How to Test a QRNG

1. Identify the quantum claim

Start with the physical statement.

What quantum process is supposed to provide unpredictability? How is it observed? What part of the measured signal is attributed to that process, and what classical contributions are expected?

A QRNG should be able to answer those questions at an appropriate level without requiring public disclosure of proprietary circuit details.

2. Draw the measurement chain

Map the path from the physical phenomenon to digital samples.

Include relevant sensors/detectors, analog circuitry, comparators/ADCs, clocks, sampling, filtering and digital preprocessing.

Every stage can alter the statistical structure. The word “quantum” does not make the classical electronics disappear.

3. Obtain raw data

For entropy-source evaluation, the most useful dataset is normally the rawest practical output required by the assessment, before a conditioner or DRBG hides source behavior.

Record the exact capture point and configuration.

If only final conditioned output is available, be explicit about the limitation: you can analyze that output, but you cannot reconstruct the source entropy model from it.

4. Evaluate classical contributions

A QRNG measurement can contain both desired quantum contribution and predictable/classical effects.

Ask how the implementation separates, bounds or models contributions from electronics, environment and deterministic processing.

This is a central difference between “the device produces random-looking bits” and “the device has a defensible quantum entropy claim.”

5. Estimate entropy conservatively

Use the appropriate entropy-source framework and document the assumptions.

For SP 800-90B-oriented work, distinguish IID from non-IID assessment and report min-entropy in relation to raw samples. Do not equate sample width or output throughput with entropy.

6. Check restart behavior

A QRNG can contain deterministic startup dynamics in amplifiers, detectors, clocks, bias circuits or digital logic even when its underlying source is quantum.

Collect genuine restart data if the assurance process requires it and examine repeated initialization behavior.

7. Review health monitoring

Ask what the device observes continuously and how it responds when conditions leave the characterized region.

Examples of useful questions:

• Can the system detect a stuck or saturated measurement path?
• Can it detect source-strength degradation?
• What happens to output after a failure?
• Is the host notified?
• Are health checks before or after conditioning?

8. Review conditioning

Document how raw samples become final random bits.

A conditioner can remove bias and concentrate entropy, but it cannot compensate for an invalid source model by magic. Verify the entropy budget and role of the conditioning step.

9. Evaluate environmental behavior

Test conditions relevant to the intended deployment rather than one nominal bench environment.

Depending on the device, consider temperature, voltage, clocking, EMI, aging, packaging and host-system effects. The appropriate range must come from the actual product/evaluation plan.

10. Test interfaces and integration

Security can be undermined outside the entropy core.

Check:

• output protocol and framing;
• error signaling;
• buffering and caching;
• driver behavior;
• host entropy-pool integration;
• reseeding strategy;
• failure fallback;
• whether deterministic fallback can silently replace the physical source.

11. Use statistical suites correctly

Generic statistical suites can detect anomalies in output and are useful diagnostics. They cannot prove that the source is quantum, that the physical model is correct or that the implementation is secure.

Treat them as one evidence layer, not the verdict.

12. Check standards claims precisely

Separate:

• designed with a standard in mind;
• tested using methods from a standard;
• assessed against a requirement set;
• formally validated/certified under a recognized program.

The language on a product page should match the evidence exactly.

A practical QRNG evaluation report

A useful report includes:

• architecture and source claim;
• raw-data capture point;
• dataset hashes;
• source model and assumptions;
• IID/non-IID rationale;
• entropy results;
• restart results;
• health-monitoring description;
• conditioning description;
• environment/configuration;
• interface/integration notes;
• limitations and open questions.

Where QRNG.io fits

Use the Local Entropy Assessment Kit for dataset-level preliminary analysis, What Makes a QRNG Trustworthy? for the assurance model, and iQrypto's evaluation path only when you are ready to evaluate specific hardware.

Sources and further reading

1. NIST SP 800-90B
2. ETSI TR 104 171 work item
3. UK NCSC Quantum security technologies
4. UK NCSC Quantum networking technologies