Quantum Random Number Generators
Every key is only as good as the randomness behind it. The essentials before you buy, test or certify a QRNG.
A quantum random number generator (QRNG) produces random numbers by measuring a quantum process, such as the arrival time of photons, instead of running an algorithm, and every key, nonce and salt you rely on starts from that randomness.
Why it matters now
March 2026
ETSI Technical Report TR 104 171, “Implementation Guidelines for Quantum Random Number Generators”, carries a March 2026 date and drew press coverage on 24 September 2026. It classifies QRNG products by trust level, throughput, power and size. Expect buyers to start asking in that order.
May 2026
The NCSC says QRNGs offer no new defence against quantum computers attacking public-key cryptography, and that classical generators “will continue to meet our needs” for government and military use. A pitch that sells QRNG as quantum protection has to argue against the agency.
August 2023
NIST validated ID Quantique's IDQ250C2 QRNG chip under SP 800-90B on 25 August 2023, as entropy certificate E63, on the IID track and with reuse restricted to the vendor. Quantum entropy now ships as a component, so ask for the certificate number, not the brochure.
The 7 things
The essentials, in the order we would explain them to a board. Each ends with one lecture from our archive, given by a named practitioner.
A quantum random number generator measures a quantum process instead of stretching a seed with an algorithm. The NCSC says QRNGs offer no new defence against quantum computers breaking public-key cryptography. Their job is narrower: supply entropy you can defend. If your weakness is RSA, a QRNG will not help.
Entropy assurance and why a QRNG mattersJon Maliepaard, CEO About 40 minMembers The NCSC expects classical generators to keep meeting government and military needs. A QRNG case therefore needs something concrete: form factor, source monitoring or a compliance demand. Self-certifying designs claim to check their own output, so ask what that claim rests on. A supplier who cannot name the failure is selling the word quantum.
Why do self-certifying QRNGs matter in classical and post-quantum security?Wenmiao Yu, co-founder and Director of Business Development About 40 minMembers NIST SP 800-90B tests entropy sources by measuring their output, and its final text dates from January 2018. ITU-T X.1702 (November 2019) describes an architecture for quantum entropy sources as an add-on to existing noise-source standards. The newest guidance, ETSI's, is a technical report rather than a standard, so suppliers will keep changing too. Crypto agility lets you change generator without redesigning the system.
Everything you knew about crypto agility has changed.David Harding, Co-Founder and CEO, Entrokey Labs About 40 minMembers Quantum key distribution protocols such as BB84 depend on random choices of state and basis, and the 2024 ANSSI, BSI, NLNCSA and Swedish NCSA paper notes that random number generators are typically part of the QKD module. A QKD supplier's randomness claim deserves the same questions as a QRNG supplier's: what is the source, how is it monitored, who validated it? Case studies show how real systems are specified.
Quantum Key Distribution Case StudiesFlorian Fröwis, Business Development Director About 40 minMembers Ask for the entropy source description, the min-entropy estimation method, the continuous health tests, an independent validation such as NIST SP 800-90B or BSI AIS 20/31, and the origin of the components. ETSI's 2026 report gives compliance and certification a section of its own, listing both. Missing paperwork is itself an answer.
Advantages of QRNGs from COTS, affordability and trust in your current supply chainDr. Jose Coello, Head of Research About 40 minMembers ETSI's report covers tamper resistance, side-channel shielding and a section on AI-driven attacks. It says such attacks do not predict the quantum process itself but exploit the classical components and side channels around it. Ask each supplier for a written attack model, not a test report alone.
Prompting QRNG with AIAnthony (Tony) Lawrence, CEO About 40 minMembers List every system that generates keys: servers, hardware security modules, embedded devices, certificate authorities. For each, note the entropy source and whether anyone has tested it. The map shows whether you need better randomness anywhere, or only a post-quantum migration plan.
Practical Cryptographic Inventory and Quantum Readiness StrategyMarin Ivezic, CEO of About 40 minMembers Expert lectures
Every QRNG lecture in the QSECDEF archive, from the companies that build the devices and the people who test them. Members first, then the rest. Pick the one closest to the decision on your desk.
LectureQuantum Key Distribution Case Studies
LecturePrompting QRNG with AI
Co-Founder and CEO, Entrokey Labs
LectureEverything you knew about crypto agility has changed.
LectureAdvantages of QRNGs from COTS, affordability and trust in your current supply chain
LectureEntropy assurance and why a QRNG matters
LectureWhy do self-certifying QRNGs matter in classical and post-quantum security?
The dated sources on this page run from January 2018 to September 2026, and the newest of them, ETSI's implementation guidance, changes what a buyer should ask a supplier. A one-off course is a snapshot. Weekly learning is a feed, and a feed is what keeps your questions current while evidence standards settle.
Your membership includes the introductory quantum cyber security and quantum resilient blockchain courses, plus the Business Bootcamp. Each ends in a certificate, so your team can study at its own pace and show what it completed.
See the courses
More than 170 lectures from practising experts sit in the member library. Topics run from post-quantum cryptography and QKD to sensing, PNT and quantum business. Watch when your diary allows, then return to the ones you need.
Browse the lectures
We commit to publishing a new training course every 90 days, so the programme keeps pace with the field. Your membership covers each one as it goes live, with no extra fee for the course.
See current courses
Members save 25% on partner training and certifications, including the CPQCPM Post Quantum Cryptography Programme Manager certification. The discount applies at booking, so the saving comes before you pay.
View the certification
Members receive invitations to our in-person events, including our London, Amsterdam and Berlin events, plus private members-only briefings and priority access to the QSECDEF members’ symposium 2027 in Paris.
See upcoming events
Every Tuesday at 3pm CET, a practitioner presents a live topic and takes questions. Members get priority access to the call and the recorded archive afterwards, so a missed week is never lost.
Join Tuesday's callAll four courses and 170+ lectures included
Find the right membership for you
Become a memberTraining path
Four to five hours across six modules, with a module on QRNG certification standards and integration pathways, no physics background needed, a QSECDEF certificate at the end. Module 1 is free and the course is included in membership. It turns the evidence checklist above into questions you can put to a supplier.
View the courseCPQCPM. Ten hours live online over five weeks, built around post-quantum migration programme management. Randomness is one input to the migration this certification organises. Members save 25% on partner certifications.
Social proof
Recommendations shared publicly on LinkedIn by QSECDEF members.
1,500+
40+
900+
700+
Free updates
A quantum random number generator (QRNG) is a device that produces random numbers by measuring a quantum process, such as photon arrival times or vacuum fluctuations, rather than computing them from a seed. It supplies the entropy that key generation depends on. The NCSC describes the potential as truly unpredictable output, with real-world noise and implementation attacks limiting it.
Not automatically. The NCSC states that classical generators will continue to meet government and military needs. A QRNG can monitor its source and generate entropy quickly, but ETSI notes that QRNGs generally deliver lower throughput than a classical generator feeding a pseudorandom generator. Judge it on validation evidence, such as NIST SP 800-90B results or BSI AIS 20/31, not on the word quantum.
No. Post-quantum algorithms need good randomness, but classical generators that pass entropy validation can supply it. The NCSC says QRNGs give no new defence against quantum attacks on public-key cryptography. A QRNG is a choice about entropy quality and assurance, made alongside the migration rather than instead of it.
Start with the QSECDEF Quantum Cyber Security Foundation. It takes four to five hours, includes a QRNG module, and needs no physics background. The first module is free, and the course is included in membership. The lecture archive adds supplier and researcher views on entropy assurance, certification and supply chains.
We take guidance from the following open frameworks for technical education: EQAVET, the European Quality Assurance Reference Framework for Vocational Education and Training; the European Union Council Recommendation on micro-credentials; the CAST Universal Design for Learning Guidelines; and WCAG 2.2, the web accessibility standard. Educational oversight: QSECDEF Advisory Board. Feedback, errors, omissions and updates: QSECDEF Community.
