QRNG glossary

Output that cannot be predicted better than by guessing.

In security, a value is random when nobody — including someone who knows the system in detail — can predict it better than by chance. Looking irregular is not enough; the value has to be genuinely unpredictable.

A measure of unpredictability.

Entropy quantifies how much genuine uncertainty a value carries. High entropy means hard to guess. Low entropy means a value may look random while actually being biased, repeated, or reproducible. Cryptographic systems should never claim more random bits than their entropy source can justify.

• Why entropy matters in cybersecurity

The conservative, worst-case entropy measure.

Min-entropy is based on the single most likely outcome of a source rather than its average behaviour. Because it assumes the attacker guesses the most probable value first, it is the measure used for cryptographic entropy claims. It is always less than or equal to average (Shannon) entropy.

The physical or algorithmic origin of unpredictability.

The entropy source is where the randomness actually comes from — thermal noise, oscillator jitter, a quantum process, or an operating-system pool. Everything downstream can only preserve or reduce the entropy the source provided; it cannot create more.

A deterministic algorithm expanded from a seed.

A PRNG takes a starting value (a seed) and stretches it into a long sequence that looks random. It is fast and used everywhere, but the output is fully reproducible to anyone who learns the seed or internal state. A strong PRNG with a weak seed is a weak security component.

• QRNG vs PRNG vs TRNG

A PRNG designed to resist cryptographic attack.

A cryptographically secure PRNG is built so that observing part of its output does not let an attacker recover its state or predict past and future output. It still depends entirely on being seeded with real entropy.

A generator whose randomness comes from a physical process.

A TRNG measures a physical phenomenon such as thermal noise or clock jitter instead of running an algorithm. Its trustworthiness depends on the quality of the physical source, how faithfully it is measured, and how carefully the raw signal is processed.

• QRNG vs PRNG vs TRNG

Hardware whose entropy source is a quantum physical process.

A QRNG roots its randomness in a process that quantum physics describes as inherently unpredictable, rather than merely hard to compute. It still requires engineering: the source must be characterised, monitored, and conditioned before its output is usable as cryptographic random bits.

• What is a QRNG?

The measured signal before any processing.

Raw output is what the measurement circuit reports directly from the entropy source. It typically carries bias and correlation from the surrounding electronics, so it is never used as random bits on its own.

Turning a biased physical signal into uniform bits.

Conditioning (also called post-processing or randomness extraction) compresses raw measurements into a shorter, uniform bit stream. It removes classical artefacts and bias. Conditioning concentrates entropy — it never adds any.

Continuous checks that the entropy source still behaves correctly.

Health tests run while the generator is operating and watch for signs of failure: stuck outputs, sudden bias, or behaviour outside the characterised range. They matter because an entropy source can degrade with temperature, ageing, voltage, or deliberate attack while its output still looks superficially random.

• What makes a QRNG trustworthy?

A documented explanation of where the randomness comes from.

An entropy model states which physical effect provides the unpredictability, how much entropy it is expected to deliver, and under what operating conditions. Without one, statistical tests can only show that output looks uniform — not that entropy is genuinely present.

Tests that check whether output looks uniform.

Suites such as NIST SP 800-22, Dieharder and TestU01 look for patterns in a bit stream. They can reveal a broken generator, but passing them does not prove a source is a valid entropy source — a well-seeded PRNG passes them easily.

A QRNG whose entropy source is built in standard silicon.

Most QRNGs are explained with optical or photonic examples. A CMOS-native design instead derives its entropy from physical effects inside ordinary silicon electronics. The appeal is integration: compact hardware that can sit alongside the rest of a chip rather than requiring separate optical components.

• What is CMOS-native QRNG?

A QRNG built around measurements of light.

Photonic designs measure quantum properties of photons — which path a photon takes, arrival timing, or vacuum fluctuations. They are well studied and often used to explain the concept, but typically involve optical components alongside the electronics.

Creating the secret values cryptography depends on.

Encryption keys, signing keys and session secrets all begin as random numbers. If those numbers are predictable, the cryptography built on top of them fails regardless of how strong the algorithm is.

A number used once.

A nonce is a value that must never repeat within a given context — for example an initialisation vector or a challenge in an authentication exchange. Repeated or predictable nonces are a common and serious cause of real-world cryptographic failure.

Algorithms designed to withstand quantum computers.

PQC replaces the mathematical problems that quantum computers would break. It changes the algorithms, not the need for randomness: PQC key generation still consumes high-quality entropy, so entropy quality remains a foundation rather than a legacy concern.

• QRNG and post-quantum cryptography

The hardware component a system's security is anchored to.

A root of trust is the small, well-protected element other security functions rely on. Entropy generation is often part of it, because keys created from a compromised or weak source undermine everything derived from them.

Dedicated hardware for protecting keys and cryptographic operations.

An HSM generates, stores and uses cryptographic keys inside tamper-resistant hardware. Because key generation happens there, the quality of its entropy source is directly relevant to the assurance the module can offer.

Hardware supplied so engineers can test a technology themselves.

An evaluation kit lets a team measure a generator's real behaviour — output rate, integration effort, and how it responds to their own testing — instead of relying on datasheets. QRNG.io is educational; evaluation hardware is provided by iQrypto.