Post-Quantum Security Requires More Than New Algorithms

The transition to post-quantum cryptography (PQC) is moving from algorithm selection toward implementation. On 27 October 2026, the US National Institute of Standards and Technology (NIST) finalized NIST IR 8547: Transition to Post-Quantum Cryptography Standards. It describes NIST’s approach to replacing quantum-vulnerable public-key algorithms with quantum-resistant digital signatures and key-establishment mechanisms. 1

The Cloud Security Alliance’s Crypto News newsletter of 2 November 2026, compiled by Dhananjoy Dey, provided industry context for this article. The technical discussion below draws directly on NIST and ETSI publications; the newsletter is not cited as a requirement to adopt QRNG. 2

The strength of an algorithm is one part of the security of the system that uses it. Cryptographic implementations also depend on key management, hardware integrity, operational controls and unpredictable random values.

PQC migration should therefore include the randomness infrastructure supporting cryptographic operations. Replacing an algorithm does not repair a predictable seed or an entropy source that the application never actually uses.

• PQC algorithms
• Randomness

Implementation

Cryptographic randomness remains a foundational requirement

Randomness supports cryptographic key generation, seeding deterministic random bit generators (DRBGs) and randomized operations where the chosen mechanism requires them. The mathematical properties of post-quantum algorithms do not remove these requirements.

If an adversary can predict the values used to generate secret material, the implementation may be vulnerable even when the underlying algorithm resists known quantum attacks. The required security strength, seeding and reseeding behaviour must be assessed for the specific mechanism and system.

NIST’s random-bit-generation framework distinguishes the source of entropy from the cryptographic processing that uses it. SP 800-90B addresses entropy-source design, characterization and health testing. SP 800-90C, finalized in September 2025, specifies complete random-bit-generator constructions that combine entropy sources with deterministic mechanisms. 3 4

An appropriately seeded and protected DRBG remains a valid part of a cryptographic architecture. It can supply output efficiently; running it longer does not create fresh physical entropy. For an introduction to these complementary roles, read NIST’s Random Bit Generation project.

PQC, QRNG and QKD address different requirements

Post-quantum cryptography concerns algorithms intended to resist attacks by quantum computers. It changes the cryptographic mechanisms used for operations such as key establishment and digital signatures.

Quantum random number generation (QRNG) addresses the physical source of unpredictability. It uses quantum physical processes to generate entropy that can be assessed and supplied to cryptographic systems.

Quantum key distribution (QKD) uses quantum communication protocols to establish shared key material between communicating parties. It is a separate technology from both algorithm migration and entropy generation.

These technologies can coexist in some architectures, but their functions are distinct. QRNG does not replace PQC, and secure PQC does not inherently require a QRNG. Other physical entropy sources remain valid when they meet the applicable requirements. A quantum source is an implementation option to evaluate, rather than a change to an algorithm’s mathematical security.

What ETSI’s QRNG implementation guidance adds

In March 2026, ETSI published TR 104 171 V1.1.1: Implementation Guidelines for Quantum Random Number Generators. The report considers physical source models, extraction, monitoring, environmental vulnerabilities and implementation assurance. 5

Section 5 discusses Entropy Zero Trust and entropy provenance, extending attention beyond the physical source to monitoring, hardware and the interfaces that deliver entropy. Annex A.5 considers architectures combining PQC and QRNG, including runtime attestation.

For implementers, the useful question is how to establish confidence in the complete path from a physical measurement to cryptographic use. A quantum process alone does not demonstrate output quality or show that an application receives the intended entropy.

The document is technical guidance. It does not create a universal requirement to use QRNG with PQC, or establish that a particular commercial device meets its recommendations.

From quantum entropy to CMOS integration

At iQrypto, our development focuses on quantum-origin entropy from electron shot noise in standard CMOS silicon. A deliberately high-leakage, reverse-biased semiconductor junction provides the physical source; discrete charge-carrier events are measured, monitored and processed into random output. The implementation does not require a light source or optical alignment. 6

The technology has been demonstrated in a European 180 nm CMOS process, with an entropy cell under 5 µm and a current QRNG die measuring 1.5 × 1.5 mm. The implementation includes continuous health monitoring and cryptographic conditioning. Our published entropy figures come from an internal NIST SP 800-90B assessment. Formal SP 800-90B validation and AIS 31 readiness remain separate roadmap activities. 6

We offer three routes for discussing evaluation and integration:

• System evaluation: VERA-Q provides a USB-based way to evaluate quantum entropy with a host system. Access is through a shortlist, in very limited quantities, with samples available on request.
• Board-level integration: discuss a dedicated QRNG chip for an electronic product. Packaged supply is on demand, with requirements and quantities agreed for the project.
• Silicon IP integration: discuss entropy-cell hard IP for a microcontroller, secure processor or system-on-chip design, including the target process, constraints and assessment responsibilities.

The relevant trade-offs include area, power, interfaces, operating conditions, entropy throughput and integration into the semiconductor design flow. Our USB, chip and IP integration guide compares the starting points.

Evaluate entropy assurance across the complete system

Introducing a new entropy source does not automatically improve system security. Its contribution must be characterized, the random-bit-generator construction understood, and the delivery path maintained during operation.

For hardware security developers, semiconductor teams and system architects, an evaluation should cover:

• Physical source characterization: identify the process responsible for entropy and establish what is measured.
• Entropy estimation and conditioning: relate the output processing and output length to the assessed entropy budget.
• Operational monitoring: detect source failures or abnormal conditions, and define how the system responds.
• Entropy delivery: verify that the intended source reaches the cryptographic application through the actual hardware and software path.
• Assurance evidence: identify the relevant requirements, internal test evidence and independent assessment or validation needed for the intended use.

These questions apply to quantum and other physical entropy sources. They should be addressed alongside algorithm selection, key management and implementation review, rather than deferred until after the cryptographic migration.

Plan the algorithm and entropy work together

NIST’s transition roadmap provides a direction for replacing quantum-vulnerable algorithms. The NIST random-bit-generation publications and ETSI implementation guidance address different parts of the system supporting those algorithms.

For a product team, a practical next step is to document the chosen cryptographic mechanisms, the randomness they require, the entropy source and processing path, and the evidence needed to assess the complete construction. QRNG can be one physical source within that plan, supported by characterization, monitoring and appropriate assurance.

To discuss an evaluation, use the VERA-Q request below. For chip or IP integration, share your target platform, operating constraints and the questions you need to resolve. Our technology overview explains the iQrypto implementation in more detail.

References

1. NIST IR 8547: Transition to Post-Quantum Cryptography Standards. Final, 27 October 2026.
2. Cloud Security Alliance. Crypto News, 2 November 2026. Compiled by Dhananjoy Dey; article 1 (pp. 5–6) and article 15 (pp. 30–36). Industry context. Quantum-Safe Security Working Group information.
3. NIST SP 800-90B: Recommendation for the Entropy Sources Used for Random Bit Generation (2018).
4. NIST SP 800-90C: Recommendation for Random Bit Generator Constructions. Final, 25 September 2025.
5. ETSI TR 104 171 V1.1.1: Implementation Guidelines for Quantum Random Number Generators (March 2026), including Sections 4–5 and Annex A.5.
6. iQrypto technology overview: CMOS implementation, internal assessment and assurance status.