You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
feat: seed signatures with genuine two-source quantum RNG
Replace the modal-bitstring scheme (deterministic, range [0,15]) with a
two-source QRNG following the AWS Randomness_Generation reference: per-shot
Hadamard bit streams from SV1 (ideal) and DM1 (noisy) condensed by a Toeplitz
two-source extractor. Yields a true quantumNumber in [0,1000] plus a 32-byte
fresh quantum nonce r, so signatures are non-deterministic and replay-resistant.
- quantum-signature.ts: two-source circuits, toeplitzExtract, nonce-seeded
ToyLWE signature; honest CSPRNG fallback (fresh, not content-derived)
- webhook route: cache per-sender for stable badges; persist quantumNonce
- docs (en/zh): describe the two-source + Toeplitz pipeline and genuine r
- docs/paper: accuracy feedback for the paper + implementation design write-up
Copy file name to clipboardExpand all lines: docs/en/quantum-key-generation.md
+32-25Lines changed: 32 additions & 25 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -10,31 +10,36 @@ The implementation lives at [`photo-wall/src/lib/quantum-signature.ts`](../../ph
10
10
11
11
### 1.1 What we generate
12
12
13
-
For every new sender in a Telegram group we produce a small, stable identity bundle:
13
+
For every new sender in a Telegram group we produce a small identity bundle:
14
14
15
-
- a **quantum random number** in `[0, 1000]`, derived from a quantum measurement,
15
+
- a **quantum random number** in `[0, 1000]`, harvested from quantum measurements (see §1.2),
16
+
- a **32-byte quantum random nonce `r`**, the fresh entropy that seeds the signature,
16
17
- a **Bell-state probability vector**`[P(00), P(01), P(10), P(11)]`, used as a structural witness,
17
18
- a **ToyLWE keypair**, where the public key hash is shown on the card,
18
-
- a **signature**over `username | messageText | quantumNumber`,
19
-
-a deterministic**HSL accent color** derived from the quantum number and Bell-state probabilities.
19
+
- a **signature**`𝒮 = SHAKE-256(username ‖ quantumNumber ‖ r)` and a derived `𝒢` (see §3.1),
20
+
-an**HSL accent color** derived from the quantum number and Bell-state probabilities.
20
21
21
-
Subsequent messages from the same `(groupId, senderId)` reuse the cached bundle, so each user has a single stable identity per group.
22
+
The bundle is seeded by fresh quantum randomness, so it is **not** reproducible from the
23
+
username or message content. The first message from a `(groupId, senderId)` runs the QRNG
24
+
and the bundle is stored on the row; subsequent messages **reuse the stored bundle**, so
25
+
each user keeps a single stable badge per group while the underlying identity is genuinely
26
+
quantum-random.
22
27
23
28
### 1.2 Algorithm choices and rationale
24
29
25
30
The pipeline is composed of three building blocks. Each is chosen for a specific reason given the constraints of an event-grade demo.
26
31
27
32
| Building block | Choice | Rationale |
28
33
|---|---|---|
29
-
|**Quantum entropy**|4-qubit random-number circuit on Amazon Braket SV1 (100 shots), result mapped to `topBitstring mod 1001`| A small circuit fits SV1's latency budget (typical task < 5 s) and avoids QPU queue waits. Mod 1001 gives a presentation-friendly badge `Q#000`–`Q#1000` while still drawing entropy from quantum measurement. |
30
-
|**Quantum structural witness**| 2-qubit Bell-state `\|Φ⁺⟩` circuit on SV1 (200 shots), probabilities `[P(00), P(01), P(10), P(11)]`| A perfect simulator should yield ≈ `[0.5, 0, 0, 0.5]`. Storing the empirical vector lets us drive a deterministic HSL color from quantum data and gives a visible "this came from a quantum execution" signal. |
31
-
|**Post-quantum identity**| Educational ToyLWE: SHAKE-256 derives keypair material from `domain ‖ quantumSeed ‖ 32 OS bytes`; SHA-256 chain produces the signature; first 12 hex chars of the public-key digest become the badge | LWE is the same hardness assumption underlying the NIST PQC winners (Kyber/Dilithium). ToyLWE is a deliberately simple educational stand-in that keeps the on-chain artifact shape (public key, public key hash, signature) familiar to anyone planning a real PQC migration, while staying small enough to verify at a glance. |
34
+
|**Quantum entropy**|Two-source QRNG: a single-qubit Hadamard circuit sampled for its **per-shot bit stream** on **SV1** (ideal source) and on **DM1** (noisy/weak source), condensed by a **Toeplitz two-source extractor** into uniform output bits | Follows the canonical AWS reference (`amazon-braket-examples` → `Randomness/Randomness_Generation.ipynb`). Reading every shot — rather than the modal bitstring — keeps the quantum randomness, and the two-source extractor yields output that is ε-close to uniform even under device noise. Output bytes supply both `quantumNumber ∈ [0, 1000]` and the 32-byte nonce `r`. Both circuits run on simulators, so cost stays < USD 0.01 per generation. |
35
+
|**Quantum structural witness**| 2-qubit Bell-state `\|Φ⁺⟩` circuit on SV1 (200 shots), probabilities `[P(00), P(01), P(10), P(11)]`| A perfect simulator should yield ≈ `[0.5, 0, 0, 0.5]`. Storing the empirical vector lets us drive an HSL color from quantum data and gives a visible "this came from a quantum execution" signal. |
36
+
|**Post-quantum identity**| Educational ToyLWE: `𝒮 = SHAKE-256(username ‖ quantumNumber ‖ r)` derives keypair material from the quantum nonce; a SHA-256 chain produces the signature; the first 12 hex chars of the public-key digest become the badge | LWE is the same hardness assumption underlying the NIST PQC winners (Kyber/Dilithium). ToyLWE is a deliberately simple educational stand-in that keeps the artifact shape (public key, public key hash, signature) familiar to anyone planning a real PQC migration, while staying small enough to verify at a glance. The full construction is specified in [`docs/paper/quantum-rng-implementation.md`](../../docs/paper/quantum-rng-implementation.md). |
32
37
33
38
### 1.3 What we do **not** claim
34
39
35
40
-**Not BB84 / E91 / QKD.** Quantum key distribution requires two cooperating endpoints with quantum hardware and a public classical channel. The wall is a single-endpoint event experience; QKD would not have been the right primitive.
36
41
-**Not standardized PQC.** ToyLWE is not Kyber, Dilithium, or any NIST-standardized scheme; it is a teaching artifact. For production migration, swap ToyLWE for `@aws-crypto/kyber` / `pq-crystals/dilithium` or the equivalent in your stack — the surrounding pipeline (Braket entropy + Bell witness + per-user caching + ALB-fronted DynamoDB row) is unchanged.
37
-
-**Not fault-tolerant cryptanalysis.** The 4-qubit circuit is a randomness source, not a Shor/Grover instance. The badge demonstrates "quantum-authenticated identity" at event scale, not a quantum attack or quantum-key-establishment session.
42
+
-**Not fault-tolerant cryptanalysis.** The Hadamard source circuits are a randomness source, not a Shor/Grover instance. The badge demonstrates "quantum-authenticated identity" at event scale, not a quantum attack or quantum-key-establishment session.
38
43
39
44
---
40
45
@@ -46,23 +51,24 @@ The pipeline is composed of three building blocks. Each is chosen for a specific
| Supports OpenQASM 3.0 | Yes; circuits are emitted as `braket.ir.openqasm.program`|
56
61
57
-
SV1 was chosen because it is queue-free, region-flexible, and its latency stays within the 5-second polling cadence of the photo wall's `GET /api/messages/[groupId]` endpoint. A real QPU run can take 5–60 minutes once queueing is included, which would force the wall into an asynchronous "pending signature" flow without a meaningful change in the demonstration's narrative.
62
+
SV1 and DM1 were chosen because they are queue-free, region-flexible, and their latency stays within the 5-second polling cadence of the photo wall's `GET /api/messages/[groupId]` endpoint. Using two **independent** simulator sources — one ideal, one noisy — is what makes the Toeplitz two-source extractor meaningful: it condenses two weak sources into output that is provably close to uniform even under noise. A real QPU run can take 5–60 minutes once queueing is included, which would force the wall into an asynchronous "pending signature" flow without a meaningful change in the demonstration's narrative.
58
63
59
64
### 2.2 Fallback path
60
65
61
-
If Braket is unavailable, the code falls back to a deterministic local pipeline so the wall never blocks a sender:
66
+
If Braket is unavailable, the code falls back to a local pipeline so the wall never blocks a sender. The fallback uses the OS CSPRNG (`crypto.randomBytes`) — it is **fresh and non-deterministic**, but it is **not** a quantum measurement, and it is **not** derived from message content:
62
67
63
68
| Stage | Fallback behavior |
64
69
|---|---|
65
-
| Quantum random number |`shake256(\"quantum:\" + username + \":\" + Date.now()).readUInt16BE(0) mod 1001`|
70
+
| Quantum random number |`crypto.randomBytes(4).readUInt32BE(0) mod 1001`|
71
+
| Nonce `r`|`crypto.randomBytes(32)`|
66
72
| Bell state | Static `[0.5, 0, 0, 0.5]` (the noiseless ideal) |
67
73
| Algorithm tag |`algorithm: \"ToyLWE-local-fallback\"`|
68
74
| Device tag |`device: \"local-fallback\"`|
@@ -80,7 +86,7 @@ The same `BraketClient + CreateQuantumTaskCommand` path can target real QPUs wit
80
86
| Neutral atom | QuEra Aquila (256 qubits, us-east-1) | Programmable layouts, AHS paradigm; not a drop-in replacement for the gate-based RNG circuit but a candidate for thematic reservoir-style outputs |
81
87
| Managed simulators | DM1 (density matrix), TN1 (tensor network) | Useful when modeling noise (DM1) or wider circuits (TN1) for educational variants |
82
88
83
-
For an actual QPU rollout, expect to relax the 30-second polling window in `runOnSV1` and to surface a `signatureStatus = "queued"` state until the task completes.
89
+
For an actual QPU rollout, expect to relax the 30-second polling window in `submitAndFetch` and to surface a `signatureStatus = "queued"` state until the task completes.
| Stage | What is produced | Where it lives in the row |
106
113
|---|---|---|
107
-
|**Raw quantum random bits**|Most-frequent bitstring out of 100 shots on the 4-qubit RNG circuit | Not stored verbatim; collapsed to `quantumNumber = int(topBitstring, 2) mod 1001`|
108
-
|**Error-tolerant aggregation**|Picking the modal bitstring is the trivial majority-vote analogue of error correction; combined with `mod 1001`, it absorbs single-shot noise from the simulator |`quantumNumber`|
109
-
|**Privacy amplification**|`xof = SHAKE-256(\"ToyLWE-KeyGen-v1\" ‖ quantumSeed ‖ os.urandom(32), 64)` mixes quantum entropy with 32 OS-random bytes, breaking any per-task correlations | Not stored; mixed into `publicKeyHash` and `signature`|
|**Raw quantum random bits (two sources)**|Per-shot measurement streams `x` (SV1, ideal) and `y` (DM1, noisy) from ~700 shots each of a single-qubit Hadamard circuit | Not stored verbatim|
115
+
|**Two-source randomness extraction**|Toeplitz extractor `Ext(x, y) = x·(T(y)\|I_m)ᵀ mod 2` condenses the two weak sources into `m = 288` bits that are ε-close to uniform (ε = 1e-8) even under device noise | Not stored; consumed below|
116
+
|**Quantum random number + nonce**|`quantumNumber = readUInt32(out[0:4]) mod 1001`; `r = out[4:36]` (the 32 fresh quantum-random bytes) |`quantumNumber`, `quantumNonce`|
|**Structural witness**| Empirical Bell-state probabilities from the 2-qubit `\|Φ⁺⟩` circuit (200 shots) |`bellState`|
112
-
|**Audit metadata**| Whether SV1produced the row or the fallback did |`algorithm`, `device`, plus `signatureStatus` in DynamoDB |
119
+
|**Audit metadata**| Whether the SV1+DM1 QRNG produced the row or the fallback did |`signatureAlgorithm`, `device`, plus `signatureStatus` in DynamoDB |
@@ -146,4 +153,4 @@ The same pipeline shape generalizes to several real workloads:
146
153
- ToyLWE is for demonstration; do not use it to protect real assets.
147
154
- SV1 is a simulator; the only "quantumness" being demonstrated is the entropy source and the structural witness.
148
155
- The fallback path is cryptographically seeded but is **not** a quantum measurement; rely on the `device` and `algorithm` tags when communicating provenance.
149
-
- The 30-second polling window in `runOnSV1` is tuned for SV1; targeting a real QPU requires extending that window and propagating a `queued` state to the UI.
156
+
- The 30-second polling window in `submitAndFetch` is tuned for SV1; targeting a real QPU requires extending that window and propagating a `queued` state to the UI.
0 commit comments