Quantum physics can produce genuine randomness, yet practical implementations of Quantum Random Number Generators frequently introduce predictable patterns that undermine cryptographic security. Engineers at the European Telecommunications Standards Institute warn that devices passing statistical randomness tests may still leak enough information for attackers to forecast future values.
The newly released ETSI TR 104 171 provides detailed guidance on building and assessing QRNG systems. These devices measure quantum processes, process the raw data, and supply random numbers to cryptographic applications for key generation and other security functions.
Security depends on more than the quantum source alone. Components such as sensors, power supplies, signal processors, and data-processing algorithms can add noise that contains detectable regularities. Artificial intelligence tools can now sift through large volumes of output to identify these hidden correlations.
Additional clues may come from side-channel emissions. Variations in power consumption and electromagnetic radiation can be correlated with the numbers being generated, potentially weakening the cryptography they support.
The report advocates an entropy zero trust approach. Manufacturers and operators should verify the quantum source, monitor all processing stages, search continuously for anomalies, protect hardware against tampering, and encrypt the channels that deliver random values to applications.
For forensic investigations, systems must record the exact time of generation, the software version in use, and the origin of each output value. In shared environments, entropy streams belonging to different clients must be strictly isolated.
