Why quantum random number generators?

In 2016, security researcher Miguel Herrero-Collantes Miguel_ H. published the highly cited paper "Quantum Random Number Generators", which gives an excellent overview of the basics of QRNGs. ??

This is a simplified summary.

Why do we need randomness? ??

Security in cryptography is based on information asymmetry, which means that what protects your data or identity from an attacker who captures your encrypted data is the lack of knowledge of your encryption key. ???

Large servers on the Internet need to quickly generate many secret keys/tokens for SSH connections, session IDs or SSL encryption. These secret keys/tokens protect the privacy of our data or represent our identity on the Internet.

Since trying every possible key/token on your encrypted data would not be computable in a reasonable amount of time, an attacker ??? could make some smart guesses about the key by reverse engineering the source of randomness in the generator.

Secure random number generation is therefore a fundamental aspect of cryptography.

Random number generators are designed to produce uniformly distributed and unpredictable numbers.

Classical Random Number Generation

Classical random number generators can be categorized into so-called pseudorandom and true random number generators (TRNGs). As Herrero-Collantes notes:

"it is important to distinguish between algorithmically generated numbers that mimic the statistics of random distributions and random numbers generated from unpredictable physical events."

Purely software generators are called pseudorandom because algorithms normally produce deterministic output with the same initial state (seed). If the initial state of the software random number generator can be guessed, the attacker can greatly reduce the possible secret key. This has led to security compromises in the past, such as the Debian OpenSSL vulnerability in 2008.

This vulnerability was addressed by collecting randomness outside the software:

"True random number generators measure some unpredictable or, at least, difficult to predict physical process"

Examples of such sources are the timing of packets on the network, the temperature of computer components, or electronic noise amplified and binarised by a comparator. A spectacular source of randomness is demonstrated by the cybersecurity company Cloudflare. They use the state of 80 lava lamps ?? as a physical source of randomness (described in their blog post).

Quantum random number generators are a subset of TRNGs.

3 arguments for quantum over classical random number generators

1?? Faster generation rate ??, as classical physical events may not change fast enough:

"In many cases, there is a fundamental limitation in the rate of change of the sampled physical parameter. If the system is sampled at a high rate, there is not enough time for the system to change and the random numbers are not independent".

For example, quantum events based on uncorrelated photons offer a fast (Mb/s) and independent generation rate, which today is limited by the detection apparatus and not the quantum event itself.

2?? Assurance of the objective randomness of quantum events as a postulate of quantum mechanics ??:

"there remains a doubt whether the backing physical process is truly random ... or we simply have a poor model and a better one could destroy the illusion of randomness."

3?? Classical sources of randomness can degrade over time ??:

"If a hardware random number generator fails during operation, it can be difficult to notice."

The source of randomness in quantum events compared to classical events is a well-defined phenomenon:

"quantum random number generators have the virtue of a precise description of the randomness source"

At the time of publication, the most advanced generators were based on quantum optics (weak laser light). Randomness is extracted, for example, from photon path splitting, photon time of arrival, photon number statistics or laser phase noise. ??