Marin Ivezic
The failure is almost never the algorithm
In 2012, Nadia Heninger and colleagues scanned the public internet and recovered the private RSA keys for 0.50% of the TLS hosts they surveyed (Mining Your Ps and Qs, USENIX Security 2012). RSA itself held. What failed was the randomness. Embedded routers and firewalls were generating keys seconds after boot, before the operating system had gathered enough unpredictable input, and thousands of unrelated devices ended up choosing the same prime numbers. A shared prime between two public keys hands an attacker both private keys with one greatest-common-divisor computation.
Four years earlier, a packaging change in Debian’s OpenSSL removed most of the seeding material from the key generator (CVE-2008-0166, Debian Security Advisory DSA-1571-1). Every key produced on affected systems between 2006 and 2008 came from a pool of at most 32,767 possibilities, the range of a 15-bit process identifier. An attacker could enumerate the whole set on a laptop.
Both incidents point at the same layer. Cryptographic keys are not chosen by an algorithm; they are chosen by an entropy source, meaning the physical process a system draws unpredictability from. The algorithm only formats the result. Get the source wrong and the strongest cipher in the catalogue protects nothing.
Why classical generators are hard to trust
Almost nothing in production draws keys directly from a physical process. Systems use a DRBG, a deterministic random bit generator: an algorithm that takes a short secret seed and expands it into as many bits as the application asks for. The expansion is repeatable by design. Feed the same seed twice and you get the same stream twice. Security rests entirely on the seed being unknown.
That leaves two places to fail, and the industry has failed in both. The first is seed quality. Classical entropy sources are things like interrupt timing, disk latency, and thermal noise in a ring oscillator, and each of them is a chaotic classical process rather than an unpredictable one. Chaotic means sensitive to initial conditions; it doesn’t mean the outcome is undetermined. A virtual machine cloned from a snapshot inherits its host’s timing profile, and a headless appliance at first boot has no keyboard, no user, and very little happening on the disk.
The second is the algorithm itself. Dual_EC_DRBG sat in NIST SP 800-90A as an approved generator until the constants in its specification turned out to permit a party who chose them to predict the output. NIST withdrew it in the 2015 revision of SP 800-90A. A generator can be standards-compliant and still be readable by whoever built the standard.
Cloudflare’s lava lamps, read carefully
Cloudflare’s wall of lava lamps in San Francisco is the best-known illustration of the problem, and it is usually described inaccurately. A camera films roughly a hundred lamps, the frames are hashed, and the result contributes to the entropy pool that seeds Cloudflare’s generators. It’s one input among several, not the source of the company’s keys.
It is also, physically, a classical system. Wax convection is governed by fluid dynamics. It is unpredictable in practice because measuring the initial state to sufficient precision is infeasible, not because the outcome is undetermined. That gap is the whole argument for quantum entropy.
What a QRNG actually does
Quantum random number generation (QRNG) replaces the chaotic process with an indeterminate one. Under standard quantum mechanics, the outcome of certain measurements is not fixed by any prior state of the system. There is nothing to know in advance, so there is nothing an adversary can compute.
The textbook design uses a single-photon source and a 50/50 beam splitter. Each photon is transmitted or reflected with equal probability, two detectors record which, and each detection becomes one bit. Most commercial devices use something cheaper and faster: a laser measured against the vacuum, where the fluctuation in the vacuum field produces a fluctuating signal that gets digitised into bits, or a photodiode counting arrival times of photons from an LED.
Raw output is never usable as it stands. Detectors have dead time, one path of the splitter is always slightly favoured over the other, and electronics inject correlated noise. The device therefore applies conditioning, a compression step that takes a longer biased string and emits a shorter one closer to uniform. The device also runs continuous health tests, because a QRNG that has quietly stopped working still emits bits.
Where it belongs in the stack
Vendor material that frames a QRNG as a DRBG replacement has the placement wrong. A QRNG is an entropy source, and it goes where entropy sources go. It seeds the DRBG. It doesn’t replace it.
The NIST SP 800-90 series draws this line clearly. SP 800-90B specifies how an entropy source is validated and how much entropy per bit it may claim. SP 800-90A specifies the DRBG mechanisms that expand a seed. SP 800-90C specifies how the two are assembled into a working generator. A QRNG that intends to serve a FIPS 140-3 module is a candidate for SP 800-90B validation, and the validation is about the device’s entropy estimate and its health tests rather than about the physics being quantum.
A TLS terminator handling ten thousand handshakes a second does not need ten thousand handshakes’ worth of physical entropy. It needs a well-seeded DRBG and periodic reseeding. Sizing a quantum entropy deployment by peak key demand overbuilds it, sometimes by orders of magnitude. Size it by seeding policy instead: how many independent DRBG instances exist, and how often each one reseeds.
The honest limits
The device is a trust boundary. You’re trusting a sealed box to be measuring what its datasheet says. A QRNG whose laser has degraded, or whose conditioning stage has been substituted, produces a clean-looking stream with far less entropy than claimed. This is the same class of trust problem the hardware entropy sources inside a hardware security module (HSM) already carry.
Device-independent QRNG addresses this and is not yet a product. A DIQRNG certifies its own output by running a Bell test: if the measured correlations violate a Bell inequality, no prior local description of the outcomes existed, and the randomness is certified from the statistics rather than from trust in the apparatus. NIST demonstrated loophole-free generation of this kind in 2018 (Bierhorst et al., Nature). Bit rates remain far below what production key management needs.
Environmental sensitivity is real. Temperature drift, electromagnetic noise, and vibration all move the operating point of a photonic device, which is why the health tests exist and why entropy claims are stated conservatively.
Mixing is cheaper than replacing. A DRBG can be seeded from several independent sources, and the pool is as strong as the best of them. Adding quantum entropy alongside existing sources removes a single point of failure without asking anyone to retire hardware.
Does post-quantum migration change the calculus?
Not in the way vendors sometimes imply. The new NIST algorithms are not more resistant to weak entropy; they consume randomness at exactly the same points classical algorithms do. ML-KEM (Kyber) key generation consumes two 32-byte random seeds, and each encapsulation consumes another 32 bytes. ML-DSA (Dilithium) supports a hedged signing mode that draws fresh randomness per signature specifically to blunt fault and side-channel attacks, and that mode is only as good as the source behind it.
So the honest framing is this. Quantum entropy and post-quantum cryptography solve different problems, and neither substitutes for the other. Migrating a certificate authority to ML-DSA while it seeds from a virtual machine’s boot-time pool moves the weakness rather than removing it.
What to ask before you buy
- Is the entropy source SP 800-90B validated, and what is the assessed min-entropy per output bit?
- What are the continuous health tests, and what does the device do on failure: block, flag, or keep emitting?
- Where does conditioning happen, and is the raw pre-conditioned output available for independent assessment?
- How does the output reach the consuming system, and what protects that path?
- Does it seed a DRBG that is already in your validated boundary, or does it introduce a second generator you now have to govern?
The last question is usually the one that decides deployment cost.
Where this fits in the curriculum
Entropy design sits at the join between two Quantum Academy tracks. Our quantum networking program covers photonic sources, detectors, and the measurement chain a QRNG shares with QKD hardware. Our post-quantum cryptography program covers key management, DRBG architecture, and the SP 800-90 validation path a quantum entropy source has to clear before it goes near a production certificate authority. Both are at quantumacademy.com/.
For migration methodology that puts entropy sources into a wider inventory, see pqcframework.org. For the longer technical background this article draws on, see the original QRNG explainer on PostQuantum.com.