Statistical Validation of a Physical Prime Random Number Generator Based on Quantum Noise ^†

Abstract

Random prime numbers are an essential resource for many asymmetric cryptographic protocols. However, despite the emerging popularity of quantum random number generators (QRNGs) as sources of secure randomness, physical prime number generators have not yet been explored. In this work, we experimentally implement and characterize a vacuum-based probabilistic prime number generation scheme with an error probability of $3.5\times {10}^{-15}$. By removing the quantum source (QS), an additional scheme based on electronic noise is derived, and a comparative analysis for increasing prime lengths is made. We observed that the QS significantly outperforms the classical scheme for small prime generation, where increases up to 585.0% in the diversity of unique primes obtained are seen. Moreover, we propose a length-agnostic statistical test for prime number sequences and apply it to the output of the uniformized randomness source, which was successful in revealing underlying biases in the output prime distributions. The resultant sequences were subsequently submitted to the NIST statistical test suite, where the quantum and classical sources passed, respectively, 86.96% and 45.34% of the total test set applied.

1. Introduction

Random Numbers (RNs) are currently an indispensable component of most cryptographic systems since their security fundamentally relies on using unpredictable keys, nonces, or seeds [1,2]. For example, random prime number generation has been particularly important given its role in choosing key pairs for public-key cryptographic protocols such as RSA or ECC [3]. The security of the former, for instance, relies on the difficulty of factoring a given public modulus n, which is obtained from the product of two large prime integers, $n=pq$. The public key, which is used for encryption, consists of the pair $(n,e)$, where e is an additional public exponent. In turn, this factor e is related to the private exponent d, which is part of the private key $(n,d)$ used for decryption. The first step to generate these key pairs is thus randomly selecting the two large prime factors. These should remain secret and be unpredictable since recovering them would allow an adversary to compute the private exponent from the public key [4]. Although often overlooked, choosing an adequate Random Number Generator (RNG) is thus critically important [5]. If an adversary can predict any future or past outputs with better accuracy than randomly guessing, security loopholes are introduced even if the cryptographic protocol itself remains secure [6]. As a result, the traditional approach of employing high throughput deterministic RNGs, the so-called Pseudorandom Number Generators (PRNGs), for security-critical applications seems increasingly unsound [7,8]. Despite the best algorithmic implementations being able to output uniformly distributed numbers that pass multiple statistical tests, their output is inherently periodic and thus can be predicted by adversaries with enough computational resources [9]. In fact, the applicability of cryptanalytic attacks against PRNGs has progressively been made easier by the increasing computational power and novel techniques such as Machine Learning (ML), which are capable of independently recognizing the correlations in the RNG output [10,11]. More worryingly, they are particularly susceptible to the insertion of backdoors [12], and weak cryptographic keys have already been found to still be widely in use due to poorly implemented PRNGs [13]. Although there are alternative physical implementations that extract randomness from measuring noisy phenomena, most of these still rely on classical processes such as atmospheric noise [14,15,16]. Consequently, they still simply ground their unpredictability on an incomplete description of the physical system and can potentially present highly correlated outputs [2]. Indeed, recently, a ML model was found to be successful in increasing the probability of guessing the outcome of such a RNG whenever the electronic noise source was prominent [11].

These problems are slowly being addressed by the emergence of Quantum Random Number Generators (QRNGs), which extract randomness from the probabilistic properties of quantum measurements [2,17]. Unlike the approaches based on classical noise, their randomness source is fundamentally unpredictable to any adversary, thus allowing them to yield information-theoretically provable randomness [18]. In fact, several different schemes have already been thoroughly explored, such as measuring amplified spontaneous emission [19,20], phase laser noise [21,22], photon arrival times [23,24], or the quadrature fluctuations of the optical vacuum state [25,26,27]. The latter is particularly promising since it can deliver the high throughput rates of potentially several hundred $\mathrm{Gbps}$ seen for more complex implementations while requiring a simpler homodyne measurement scheme that can be implemented with off-the-shelf optical devices [28]. Moreover, obtaining the optical vacuum state can be done, within a reasonable approximation, by simply blocking the impinging optical signal, which makes it a source more resilient against environmental perturbations [29]. Due to the lower number of optical components required, these schemes are also more easily integrated. Despite often sacrificing the achievable throughput due to challenges such as the presence of dark currents, these compact schemes are essential to achieve commercially viable implementations [28,30]. This thus lowers their adoption threshold and allows them to compete against the traditional pseudorandom solutions. Nonetheless, the output statistical quality of these schemes should not be assumed by default but corroborated by extensive characterization. In fact, challenges such as guaranteeing a properly balanced detection or fluctuations in the classical noise floor can lower the available entropy and introduce security loopholes [31]. Although fully device-independent solutions exist, these rely on observing loophole-free Bell inequality violations and thus are tendentiously extremely slow and difficult to implement [32]. This makes them unfeasible for any practical realization, and thus, implementations at least partially based on trusted devices are widely used. Therefore, most schemes are still prone to manipulation by an adversary with even partial access to the entropy source, and their statistical properties can deviate if the expected environmental conditions change [33].

Given this, surprisingly, few assessments of the applicability of these generation schemes for random prime number generation have been made [34]. Random prime numbers are typically distilled from the output of a deterministic RNG using provable prime number generation algorithms such as the Shawe–Taylor random prime routine described in the Digital Signature Standard (FIPS 186-5) [3]. Alternatively, one can sequentially test different RNs with either primality-proving algorithms, such as the Pocklington and AKS tests, or probabilistic approaches such as the Miller–Rabin primality test [4,35]. In either case, the statistical quality of the retrieved prime number sequence is non-trivially impacted by the chosen RNG. Despite these routines acting as an additional postprocessing layer and thus masking some input biases, a highly correlated output can still be present when a compromised randomness source is used [34].

In this work, we extend the preliminary analysis made in [34] and proceed with the statistical validation of a probable quantum prime number generator based on raw homodyne measurements of vacuum quadrature fluctuations. To evaluate the extent to which the additional classical entropy impacts the statistical quality of the gathered prime sequences, we additionally perform a comparative analysis with a purely classical entropy source derived from the proposed vacuum-based QRNG and present the key merit figures such as the variation in the diversity of prime numbers obtained and the search times for different prime lengths. Moreover, a length-agnostic statistical validation approach based on measuring the frequency of observations in an equiprobable binning of the prime output distribution is proposed, and the resulting sequences are submitted to the NIST statistical test suite.

This paper is organized into 4 sections. In Section 2, we describe the experimental QRNG implementation and the additional probabilistic prime-searching algorithm implemented. In Section 3, the output noise from the quantum source is characterized in comparison with measurements from the classical scheme, and the prime sequences are statistically validated. Moreover, the key figures of merit for prime number generation are compared. Finally, in Section 4, a brief conclusion is presented.

2. Materials and Methods

In this study, to assess the impact of classical entropy contributions in the prime number generation, we have comparatively analyzed two randomness sources exploring distinct physical phenomena. The first is the proposed quantum scheme, which performs quadrature measurements of the vacuum state by employing a homodyne detection scheme. Here, these normally distributed noise contributions are amplified by a Local Oscillator (LO) that interacts with the vacuum state in a balanced Beam Splitter (BS) [29]. In practice, the input port of this BS can simply be blocked to obtain a reasonable approximation of this optical state. Subsequently, the output beams are detected, and their photocurrents are subtracted. Thus, ideally, only the shot noise remains, whose variance, ${\sigma }_Q^2$, is proportional to the impinging optical power, $P_{\mathrm{LO}}$:

$${\sigma }_Q^2\propto q\mathcal{R}\left(\lambda \right)P_{\mathrm{LO}}\Delta f,$$

(1)

where q is the electron’s charge, $\mathcal{R}\left(\lambda \right)$ the wavelength-dependent responsivity of the photodetector and $\Delta f$ its bandwidth [31]. Additional classical noise contributions will also be inevitably present due to factors such as excess relative intensity noise from an unbalanced detection or the electronic components in the experimental setup. The latter component was also separately recorded to obtain a second Classical Source (CS) from the device’s electronic noise. Since the output of the vacuum-based QRNG contains a mixture of quantum entropy and potentially correlated classical noise contributions, a Randomness Extractor (RE) layer is typically required. This stage sacrifices a portion of the biased output sequence, allowing the scheme to achieve information-theoretically secure and bias-free RNs [18]. Nonetheless, since our goal is to assess the impact that a predominance of classical noise has on the prime number output, this stage was not implemented. Instead, we have simply considered the unprocessed output of the quantum scheme. Consequently, any correlations presented by the classical RNG will also be displayed by the QRNG implementation, thus allowing us to quantify the impact of the quantum noise source on the statistical quality of the prime output. We refer to [31] for a complete theoretical description of the implemented vacuum-based QRNG and derivation of the expected variances for all the noise sources considered.

2.1. QRNG Implementation

Figure 1 shows a schematic diagram of the implemented experimental vacuum-based randomness generation scheme. Here, a $1550.92$ $\mathrm{n}$$\mathrm{m}$ continuous-wave laser tuned at approximately 11 $\mathrm{dBm}$ is used as the LO, while a Variable Optical Attenuator (VOA) (VOA1) allows the accurate control of its output power. Moreover, a 80/20 BS (BS1) and an Optical Power Meter (OPM) are introduced to monitor the input power at the 50/50 BS (BS2), which was registered at $5.5$ $\mathrm{m}$$\mathrm{W}$. A second VOA (VOA2) was additionally used to obtain a fine-tuned balanced detection scheme. A balanced receiver (WL-BPD1GA) with an output bandwidth ranging from 300 $\mathrm{k}$Hz to 1 GHz was subsequently introduced to detect and subtract the output optical signals. It contains a Transimpedance Amplifier (TIA) with a gain of 3500 $\mathrm{V}$/$\mathrm{W}$ that amplifies the resultant electronic signal. Finally, the output measurements are sampled at $983.04$ $\mathrm{MSa}/\mathrm{s}$ by the Texas Instruments ADS54J60EVM Analog-to-digital Converter (ADC) module, which has an acquisition range, R, of $\pm 0.95$ $\mathrm{V}$ and a resolution, n, of 16 bits.

The digitization of the noise signal also introduces an additional quantization noise variance that can be determined as $\frac{{\delta }^2}{12}$, where $\delta =\frac{R}{2^{(n-1)}}$ is the bin width of the ADC [27]. Given these experimental conditions, an additional noise variance of $7\times {10}^{-5}$ $\mathrm{m}$$\mathrm{V}$² can be expected. Moreover, as specified by the Nyquist sampling theorem, the noise signal will not be accurately recovered when its bandwidth is larger than half the sampling frequency. Despite this, here, this condition should not be obeyed since, given a finite signal bandwidth, any samples taken would necessarily be highly correlated. In fact, under an ideal TIA response, maximally uncorrelated measurements are only obtained when the sampling frequency, $f_s$ follows [36]:

$$f_s=\frac{2\Delta f}{j},\forall j\in \mathbb{N},$$

(2)

where $\Delta f$ is the cut-off frequency of the detector’s TIA. Although an optimal sampling rate was not considered in this implementation, a value lower than 2 $\mathrm{GSa}/\mathrm{s}$ must nevertheless be adopted to avoid introducing additional temporal correlations in the homodyne output signal [34].

To derive the classical randomness source based on the electronic noise measurements, the LO was simply removed from the experimental setup described, and measurements of the detector’s electronic noise were recorded. This process also allows us to estimate the contribution of the classical noise floor to the discretized homodyne signal distribution, M, and thus quantify the fraction of randomness that can be extracted without compromising the implementation. A conservative approach is to consider the worst-case conditional min-entropy, $H_{\min }\left(M\right|E)$, as a lower bound. It quantifies the maximum probability of an eavesdropper predicting a QRNG outcome, given that the classical noise distribution E is known with arbitrary precision. Assuming that M and E are independent and follow identically distributed null-mean Gaussian distributions: [21,37]:

$$H_{\min }\left(M\right|E)=-{log}_2\left[max\left\{\frac{1}{2}\left[1+\left(\frac{e_{\max }-R+\frac{3\delta }{2}}{{\sigma }_Q\sqrt{2}}\right)\right],\left(\frac{\delta }{2{\sigma }_Q\sqrt{2}}\right)\right\}\right],$$

(3)

where R and $\delta$ are, respectively, the acquisition range and bin width of the previously considered ADC module, ${\sigma }_Q$ is the experimentally measured standard deviation of the quantum noise distribution, and $e_{\max }$ is the maximum excursion considered for the classical noise signal. Here, this parameter was taken as $5{\sigma }_E$ so that, for any given classical noise sample, only a low probability, approximately $5.73\times {10}^{-7}$ , of it falling outside the considered interval $[-e_{\max },e_{\max }]$ was observed.

2.2. Prime-Searching Algorithm

Finally, the measurements were submitted to the prime-testing layer, which maps the output distribution of both schemes into a set of random prime numbers with a given bit length $n_{\mathrm{prime}}$. Since both randomness sources measure Gaussian-distributed phenomena, their output distribution will be biased if no further postprocessing is applied. This could reflect itself on the generation of prime numbers, and thus, their output signals were also mapped into uniform distributions in an effort to increase their measured entropy. With that aim, the measurement distributions were divided by an equiprobable binning algorithm, and 16-bit Gray sequences were attributed to all outcomes falling on a certain bin [29]. Consequently, uniformly distributed 16-bit RNs are obtained. This step is also necessary to do a proper comparative analysis of the two sources since the electronic noise distribution will naturally have a lower variance than the overall homodyne signal, which includes additional contributions. The CS thus occupies a smaller proportion of the ADC range and outputs fewer unique codes, which further increases its bias when compared with the Quantum Source (QS). Nonetheless, to allow an assessment of the impact that this stage has on the statistical quality of the obtained prime RNs, the scenario where the biased distributions were directly used has also been considered.

To distill the prime numbers, the 16-bit random output is first converted to its binary representation. The algorithm then gathers a $n_{\mathrm{prime}}$-bit prime number candidates by parsing the binary input bitwise until both the Most Significant Bit (MSB) and Least Significant Bit (LSB) are equal to one [34]. This guarantees that the candidate number is odd and has the expected bit-length. Naturally, in a practical application, where the generation rate is a major concern, the MSB and LSB can simply be forced to be unitary while gathering $(n_{\mathrm{prime}}-2)$-bit binary sequences from the QRNG output. This would greatly increase the fraction of the output submitted to the primality test and thus decrease the number of candidate numbers tested until a prime is found.

A sequence of 24 standard Miller–Rabin primality tests is then applied to the candidate number as defined by the Digital Signature Standard [3]. Given that a RE layer was not implemented, the random basis required for each test iteration was obtained from a Mersenne Twister PRNG. This avoids having to further limit the number of candidate numbers submitted and guarantees the statistical significance of the primality test even if correlations exist in the QRNG output. Given the sequence of probabilistic primality tests applied, the expected probability of false positives for this prime generator can be calculated as $4^{-24}$, thus standing at $3.55\times {10}^{-15}$ . For this work, in order to balance between accuracy and algorithmic speed, a compromise was made in selecting this value. Nevertheless, a longer sequence of primality tests should be included to meet the security standards set for cryptographic applications such as RSA key generation [3].

In this work, we have chosen this approach of probabilistic primality testing due to, despite introducing the possibility of false positives, being much faster than deterministic algorithms, thus making the generation of large prime numbers feasible. Disregarding the test algorithmic complexity, a lower bound for the theoretically possible prime generation rate of this scheme, N, can be given by taking the asymptotic approximation for the prime-counting function, $\pi \left(x\right)\approx \frac{x}{logx}$ [4], yielding:

$$N(\mathrm{in}\mathrm{primes}/\mathrm{s})\approx \frac{G}{2}\frac{n_{\mathrm{prime}}-2}{n_{\mathrm{prime}}(n_{\mathrm{prime}}-1)log2}$$

(4)

where G is the maximum throughput of the implementation in bit/s. This yields a reasonable approximation for $G\gg n_{\mathrm{prime}}$. The real performance is naturally much lower since it depends on the computational power available and decreases with the $O\left(24{log}^3{n}_{\mathrm{prime}}\right)$ algorithmic complexity of the primality test [4].

3. Results and Discussion

A sequence of 1 G noise samples was acquired for each of the randomness sources considered and used in the noise characterization presented in Section 3.1. As previously mentioned, each of these datasets was then considered in two different scenarios: directly in its biased form or after mapping them into a uniform distribution. By taking them in their binary representation, four distinct sequences of random bits were obtained. For each case, only the first 1 GB was submitted to the prime-searching algorithm. Consequently, in all cases, the segment of binary data used in prime number generation directly results from the first 500 M acquired samples from the respective noise source. All the described postprocessing was implemented on an Intel i9-10900k Central Processing Unit (CPU) for increasingly large prime numbers. To assess the performance variation of the scheme, the algorithm was implemented for prime lengths of 32, 64, 128, 256, and 512 bits. Given the fixed size of its binary input, the total amount of prime numbers yielded by the algorithm will decrease with the prime length. Consequently, when directly comparing the figures of merit obtained for different prime lengths, only the first 10 M prime numbers of each case were considered.

3.1. Noise Characterization

In the conditions previously described, a Quantum-to-classical Noise Ratio (QCNR) of at least $11.7$ dB was always observed, which highlights the high noise clearance obtained. Over $1\times {10}^9$ samples, a classical noise floor of $1.04\times {10}^{-6}$ $\mathrm{V}$² was evaluated, while an average variance of $1.64\times {10}^{-5}$ $\mathrm{V}$² was seen for the homodyne signal. As can be seen in Figure 2a, both noise sources follow the expected null-mean Gaussian distribution. After applying the binning algorithm, as can be seen in Figure 2b, these output signals appear to be successfully mapped to the same set of output codes. Nonetheless, both sets seem to significantly deviate from the theoretically expected uniform distribution, whose probability density function is represented by the dashed line. This is additionally corroborated by the fact that both datasets conclusively fail a Chi-square goodness-of-fit test with null p-values, thus rejecting the null hypothesis that the measurements observed arise from a uniform distribution. Consequently, we verify that the simple binning algorithm is not completely successful in suppressing all the underlying biases of the raw RNG output. This illustrates the importance of implementing the RE layer in a fully fledged practical application. Despite this, the CS seems to present a greater deviation than the raw QRNG output, which may be a consequence of the increased entropy introduced by the QS.

In Figure 3a,b, the normalized autocorrelation coefficients for 10 $\mathrm{M}$ measurements calculated over a delay of 200 samples can be seen, respectively, for the raw and uniformized dataset. For a sequence of this size, these values should be normally distributed around a null average value with a standard deviation of $3.16\times {10}^{-4}$, which is here represented by a black-dashed line. Although the coefficients for the uniformized output stay within the expected standard deviation in both scenarios, this clearly contrasts with the case seen for the raw sequences presented in Figure 3a. Here, the QS clearly shows significant correlations for delays up to 60 samples, which can be mostly attributed to the TIA [36]. Meanwhile, we confirm the highly correlated nature of the CS output, which clearly shows the unreliability of using electronic noise for randomness generation. Consequently, we expect the raw CS to perform significantly worse at prime number generation.

Although the RE layer was not implemented, a quantum min-entropy of $8.39$ $\mathrm{bit}$ was calculated for the QRNG implementation through the evaluation of Equation (3). At the chosen sampling rate, an information-theoretically secure implementation would support a maximum output rate of approximately $8.25$ $\mathrm{Gbps}$. This high throughput allows the implementation of a fast prime generation scheme. For example, as can be assessed through Equation (4), a theoretical prime generation rate of $180.0$ $\mathrm{M}$ primes per second could be expected for 32-bit primes. Naturally, this does not consider the algorithmic complexity of the prime-testing layer, and significantly lower rates would be seen in a real-time implementation. Moreover, as expected, this rate decreases for prime numbers with longer bit-lengths since, according to the prime number theorem, the density of primes for any given value x is asymptotically $\frac{1}{log\left(x\right)}$ [4]. Consequently, the probability of the RNG outputting a prime number decreases for larger bit sizes. For example, for a length of 512 $\mathrm{bit}$, the expected output rate is $11.6$ $\mathrm{M}$ primes per second.

3.2. Figures of Merit

Given the input noise previously characterized, the total number of primes found over the entire 1 GB dataset for each of the scenarios considered is represented in Figure 4a. Here, the solid line represents a lower bound for the total number of primes found estimated through Equation (4). Here, it should be noted that the total number of primes found should asymptotically approximate this bound for increasing bit-lengths in agreement with the approximation taken for the prime-counting function in Section 2.2. As theoretically expected, this figure consistently decreases for larger prime lengths but remains relatively constant across the four scenarios for each prime length. A notable exception can be seen for the 32-bit prime output. Here, the normally distributed sources yield significantly fewer numbers than the uniformized scenarios. In fact, for the raw CS and QS cases, a total of $187.9$ $\mathrm{M}$ and $191.7$ $\mathrm{M}$ numbers were, respectively, obtained, representing decreases of 3.89% and 1.94% when compared with the average of $195.5$ $\mathrm{M}$ seen across the uniformized scenarios. This reduction can naturally be explained by the biased input distribution of the raw randomness sources and is consistent with the smaller variance of the CS, which implies a smaller probability of yielding extreme candidate numbers.

Despite this, this performance difference is not seen in the time that it takes to find each prime, which stays consistent across the four datasets considered. Instead, the search time exponentially increases with the prime length as described by the decreasing generation rate, expressed in Equation (4), and the algorithmic complexity of the Miller–Rabin primality test. Figure 4b clearly illustrates this. For instance, although finding each prime took an average of $108.8$ $\mathsf{\mu }$$\mathrm{s}$ across all cases considered, $1019.2$ $\mathsf{\mu }$$\mathrm{s}$ were necessary for a length of 512 $\mathrm{bit}$, highlighting the challenge of achieving physical RNG schemes able to deliver prime lengths suitable for cryptographic applications.

A more relevant figure of merit than the overall number of primes obtained is the diversity of the prime output sequences since it allows the identification of a prevalence of repeated outputs. Here, to allow a comparison between all sources and prime lengths considered, we have taken 10 $\mathrm{M}$ prime numbers from each case and compared the number of unique values. In fact, while for larger primes, every output is unique across all cases considered, this is not true for the 32 and 64-bit lengths. As seen in Figure 5a, the diversity of primes is particularly low for the 32-bit case, where the number of unique values is only a small fraction of the total. As with what was seen in the overall number of primes, for the unprocessed randomness sources, this observation can be expected since, due to the normally distributed input noise, certain ADC codes have a higher probability of being observed. For smaller primes, which are constituted from fewer samples, this significantly reduces the diversity of candidate numbers seen, and thus, the probability of observing repeated prime numbers increases. This is obviously more easily observed in the 32-bit case, where every candidate number is only obtained from 2 ADC samples. However, the same phenomena can be seen for the 64-bit prime sequence represented in Figure 5b.

The uncorrelated nature of the QS shows here an immediate advantage, yielding approximately 827.5% more unique RNs than the classical case. In fact, this difference cannot be explained by the higher noise variance of the homodyne signal. Although uniformizing the input noise clearly increases the diversity of primes for the classical scheme, the uniformized QS still outperforms it by an order of magnitude. Indeed, we observe an additional gain of 585.0% that cannot be solely attributed to the biased distribution of the unprocessed randomness sources. Nevertheless, at least for the 32-bit case, the diversity of primes remains low even for the uniformized QS, confirming the underlying bias revealed in Section 3.1 for both sources considered. Given that, in reality, the QS is a mixture of quantum noise and classical contributions, these can also be attributed to the CS. Despite this, it would be important to assess this figure of merit after implementing an adequate RE layer.

For completeness, in

Table 1. Difference (expressed in %) in the diversity of prime numbers found, when compared with the CS and uniformized CS cases, for the QS, uniformized CS, and uniformized QS schemes. In each case, all the prime numbers found in the entire 1 GB dataset were considered. Data from [34].

Prime Length (Bit)	QS (CS)	Uniformized CS (CS)	Uniformized QS (CS)	Uniformized QS (Uniformized CS)
32	890.7	837.1	8749.0	844.3
64	53.7	33.4	54.0	15.5

, we also present the variation in the diversity of prime numbers taken for the entire 1 GB total number of primes generated across different noise sources, which are also reflected in the values calculated. Here, the behavior previously described can still be observed, and, notably, the diversity variation for the 64-bit case is much more pronounced than in the first 10 $\mathrm{M}$ values. Finally, it should be noted that, in total, the raw CS yielded only 0.056% of the entire set of 32-bit prime numbers. On the other hand, both the QS and the uniformized CS were much more successful, generating approximately 0.53% of all possible outcomes. Meanwhile, the uniformized QS showed an even greater performance increase, outputting nearly 5% of all 32-bit prime numbers, which clearly illustrates its superiority.

3.3. Statistical Validation

As a simple assessment of the statistical quality of the prime number sequences obtained, the distribution of 10 $\mathrm{M}$ samples was plotted for increasing lengths in each of the four cases considered. To illustrate these results, the 32-bit prime output is represented for the CS and QS cases, respectively, in Figure 6a,b. The distributions seen for all other lengths evaluated can be found in Figure A1 from Appendix A. As can be seen, the distribution significantly improves after applying the binning algorithm and uniformizing the input noise. In fact, both the raw CS and QS distributions appear to be clustered around certain values in the domain of possible outcomes, presenting prominent peaks in the number of counts. Meanwhile, the uniformized sources approach the desired uniform distribution among all possible outcomes. As seen in Figure A1, this behavior remains remarkably consistent across all prime lengths, with the outcome distribution following the same recognizable pattern. Given this, the raw noise sources appear to not be suitable for safe prime number generation and will be excluded from the following analysis. Additionally, as is exemplified in Figure 6c, we see an additional improvement of the prime distribution when the QS is considered.

3.4. Length-Agnostic Statistical Validation

In this section, we present a length-agnostic approach to assess the statistical quality of the prime RNG output based on observing the probability of measurements falling below a given threshold. Since prime numbers are not uniformly distributed in the set of natural numbers $\mathbb{N}$, searching for the presence of patterns in the RNG output is not a trivial task. Statistical test suits, such as the one from NIST [1], typically certify randomness by expecting uniformly distributed sequences and simply test for deviations from this assumption. Moreover, for larger prime lengths, collecting and testing a sufficiently representative sequence can quickly become unfeasible due to the vast number of possible outcomes and the computational precision required to represent these values. Most statistical evaluations will be increasingly complex for larger prime lengths, making their implementation unfeasible.

Nonetheless, it should be possible to establish a threshold, $p_{\mathrm{th}}$, such that any given n-bit prime distribution can be mapped into two equiprobable bins, each containing half of all possible outcomes. An unbiased prime RNG should then yield a uniformly distributed binary sequence that can be tested by a randomness test suite. Unfortunately, it is not feasible to calculate the exact value of the prime-counting function, $\pi \left(x\right)$, for any arbitrary x. Instead, lower and upper bounds, ${\pi }_{\min ,\max }\left(x\right)$, must be established [38]:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill \pi \left(x\right)& \ge \frac{x}{logx}\left(1+\frac{1}{log\left(x\right)}+\frac{1.8}{{log}^2\left(x\right)}\right)\mathrm{for}x\ge 32299\hfill \\ \hfill \pi \left(x\right)& \le \frac{x}{logx}\left(1+\frac{1}{log\left(x\right)}+\frac{2.51}{{log}^2\left(x\right)}\right)\mathrm{for}x\ge 355991.\hfill \end{array}\end{array}$$

(5)

Since $\pi \left(x\right)$ is not a bijective function, $p_{\mathrm{th}}$ will also have to be estimated and thus presents associated uncertainty bounds, $p_{\mathrm{th}}^{\min ,\max }$. For any $k=\pi \left(x\right)$ [39]:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill p_k& <k\left(log\left(k\right)+loglog\left(k\right)-1+\frac{loglog\left(k\right)-2}{log\left(k\right)}-\frac{{(loglog\left(k\right))}^2-6loglog\left(k\right)+10.667}{2{log}^2\left(k\right)}\right)\mathrm{for}x\ge 46254381\hfill \\ \hfill p_k& >k\left(log\left(k\right)+loglog\left(k\right)-1+\frac{loglog\left(k\right)-2}{log\left(k\right)}-\frac{{(loglog\left(k\right))}^2-6loglog\left(k\right)+11.321}{2{log}^2\left(k\right)}\right)\mathrm{for}x\ge 2.\hfill \end{array}\end{array}$$

(6)

Consequently, given a certain probability r that a n-bit prime number is below $p_{\mathrm{th}}$, the expected interval for the number of measurements below the threshold, $I_{\min ,\max }$, can be estimated through Equation (5):

$$I_{\min ,\max }=(1-r){\pi }_{\min ,\max }\left(2^{n-1}\right)+r{\pi }_{\min ,\max }(2^n-1).$$

(7)

Since there is uncertainty in determining $p_{\mathrm{th}}$, there is also a maximum expected interval for the proportion of measurements below the threshold, $r_{\min ,\max }$, which can be numerically calculated using the bounds in Equation (6):

$$r_{\min ,\max }=\frac{{\pi }_{\min ,\max }\left(p_{I_{\min ,\max }}^{\min ,\max }\right)-{\pi }_{\max ,\min }\left(2^{n-1}\right)}{{\pi }_{\max ,\min }(2^n-1)-{\pi }_{\max ,\min }\left(2^{n-1}\right)}.$$

(8)

After dividing the distribution of number primes, finding a proportion of outcomes outside the calculated probability interval, $r_{\min ,\max }$, is a strong indicator that the sequence under test is biased. Moreover, since the output measurements are mapped into binary sequences, this approach has the advantage of not increasing in complexity for larger prime lengths, which allows the statistical validation of all prime lengths considered.

Here, we have applied this mapping, with a threshold probability of $0.5$, to the output of the uniformized CS and QS. In Figure 7a, the normalized autocorrelation coefficients for the binary threshold values of 10 $\mathrm{M}$ 32-bit prime numbers are shown. As can be seen, no persisting correlations were found for either source. The same is seen in the correlation analyses for all other lengths, which can be found in Figure A2 from Appendix A. Additionally, the proportion of measurements that fall below the equiprobable threshold was calculated for increasing lengths, as shown in Figure 7b. Here, the theoretically expected Confidence Interval (CI), given by Equation (8), are represented by full lines. Nonetheless, since only 10 $\mathrm{M}$ samples were evaluated, its 99% binomial CI was also calculated for each of the probability bounds. As can be seen, all the obtained values appear outside the acceptable interval. Consequently, we are forced to conclude that the prime RNG fails this particular statistical test for all the cases that were considered. Given that a single assessment was made, additional test runs are necessary to assess the statistical significance of this result. Nonetheless, this indicates an unbalanced dataset where the proportions of 0’s and 1’s in the binary sequences are significantly different. In practice, this means that the prime generation of the implemented RNG is slightly unbalanced, with more values being consistently outputted below the calculated threshold even for the larger prime lengths.

Finally, to conclusively determine the significance of this result, a 100 $\mathrm{M}$$\mathrm{bit}$ binary sequence obtained from the 32-bit prime output was submitted to NIST’s statistical test suite [1]. These results are represented in

Table A1. NIST’s statistical test suite results for the default $\alpha =0.01$ and a data size of 100 Mbit (100 bit streams of 1 Mbit). The minimum pass rate is 96/100 and, when multiple values exist, the smallest is represented. For tests with multiple p-values, a Kolmogorov-Smirnov (KS) test was applied to obtain a representative value.

Statistical Test	Uniformized CS			Quantum QS
	p-Value	Proportion	Result	p-Value	Proportion	Result
Frequency	0.000000	0/100	FAILED	0.000000	0/100	FAILED
BlockFrequency	0.000000	76/100	FAILED	0.000000	93/100	FAILED
CumulativeSums	0.000000	0/100	FAILED	0.000000	0/100	FAILED
Runs	0.000000	0/100	FAILED	0.000000	0/100	FAILED
LongestRun	0.010988	97/100	PASSED	0.000082	93/100	FAILED
Rank	0.304126	99/100	PASSED	0.262249	99/100	PASSED
FFT	0.262249	98/100	PASSED	0.028817	100/100	PASSED
NonOverlappingTemplate	0.000000	31/100	FAILED	0.000000	73/100	FAILED
OverlappingTemplate	0.000000	57/100	FAILED	0.000000	81/100	FAILED
Universal	0.319084	98/100	PASSED	0.304126	98/100	PASSED
Approximate entropy	0.000000	3/100	FAILED	0.000000	90/100	FAILED
Serial	0.500000	92/100	FAILED	0.704474	100/100	PASSED
LinearComplexity	0.319084	98/100	PASSED	0.319084	99/100	PASSED

from Appendix B, both for the uniformized CS and QS. Here, each binary sequence was subdivided into bitstreams of 1 $\mathrm{M}$$\mathrm{bit}$ and subsequently submitted to the statistical tests. As can be seen, the output conclusively fails most of the applied evaluations, which confirms our prior assessment. In fact, we verify that both sources decisively fail the Frequency test, which evaluates a very similar metric to the previous analysis. Notably, although it also yields a failure, the QS performed slightly better in the OverlappingTemplate and NonoverlappingTemplate tests. In fact, here, 83 and 73 sequences, respectively, successfully passed these tests, which is contrasted with the 57 and 31 sequences that yielded a positive result for the CS. As described in [1], these two tests assess the occurrence of predetermined bit patterns, which could indicate that the QS output has higher entropy. Moreover, although the QS ultimately fails some test runs and, consequently, is rejected by the overall test, it is relevant to highlight that the vacuum-based QRNG performed significantly better than the classical scheme when considering all test iterations applied. In fact, the QS successfully passed 140 tests of the 161 applied, yielding a success rate of 86.96%. Meanwhile, the CS only passed 45.34% of the tests considered by the statistical suite. Despite this, the failures observed are very significant since they highlight serious flaws in the prime RNG implemented. Although it is hard to give a conclusive reason for this result, a strong candidate is the aforementioned lack of RE layer. The temporal correlations introduced by the TIA and the classical noise floor clearly manifest themselves on the prime number sequences obtained since, as previously verified, the prime-searching algorithm is unable to suppress them. In this way, it would be important to reassess these figures after implementing this essential step. Moreover, additional data should be gathered to allow more extensive statistical validation. This would allow us to conclusively determine the viability of the implemented vacuum-based QRNG for prime number generation.

4. Conclusions

In conclusion, we have implemented a probabilistic prime quantum number generation scheme based on homodyne measurements of vacuum fluctuations passed through a set of 24 Miller–Rabin primality tests. For a prime length of 512 bits, we expect a theoretical maximum throughput of $11.6$ $\mathrm{M}$ primes per second with a probability of outputting a composite number of only $3.55\times {10}^{-15}$. By removing the QS, a second classical generation scheme based on electronic noise was obtained, and the two schemes were compared. Although the overall number of primes does not depend on the noise source chosen, the quantum scheme clearly outperforms the CS at small prime generation. For the set of 32-bit primes, increases in the diversity of primes up to 585.0% are shown, which cannot be explained by the bias of the input distribution. In fact, the quantum source was shown to yield approximately 5% of all possible prime outcomes, outperforming the classical RNG by an order of magnitude. Moreover, we revealed that strong biases in the input distribution are clearly reflected in the prime output distribution, and although these differences are less prominent for larger lengths, the output distributions were also shown to consistently improve for the QS. Finally, a novel length-agnostic statistical test for prime number sequences based on establishing interval bounds for the expected frequency of measurements in an equiprobable binning of the prime distribution was proposed and applied to the output of the uniformized sources. Using the known bounds for the prime-counting function, the proportion of prime numbers below any given threshold can be bounded such that observations outside this range are witnesses of an unbalanced prime distribution. This approach allows the direct validation of a sequence of prime numbers with arbitrary length instead of relying on assessing the underlying RNG, which would not consider potential biases introduced by the prime-searching algorithm. This analysis was able to reveal the underlying correlations in the prime output of both sources, which remain present due to the lack of a RE layer. The resultant binary sequences thus conclusively fail the tests contained in the NIST statistical test suite, with only 86.96% and 45.34% of the evaluations being, respectively, passed by the QS and CS. In fact, out of the 161 evaluations applied, the QS source passed 140 tests, whereas the CS had a pass rate of 73. This nevertheless shows a significant difference between the two cases. Finally, to improve the statistical significance of this analysis, it would be important to gather additional datasets for each of the cases considered. This would allow us to more precisely estimate the key merit figures by establishing their respective confidence intervals, as well as apply a more extensive statistical validation. Moreover, to conclusively validate the viability of the vacuum-based implementation, it is fundamental to reassess all these cases after implementing the required RE stage.