Every cryptographic algorithm rests on entropy

Cryptography has two layers. The algorithm — RSA, ECDSA, AES, ML-KEM, ML-DSA — determines what mathematical problem an attacker must solve. The randomness determines whether that problem is actually hard in practice. When randomness fails, the algorithm fails with it. No algorithm, classical or post-quantum, is immune to this dependency.

Where entropy enters classical cryptography

• RSA key generation — the entire security of RSA rests on two random primes. Weak entropy has produced the two largest known RSA vulnerabilities in production: Mining Your Ps and Qs (Heninger et al., 2012) found 0.5% of TLS RSA keys on the internet shared prime factors due to weak boot-time entropy; ROCA (2017) found Infineon TPM chips producing RSA keys with exploitable structure, affecting Estonian national ID cards, government smartcards, and millions of hardware tokens.
• ECDSA keys and signing — the private key needs a strong random seed, and every signature requires a per-signature nonce. Reuse, bias, or predictability in the nonce reveals the private key algebraically. Weak key seeds broke Profanity, Milk Sad, and Trust Wallet; nonce reuse broke Android Bitcoin wallets.
• EdDSA signing — Ed25519 avoids ECDSA's nonce problem by deriving the nonce deterministically from the private key and message, but the key itself still depends on entropy at generation time, and pure-deterministic signing is sensitive to fault-injection attacks (Poddebniak et al. 2017, Samwel et al. 2018) — which is why hedged EdDSA variants have been proposed.
• AES-GCM / ChaCha20-Poly1305 — nonces must be unique per key (unpredictability is best practice but not strictly required by NIST SP 800-38D for GCM). Nonce reuse is catastrophic in both constructions — it breaks the Wegman–Carter polynomial MAC (GHASH or Poly1305) and allows the authentication key to be recovered, enabling forgeries.
• RSA-OAEP and RSA-PSS — padding and salts require fresh randomness per operation.
• TLS, SSH, VPN handshakes — ephemeral key shares, session keys, and nonces.
• Key derivation (HKDF, PBKDF2, Argon2) — salts.
• Certificate serial numbers — must be unpredictable to prevent collision attacks.
• Session tokens, API keys, CSRF tokens, TOTP secrets — security rests entirely on unpredictability.

Post-quantum algorithms inherit this dependency

Post-quantum standards resist Shor's algorithm. They do not escape the entropy dependency — in many cases they expand it.

• ML-DSA — hedged signing mode requires 32 bytes of fresh randomness per signature. The hedged construction is more tolerant than ECDSA's nonce (a few bits of ECDSA nonce bias is catastrophic; ML-DSA is not), but the same root dependency on unbiased randomness is present, and biased rnd combined with side-channel or fault-injection capability enables key recovery in published research.
• ML-KEM — FIPS 203 removed the original Kyber design's hashing of encapsulation randomness, so ML-KEM relies directly on the quality of the implementation's RNG.
• FALCON — the discrete Gaussian sampler is a primary attack surface. Against unprotected implementations, single-trace power-analysis attacks have demonstrated per-coefficient key recovery; hardened implementations with masking and constant-time sampling mitigate the specific attack but don't eliminate the sensitivity that produces it.
• SLH-DSA — the randomized variant requires fresh randomness per signature.

Why the dependency is invisible

Most cryptographic code assumes randomness will be good.

The operating system's CSPRNG returns bytes; developers treat them as uniformly random. In practice, that assumption fails in five common ways:

1. Seed compromise — weak initial seed (Profanity, Milk Sad, Trust Wallet)
2. State cloning — VM snapshots or container restores duplicate PRNG state
3. Boot-time entropy gaps — embedded devices generate keys before the entropy pool fills (Heninger et al.)
4. Side-channel correlation — deterministic schemes leak secrets across signatures via power analysis
5. Algorithmic bugs or backdoors — implementation flaws, uninitialized memory (35B+ IoT devices, Bishop Fox 2021), or deliberate backdoors (Dual_EC_DRBG / Juniper 2015)

A CSPRNG can only inherit the security of its seed and its internal state. If either fails, every output is predictable.

What quantum entropy actually changes

QRNG replaces the root of the entropy chain, not the entire chain. The underlying measurement — single-photon detection in complementary bases, vacuum-state quadrature, or similar — is a physical process whose outcome is governed by quantum mechanics rather than by a computed seed. Unlike a CSPRNG, there is no stored state from which an attacker can predict future outputs by compromising the seed.

In production systems, raw QRNG output is not directly consumed. Real hardware exhibits detector-efficiency asymmetries, dark counts, dead time, and after-pulsing, which introduce bias in the raw bit stream. NIST SP 800-90B mandates continuous health tests (Repetition Count, Adaptive Proportion), production designs typically add a vetted conditioning component to extract near-uniform output, and production QRNG systems typically feed that conditioned output into a DRBG for performance. QCP's device self-testing and attestation layer exist precisely because QRNG hardware can fail — no provider can honestly claim the output "cannot be biased"; what they can claim is that bias is continuously detected and proven out via published health tests.

The value is narrower and more defensible than "randomness that cannot fail": it's a root of entropy derived from a physical measurement, with cryptographic attestation of the device state at the moment of generation. That replaces the most common CSPRNG failure — a weak, cloned, or exhausted seed — with a root that doesn't depend on environmental entropy accumulation. It doesn't replace the downstream stack (conditioning, DRBG, key schedule), and it doesn't make implementation security (constant-time code, side-channel protection, fault resistance) optional. Those remain the cryptographer's job.

This is the layer QCP provides: an attested, health-tested root of entropy that sits beneath RSA, ECDSA, ML-DSA, AES-GCM, and the CSPRNGs that feed them.

The strongest algorithm with weak entropy is broken. The strongest entropy with a compromised algorithm is vulnerable. You need both halves of the cryptographic stack.