Practical attack on a quantum random-number generator via injection of source-signal fluctuations
Phys. Rev. Applied 24, 014008 – Published 2 July, 2025
DOI: https://doi.org/10.1103/k3c9-ngt1
Abstract
Quantum random-number generators (QRNGs), which exploit quantum mechanical effects to produce truly random numbers, are extensively used in information security and cryptography. Despite their inherent randomness, practical implementations of QRNGs, particularly those based on CMOS sensors, face security challenges due to device imperfections and external interference. This paper investigates the security vulnerabilities of QRNG systems against source-signal-injection attacks, specifically focusing on electrical signal fluctuations that modulate the intensity of the light source. This modulation induces subtle classical fluctuations in the photon-detection process, which are misinterpreted by legitimate users as quantum noise. This leads to an overestimation of secure entropy, compromising the security of the system. We demonstrate the effectiveness of the attack through experimental design and implementation, simulating practical-attack scenarios and assessing the impact on the entropy of generated random numbers. Our experiments reveal that while the altered random numbers can still pass National Institute of Standards and Technology (NIST) tests, the attacker can extract additional entropy without significantly affecting the statistical properties of the random numbers. To mitigate these risks, we introduce a defense mechanism that sets an entropy-threshold range and continuously monitors entropy variations, effectively preventing classical fluctuations from being misinterpreted as secure entropy. These findings hopefully provide critical insights for enhancing the reliability and security of QRNG systems in future large-scale quantum security applications.
