Electronics Guide

The Trust Problem in Entropy Sources

A random number generator is unusual among cryptographic components in that its output cannot be checked. A cipher can be tested against known-answer vectors, and a signature can be verified against a public key, but a bit string carries no evidence of how it was produced. Statistical test suites such as the NIST SP 800-22 battery detect gross structure, yet they pass a counter encrypted under AES with a key the attacker knows, which has zero entropy from the attacker's perspective. Statistical testing therefore identifies broken generators; it never certifies working ones.

Because the output is uninformative, assurance has traditionally come from the process: a documented stochastic model of the noise source, a min-entropy estimate derived from that model, continuous health tests, and third-party validation under a scheme such as NIST SP 800-90B or the German BSI AIS 20/31 methodology. This works well when the evaluator and the manufacturer are honest and competent. It fails in three situations that motivate the device-independent approach.

The first is supply-chain compromise. A generator whose noise source has been quietly weakened, or whose conditioning function has been replaced with a keyed deterministic construction, will pass every statistical test while producing output that its designer can predict. The reference case is the Dual_EC_DRBG deterministic generator, standardized and later withdrawn after the discovery that its elliptic-curve parameters admitted a trapdoor for whoever generated them.

The second is model error without malice. Physical entropy sources drift with temperature, supply voltage, and age; a ring-oscillator generator can lock to an injected signal, and an avalanche source can degrade toward a deterministic regime as its bias network ages. If the stochastic model does not anticipate the failure mode, the entropy estimate is simply wrong.

The third is the public randomness problem. When a random value must be trusted by parties who do not trust each other, such as the seed for a lottery, the challenge in a public audit, or a "nothing up my sleeve" cryptographic parameter, no amount of vendor documentation resolves the dispute. What the parties need is randomness whose unpredictability can be verified from published evidence.

Device-independent certification addresses all three. It replaces trust in the manufacturer with a physical test whose outcome the user observes directly, and it produces a transcript that a skeptical third party can audit after the fact.

Bell Inequalities as a Certification Tool

The certification principle comes from the foundations of quantum mechanics rather than from engineering. John Bell showed in 1964 that any theory in which measurement outcomes are determined by local variables carried by the particles must obey certain inequalities among measurement correlations, and that quantum mechanics predicts violations of those inequalities. Alain Aspect, John Clauser, and Anton Zeilinger shared the 2022 Nobel Prize in Physics for the experiments that established the violation in the laboratory.

The CHSH Inequality

The standard test in randomness work is the form due to Clauser, Horne, Shimony, and Holt. Two stations, conventionally Alice and Bob, each receive a binary input selecting between two measurement settings and each produce a binary output. Over many trials, the experimenters compute the correlation for each of the four setting pairs and combine them into a single quantity, usually written S. Any theory in which the outcome at each station is a predetermined function of that station's setting and of shared information distributed before the trial satisfies S at most 2. Quantum mechanics allows values up to the Tsirelson bound of twice the square root of two, approximately 2.828, attained by measuring a maximally entangled pair of qubits along suitably chosen axes.

From Violation to Min-Entropy

The step that makes a Bell violation useful for cryptography is quantitative. Suppose an adversary prepared the devices, holds any classical or quantum side information about their internal state, and wishes to predict the outputs. The probability that the adversary guesses a given trial's output correctly can be bounded as a decreasing function of the observed value of S. At the classical limit of 2, the bound permits perfect prediction and certifies nothing. As S rises toward the Tsirelson bound, the guessing probability falls, and the certified min-entropy per trial rises. The relationship is the operational content of the certification: the measured violation, and nothing else, sets the number of bits that may be claimed.

Two features of this bound deserve emphasis. It holds against an adversary who knows the complete construction of the devices, because the derivation makes no reference to that construction. It also holds against an adversary holding quantum side information, provided the security proof is carried out in the appropriate framework, which matters because entanglement between the devices and an adversary's memory is exactly the resource a malicious manufacturer would exploit.

What Must Still Be Assumed

Device independence is not assumption-free, and honest accounting of the residual assumptions is part of the engineering discipline. Four requirements remain. The stations must not communicate during a trial, which is enforced by physical shielding, by space-like separation, or by both. The inputs must be chosen independently of the devices and of any variable that influences them, which is the free-choice or measurement-independence assumption. The classical post-processing, including the randomness extractor, must run on trusted hardware, since a compromised extractor can discard the certified entropy. Finally, the protocol consumes random bits to choose settings, so it expands or amplifies existing randomness rather than creating it from nothing. The last point is why the field speaks of randomness expansion and randomness amplification rather than randomness generation.

The right description of the result is therefore information-theoretic security under a stated device model, not unconditional security. The entropy bound holds against an adversary of unlimited computational power who built the boxes, but only for as long as the four conditions above hold; a violation of any one of them voids the claim. An honest specification for a device-independent generator states the four conditions and says how each is enforced, in the same way that a conventional entropy source states its stochastic model.

Closing the Loopholes

A Bell violation certifies randomness only if every classical explanation of the observed correlations has been excluded. Experimental imperfections open specific escape routes, known as loopholes, and each one corresponds to a concrete engineering requirement.

The Detection Loophole

If a substantial fraction of particle pairs goes undetected, and the analysis considers only the trials in which both stations registered an event, then a local model can reproduce an apparent violation by arranging for the devices to decline to answer whenever answering would spoil the correlation. Closing the loophole requires counting every trial, including those with no detection, which in turn requires detection efficiency above a threshold. For the CHSH inequality with maximally entangled states the threshold is approximately 82.8 percent. Philippe Eberhard showed in 1993 that using non-maximally entangled states and a suitably chosen inequality lowers the requirement to two-thirds in the limit of negligible background, and essentially all photonic randomness experiments follow that route. Real background counts raise the working threshold above that ideal figure, which is why photonic experiments are built with as much efficiency margin as the optics allow. The requirement is on end-to-end heralding efficiency, so every loss in the chain counts: source collection optics, fiber splices, filters, modulators, and the detector itself.

The Locality Loophole

If a signal could travel from one station to the other between the choice of a setting and the recording of the outcome, the correlation may be explained by ordinary communication. Closing the loophole means arranging the space-time geometry so that each station's setting choice and measurement are space-like separated from the other station's. Because light travels roughly thirty centimeters per nanosecond, a separation of a hundred meters allows about 330 nanoseconds for the entire cycle of generating a setting, applying it to an optical modulator, detecting the photon, and latching the result. This budget, more than any other constraint, dictates the electronics design.

Freedom of Choice and Measurement Independence

The setting choices themselves must be uncorrelated with the hidden variables that might govern the devices. This assumption cannot be verified experimentally, only made progressively more implausible to violate. The 2015 experiment at the National Institute of Standards and Technology (NIST) drew setting bits from three independent sources combined by exclusive-or, including a fast physical noise source and bits digitized from popular media files. Later work pushed the argument further: cosmic Bell tests reported in 2017 and 2018 derived setting choices from the color of light emitted by distant stars and quasars, so that any conspiracy between the devices and the settings would have to have been arranged billions of years ago, and the Big Bell Test of November 2016 recruited roughly one hundred thousand volunteers worldwide to supply setting bits by hand.

Timing, Memory, and Coincidence Loopholes

Two further loopholes matter for a rigorous analysis. The coincidence-time loophole arises when detection events are paired using a time window whose placement depends on the outcomes; robust analyses use fixed, setting-independent trial windows defined by a synchronized clock. The memory loophole arises when devices retain state across trials and adapt their behavior to the history, which invalidates statistical analyses that assume independent, identically distributed trials. Modern treatments handle it by using martingale-based or entropy-accumulation arguments that remain valid for arbitrarily correlated trials, at some cost in the required number of rounds.

The Loophole-Free Experiments

Three groups closed the detection and locality loopholes simultaneously in 2015. A team at Delft University of Technology used electron spins in nitrogen-vacancy centers in diamond separated by 1.3 kilometers, entangled by an event-ready scheme that heralds success before the measurement, which closes the detection loophole by construction at the cost of a very low trial rate; the first run gathered 245 trials and reported S of 2.42 with a standard deviation of 0.20. Groups at the National Institute of Standards and Technology in Boulder and at the University of Vienna independently reported photonic experiments later the same year, using superconducting nanowire single-photon detectors with high system efficiency, non-maximally entangled states, and fast random setting choices. The photonic route gives up the event-ready guarantee but runs at a trial rate orders of magnitude higher, which is why every practical randomness protocol since has been built on it.

Later work extended the result to further platforms. A 2017 experiment entangled two single rubidium atoms held in buildings about four hundred meters apart, again using event-ready heralding. In 2023 a group at ETH Zurich violated the CHSH inequality loophole-free using two superconducting qubits joined by a thirty-meter cryogenic link, reporting an average S of 2.0747 with an uncertainty of 0.0033 over more than a million trials. The violation there is small, but the trial rate is very high by the standards of the field, and that combination later proved to be what randomness amplification required. Together these experiments turned device-independent certification from a theoretical construction into a laboratory capability.

Randomness Expansion Protocols

A raw Bell violation certifies that the output string contains min-entropy, but the string itself is biased and correlated. Turning it into uniform bits, and doing so while consuming as little input randomness as possible, is the job of a randomness expansion protocol.

Structure of a Protocol

A protocol proceeds in rounds. In most rounds, called generation rounds, both stations use a fixed default setting, which costs no input randomness and yields output that is expected to be random. A small, randomly chosen fraction of rounds are test rounds in which the settings are drawn at random and the CHSH score is recorded. This spot-checking structure, in which testing is sparse, is what makes expansion possible: the input randomness is spent almost entirely on deciding which rounds to test. At the end of the run, the accumulated CHSH statistics yield a lower bound on the smooth min-entropy of the full output string conditioned on the adversary's side information. A quantum-proof randomness extractor, seeded with a short trusted random string, then compresses the output into a nearly uniform key. Trevisan-style extractors are common in this role because their seed length grows only polylogarithmically with the output length.

Theoretical Foundations

Roger Colbeck proposed randomness expansion from Bell tests in his 2006 doctoral thesis, and Stefano Pironio and colleagues gave the first experimental demonstration in 2010, extracting 42 certified bits from measurements on two trapped ytterbium ions over roughly a month of running. That experiment closed the detection loophole through near-unit detection efficiency, but not the locality loophole: the two traps stood about a meter apart, so non-communication was assumed rather than enforced by space-like separation. Umesh Vazirani and Thomas Vidick showed in 2012 that expansion can be exponential in the seed length and secure against quantum adversaries, and Carl Miller and Yaoyun Shi later established robust unbounded expansion, in which a fixed seed can be grown without limit by cross-feeding pairs of device sets. The analytical tool that made tight finite-round security proofs practical is the entropy accumulation theorem of Frédéric Dupuis, Omar Fawzi, and Renato Renner, which bounds the smooth min-entropy accumulated over many sequential, possibly correlated rounds in terms of a single-round quantity. Generalized versions published since have simplified the analysis further.

Demonstrated Performance

The first randomness certified by a loophole-free Bell test was reported by Peter Bierhorst and colleagues in 2018: 1,024 bits distilled from data taken at NIST, uniform to within ten to the minus twelve, and secure against an adversary constrained only by the impossibility of superluminal signaling. The figure illustrates both the strength of the guarantee and its cost, since a trusted-device generator produces that many bits in well under a microsecond. That run certified randomness without expanding it, because the protocol consumed more seed than it returned.

Two experiments published in 2021 crossed into genuine expansion. The NIST group ran a photonic setup for 91.0 hours at an average rate of 3,606 certified bits per second, returning roughly 24 percent more output bits than it consumed, with a soundness error of 5.7 times ten to the minus seven against classical side information. The second experiment, with single-photon detection efficiency near 84 percent, ran for 19.2 hours at an average rate of 13,527 bits per second for a net gain of 2.57 times ten to the eighth certified bits, with a soundness error of 3.09 times ten to the minus twelve and security proved against quantum side information by extending the entropy accumulation theorem. Kilobits per second remains the published state of the art for fully device-independent operation.

Randomness Amplification

Randomness expansion assumes that the protocol's seed is perfectly uniform and private. Randomness amplification asks a harder question: given only a source of weak, partially predictable randomness, can one produce output that is nearly perfect? Classically the answer is no. A Santha-Vazirani source, in which each bit conditioned on the entire history has probability bounded away from zero and one by some margin but is otherwise adversarial, admits no deterministic extractor that produces even a single unbiased bit.

Quantum devices change the answer. Colbeck and Renner showed in 2012 that Bell-violating devices can amplify a Santha-Vazirani source into nearly perfect randomness, and subsequent work extended amplification to sources with arbitrarily weak guarantees using a finite number of devices and to security against general no-signaling adversaries. The result is of considerable conceptual importance, since it separates what quantum and classical resources can do with imperfect randomness, and it also matters practically: the free-choice assumption in a Bell test is itself an assumption about randomness quality, and amplification protocols weaken what must be assumed.

Amplification protocols demand higher Bell violations and far more rounds than expansion protocols, which kept them out of the laboratory for more than a decade. The first experimental demonstration was reported in 2026 by a group at ETH Zurich working on the superconducting-circuit platform described above, converting a weak, adversarially correlated source into output that is nearly uniform, a task provably beyond any classical procedure. The result is a single laboratory demonstration on a cryogenic platform rather than a deployable component, but it closes the gap between the amplification theorems and experiment.

Hardware Implementation

A device-independent generator is an optical and electronic instrument built around a hard latency budget and an even harder efficiency budget. Every element is chosen to protect one of the two.

Entanglement Sources

Photonic implementations almost always use spontaneous parametric down-conversion in a nonlinear crystal, typically periodically poled potassium titanyl phosphate or beta barium borate, pumped by a stabilized laser. The source is operated at low pair-emission probability to suppress multi-pair events, which degrade the correlation, and the crystal, waveguide, and collection optics are engineered for high heralding efficiency rather than high raw brightness. Because Eberhard-type analyses call for non-maximally entangled states, the source is deliberately tuned away from the maximally entangled configuration to the degree that optimizes the certified entropy at the achievable efficiency. Matter-based platforms, including nitrogen-vacancy centers, trapped ions, and neutral atoms, achieve near-unit detection efficiency through event-ready heralding, at trial rates orders of magnitude lower than photonic sources. Superconducting circuits sit outside that trade-off: readout fidelity is high and trials repeat quickly, but the two stations and the waveguide joining them must share a single cryogenic envelope, so the separation that closes the locality loophole is bought in meters of millikelvin plumbing rather than in fiber.

Detectors

Detection efficiency is the binding constraint, which is why superconducting nanowire single-photon detectors dominate the field. Devices with system detection efficiency above ninety percent, dark count rates of a few counts per second, and timing jitter well under a hundred picoseconds are commercially available. They require operation at roughly one to four kelvin in a closed-cycle cryostat, which adds substantial size, cost, and power consumption relative to the avalanche photodiodes used in trusted-device generators. Transition-edge sensors offer photon-number resolution and comparable efficiency but with recovery times too slow for high trial rates. Every optical component between source and detector reduces the same efficiency figure, so the design minimizes connector count, uses low-loss fiber, and places narrowband filtering with care.

Setting Choice and Fast Switching

Each station must choose a setting and apply it within a few tens of nanoseconds. The choice comes from a local fast physical random source, often a laser-phase-noise or vacuum-fluctuation generator, digitized and processed in a field-programmable gate array with deterministic latency. The setting is applied to the photon by an electro-optic modulator, such as a Pockels cell, driven by a high-voltage switch. The FPGA also timestamps detection events, enforces fixed trial windows, and streams the transcript to storage. Deterministic, bounded latency matters more than average speed, because the security argument depends on the worst-case timing rather than the typical case.

Timing, Synchronization, and Geometry

The two stations are separated by enough distance to give the electronics time to work, typically a hundred meters or more, and the space-time diagram of each trial is documented as part of the security claim. Synchronization is maintained by a common reference distributed over fiber, with the propagation delay of the reference itself calibrated and accounted for. Trial windows are defined in advance from the synchronized clock rather than from the data, which closes the coincidence-time loophole. Cable lengths, connector delays, and modulator rise times are measured and included in the timing analysis, since an unbudgeted forty-nanosecond delay can invalidate space-like separation on a hundred-meter baseline.

Classical Processing

The final stage estimates the CHSH violation from the test rounds, converts it into a smooth min-entropy bound under the chosen security framework, and runs the extractor. This computation is performed on trusted hardware inside the security perimeter, because it consumes the raw transcript and the extractor seed. Extraction over strings of ten to the ninth bits or more is computationally demanding, and implementations commonly use Toeplitz-matrix hashing accelerated by the fast Fourier transform, or a Trevisan construction when seed economy is the priority. Whether extraction runs online or offline determines the latency between measurement and usable output, which is the figure of merit for a beacon that must publish on a schedule.

Relaxed Trust Models

Full device independence is often more assurance than an application needs and more cost than it can bear. A family of intermediate protocols trades a specific, explicitly stated trust assumption for a large gain in rate and simplicity.

Source-device-independent protocols trust the measurement apparatus but not the source, which suits scenarios in which the entangled or squeezed state is delivered by a third party. Measurement-device-independent protocols invert the assumption, trusting the state preparation while treating the detectors as fully untrusted, which is valuable because detectors have historically been the most successfully attacked component in quantum cryptographic hardware. One-sided device-independent protocols rest on the demonstration of quantum steering rather than a full Bell violation and tolerate substantially lower detection efficiency. Semi-device-independent protocols assume only a bound on some physical quantity, most commonly the dimension of the transmitted system or the energy of the optical pulse, and can be built from a single station with no entanglement at all.

These schemes reach output rates in the megabits per second and above and can be built with room-temperature avalanche photodiodes and integrated photonics. They are a genuine middle ground rather than a compromise of the same guarantee: each certifies entropy under an assumption that is stated plainly and can be checked against the deployment, which is a considerable improvement over an unstated trust in a complete hardware model.

Public Randomness Beacons

The application in which device-independent certification has moved furthest toward routine use is the public randomness beacon: a service that publishes fresh random values on a fixed schedule, signed and chained so that the sequence cannot be revised after the fact. A beacon is useful precisely where the parties consuming the randomness do not trust one another.

The NIST Randomness Beacon

NIST has operated a randomness beacon since 2013. Its version 2.0 prototype publishes pulses of 512 bits at sixty-second intervals; each pulse is sequence-numbered, timestamped, digitally signed, and includes the hash of the preceding pulse, so that the operator cannot retroactively alter a published value without detection. The format and protocol are described in NIST Interagency Report 8213, released as an initial public draft in 2019, whose stated purpose is to serve as a baseline for a set of interoperable beacons operated by independent parties. NIST states plainly that beacon output must never be used as a secret key: the values are public by design, and their utility lies in public verifiability rather than confidentiality.

Bell-Certified Beacons

In June 2025, NIST and the University of Colorado Boulder launched CURBy, the Colorado University Randomness Beacon, which publishes randomness certified by a loophole-free Bell test performed at NIST. Entangled photons travel by optical fiber to laboratories at opposite ends of a hall, where the Bell measurement repeats roughly 250,000 times per second, and each successful run yields a pulse of 512 bits. Over the beacon's first forty days of operation the protocol succeeded on 7,434 of 7,454 attempts, a rate of 99.7 percent; the remaining attempts produced no certified output rather than an uncertified value. The distinguishing feature is provenance: rather than asking users to trust a hardware entropy source, the beacon publishes the Bell test transcript and the certification chain alongside the output. The accompanying Twine protocol uses hash-chaining across several participating parties so that the generation and certification steps are independently attested and auditable, and the implementation is open source. Suggested uses include public lotteries, jury selection, and any allocation of resources in which a losing party may later question whether the draw was fair.

Where Public Randomness Is Needed

The demand for auditable public randomness is broader than lotteries. Risk-limiting election audits must select ballots to inspect by a method that neither side controls. Cryptographic standards use publicly derived constants to demonstrate that parameters were not chosen with a hidden structure. Distributed ledgers select block proposers and committees by lot. Zero-knowledge and interactive proof systems can be made non-interactive using a public random challenge. Clinical trials assign treatments by randomization that must withstand later scrutiny. In each case the value is public, the requirement is unbiasability and verifiability rather than secrecy, and a certification that rests on physics rather than on the reputation of an operator is a meaningful improvement.

Standards, Validation, and Practical Limits

Device-independent generators sit awkwardly in the existing validation landscape. NIST SP 800-90B, the entropy source validation standard, is built around a documented stochastic model of a noise source together with statistical estimators applied to raw samples. A device-independent generator has no noise-source model to submit, because the absence of such a model is the point, and its entropy claim rests on a protocol-level security proof against an adversary who may hold quantum side information. Neither the estimators nor the documentation requirements map cleanly onto that structure. Work on quantum entropy source evaluation continues in several venues, including ISO/IEC and ETSI, and the general direction is to accept a physical-model-based entropy claim with defined assumptions, but a validation route that credits device-independent certification for what it actually proves is still developing.

The practical limits are equally important to state. Output rates of a few kilobits per second are many orders of magnitude below the gigabit-class throughput of trusted-device quantum generators and far below the demand of any server handling cryptographic traffic. The equipment occupies a laboratory, requires cryogenics, and is not portable. The security proof requires that the two stations be shielded and non-communicating, which is straightforward on a campus and impossible inside a chip package. Certified bits therefore make sense as a seed of the highest available assurance, as a periodic public value, or as an independent reference against which conventional generators can be assessed, rather than as a general-purpose entropy supply.

Two engineering trends are shifting these limits. Detector efficiency continues to improve, and every point of efficiency above the Eberhard threshold increases certified entropy per trial disproportionately. Integrated photonics is reducing the loss and footprint of the source and switching stages. Meanwhile, tighter finite-size security proofs based on entropy accumulation extract more certified bits from the same experimental data than earlier analyses did, which is a genuine rate improvement obtained through mathematics rather than hardware.

Conclusion

Device-independent randomness certification answers a question that conventional entropy engineering can only address by appeal to authority: how does a user know that a random number generator is random, when the output carries no evidence and the hardware cannot be inspected? By deriving the entropy claim from an observed Bell inequality violation under carefully controlled space-time and detection conditions, the approach yields a bound that holds even if an adversary designed and built the apparatus. The cost is severe. Closing the detection loophole demands detection efficiency above the Eberhard threshold, closing the locality loophole demands separated laboratories and nanosecond-scale control electronics, and the resulting rates are measured in kilobits per second.

The practical result is a division of labor. Trusted-device quantum and classical generators will continue to supply the bulk entropy that cryptographic systems consume, backed by physical models, min-entropy estimates, and continuous health tests. Device-independent certification supplies the highest-assurance seeds, the reference measurements against which those generators can be judged, and the auditable public randomness that beacons such as CURBy now publish and certify every day. Semi-device-independent and measurement-device-independent protocols fill the space between, each trading a stated assumption for practical throughput. What the field has established beyond any particular instrument is a standard of argument: an entropy claim should say what is assumed, what is measured, and how the two are connected.

Related Topics