Online Adaptive Randomness Extraction for Physical and Quantum Entropy Sources: Composing Health-Test Soundness with the Leftover Hash Lemma

Abstract

Physical and quantum random number generators (QRNGs) do not emit uniform bits: detector bias, dead time, after-pulsing, and environmental drift leave their raw output biased, correlated, and partially predictable to an adversary who models the device. Deployable generators therefore include a conditioning (randomness-extraction) stage that distils near-uniform keys from a source of certified min-entropy, and the cryptographic workhorse of that stage is the Leftover Hash Lemma (LHL). This paper analyses two ways in which real deployments depart from the textbook LHL. First, a physical source has no fixed min-entropy: continuous health tests, as standardised in NIST SP 800-90B, produce a runtime lower-bound estimate that varies from block to block and can occasionally be optimistic. Driving the extractor output length from this estimate, we prove an online adaptive extraction theorem whose security bound cleanly composes the estimator soundness error with the extractor error, yielding a (δ+ε)-secure key and separating how often the entropy estimate is optimistic from how uniform the hash output is, as two independently tunable budgets. Second, for settings that publish or reuse the extractor seed — public randomness beacons, reproducible pipelines, and seed-constrained devices — we prove that publishing the seed costs nothing, since this is the defining property of a strong extractor, and that reusing a single seed across m independent source blocks costs at most mε in statistical distance. A corollary bounds the security loss when the extracted key is consumed by a downstream symmetric primitive, and a worked instantiation with realistic QRNG parameters reports the achievable secret-key rate. A reproducible numerical simulation on a synthetic biased source corroborates all four claims. Throughout, we are explicit about the single load-bearing unproven premise — empirical min-entropy certification of the physical device — which belongs to entropy-source validation and lies outside the scope of the analysis.