A cryptographic key is only a sequence of random bits. Every other property of a security system, from the strength of a post-quantum algorithm to the length of a certificate chain, rests on the assumption that those bits could not have been predicted. This post is about where that assumption comes from and how it can be checked.
Deterministic generators
Most systems draw randomness from a software generator seeded by events the operating system observes: timings, interrupts, hardware counters. The output passes statistical tests, and for many purposes it is good enough. But it is deterministic. Given the internal state of the generator, every subsequent key is predictable, and the seed events themselves can be sparse at boot time, in virtual machines, or on embedded hardware. A weakness in the generator is inherited by every key it ever produced, and no later cryptography can add the missing entropy back.
Quantum measurement
A quantum random number generator draws its randomness from a physical process whose outcome does not exist before it is measured. Aevum measures single photons. In its first tier, each random bit comes from an individually heralded detection: a companion photon confirms that a genuine quantum event occurred. In its second tier, the randomness is the photon’s time of arrival. The third tier combines both. The X-Series takes a different route, continuously measuring quantum phase noise across paired interferometers, which is how it reaches datacentre rates.
The point of this detail is not that quantum sources are exotic. It is that their unpredictability comes from physics rather than from the secrecy of a seed.
Verifiable
A quantum source can still fail. A detector degrades, a laser drifts, a component is tampered with. A generator that cannot tell you this is only trusted, not verified. Verifiable entropy means the device measures the health of its own quantum process while it runs, applies randomness extraction to the raw measurements so that residual bias is removed, and reports the result in a form an auditor can inspect. Aevum is designed for the NIST SP 800-90B entropy-source model, which is the framework certification bodies use to assess exactly this.
Where it is used
Hardware security modules, certificate authorities and post-quantum key agreement all consume entropy in volume. Tessera carries an Aevum generator on board for the same reason: a post-quantum key agreement is only as strong as the randomness that seeds it.