A real hardware QRNG never outputs perfectly unbiased, independent bits: detector inefficiency skews P(1) away from 0.5, and effects like APD afterpulsing/dead time correlate each bit with the previous one. This sim models the raw stream as an order-1 Markov source and certifies exactly how much true randomness survives.
Source: P(1|prev=0)=p01, P(1|prev=1)=p11 (fit from bias b, correlation ρ)
Predictor: worst case an adversary who knows "prev" guesses right with
q = max(p01, 1-p01, p11, 1-p11)
Min-entropy/bit: H_min = -log2(q) (order-1 Markov estimate, cf. NIST SP 800-90B)
The raw n-bit block carries at most n·H_min bits of true randomness. A public, reusable Toeplitz matrix T (m×n, built from a random seed of length n+m-1, T[i][j] = seed[i+j]) then extracts a shorter output that is provably close to uniform, by the Leftover Hash Lemma:
output = T · raw (mod 2, GF(2) matrix-vector product)
m = floor( n · H_min · (1 − ε) ) ε = security margin
- Detector bias / correlation — worsen the source; watch H_min fall and m shrink even though n is unchanged.
- Security margin ε — extra bits shaved off m to bound statistical distance from ideal uniform output (finite-block-size cushion).
- Generate Block — draws a fresh raw block, computes stats, and runs the real Toeplitz extraction once.
- Middle panel — the actual m×n Toeplitz matrix, rendered as a bit heatmap. Drag it to pan around when n or m is larger than the view; the highlighted row is the one currently being dot-producted against the raw block.
This is the same two-stage design (raw quantum entropy source → certified randomness extractor) used by commercial QRNGs such as ID Quantique's Quantis, which must pass NIST SP 800-90B min-entropy certification before their extracted output is trusted for cryptographic keys.