The Entropy Half
of the Stack
Quantum-measured entropy is not a performance feature. It is the cryptographic foundation that makes key generation and nonce construction information-theoretically secure.
Why Randomness Breaks Cryptography
Every cryptographic system — TLS, SSH, code signing, key generation — depends on unpredictable random values. When the entropy source is flawed, the math is irrelevant. The keys are recoverable.
Entropy failures have compromised national infrastructure, government identity systems, and millions of production keys — long before blockchain existed.
ROCA / Infineon: Flawed PRNG in Infineon TPM chips produced RSA keys with exploitable structure. Affected Estonian national ID cards and millions of hardware tokens.
IoT RNG Failure: Hardware RNG on 35B+ IoT devices silently fails under entropy exhaustion — returning zeros. Every TLS key generated in that state is compromised.
PuTTY ECDSA: Biased nonce generation allowed private key recovery from ~60 signatures. Every P-521 key used with PuTTY 0.68–0.80 was affected.
SonicWall SSLVPN: Weak PRNG in SonicOS SSLVPN token generator allowed attackers to predict tokens and bypass enterprise VPN authentication.
On-chain systems inherit every classical entropy vulnerability — and add new ones. Every digital signature (ECDSA on Ethereum, EdDSA on Solana) requires a per-signature random nonce. Key generation, vanity address tools, and wallet implementations all depend on entropy quality that the protocol itself cannot enforce.
Profanity Exploit: 32-bit PRNG seed allowed private key brute-force. $160M stolen from Wintermute alone.
Milk Sad: Mersenne Twister with time-based seed reduced 256-bit key entropy to brute-forceable levels. $3.4M+ drained.
Trust Wallet: WASM build fell back to MT19937 with 32-bit seed. Every wallet created during the affected window was permanently compromised.
Lattice Nonce Recovery: Private key recovery from biased ECDSA nonces using lattice attacks on as few as 60–80 signatures. Applies retroactively to every signature on-chain.
Post-Quantum Algorithms Inherit the Problem
NIST finalized post-quantum standards in August 2024 — ML-KEM, ML-DSA, and SLH-DSA. These algorithms resist Shor's algorithm. They do not resist weak randomness.
The Structural Parallel
ML-DSA's hedged signing mode computes its nonce as ρ' = H(key ‖ rnd ‖ message), where rnd is 32 bytes of fresh randomness. This is structurally identical to ECDSA's nonce construction. A biased rnd breaks ML-DSA the same way a biased k breaks ECDSA.
NIST chose randomized mode as the default specifically because deterministic mode was "devastating" for side-channel attacks. Researchers have already demonstrated single-trace fault injection recovering ML-DSA keys with 53% success on ARM Cortex-M4.
The FIPS 203 Change
During ML-KEM standardization, NIST removed the explicit randomness safeguard from key generation. The original Kyber design included a check against flawed entropy. The production standard delegates entropy quality entirely to the implementation environment.
A 2024 cryptographic challenge demonstrated full key recovery from ML-KEM when the RNG seed had weak entropy — knowledge of the seed allowed predicting all randomness and recovering the complete key pair.
Computational vs. Physical Security
A cryptographically secure pseudorandom number generator produces output that is computationally indistinguishable from random — under a hardness assumption.
Its security is conditional: if the seed is exposed, all outputs are determined. If the underlying cipher is broken, all outputs are predictable. If internal state is observed, all future outputs are known.
"No efficient algorithm exists — under current assumptions — to predict the output."
A quantum random number generator sources entropy from physical quantum measurements — vacuum fluctuations, photon arrival times, path superposition.
The measurement outcome is not determined by any prior state of the system, the state of the hardware, or any classical hidden variable. This is a consequence of quantum mechanics, not a computational assumption.
"No algorithm of any computational power can predict the output, because the output did not exist before measurement."
Where Quantum Entropy Addresses the Attack Surface
Each entropy weakness maps to a point in the cryptographic stack where quantum measurement provides structural defense.
Weak Key Generation
PRNG seed with low entropy during key generation. Private key brutable regardless of algorithm strength.
Entropy drawn from quantum measurement at key generation. No algorithmic seed. No state to expose. One measurement protects the full lifetime of the key.
Biased Nonces
CSPRNG bias in per-signature nonce sampling. Lattice attacks recover keys from 60–80 biased signatures.
Per-signature quantum entropy. Each nonce is an independent physical measurement — structurally impossible to bias across signatures.
Side-Channel Correlation
Deterministic nonces leak the same secret across power analysis, timing, or EM observations.
Quantum randomness adds an independent unknown per signature. No correlation possible across traces.
PRNG State Compromise
Exposing PRNG internal state reveals all past and future outputs.
Quantum measurement has no state. Each output is a fresh physical event. Nothing to compromise.
Compliant Entropy Source
QRNG hardware output assessed to international entropy standards. On-chain delivery via an ECVRF proof (secp256k1), verifiable by your smart contract.