Peter Raymond Smith

Random numbers play a crucial role in information technology, particularly as digital communication capacity continues to expand. Consequently, the need for secure and high-rate random number generation has become increasingly urgent. While integrated photonics technology holds promise for mass-producing optoelectronic quantum random number generators (QRNGs), there remains a challenge in developing fast, robust, and scalable solutions suitable for industrial deployment. Addressing this challenge, we present a fast QRNG solution in this study, leveraging a photonic integrated circuit (PIC) directly embedded onto a versatile electronic platform. Designed to withstand real-world applications, our PIC is packaged to align with industrial electronic assembly lines. To rigorously assess scalability and stability, these generators underwent week-long periods of continuous GHz operation. Furthermore, a QRNG was integrated into a quantum key distribution system, where despite operating in an uncontrolled environment, minimal variations in physical randomness were observed over 38 days, as measured from 2.9 million histograms. Finally, we implemented a security model for the QRNGs, enabling rate adjustment to match the actual randomness content and demonstrating secure generation at 2 Gbit/s.

Random number generators underpin the security of current and future cryptographic systems and are therefore a likely target for attackers. Quantum random number generators have been hailed as the ultimate sources of randomness. However, as shown in this work, the susceptibility of the sensitive electronics required to implement such devices poses a serious threat to their security. We present the first out-of-band electromagnetic injection attack on a quantum random number generator through which an adversary can gain full control of the output. In our first experiment, the adversary forces the binary output of the generator to become an alternating string of 1s and 0s, with near 100% success. This attack may be spotted by a vigilant user performing statistical tests on their output strings. We therefore envisage a second more subtle attack in which the adversary forces the output to be a random pattern known to them, thus rendering any protection based on statistical tests ineffective.