exponentially distributed arrival intervals, enabling the comparison scheme.Source: C. Time of arrival generators · pp. 17–18

Timing precision and clock design

• Timing digitization can produce equal consecutive intervals that the basic comparison scheme must discard, and finite precision limits usable entropy to the discrete distribution over N = 2^p bins.Treating equal intervals as valid requires a separate probability analysis and bit-assignment rule.Source: C. Time of arrival generators · p. 18
• Fast clocks improve time resolution, while resettable clocks eliminate many biases caused by imprecise time measurement.The first optical time-detection generator used LED photons and a photomultiplier tube; higher clock resolution produced better results.Source: C. Time of arrival generators · p. 18

Alternative time-based schemes

• Alternative generators use photon-arrival parity or paired empty/detected bins, reshape exponential arrivals toward uniformity, or combine time with spatial uncertainty to reduce bias.Examples include gated APD even-odd output, attenuated pulsed-laser bin pairing, source-current shaping, external-bin sampling, and two-detector schemes.Source: C. Time of arrival generators · pp. 18–19

Randomness extraction

• Digitized time differences are distilled with SHA-256, resilient functions, or Elias extraction to convert available exponential-distribution entropy into uniform bit strings.These methods require additional hardware and processing effort.Source: C. Time of arrival generators · p. 18

D. Photon counting generators

• Photon counts in a fixed interval T follow a Poisson distribution when arrival times are exponentially distributed, providing the basis for these generators.Source: D. Photon counting generators · p. 19
• Generators produce bits from count parity, least-significant count bits, or comparisons between photon counts in adjacent bins (F¨urst et al., 2010; Lopes Soares et al., 2014; Ren et al., 2011).Small detector dead time can reduce parity bias relative to a pure Poisson process, while thermal and weak coherent sources have been compared.Source: D. Photon counting generators · p. 19
• Multiple bits can be extracted by grouping photon-count outcomes into equal-probability sets or dynamically selecting uniform least-significant bits according to λT.The dynamic method uses a 32 × 32 CMOS SPAD array and requires correcting the detected rate for detector dead time (Jian et al., 2011; Tisa et al., 2015; MPD, 2014).Source: D. Photon counting generators · pp. 19–20
• Commercial cameras and mobile phones can generate quantum random numbers from photon-count variations, followed by extraction to remove correlations and noise.The mobile-phone implementation used a state with around 410 photons.Source: D. Photon counting generators · p. 20
• Other methods subdivide detection windows into smaller bins and transform non-uniform Poisson counts into uniform random variables (Wang et al., 2015a,b; Yan et al., 2015).Source: D. Photon counting generators · p. 20

E. Attenuated pulse generators

• Attenuated generators rely on binary detectors and time bins where the weak source ideally produces zero or one photon, despite limited photon-number resolution.Multiple clicks across successive bins provide the raw detection sequence.Source: E. Attenuated pulse generators · p. 20
• Attenuated pulse generators use weak sources tuned so the complete system detects a photon with probability one half, encoding clicks as 1 and no-detection events as 0.The occupied state may contain one or more photons; externally, only the click outcome is used.Source: E. Attenuated pulse generators · p. 20
• Coherent states provide practical attenuated pulses, with λT = ln 2 ≈0.693 yielding equal zero- and one-or-more-photon probabilities before accounting for detector efficiency and losses.Variable attenuation or source-current adjustment tunes the effective detection probability; Wei and Guo (2009a), Bisadi et al. (2015a,b), and Stipˇcevi´c and Ursin (2015) implement such adjustments.Source: E. Attenuated pulse generators · p. 20
• Residual bias and drift in attenuated generators can be removed with von Neumann extraction, which outputs balanced bits from opposite click–empty outcomes while discarding identical pairs.For Poissonian sources, the resulting bit rate is at least four times slower but remains unbiased.Source: E. Attenuated pulse generators · p. 20

F. Generators based on quantum vacuum fluctuations

• Homodyne detection mixes vacuum with a local-oscillator laser, subtracts two detector currents, and digitizes the resulting signal proportional to a vacuum-field quadrature.With adequate treatment, final-measurement uncertainty can be attributed mainly to intrinsic vacuum fluctuations rather than local-oscillator shot noise or other technical noise.Source: F. Generators based on quantum vacuum… · p. 21, Figure 8 · p. 21
• Vacuum quadrature measurements can be binned into intervals and assigned bit values; Gabriel et al. (2010) uses 32 bins to obtain 5 bits per measurement and hashes the sequence.Hashing removes residual correlations.Source: F. Generators based on quantum vacuum… · p. 21
• Vacuum-fluctuation QRNGs can exceed Mbps single-photon rates and reach Gbps rates by using fast detectors, optimized electronics, and technical-noise reduction.Symul et al. (2011) discards least significant bits because the most significant digitized homodyne bits carry most quantum noise.Source: F. Generators based on quantum vacuum… · p. 21
• Squeezed-vacuum homodyne generators enlarge measured quadrature uncertainty, enabling more voltage ranges, reduced classical-noise effects, and higher extracted bit rates as squeezing increases.Zhu et al. (2012) produces squeezed vacuum with a parametric oscillator without an input signal.Source: F. Generators based on quantum vacuum… · p. 21

Continuous-wave phase noise

• An unbalanced Mach–Zehnder interferometer converts quantum phase differences into amplitude variations measurable by high-speed optical detectors.For delay τ far exceeding coherence time, phase differences are Gaussian; sampling intervals well above τ plus coherence time yields independent amplitudes.Source: G. Generators based on the phase noise… · pp. 21–22
• Continuous-wave implementations generate bits from sampled Gaussian detector voltages using least-significant-bit extraction or thresholding, with differencing helping remove digitization bias.Phase compensation, Faraday mirrors, and advanced drift correction reduce classical phase effects; randomness extraction produces uncorrelated bits from correlated digitized samples (Liu et al., 2010b).Source: G. Generators based on the phase noise… · p. 22

Rate optimization

• Sampling faster raises the random-bit rate only until ∆t = τ; beyond that, increased correlations reduce uniform output, so delay and sampling must be optimized.Operating near the lasing threshold helps quantum phase noise dominate classical detector noise because quantum phase noise scales inversely with laser power.Source: G. Generators based on the phase noise… · p. 22

Pulsed-laser generators

• Pulsed-laser phase-noise generators reached rates up to 43 Gbps after passive phase compensation and system tuning (Tang et al., 2013; Abellán et al., 2014).Below-threshold operation attenuates prior coherence, while spontaneous emission establishes a new random phase before amplification.Source: G. Generators based on the phase noise… · pp. 22–23

Chaos-based generators

• Chaos-based laser generators can reach hundreds of Gbps, but deterministic chaotic evolution supplies most unpredictability after amplifying a smaller quantum seed.Thus, they contain quantum entropy but function in part as physical pseudorandom generators.Source: G. Generators based on the phase noise… · p. 23

H. Generators based on amplified spontaneous emission

• ASE noise provides a strong quantum-origin signal whose independent frequency-band amplitudes enable fast QRNGs reaching Gbps rates.Detector speed usually limits ASE sampling because the noise changes faster than the detection mechanism.Source: H. Generators based on amplified… · p. 23
• ASE generators extract bits by comparing polarization-detector voltages, thresholding single-detector intensities, digitizing Gaussian noise, or multiplexing independent spectral channels.Delayed XOR processing or randomness extraction corrects residual correlations and bias, while oversampling can improve final bit rates after postprocessing.Source: H. Generators based on amplified… · pp. 23–24
• An unamplified LED generator collects spontaneous-emission fluctuations with an ellipsoidal cavity, then digitizes the resulting approximately Gaussian detector voltage into unbiased bits.The method avoids amplification while using many independent emission events to produce amplitude fluctuations.Source: H. Generators based on amplified… · p. 24

I. Generators based on Raman scattering

• Stimulated Raman generators amplify spontaneously initiated Stokes fields, exposing quantum fluctuations as uncertainty in optical phase and amplitude.Phase generation uses a pumped diamond, interference with a reference pulse, 64 phase bins, and extraction of 6 bits; amplitude generation corrects pump fluctuations before Toeplitz hashing.Source: §I · p. 25, Figure 11 · p. 25, Figure 12 · p. 26
• Waveguide Raman devices increase interaction strength and repetition rate, converting random phase into amplitude variations through a delayed-arm interferometer.A KTiOPO4 waveguide enabled operation with an 80 MHz titanium:sapphire oscillator, compared with free-space systems limited to kbps by available lasers.Source: §I · p. 26
• Spontaneous Raman QRNGs select frequency bands dominated by phonon-vacuum fluctuations, separate photons into balanced detector paths, and postprocess biased clicks.Thermal and detector-induced biases are corrected after spectral selection; multiple wavelength channels could extract more than one bit per measurement.Source: §I · pp. 26–27
• 1 Mbps raw and 650 kbps after postprocessing were achieved with spontaneous Raman scattering, while rates up to 1 GHz could remain weakly correlated.The experiment’s rate was detector-limited, whereas the Raman medium responded in under 100 fs and could support higher rates with controlled pump power.Source: §I · pp. 26–27

J. Generators based on optical parametric oscillators

• Vacuum fluctuations initiate oscillation in a degenerate optical parametric oscillator, amplifying microscopic quantum randomness into a macroscopic optical field.In type I degenerate down conversion, the output is a squeezed vacuum state whose quantum uncertainty is measurable from a macroscopic signal (Wu et al., 1986, 1987).Source: J. Generators based on optical… · p. 27
• Above threshold, phase-dependent gain produces two stable oscillation states centered near θs = 0 and θs = π relative to the pump.Cavity losses impose a gain threshold below which spontaneous down conversion cannot reach the macroscopic level.Source: J. Generators based on optical… · p. 27
• The generators of (Marandi et al., 2011, 2012b) interfere outputs from two independent cavities, mapping constructive and destructive interference to binary random values.The selected phase is inherited from vacuum fluctuations, while classical noise is negligible; thresholding distinguishes low destructive-interference voltage as 0 from high constructive-interference voltage as 1.Source: J. Generators based on optical… · p. 27, Figure 13 · p. 27
• A fresh random phase requires restarting the oscillation after the intracavity field decays to the quantum-noise level; residual fields otherwise correlate successive outputs.For operation well above threshold, regeneration can require 10 to 20 times the cavity’s 1/e decay time, depending on cavity and pump parameters.Source: J. Generators based on optical… · pp. 27–28
• Tens of kbps are achieved before serious correlations appear, while shorter cavities with higher-repetition-rate pumps could enable rates in the Gbps range.The regeneration time limits the rate because the cavity must return to the quantum-noise level before producing an independent phase.Source: J. Generators based on optical… · pp. 27–28
• Related quantum-randomness schemes use χ(3) integrated optical parametric oscillators, bistable semiconductor ring lasers, or competing laser modes.These systems amplify spontaneous-emission or spontaneously emitted-photon noise to select between macroscopic stable states or winning modes.Source: J. Generators based on optical… · p. 28

VIII. NON-OPTICAL QUANTUM RANDOM NUMBER GENERATORS

• Non-optical QRNGs use quantum processes such as radioactive decay, electronic shot noise, quantum tunneling, trapped-ion measurements and atomic spin noise.Trapped-ion systems are slower and more complex than optical setups but offer nearly perfect detection efficiency, which is important for certification; spin-noise generation reaches the kbps range and is limited by relaxation time.Source: §VIII · pp. 28–29
• Quantum tunneling produces randomness through electron transmission across semiconductor barriers, leakage currents and shot noise, replacing discrete photons with discrete electrons in analogous schemes.In reverse-biased Zener diodes, random tunneling from the p-side valence band to the n-side conduction band creates the reverse current used by electronic physical RNGs.Source: §VIII · p. 28
• Spin-noise QRNGs measure quantum fluctuations of an alkali-metal vapor through probe-beam polarization and threshold the measured branch to produce binary outputs.The random spin polarization is mapped to optical intensity; samples taken faster than the relaxation time are correlated, whereas solid-state systems may permit dephasing rates near 1 GHz.Source: §VIII · p. 29

IX. RANDOM NUMBERS CERTIFIED BY QUANTUM MECHANICS

• Quantum certification methods target the trust problem caused by algorithmic backdoors, malicious hardware modifications and undetected physical failures.The reviewed approaches include quantum-property self-testing, device-independent generation based on correlations, and less stringent quantumness certification under relaxed security assumptions.Source: §IX · pp. 29–30

A. Self-testing in quantum random number generators

• Self-testing filters outputs using expected statistical behavior, detecting spontaneous failures and simpler attacks while remaining vulnerable to malicious modifications designed to pass the tests.Poor entropy estimation can itself create an attack vulnerability, so testing requires careful implementation.Source: A. Self-testing in quantum random… · p. 30
• Tomography-based self-testing estimates worst-case min-entropy and feeds raw bits to an extractor, protecting against source control when repeated measurements assume the state is preserved.This provides limited protection against advanced attackers but effectively detects accidental device errors and is suited to honest implementation failures rather than colluding untrusted components.Source: A. Self-testing in quantum random… · p. 30
• Tens of bits per second were generated in a dimension-witness self-testing QRNG, which also responded correctly to environmental alignment changes.The witness W bounds guessing probability and determines extractor compression; smaller W values yield fewer clean random bits.Source: A. Self-testing in quantum random… · p. 31
• Alternative self-testing approaches certify privacy with two mutually unbiased bases or bound entropy through complete physical modeling and auxiliary measurements.The basis-switching method requires a small uniform random seed, while metrology-based modeling supplies a conservative average-min-entropy bound for selecting an extractor.Source: A. Self-testing in quantum random… · p. 31

Bell-test certification

• Bell-test schemes certify randomness without trusting device details: when separated quantum systems yield Ĩ > 2, their correlations imply a positive min-entropy bound.If Ĩ ≤ 2, the bound is zero; the resulting nonuniform bits can be converted into uniform random strings with a randomness extractor.Source: B. Device independent quantum random… · p. 32

Protocol requirements

• The protocol requires independent, not perfectly predictable measurement settings and spacelike-separated devices, while its corrected security proofs establish composability and cryptographic suitability.The original min-entropy derivation contained a technical error, later corrected by Pironio and Massar and by Fehr et al.Source: B. Device independent quantum random… · p. 32

Randomness expansion

• Starting from a small random seed, device-independent protocols produce a longer bit sequence whose randomness is certified by quantum mechanics, including exponential expansion in the Vazirani–Vidick protocol.The Pironio et al. protocol consumes a seed of order √n bits for n certified bits, while Vazirani and Vidick use a seed of order log^3_2 n bits.Source: B. Device independent quantum random… · pp. 32–33

Experimental implementations

• The first trapped-ion implementation generated 42 certified random bits with 99% confidence after about a month, reflecting the tension between loophole closure and speed.Trapped ions offered nearly perfect detection efficiency but were slower than optical implementations because photon-mediated entanglement was probabilistic and heralded.Source: B. Device independent quantum random… · p. 32
• Optical and semi-device-independent proposals improved practicality, achieving about half a bit per second with transition-edge sensors and 0.28 certified bits per second with bounded-dimension single photons.The semi-device-independent approach permits lower detection efficiencies while assuming a bounded quantum-system dimension.Source: B. Device independent quantum random… · p. 33

No-signalling extension

• The framework also extends beyond quantum mechanics to no-signalling models, where the protocols retain randomness amplification and require only a uniform random seed.The no-signalling principle forbids faster-than-light information transmission, and the conditional min-entropy bound changes while the general results remain valid.Source: B. Device independent quantum random… · p. 33

C. Other forms of quantum certification

• Contextuality tests certify quantum-origin randomness and detect classical noise or device imperfections, but without spacelike separation a rogue manufacturer could still supply pregenerated bits.These protocols use untrusted devices in a less adversarial setting and do not rely on complex nonlocal entangled states or causal guarantees.Source: C. Other forms of quantum certification · p. 33
• KCBS-inequality violations provide a lower bound on output entropy that can be fed to a randomness extractor, certifying a minimum amount of quantum-origin randomness.Deng et al. (2013) and Um et al. (2013) demonstrated contextuality-based certified bits using optical qutrits and three-level trapped ions, respectively.Source: C. Other forms of quantum certification · pp. 33–34
• Under the tested conditions, the optical and trapped-ion implementations generated more random bits than they consumed only with non-uniform measurement settings.The optical system encoded a qutrit in three photon paths, while the ion system used fluorescence registration over measurements lasting about 10 ms and closed the detection-efficiency loophole.Source: C. Other forms of quantum certification · p. 34

X. POSTPROCESSING

• Postprocessing primarily performs randomness extraction, while buffering and health tests support accumulation and operational checks; extraction corrects biases and correlations caused by device imperfections.Quantis, for example, includes hardware checks for inconsistencies following the AIS31 standard (ID Quantique, 2014).Source: §X · p. 34
• Cryptographic applications generally require almost uniform randomness, motivating debiasing and mixing methods such as XOR, cryptographic hashing, and von Neumann extraction.Von Neumann extraction discards 00 and 11, maps 01 to 0 and 10 to 1, and reduces the bit rate by at least one fourth under systematic bias; Elias (1972) and Peres (1992) refine its efficiency.Source: §X · p. 34
• An extractor maps n raw bits to m bits whose distribution is ǫ-close to uniform, with statistical distance quantifying the maximum probability difference between distributions.The target distribution is Um, uniform over {0, 1}^m, and ǫ is chosen according to the application’s requirements.Source: §X · p. 34
• A source with min-entropy H∞(X) = k yields at most k nearly uniform extracted bits, so min-entropy limits extraction regardless of the raw sequence length.An (n, k)-source produces n bits from a distribution with min-entropy at least k; extractor design seeks high output rates with minimal computation or additional randomness.Source: §X · p. 34

A. Randomness extractors

• Randomness-extractor selection depends on speed, hardware requirements, and accurate entropy estimation, using an (n, m, k, ǫ)-extractor to produce m bits as close to k as possible.The framework assumes a characterized source with known min-entropy or structural properties such as bit independence or a Markov process.Source: A. Randomness extractors · p. 35

1. Deterministic extractors

• Deterministic extractors map n-bit inputs to m bits but cannot work uniformly for every source, even when the source has min-entropy n−1.A uniform distribution over a sufficiently large preimage forces any one-bit deterministic extractor to output a constant; this proves general impossibility.Source: §1 · p. 35
• Practical deterministic extractors exist for restricted families, including samplable, bit-fixing, affine, and algebraic-variety sources.Variable-length methods such as von Neumann’s extractor work for independent bits, approach Shannon-entropy efficiency after refinements, and extend to Markov chains.Source: §1 · p. 35
• Deterministic extraction fails when an attacker adaptively varies bit biases, while weak sources may still support randomized algorithms but generally cannot provide cryptographic-quality keys.Encryption and related protocols require high-quality keys, unlike some signature schemes (Austrin et al., 2014; Dodis et al., 2004; Dodis and Spencer, 2002; McInnes and Pinkas, 1991).Source: §1 · pp. 35–36
• Combining two independent Santha–Vazirani sources can produce sequences computationally indistinguishable from uniform, supporting efficient randomized algorithms and most cryptographic applications.Multiple-source extractors include the GF(2) inner product for two n-bit sources with min-entropy at least n/2 (Chor and Goldreich, 1988; Vazirani, 1987a,b).Source: §1 · p. 36

2. Seeded extractors

• Seeded extractors combine an n-bit raw sequence with a d-bit uniform seed, enabling general near-uniform extraction close to the maximum possible output length.For a k-source, constructions achieve m ≈ k + d with ǫ-close uniformity using d of order log2(n).Source: §2 · p. 36
• Seeded extractors protect quantum random-number generators against external attackers, with constructions proven secure against quantum attackers of different power.The Trevisan extractor additionally resists quantum adversaries and preserves seed randomness, but its calculations can slow practical generation (Mauerer et al., 2012).Source: §2 · pp. 36–37
• Two-universal hashing extracts nearly uniform randomness from high-entropy sources, including sources correlated with classical or quantum side information.With conservative bounds on source–eavesdropper correlation, generalized Leftover Hash Lemmas yield outputs independent of external systems (König and Renner, 2011; König and Terhal, 2008).Source: §2 · p. 37
• Compared with Trevisan extraction, two-universal hashing is faster and less computationally demanding but requires a larger seed.The seed is comparable in length to the input block, though a randomly chosen public seed can be recycled; Toeplitz-matrix implementations are particularly efficient.Source: §2 · p. 37

XI. QUANTUM RANDOMNESS EXTRACTORS: RANDOMNESS EXPANSION AND RANDOMNESS AMPLIFICATION

• Quantum randomness expansion uses untrusted ancillary systems to enlarge a uniform seed, while randomness amplification converts weak classical or quantum sources into arbitrarily near-uniform output.Privacy amplification additionally produces shorter strings statistically hidden from adversaries or causally preceding events.Source: §XI · p. 37

A. Quantum randomness expansion

• Quantum randomness expansion combines a random seed with weak randomness from quantum or Bell-test devices to produce longer, privacy-guaranteed output.Device-independent generators implement this model, and concatenating protocols can produce arbitrarily large sequences certified against quantum adversaries.Source: A. Quantum randomness expansion · p. 38
• Semi-device-independent and source-independent extractors relax assumptions or address optical imperfections, while quantum-to-classical extractors maximize secret bits from states correlated with an eavesdropper.Privacy-amplification formulations can extend private strings efficiently against quantum attackers, but face severe limitations against nonsignalling attackers.Source: A. Quantum randomness expansion · p. 38

B. Quantum randomness amplification

• Quantum randomness amplification removes the need for a uniform seed by combining weak-source randomness with measurements on entangled quantum systems to produce uniform bits.The main experimental challenge is ensuring independence among the multiple devices required by some protocols.Source: B. Quantum randomness amplification · p. 38
• Deterministic amplification can strengthen Santha-Vazirani sources using only nonlocality and remains secure against attackers beyond quantum mechanics.Later protocols handle arbitrarily weak or bounded-min-entropy sources, while amplification can supply seeds for subsequent randomness expansion.Source: B. Quantum randomness amplification · pp. 38–39

XII. RANDOMNESS TESTING

• Randomness testing uses statistical suites such as NIST, TestU01, DieHard, and DieHarder to detect suspicious frequency, run, spectral, compression, or autocorrelation patterns.Tests generally produce p-values and compare them with suite-specific thresholds for compatibility with randomness.Source: §XII · p. 39
• Finite-sequence tests cannot prove true randomness: predictable generators may pass, false positives occur, and even perfect generators sometimes fail tests.Tests should therefore be repeated, and operational testing can still detect sudden failures or faulty components.Source: §XII · p. 39
• Statistical tests can miss active attackers and implementation-specific correlations such as photon-detector afterpulsing because they usually omit physical models.Quantum protocols are described as a response to adversarially pregenerated sequences that pass conventional tests.Source: §XII · p. 39

• Quantum entropy can be harvested from radioactive decay, photon splitting, Raman-amplification noise, laser phase noise, and amplified spontaneous emission.Source: §XIII · p. 40
• Optical quantum random number generators routinely reach megabits-per-second rates, with gigabit rates promised, although electronic systems and postprocessing often limit practical performance.Commercial devices cover implementation requirements but remain about two orders of magnitude slower than the fastest laboratory rates.Source: §XIII · p. 40
• Generation proposals often extrapolate raw-bit rates without fully processing available samples, creating a need for faster production of final usable random bits.Source: §XIII · p. 40
• Communication is an engineering bottleneck that current USB, PCI Express, and integrated-silicon technologies can address, while randomness extraction remains a more significant limitation.Fast optical generators can require extraction sustaining output rates on the order of Gbps; seeded extractors such as Trevisan’s and two-universal hashing provide security against quantum attackers, but postprocessing is comparatively slow.Source: §XIII · p. 40
• Device-independent protocols can provide reliable randomness without trusted hardware and support quantum randomness expansion and amplification, but current devices remain experimentally challenging and slow.Future work targets faster device-independent QRNGs and simpler certification methods, including protocols based on nonlocality.Source: §XIII · p. 40
• The field combines new fundamental results with commercially available quantum random number generators, while continuing to develop existing technologies and future directions.Source: §XIII · p. 40