In short
A quantum random number generator (QRNG) produces bits whose unpredictability is guaranteed by the laws of quantum mechanics rather than by the cleverness of an algorithm. The simplest recipe: prepare a qubit in the superposition |+\rangle = \tfrac{1}{\sqrt{2}}(|0\rangle + |1\rangle) and measure in the computational basis. The outcome is 0 or 1 with exactly probability \tfrac{1}{2} each, and no hidden variable — in the sense of Bell's theorem — can predict it in advance. Commercial QRNGs implement this with photons: a single photon hits a 50/50 beam splitter and triggers one of two detectors; the click pattern is the bit stream. Variants measure vacuum-field quadratures or laser phase noise and extract many megabits per second. A self-testing QRNG goes further: it violates a Bell inequality so strongly that the measured randomness is certified even if the hardware was built by your adversary. QRNGs already run inside SIM cards (ID Quantique), lottery draws, Monte Carlo simulations, and the Indian QNu Labs Tropos and Armos stacks — and the National Quantum Mission funds a certified randomness infrastructure that UPI, Aadhaar, and defence systems can draw on.
Every cryptographic key, every simulated dice roll in a finance Monte Carlo, every session token your UPI app prints — starts life as a random bit. Ask a classical laptop to produce a billion of them and it will run an algorithm: take a seed, apply a deterministic shuffle, output the result. That output looks random. It passes statistical tests. But given the seed, anyone can recompute the sequence exactly. This is pseudo-random, and it is the only kind of randomness a purely classical deterministic machine can manufacture.
A qubit sitting in the superposition |+\rangle is different. When you measure it in the computational basis, it gives you 0 or 1 — but the choice is not the output of any algorithm and not the readout of any hidden variable. It is, as far as physics can tell, drawn fresh from the universe at that instant. This is the core promise of a quantum random number generator: a machine that bottles up quantum measurement and pours it out as bits.
This chapter builds the idea from one qubit up to commercial hardware. Along the way it answers the three questions that matter for a cryptographer: Can we trust the bits? Can we certify them even if the device was built by someone we do not trust? And is any of this deployed in India today?
Why classical randomness is not random
Your laptop's random() function does not flip a coin. It runs a pseudo-random number generator — a deterministic function f such that, given a 256-bit seed s, it produces a long sequence
that looks statistically random. The Mersenne Twister, Xorshift, ChaCha20-based CSPRNGs — all of them are deterministic. Two laptops with the same seed produce the same stream. There are no coin flips inside.
For most tasks that is fine. For cryptography it is a time bomb: if the adversary ever guesses the seed, every past and future output is known. Linux's /dev/urandom and Windows' CryptGenRandom mitigate this by harvesting noise — mouse jitter, disk-access timing, network packet arrivals, thermal fluctuations in a ring oscillator — and folding it into the seed. That is hardware randomness, and it is good. But it is not provably random. A sufficiently clever attacker who models the machine precisely enough might, in principle, predict it. Intel's RDRAND instruction (Ivy Bridge and later) is of this kind: a thermal-noise ring oscillator feeding a conditioning chain. It is hardware-based, but not quantum — the noise source is classical thermal physics, not a quantum superposition.
The gap between "hardware RNG" and "QRNG" is subtle but real. A thermal resistor is noisy because trillions of electrons jiggle in complicated ways you cannot track — it is effectively unpredictable. A qubit in |+\rangle measured in Z is different: Bell's theorem (chapter 139) proves that no local hidden-variable theory can account for the correlations produced by such measurements. The randomness is not effective — it is structural.
The simplest QRNG — one qubit, one measurement
The cleanest QRNG you can describe fits on a single line of pseudocode.
Recipe.
- Prepare a qubit in the state |+\rangle = \tfrac{1}{\sqrt{2}}(|0\rangle + |1\rangle).
- Measure in the computational (Z) basis.
- Output the outcome as one random bit.
The first time Dirac notation appears in this chapter: |0\rangle is the 2-dimensional column vector \begin{pmatrix}1 \\ 0\end{pmatrix}, |1\rangle is \begin{pmatrix}0 \\ 1\end{pmatrix}, and the state
is the equal superposition — the point on the Bloch sphere's equator at +x. A Z-basis measurement projects the state onto |0\rangle with probability |\langle 0 | + \rangle|^2 and onto |1\rangle with probability |\langle 1 | + \rangle|^2. Compute:
Why this step matters: \langle 0|0\rangle = 1 because |0\rangle has unit length; \langle 0|1\rangle = 0 because |0\rangle and |1\rangle are orthogonal basis states. The inner product of a bra and a ket is a single complex number, and for basis states it is the Kronecker delta.
So the probability of outcome 0 is |1/\sqrt{2}|^2 = 1/2. By the same calculation, outcome 1 also has probability 1/2. The bit is a perfect coin flip.
Run this circuit n times and you get n independent, uniformly distributed random bits. That is a QRNG. Everything else in this chapter is engineering — how to realise this one-qubit loop in hardware that spits bits out fast enough to be useful, and how to convince a sceptic that the bits really are random.
Optical QRNGs — what the hardware actually looks like
You can technically run the one-qubit QRNG on a superconducting or trapped-ion machine, but it would be wasteful — these devices cost tens of millions of rupees and are shared between many users. Commercial QRNGs use photons instead, because photons are cheap, fast, and behave as qubits in polarisation or path.
Beam-splitter QRNG
The cleanest optical realisation of the one-qubit idea: a single photon meets a 50/50 beam splitter. The photon's "left path" and "right path" form a two-dimensional state space — a qubit. A symmetric beam splitter is the optical equivalent of a Hadamard: a photon incident on one port comes out in the equal superposition |+\rangle = (|L\rangle + |R\rangle)/\sqrt{2} of left-path and right-path. Two single-photon detectors, one on each output, project onto the path basis; whichever fires gives the bit.
Commercial beam-splitter QRNGs run at tens of megabits per second. The photon source is usually an attenuated laser (a real single-photon source is hard; an attenuated pulse with mean photon number well below 1 is close enough, and rare multi-photon events are handled by post-processing). The detectors are silicon avalanche photodiodes for visible light, or InGaAs detectors for telecom wavelengths. ID Quantique's Quantis product family is the canonical beam-splitter QRNG; units ranging from a USB dongle to a PCIe card run at 4 Mb/s to 16 Mb/s.
Vacuum-fluctuation QRNG
You can go faster by giving up single-photon detection. The vacuum state of the electromagnetic field is not quite zero — it has quadrature fluctuations, a pair of Gaussian-distributed numbers X and P with variance \hbar/2 each. Split a local-oscillator laser on a balanced detector, and the difference current samples one of these quadratures. The analog signal is Gaussian-distributed and carries roughly \log_2(\sigma_{\text{quantum}} / \sigma_{\text{classical}}) bits of certified randomness per sample, where the signal-to-noise ratio separates the quantum contribution from the classical electronics noise. Digitising and hashing gives a stream of gigabit-per-second-class random bits.
Vacuum-fluctuation QRNGs dominate high-speed applications. A typical commercial module runs at 1–10 Gb/s — enough to generate every encryption key a data centre needs, with bandwidth to spare.
Phase-diffusion QRNG
A third common scheme taps the phase noise of a gain-switched laser diode. Turn the laser on from below threshold; each pulse starts from spontaneous emission, whose phase is a uniformly random quantum variable. Interfere consecutive pulses in a Mach-Zehnder interferometer; the intensity at the output is \propto 1 + \cos(\Delta\phi), where \Delta\phi is the quantum-random phase difference. A photodiode samples this intensity, and the digitised output — after conditioning — is another high-speed random stream. Toshiba and the Chinese group at USTC have pushed phase-diffusion QRNGs into the 100 Gb/s regime.
Post-processing — making the bits uniform
Real hardware is never a perfect 50/50. Beam-splitter reflectances drift; detector efficiencies differ; vacuum detectors have classical electronics noise. A QRNG bit stream straight from the detector is typically biased (probability of 0 is not exactly 1/2) and correlated (consecutive bits are not quite independent). The standard fix is a randomness extractor — a deterministic function that takes a long, slightly-biased input and produces a shorter, uniformly random output.
The simplest extractor is the von Neumann trick. Read the raw stream in pairs: 00 and 11 are discarded; 01 outputs a 0; 10 outputs a 1. If the raw bits are biased but independent, the output is perfectly unbiased.
Why it works: if each raw bit is 0 with probability p and 1 with probability 1-p, the pair 01 has probability p(1-p) and the pair 10 has probability (1-p)p. These are equal. Conditional on the pair being either 01 or 10 (i.e. not discarded), each outcome is 50-50, and each output bit is uniform. The price is throughput: for p near 1/2, you output one bit per four raw bits on average.
Serious deployments use universal hash functions (Carter-Wegman hashing, Toeplitz-matrix hashing) as extractors, because they can compress the stream at rates closer to the min-entropy H_\infty of the source — a tighter theoretical bound than von Neumann's. A QRNG with raw min-entropy 0.95 bits per sample, hashed by a 2-universal family to output \lfloor 0.9 \cdot n \rfloor bits, is certified near-uniform to any adversary with bounded side information.
The whole pipeline — hardware → raw stream → extractor → NIST statistical tests (SP 800-90B) — is what ships as a "QRNG module" in a bank's HSM. The user gets a clean, uniform, high-rate random stream; the physics guarantee lives in the first stage.
Worked example — the one-qubit QRNG, in full
Example 1: generating 20 random bits from the $|+\rangle$-measurement QRNG
Setup. You have a qubit that you can reset to |0\rangle, apply a Hadamard to, and measure in the computational basis. You want to generate 20 random bits. Repeat the following three-step loop 20 times.
Step 1 — Prepare |+\rangle. Start with |0\rangle. Apply the Hadamard gate:
Why start from |0\rangle: hardware resets qubits to the computational-basis ground state, and the Hadamard is the cheapest gate in every standard gate library. The composition H|0\rangle = |+\rangle is the shortest path from a reset qubit to the equal-superposition state.
Step 2 — Measure in Z. Project onto |0\rangle or |1\rangle. The probability of outcome 0 is
By symmetry P(1) = 1/2. The post-measurement state collapses to |0\rangle or |1\rangle accordingly; this is the irreversible, non-unitary half of the quantum world.
Step 3 — Record the outcome. Append the measured bit to the output stream. Reset the qubit and go back to Step 1.
Running 20 times. A possible output — the specific sequence is genuinely undetermined ahead of time, so here is one instance:
Count: 10 zeros, 10 ones. Sample mean 0.50, sample variance 0.25 — consistent with a fair coin. A second run would produce a different sequence. You cannot predict either sequence in advance, even knowing the full state vector, because the measurement outcome is not a function of any hidden variable.
Why the sample mean landed exactly on 10-10: that is coincidence. For n = 20 coin flips, the standard deviation of the count of ones is \sqrt{n/4} \approx 2.24, so any count from 8 to 12 is well within one sigma. Asymptotically the sample proportion converges to 1/2 by the law of large numbers.
Result. Twenty certified-uniform bits from twenty runs of the simplest possible quantum circuit. Any adversary — even one who knows the state |+\rangle exactly and has perfect knowledge of your hardware — cannot predict the sequence.
What this shows. The whole apparatus of "quantum randomness" reduces, operationally, to one trivially simple circuit. The philosophical weight — that the bits are not precomputed, not stored in any hidden variable, not derivable by any algorithm — is in the quantum mechanics, not in the code.
Self-testing QRNG — certifying randomness from untrusted hardware
The beam-splitter QRNG is secure against an outside adversary who has not touched the box. It is not secure against a malicious vendor who ships you a device with a hidden pseudo-random generator inside. If the vendor pre-computed the "random" stream and the box just replays it, you would have no way to tell from the output statistics alone — a good cryptographic PRNG passes every statistical test.
The fix is extraordinary: test the device by playing a Bell game with it. If the device's output violates a Bell inequality by enough, Bell's theorem guarantees that the output contains genuine, certified randomness — even if the device was designed by your adversary.
The CHSH game as a randomness certificate
The CHSH inequality (chapter 139) bounds the correlations achievable by any local hidden-variable theory: for any such theory, the CHSH quantity S = |E(00) + E(01) + E(10) - E(11)| satisfies S \le 2. Quantum mechanics allows S up to 2\sqrt{2} \approx 2.828 — Tsirelson's bound.
Set up the device with two separated components, call them A and B, that produce bits in response to binary inputs. A trusted source of input randomness (small, call it the "seed") selects the measurement settings; the device produces outputs. Estimate S from the statistics. If S \le 2, no certification — the outputs might have been pre-programmed. If S > 2 by a statistically significant margin, the outputs cannot be the replay of any pre-agreed strategy, and Bell's theorem gives a quantitative lower bound on the min-entropy of the output string, conditioned on any side information the adversary could have.
Randomness expansion and amplification
Two remarkable theorems make self-testing QRNGs not just audit tools but entropy amplifiers:
- Randomness expansion (Colbeck 2006 [2]; Vazirani-Vidick 2012; Pironio et al. 2010 [1]): Starting with a short seed of k trusted random bits, you can drive an untrusted device to produce an output of f(k) certified random bits, where f grows faster than linearly in k. The protocol exponentially expands a small random seed into a much larger certified-random string.
- Randomness amplification (Colbeck-Renner 2012; Gallego et al. 2013): Starting with a source that is only weakly random (min-entropy rate arbitrarily close to zero), you can distil a perfectly uniform random output. No fully-random seed is required.
These are theoretical results, but they have been demonstrated experimentally — Pironio et al.'s original 2010 experiment with trapped ions [1], and a series of follow-ups using photonic loophole-free Bell tests (Delft 2018, NIST 2018). A self-testing QRNG is not a pure-theory artefact; it is a working, if finicky, class of device.
Commercial deployments
QRNGs are one of the few quantum technologies in widespread commercial use today.
- ID Quantique (Switzerland) — founded 2001, sells beam-splitter QRNGs integrated in PCIe cards (Quantis-PCIe) and in the SIM cards of several European mobile carriers. Output 4–16 Mb/s; used for master keys in payment HSMs, Swiss federal voting systems, and the Geneva state lottery.
- Toshiba (Japan) and Quantinuum (UK/US) — phase-diffusion QRNGs at 1–10 Gb/s, sold as rack-mount appliances for data-centre key generation. Quantinuum's QNuLab product is a cloud-accessible randomness-as-a-service offering.
- Chinese industry — USTC spin-offs and Huawei-affiliated labs run gigabit-class QRNG modules in state-run cryptographic infrastructure, including portions of the Beijing-Shanghai QKD backbone.
- QNu Labs (Bengaluru, India) — a homegrown QRNG and QKD company, founded 2016, based at IIT Madras Research Park and Bengaluru. Their Tropos QRNG module, certified against NIST SP 800-22 and BIS IS 18033, generates up to 1 Gb/s of quantum-certified random bits and is the randomness source for several Indian banks' HSMs and defence communications stacks. The Armos platform wraps a QRNG into a full key-management appliance.
- Intel RDRAND / AMD equivalent — not quantum. These use classical thermal-noise ring-oscillators. Useful, but not certified-by-physics.
India's National Quantum Mission (2023, ₹6003 crore) identifies certified randomness infrastructure as a strategic priority alongside QKD and quantum computing. The mission's roadmap includes a national QRNG-as-a-service backbone that critical infrastructure — UPI transaction signing, Aadhaar authentication, CERT-In-protected government links — can draw on. The Raman Research Institute and IIT Bombay both run QRNG testbeds; CDAC and QNu Labs are partnering on a production-grade deployment scheduled through 2028.
Applications — where QRNG bits actually go
A megabit of quantum-random bits a second is more than enough for most real cryptographic workloads. Where do they go?
- Cryptographic key generation. Every RSA, ECC, AES, Kyber, Dilithium key needs seed randomness of at least the key's length. Poor-quality randomness is the single most common way cryptographic systems fail — the 2008 Debian OpenSSL bug, the 2010 Sony PS3 ECDSA nonce collapse, and numerous recurring "smart card key collision" incidents all trace back to predictable seeds. A certified QRNG eliminates this failure mode at the source.
- One-time pads. The theoretically unbreakable cipher requires a key as long as the message, used once and discarded. OTP is impractical at internet scale but is used for the most sensitive diplomatic and military communications, where QRNG-sourced pads replace older dice-rolled or paper-tape pads.
- Monte Carlo simulations. Every quantitative finance firm runs Monte Carlo for options pricing, risk analysis, and portfolio optimisation; every particle physicist runs Monte Carlo for detector simulation; every climate model includes stochastic perturbations. Pseudo-random generators work for most of these, but correlations across long runs occasionally matter, and QRNG bits are becoming a drop-in replacement for high-stakes runs.
- Lotteries and gaming. Certified randomness is a regulatory requirement for state lotteries and licensed online gambling. The Swiss federal lottery uses ID Quantique QRNGs; some Indian state lotteries are evaluating domestic QRNG modules as part of a "trust no one, audit everything" stance.
- Randomised clinical trials and auditing. Regulatory audits for pharmaceutical trials and tax-audit sample selection both benefit from demonstrably-untampered randomness. QRNG bits, with a cryptographic hash as a public commitment, give a verifiable source.
Common confusions
- "QRNG is faster than a PRNG." Rarely. A Mersenne Twister in software produces gigabits per second on a laptop. A good QRNG matches that, but the advantage is certification, not speed. Use a QRNG where you cannot afford to have your random seed predicted, not because you need more bits per second.
- "Intel RDRAND is a QRNG." No. RDRAND's noise source is a classical thermal-noise ring oscillator. It is a hardware RNG — fine for most applications — but its randomness is not certified by any quantum principle.
- "Pseudo-random means random-ish." No. Pseudo-random means deterministic. Given the seed, the stream is reproducible to the bit. The name is misleading: PRNG output looks statistically like random, and for the vast majority of engineering tasks that is enough. For cryptography against a patient, resourceful adversary, it is not.
- "A QRNG proves the universe is truly random." A QRNG demonstrates that the particular outputs produced are not the readouts of any local hidden-variable theory. Whether the universe itself is truly random or merely unpredictable-to-us in a superdeterministic theory is a metaphysical question beyond the scope of any device.
- "If the QRNG is in the quantum regime, no post-processing is needed." The source is certified random; the raw bits may still be biased, correlated, or contaminated by classical detector electronics. Every production QRNG uses a randomness extractor after the quantum stage to smooth the output to within statistical distance 2^{-128} of uniform.
Going deeper
If you see that a Hadamard on |0\rangle followed by a Z-measurement gives a perfect coin flip, that commercial QRNGs realise this with beam splitters, vacuum quadratures, or laser phase diffusion, and that a Bell-inequality violation certifies randomness even when the device is untrusted — you have chapter 157. The material below is for readers who want the quantitative security definitions, the min-entropy extractor analysis, the CHSH-to-entropy-rate theorem, and the details of India's QNu Labs deployment.
Min-entropy and the leftover-hash lemma
The right quantitative notion of randomness for cryptography is min-entropy:
A stream has k bits of min-entropy if no outcome has probability greater than 2^{-k}. Min-entropy is the adversary-facing entropy: even knowing the distribution, the adversary's best single guess succeeds only with probability 2^{-H_\infty}. Shannon entropy is the wrong quantity here — it measures average surprise, which can be large even when one outcome is very likely.
The leftover-hash lemma (Impagliazzo-Levin-Luby 1989; refined by Tomamichel-Schaffner-Smith 2011 for conditional min-entropy against quantum side information) says that for any source X with conditional min-entropy H_\infty(X|E) \ge k relative to an adversary E, a 2-universal hash h : \{0,1\}^n \to \{0,1\}^\ell with \ell \le k - 2\log(1/\epsilon) produces output statistically \epsilon-close to uniform. This is the quantitative foundation of QRNG post-processing: measure H_\infty of the raw source (e.g. from detection-efficiency calibration), choose \ell, pick a hash function, and the output is provably near-uniform.
NIST SP 800-90B testing
The standards body NIST publishes SP 800-90B — Recommendation for the Entropy Sources Used for Random Bit Generation — with a battery of statistical tests that any certified entropy source must pass. The tests include:
- Collision test (expected collisions in a short window vs observed)
- Markov-dependence test (against first-order correlation)
- Compression test (LZ77-based predictability)
- Repetition-count and adaptive-proportion health tests (for online monitoring)
Commercial QRNGs publish SP 800-90B certification reports; BIS (Bureau of Indian Standards) IS 18033 is the Indian counterpart, explicitly called out for government procurement under NQM.
The CHSH-to-entropy-rate theorem
Pironio, Acín, Massar, Boyer de la Giroday, Matsukevich, Maunz, Olmschenk, Hayes, Luo, Manning, and Monroe (Nature 2010 [1]) proved a quantitative link: for a device with estimated CHSH value \hat{S}, the conditional min-entropy per output round satisfies
for \hat{S} \in (2, 2\sqrt{2}]. At \hat{S} = 2 (classical boundary), the bound is 0 — no randomness certified. At \hat{S} = 2\sqrt{2} (Tsirelson), the bound approaches \log_2 2 = 1 bit per round — full randomness. The theorem is what lets a self-testing QRNG quantify the randomness it produces rather than merely assert it.
Randomness expansion vs amplification
- Expansion: input k bits of uniform trusted seed, output f(k) \gg k bits of certified-uniform randomness using an untrusted device. Pironio's original protocol has f(k) = k^{1/2} iterations times a constant per iteration; follow-ups (Coudron-Yuen 2014, Miller-Shi 2016) achieve exponential expansion f(k) = 2^{k^{1-\alpha}}.
- Amplification: input a source of arbitrarily weak min-entropy (Santha-Vazirani source), output certified-uniform randomness. Requires no trusted input. Colbeck-Renner 2012 first proved a version; Gallego et al. 2013 improved to any non-trivial min-entropy rate. These protocols use multiple independent non-signalling devices and achieve the remarkable feat of producing full randomness from a source that is only epsilon-random.
Both are active research; neither is in commercial deployment today. But they draw the theoretical ceiling — the most randomness that can be extracted from a device given the smallest input of trust.
QNu Labs Tropos in depth
QNu Labs' Tropos module uses a vacuum-fluctuation architecture: a 1550 nm telecom-wavelength local oscillator with a balanced homodyne detector, digitised at 1 GSa/s, producing a raw stream at 2 Gb/s before conditioning. Post-processing: AES-based seeding conditioner, a Toeplitz-matrix randomness extractor with a compression rate of 0.5, delivering 1 Gb/s of NIST SP 800-22 certified output. Health monitoring runs NIST SP 800-90B adaptive-proportion and repetition-count tests on a 1 MB window continuously; if either fails, the module drops into a degraded mode and alerts the host. Tropos is deployed in several Indian bank HSMs and is undergoing Common Criteria EAL4+ evaluation for government defence procurement.
Side-channel considerations
Even a certified QRNG can leak through side channels: electromagnetic emissions from the detector electronics, timing correlations with the host processor, power-consumption variations. Production deployments shield the quantum stage in a Faraday cage, use constant-time conditioning, and sample the raw stream through optocoupler-isolated interfaces. The careful engineering of the classical envelope around the quantum heart is, in practice, most of what makes a QRNG trustworthy.
Where this leads next
- Device-Independent QKD — the QKD counterpart to self-testing QRNG, where a Bell violation certifies key secrecy against malicious hardware.
- Bell's Theorem and CHSH — the theoretical foundation that turns a Bell-inequality violation into a randomness certificate.
- No-Cloning Theorem — the structural feature of quantum mechanics that makes QRNG outputs unforgeable.
- Projective Measurement — the formal mechanism that turns the |+\rangle superposition into a classical bit.
- One-Time Pad — the cipher whose unbreakability depends most critically on the quality of its random source.
References
- Stefano Pironio et al., Random numbers certified by Bell's theorem (2010) — Nature 464, 1021 / arXiv:0911.3427.
- Roger Colbeck, Quantum and relativistic protocols for secure multi-party computation (PhD thesis, 2006) — arXiv:0911.3814.
- Xiongfeng Ma, Xiao Yuan, Zhu Cao, Bing Qi, Zhen Zhang, Quantum random number generation (2016) — npj Quantum Information 2, 16021 / arXiv:1510.08957.
- Wikipedia, Hardware random number generator.
- QNu Labs, Tropos QRNG product overview.
- John Preskill, Lecture Notes on Quantum Computation, Chapter 8 — theory.caltech.edu/~preskill/ph229.