Classification of attacks and cyber security requirements for the QRNG web resource
D.M. Morhul, Олексій Нарєжній, T.O. Hrinenko · Radiotekhnika · 2025
Web services of quantum random number generators (QRNG) open new opportunities for enhancing the resilience of cryptographic systems due to their ability to generate true random numbers based on quantum effects. Unlike pseudo-random number generators (PRNG), the QRNG ensures a high level of unpredictability in output data, making them critical components in modern security systems. However, their implementation is accompanied by significant challenges, particularly due to potential attacks at the software level and during integration with hardware infrastructure. At the software level, major threats include attacks on cryptographic libraries, substitution or manipulation of runtime output data, and side-channel attacks exploiting information leaks from physical number generation processes. At the hardware level, risks arise from equipment defects, failures in integration processes, or improper operation of the QRNG in combination with other systems. This study provides a classification of the main types of attacks on QRNG web services, presents an analysis of existing attacks, and introduces modern approaches to their prevention. Among the key solutions are the certification of the QRNG during development and deployment, multi-factor verification of output data to ensure unpredictability, and the use of monitoring systems with artificial intelligence algorithms for anomaly detection. Special attention is given to hybrid protection methods that combine the QRNG with quantum key distribution (QKD) and post-quantum cryptographic algorithms, allowing for the mitigation of risks from both classical and quantum attacks. Thus, a comprehensive combination of software and hardware security methods will enhance the reliability of QRNG and their resilience to modern threats. Further research should focus on the implementation of unified standards for QRNG and the optimization of their integration into existing cryptographic systems.