Vrana Georgia, Lou Dafu, Kuang Randy
Quantropi (Canada), 1545 Carling Ave., Suite 620, Ottawa, ON, K1Z 8P9, Canada.
Sci Rep. 2025 Jul 29;15(1):27718. doi: 10.1038/s41598-025-13135-8.
High-quality randomness is fundamental to the security of modern cryptographic systems. We present QPP-RNG, a true random number generator (TRNG) that harvests entropy from diverse system-level jitters-including CPU pipeline timing divergences, DRAM refresh cycle perturbations, cache miss-driven memory access latencies, and other subtle hardware and operating system-induced fluctuations. QPP-RNG's core mechanism measures the elapsed time of randomized array sorting operations-where each Fisher-Yates shuffle is infinitesimally perturbed by these microscopic jitters-and amplifies these timing variations into cryptographically strong randomness through a quantum permutation pad (QPP) architecture, all achievable on commodity hardware. The raw output of QPP-RNG underwent rigorous evaluation for independent and identically distributed (IID) behavior using the NIST SP 800-90B IID test suite, alongside the comprehensive NIST SP 800-22 and ENT statistical test batteries. Across a range of platforms, including Windows, macOS, and Raspberry Pi, QPP-RNG consistently achieved high IID min-entropy between [Formula: see text] and [Formula: see text] bits/byte. It passed all NIST SP 800-90B IID tests with [Formula: see text]-values significantly above the [Formula: see text] threshold, confirming that its generated randomness is statistically indistinguishable from ideal IID sources derived directly from system jitter. Cross-platform analyses spanning x86_64 and ARM64 architectures further demonstrate that the extracted jitter fingerprint-and consequently the generated randomness-exhibits remarkable statistical consistency, irrespective of the underlying hardware or operating system. QPP-RNG's entropy density compares favorably with leading commercial entropy sources. It matches or slightly exceeds the NIST IID-certified min-entropy of ID Quantique's Quantis QRNG (7.8744 bits/byte), and significantly outperforms both Red Hat's CPU Time Jitter RNG (7.4528 bits/byte) and Quside's PCIe One quantum entropy source (6.5136 bits/byte). Even against specialized hardware RNGs like Microchip's ECC608 (4.0568 bits/byte), QPP-RNG demonstrates superior performance using only general-purpose processors. By effectively transforming otherwise discarded system noise into a reliable and high-quality entropy stream, QPP-RNG establishes a novel paradigm for embedded security, providing a robust entropy source on general-purpose devices without specialized hardware. This makes it especially well-suited for resource-constrained Internet of Things (IoT) and edge computing applications where strong entropy sources are paramount.
高质量的随机性是现代密码系统安全的基础。我们提出了QPP-RNG，这是一种真正的随机数生成器（TRNG），它从各种系统级抖动中获取熵，包括CPU流水线定时差异、DRAM刷新周期扰动、缓存未命中驱动的内存访问延迟以及其他由硬件和操作系统引起的细微波动。QPP-RNG的核心机制测量随机数组排序操作的耗时，其中每个费舍尔-耶茨洗牌操作都会受到这些微观抖动的微小扰动，并通过量子置换填充（QPP）架构将这些时间变化放大为具有密码学强度的随机性，所有这些都可以在商用硬件上实现。QPP-RNG的原始输出使用NIST SP 800-90B独立同分布（IID）测试套件以及全面的NIST SP 800-22和ENT统计测试套件对其独立同分布行为进行了严格评估。在包括Windows、macOS和Raspberry Pi在内的一系列平台上，QPP-RNG始终在[公式：见文本]和[公式：见文本]比特/字节之间实现了高IID最小熵。它通过了所有NIST SP 800-90B IID测试，[公式：见文本]值显著高于[公式：见文本]阈值，证实其生成的随机性在统计上与直接从系统抖动导出的理想IID源无法区分。跨越x86_64和ARM64架构的跨平台分析进一步表明，提取的抖动指纹以及因此生成的随机性表现出显著的统计一致性，而与底层硬件或操作系统无关。QPP-RNG的熵密度与领先的商业熵源相比具有优势。它匹配或略超过ID Quantique的Quantis QRNG经NIST IID认证的最小熵（7.8744比特/字节），并且显著优于红帽的CPU时间抖动RNG（7.4528比特/字节）和Quside的PCIe One量子熵源（6.5136比特/字节）。即使与Microchip的ECC608（4.0568比特/字节）等专用硬件RNG相比，QPP-RNG仅使用通用处理器也表现出卓越的性能。通过有效地将原本被丢弃的系统噪声转化为可靠且高质量的熵流，QPP-RNG为嵌入式安全建立了一种新的范式，在无需专用硬件的通用设备上提供了强大的熵源。这使得它特别适用于资源受限的物联网（IoT）和边缘计算应用，在这些应用中强大的熵源至关重要。
