Post-quantum cryptography has an entropy blind spot

NIST finalized ML-DSA, ML-KEM, and SLH-DSA in 2024. FALCON is slated for standardization. The industry is migrating. These algorithms resist Shor's algorithm — the quantum threat they were designed to counter.

They do not resist weak randomness. In many cases, their randomness attack surface is larger than the classical schemes they replace.

ML-DSA: the same pattern, larger surface

ML-DSA's hedged signing mode computes its commitment nonce as ρ' = H(key || rnd || message), where rnd is 32 bytes of fresh randomness per signature. This is not structurally identical to ECDSA — ECDSA fails catastrophically from a few bits of nonce bias, while ML-DSA's hedged construction is more tolerant — but the dependency is the same: biased or predictable rnd measurably erodes the security margin and, combined with side-channel or fault-injection access, enables key recovery.

NIST chose hedged mode as the default in part because pure-deterministic signing amplifies side-channel leakage (FIPS 204 rationale). That tradeoff makes rnd quality load-bearing. Researchers have already demonstrated failure modes against unprotected implementations:

• Fault injection on ARM Cortex-M4 — ~53% key-recovery rate against unhardened ML-DSA implementations. Requires physical access and fault-injection capability; hardened constant-time implementations with fault countermeasures are not in scope (Jendral & Mattsson, 2024).
• Rejected-signature side-channel attack — full key recovery across all security levels against unprotected reference implementations, under the assumption that rejected signing attempts leak through timing or power channels (ePrint 2025/582).

These attacks are real but bounded: they target unhardened software with attacker-local capabilities. They do not threaten well-instrumented HSM or TEE deployments today. They do illustrate that ML-DSA's security surface is sensitive to both randomness quality and implementation discipline — and the weaker the entropy source, the smaller the side-channel surface needs to be for the attack to work.

ML-KEM: the safeguard that was removed

During the ML-KEM standardization process, NIST removed a randomness safeguard from the original Kyber design. Kyber hashed its encapsulation randomness before use, so raw RNG output was never used directly. FIPS 203 drops that step and relies directly on the quality of the implementation's approved RNG.

A 2024 cryptographic challenge (SandboxAQ CTF) demonstrated full key recovery from ML-KEM when the RNG seed had weak entropy. Knowledge of the seed allowed predicting all randomness and recovering the complete key pair.

FALCON: the Gaussian sampler is the target

FALCON's discrete Gaussian sampler is its most security-sensitive component and has a documented history of implementation-side vulnerabilities. SHIFT SNARE (ePrint 2025/146) demonstrated high-precision per-coefficient key recovery via single-trace power analysis against an unprotected reference implementation. As with the ML-DSA attacks above, hardened implementations with masking and constant-time sampling mitigate the specific attack — but the underlying sensitivity is exactly why NIST's FN-DSA standardization has taken longer than its siblings. FALCON is the clearest case where entropy quality and implementation discipline are not separable concerns.

The scale of the entropy dependency

At current transaction volumes — roughly 444 million signing operations per month across Ethereum, Arbitrum, and Base — migrating to ML-DSA hedged mode creates demand for ~14.21 GB of fresh rnd per month if each signature is independently seeded. In practice, most production deployments will seed a NIST SP 800-90A DRBG from a smaller entropy pool and stretch it across many operations; that is standard and correct cryptographic engineering. The point isn't that systems consume raw quantum entropy per signature — it's that the root of the entropy chain now matters for far more operations, in far more places, than classical ECDSA ever required. A compromised or biased root propagates through every DRBG output downstream.

The fix

Post-quantum algorithms were designed assuming high-quality entropy. They are vulnerable without it. QCP supplies the entropy layer that post-quantum algorithms require — not as an afterthought, but as a first-class primitive.

The strongest post-quantum algorithm with weak entropy is broken. The strongest entropy without a quantum-resistant algorithm is vulnerable to Shor's. You need both.