QRNG (Quantum Random Number Generator)

A QRNG derives randomness from quantum-mechanical processes, such as photon behavior, whose outcomes are unpredictable in principle rather than merely hard to model. This differs from a CSPRNG, which deterministically expands a seed: a QRNG's unpredictability is physical, making it attractive as a seed source for security-critical randomness.

The honest framing separates what the provider reports from what the consumer measured. A device may be described by its vendor as having a given entropy rate, and a consuming system can record the health tests it ran on a draw, and those are two different statements. Treating the first as verified because the second passed is the common overclaim.

Assessment under SP 800-90B is a formal process applied to a source, which is distinct from running health tests against an assumed entropy figure.

The distinction that keeps claims honest is between a property of a device and a measurement made by a consumer of it. A vendor may describe a source's entropy rate; a consuming system can record which health tests it ran on a draw and whether they passed. Stating the first as though the second established it is the overclaim this term tends to attract.

SP 800-90B describes a formal assessment process applied to an entropy source, involving specified statistical testing and a documented model of the noise source. Running health tests against an assumed figure is a useful operational control and is not that assessment, and the two are worth naming separately in any description of how randomness is produced.

Operationally a physical source is usually a network call away, which is why it is used to seed rather than to serve. Pairing it with a local DRBG gives high-assurance seeding without a round trip per random byte, and what deserves recording is the seed reference and the reseed schedule, so any output can be traced to what it was derived from.

Whatever the source, the artifact worth keeping is a record of what an output was derived from, which is the attestation pattern applied to randomness.