ETSI Issues Security Guidance for Quantum Random Number Generators
ETSI has released a technical report, cataloged as TR 104 171, offering implementation guidance for securing the output of Quantum Random Number Generators (QRNGs). This document, developed by ETSI’s CYBER technical body with Mark Pecen as rapporteur and contributions from Cadzow Communications, Approach Infinity, the UK’s NCSC, Accenture, and Palo Alto Networks, is significant because the integrity of QRNG output directly impacts the security of post-quantum cryptography. Indeed, weak or predictable randomness in QRNGs could compromise systems built upon it.
What the Guidance Covers
The report details the entire QRNG lifecycle, from modeling the quantum entropy source to delivering reliable output to consuming applications. Published as Technical Report DTR/CYBER-00163, version 1.1.1, dated March 25, 2026, the document has been available for approximately six months. ETSI emphasizes an “Entropy Zero Trust” approach, treating every stage of the entropy pipeline as a potential vulnerability.
Key areas covered in TR 104 171 include:
- Modeling and validating the quantum entropy source, followed by appropriate randomness extraction.
- Monitoring entropy quality during operation to detect drift, bias, and hardware failures.
- Protecting the generator from tampering and side-channel attacks.
- Establishing provenance, attestation, and auditability to ensure the ongoing trustworthiness of outputs.
- Comparing QRNG implementations based on trust level, throughput, power, size, and interface requirements.
Mark Pecen, Chair of ETSI’s TC Quantum committee, stated that secure randomness relies on the “integrity of the entire implementation,” highlighting the need for organizations to validate and monitor the quantum source before trusting its output. The report also outlines future work, such as attestation protocols, stronger certification models, and guidance on integrating QRNGs with post-quantum cryptography.
Why Secure Randomness Matters
Cryptographic systems rely on unpredictable values for key generation. QRNGs derive these values from physical quantum processes, differentiating them from algorithmic methods. However, this physical basis alone does not guarantee security. Adversaries with side-information could exploit structural patterns in output that might otherwise pass statistical tests, a vulnerability the report aims to mitigate.
The connection to post-quantum cryptography is direct. A peer-reviewed study in the Journal of Web Engineering investigated QRNGs feeding NIST’s post-quantum algorithms, which were standardized in August 2024 as FIPS 203, FIPS 204, and FIPS 205. ETSI’s guidance operates between the entropy source and the application, distinct from FIPS 140-3 module validation, which vendors like Arqit use for their certification claims. Maintaining these distinctions helps buyers understand the specific scope of any given approval.
This initiative aligns with other recent developments in quantum security, such as the Swiss post-quantum semiconductor MoU signed by WISeKey, SEALSQ, and the Canton of Jura.