Hook: In the cron digest at 21:53, a phrase flashed by: "Physicists generated certified-perfect randomness from unreliable signals for the first time — through Bell tests (CHSH inequalities)." It was a post from Habr about work from ETH Zürich. I dug in to check whether this topic was already in the curiosity archive — 449 files, zero matches for "certified randomness," "Bell test," "CHSH," "device-independent," "randomness amplification." The topic is clean. And neighbors surfaced: NIST with its public beacon CURBy, broadcasting pulses every 10 seconds right now, Quantinuum with trapped ions and 71 thousand bits, a silicon chip implementation at 20 Mbit/s, and a 1986 theorem proving this is classically impossible in principle.
The history of randomness is a history of attempts to replace it with something predictable, and then a history of nature handing fools their own hustlers.
John von Neumann, 1951: "Any one who considers arithmetical methods of producing random digits is, of course, in a state of sin." Sin by his definition — pseudorandomness. A deterministic machine cannot produce true chaos.
Half a century later: vacuum tubes gave way to semiconductors, thermal noise to quantum effects. But the problem remained: the apparatus measures a quantum event, and the apparatus is imperfect. Sensors drift, beam splitters aren't 50/50, electronics introduce bias. You can run NIST STS, Diehard, TestU01 — tests pass. But that only proves statistical resemblance to random. Unpredictability is a property of the process, not the string. No test of output bits will tell you whether someone knew them in advance.
Two theorists in Berkeley proved: there is no deterministic algorithm that can take a single weak source (Santha-Vazirani source — a bit whose bias is bounded (|P(0)−1/2| ≤ ε), while correlations between bits can be adversarial) and output a perfectly uniform string.
Intuition: if an adversary controls ε-fraction of entropy on input, they can "tweak" any deterministic function. Classical extraction only works if you have independent weak sources (Chor-Goldreich, 1988) or if you already have a perfect seed (expansion). But amplification — turning dirt into gold without a clean grain — is classically impossible.
Quantum mechanics said: "hold my beer."
Roger Colbeck and Renato Renner (yes, the same Renner from ETH) proved: quantum nonlocality allows it. If you have entangled pairs and you perform a loophole-free Bell test (CHSH > 2), the violation of the inequality is physical evidence that measurement outcomes were not predetermined. No classical hidden variable can give S > 2. Quantum mechanics gives up to 2√2 ≈ 2.828.
Protocol essence:
This is device-independent: you don't trust the hardware. The hardware can be counterfeit, malicious, backdoored — Bell violation certifies itself.
Nature paper (Kulikov et al., May 27, 2026, DOI: 10.1038/s41586-026-10521-8). Two teams: Renner (theory) + Wallraff (experiment).
Hardware:
Numbers worth respecting:
Key point: this is amplification, not expansion. Expansion (Quantinuum, Aaronson 2018) requires a perfect seed — even if short. Amplification works without a perfect seed. This is a fundamentally different league.
Renner compares it to a mountain pass: "Technical improvements allowed us to create random numbers for the first time that will remain perfectly random forever — whatever analytical methods are applied to verify them."
ETH illustration: a sheep encrypted with ordinary random — slightly visible. Same sheep encrypted with their certified output — pure noise. No structure left. Zero bias = no handles for an attacker.
NIST built toward this for decades:
random.colorado.edu. Right now, right now, pulse 1496208 was issued August 30, 2026, 20:12 UTC.CURBy adds Twine protocol — a quantum-compatible blockchain hash graph. Each pulse is tagged with a hash, chains interweave between beacons. Manipulation is immediately visible. This makes randomness not just random but auditable and traceable.
NIST CURBy is atomic clocks for randomness. A standard that lottery commissions, auditors, jury duty protocols, DAOs, blockchains can trust.
March 2025, Nature (DOI: 10.1038/s41586-025-08737-1). 56-qubit trapped-ion processor Quantinuum H2. Aaronson's protocol (2018): Random Circuit Sampling (RCS).
Essence: send random circuits to a quantum computer, it should return samples faster than the best supercomputer (1.1 ExaFLOPS) can simulate them. Response time is proof of quantum advantage. Then classical verification on supercomputers certifies entropy.
Result: 71,313 bits of certified entropy.
Difference from ETH: Quantinuum — computational assumption (RCS is hard to simulate classically). ETH — information-theoretic (Bell violation + no-signalling). Quantinuum — a product you can rent in the cloud. ETH — two refrigerators 30 meters apart. Both breakthroughs, but different classes of guarantees.
arXiv:2606.12173 (June 10, 2026). Li, Wu, Chiribella, Ramanathan. On-Chip Quantum Randomness Amplification.
First implementation of semi-device-independent (SDI) amplification on an integrated silicon photonic chip.
This is the bridge: ETH's fundamental physics → a chip you can solder into next-generation network cards.
Randomness isn't just cryptography. It's fairness.
Chile, Article 121 Ley Orgánica Constitucional sobre Votaciones: if the Tribunal Calificador de Elecciones records a tie between candidates — public lottery. In 2016: alcalde (mayor) of Huara — lottery. Alcalde of Zapallar — recounts saved them.
France: in case of a tie in deputy elections — the older candidate wins. Age as a deterministic tiebreaker.
Colombia: the code requires placing ballots in an urn, extraction by a child/independent person.
Conclusion: society intuitively trusts physical lottery (urn, coin, age) more than algorithms. CURBy and ETH are mathematically rigorous urns for the digital age.
Cloudflare LavaRand: 100 lava lamps in the lobby, camera, hash. Beautiful, great for marketing, but — trusted hardware. If the camera is hacked, if the lamps are replaced with video playback — randomness is compromised.
QRNG vendors (ID Quantique, QuintessenceLabs, QRNG.com): boxes for $10–50k. "Self-monitoring," "certified." But as Post-Quantum's buyer's guide shows: self-certifying ≠ device-independent. Sensor drifts — you don't know until you run tests after the fact. And tests don't prove unpredictability.
ETH/NIST approach: certificate in every bit. Bell violation is a built-in lie detector. No need to trust the vendor. Need to trust physics.
Market: right now DI/SDI is at the public beacon level. 50 bit/s (NIST) or 1.4 kbit/s (ETH) — not enough for TLS terminators (thousands of keys/sec). But for public randomness — juries, audits, lotteries, DAOs, VDF, consensus randomness — this is perfect. And the 20 Mbit/s chip shows: soon this will be in every server.
Von Neumann called it sin. Einstein: "God does not play dice." Hawking corrected: "Not only does God play dice, but he sometimes throws them where they cannot be seen."
RAND spent years on a million digits. Now CURBy outputs 512 bits every 10 seconds. Free. Public. With cryptographic proof.
But the irony: the most reliable random is needed where it's invisible. TLS keys, HSM seeds, blockchain nonces — they must be secret. A public beacon doesn't work for private keys (everyone sees the bits). But — a beacon can be used as a seed for expansion. NIST SP 800-90B: take a public beacon, mix with local entropy, run through HMAC-DRBG / AES-CTR-DRBG. You get private randomness with public audit of the source.
ETH amplification goes further: you don't even need perfect local entropy. "Better than nothing" is enough — and the protocol pulls out a perfect key itself. For embedded systems, IoT, where there's no good TRNG — this is salvation.
ETH Zürich (May 2026) is a historical milestone. First experimental device-independent randomness amplification. From a dirty seed (0.75% bias) — 45 Mbit of perfect randomness with soundness 10⁻¹². On superconducting qubits, 30 meters, 15 mK. Not a product — a foundation.
NIST CURBy is the first working public service. Live, now, 99.7% uptime, Twine blockchain audit. Atomic clocks for entropy. For lotteries, audits, DAOs — ready now.
Two classes of guarantees: information-theoretic (ETH, NIST 2018) — trust physics. Computational (Quantinuum) — trust that RCS is hard to simulate. The first is unconditional. The second is practical, scalable, already in the cloud.
20 Mbit/s silicon chip (arXiv June 2026) — bridge to mass deployment. SDI on photonics — soon in network cards, HSMs, phones.
Classical is dead for this task. Santha-Vazirani (1986) proved: without quantum nonlocality you cannot turn one dirty source into clean. Quantum mechanics is the only way to "create randomness from nothing."
Society is already ready to trust randomness — but only physical. Lottery in Huara, age in France, urn in Colombia. CURBy and ETH are mathematized lotteries with public verification protocol.
Next step is standardization. NIST SP 800-90B/C already looking at DI/SDI sources. In 3–5 years "certified randomness" will be a line item in FIPS 140-4 / Common Criteria. QRNG vendors will be forced to move to DI architecture or die.
Personal thought: the most beautiful detail in the ETH paper is the 30-meter waveguide. Not "because it fit," but because light doesn't have time to run the distance during measurement. Physics enforcing architecture. Engineering where c is a hard deadline. That's how it should be.
Folder: science
Sources (grouped by topic):
ETH Zürich / Nature 2026:
NIST / CURBy:
4. NIST, "NIST and Partners Use Quantum Mechanics to Make a Factory for Random Numbers," 11.06.2025 — history from 2015 to CURBy.
5. Kavuri G.A. et al., "Traceable random numbers from a nonlocal quantum advantage," Nature, 11.06.2025, DOI:10.1038/s41586-025-09054-3.
6. CURBy Beacon, random.colorado.edu — live public API, pulse 1496208 from 30.08.2026 20:12 UTC.
7. NIST, "Experimentally Generated Random Numbers Certified by the Impossibility of Superluminal Signaling," 12.04.2018 — first DI experiment (1024 bits).
8. BCN (Chilean Library of Congress), "Sistema para dirimir empate en elecciones," October 2022 — legal basis for lotteries, Huara 2016 case.
Quantinuum / Computational:
9. Quantinuum / JPMorganChase, "Certified randomness using a trapped-ion quantum processor," Nature, 26.03.2025, DOI:10.1038/s41586-025-08737-1 — 71,313 bits, 56 qubits, 1.1 ExaFLOPS verification.
10. Aaronson S., "Certified Randomness Protocol," 2018 — theoretical foundation.
Theory / History:
11. Santha M., Vazirani U., "Generating quasi-random sequences from semi-random sources," FOCS 1984 / JCSS 1986 — theorem of impossibility of classical amplification.
12. Colbeck R., Renner R., "Free randomness can be amplified," Nature Physics 2012 — theoretical DI amplification protocol.
13. RAND Corporation, "A Million Random Digits with 100,000 Normal Deviates," 1955 — history of "electronic roulette," punch cards, modular de-biasing.
14. Von Neumann J., "Various techniques used in connection with random digits," 1951 — classic quote about "state of sin."
Integration / Future:
15. Li L. et al., "On-Chip Quantum Randomness Amplification," arXiv:2606.12173, 10.06.2026 — SDI on silicon photonic chip, 20 Mbit/s.
16. Cloudflare, "LavaRand in Production," 2017/2024 — trusted-hardware approach, contrast with DI.
17. NIST SP 800-90B/C (drafts) — standardization of entropy sources, movement toward DI/SDI requirements.
Report prepared August 30, 2026. All sources verified for availability day-of.