{"id":"86bfaee0-e084-468d-890a-6a24ca875396","arxiv_id":"2505.02868","paper_version":1,"verdict":"REJECT","confidence":"MODERATE","novelty_score":4.0,"correctness_risk":"high","formal_verification":"none","parameter_count":4,"one_line_summary":"The paper reports a 26.57 Gbps FPGA Toeplitz extractor for QRNG post-processing, but its LFSR-derived Toeplitz seed breaks the strong-extractor guarantee.","lead":"This paper reports an FPGA implementation of the Toeplitz randomness extractor for quantum random number generators, claiming a speed of 26.57 Gbps. The benchmark counts raw-input throughput rather than the extracted output rate, and the LFSR-generated Toeplitz seed violates the leftover hash lemma.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"The 25-bit LFSR seed makes the Toeplitz matrix rank at most 25, so the per-block output has at most 2^50 possible values; m=300 cannot be LHL-close to uniform, invalidating the strong-extractor claim and the 26.57 Gbps benchmark.","rationale":"I agree with the reader's weakest_assumption and verdict. The decisive issue is not the speed formula alone but the information-theoretic invalidity of the extractor: with a 25-bit LFSR seed, the Toeplitz matrix cannot be the random matrix required by the leftover hash lemma. For each seed, the rank bound is at most 25, and across all seeds the output support is at most 2^50, so m=300 bits cannot be close to uniform. This is an internal inconsistency in the security claim, not merely a disagreement with community benchmarks. The speed-benchmark issue (dividing 800,000 raw bits by extraction time yields 26.57 Gbps while extracted output is 240,000 bits, about 8 Gbps, and the 502 us one-time overhead is excluded) is a real secondary problem for comparability, but even a corrected speed figure would not rescue the paper because the construction is not a strong extractor. NIST STS results on limited 240 kbit data cannot establish LHL security. I recommend keeping the REJECT verdict unchanged.","tokens_in":7076,"tokens_out":13000,"duration_ms":137656,"concrete_test":"Write a short GF(2) script that implements the Section II-A LFSR (25-bit state, 23 raw seed bits, two fixed 1s; the exact taps do not matter for the bound) and constructs the 300x1000 Toeplitz matrix from the first 1299 bits of ts. Compute the rank of this matrix over GF(2) for at least 100 random seeds. Confirm rank <=25 in every trial. Then compute the support bound: 2^25 seeds times 2^25 images per seed equals 2^50 possible outputs, so no output distribution can be within epsilon = 2^-12.5 of uniform on {0,1}^300. If a defender instead claims seed refresh per block, repeat the rank computation per block; the bound is per block and unchanged.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The load-bearing flaw is the seed construction in Section II-A. The Toeplitz string ts (length bs+m-1 = 1299) is produced by a 25-bit LFSR whose state is seeded with 23 raw bits (plus two fixed 1s), and the extractor in Section II-B uses m=300 shifts of ts as rows of a 300x1000 Toeplitz matrix. Any 25-bit LFSR output has linear complexity at most 25, so every length-1000 row is a linear function of the same 25-bit initial state. For each fixed seed, the Toeplitz matrix therefore has GF(2) rank at most 25, and the block output T*x lies in a subspace of dimension at most 25, i.e. has at most 2^25 possible values. Since there are only 2^25 possible 25-bit seeds, the overall output distribution has support at most 2^50. That cannot be epsilon-close to uniform on {0,1}^300 for epsilon = 2^-12.5; the leftover hash lemma requires a uniformly random seed of length bs+m-1, not a 25-bit PRNG state. The claimed m=300 extraction at ER=0.3 is therefore unsupported, and the 26.57 Gbps 'strong extractor' benchmark is not a valid strong-extractor result. The fact that 23 seed bits are taken from the raw sample also violates the seed-independence requirement of the lemma.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The manuscript describes an FPGA implementation of a Toeplitz strong extractor for QRNG post-processing on a Xilinx VC709 board. Raw data of 8×10^5 bits from a phase-noise QRNG are processed in 40 parallel blocks of 1000 bits; a 25-bit LFSR generates the Toeplitz string, and the extractor multiplies each block by shifts of this string. With a reported min-entropy of 2.6 bits per 8-bit sample, the output length m=300 and security parameter ε=2^-12.5 are chosen via the leftover hash lemma. The paper reports a maximum extraction speed of 26.57 Gbps at an extraction ratio of 0.3 and validates the output with NIST STS 2.1.2. The central claims are the new single-channel post-processing benchmark and the provable-security framing of the extractor.","tokens_in":7349,"tokens_out":6789,"duration_ms":70219,"significance":"The parallel block architecture and explicit clock-cycle reporting are useful for QRNG post-processing design, and if the security claim were valid the implementation would be a competitive single-channel extractor benchmark. However, the two central claims—provable strong extraction and the 26.57 Gbps benchmark—are not supported: the LFSR-derived Toeplitz seed invalidates the leftover hash lemma, and the speed number divides raw input bits by extraction time instead of reporting the extracted output rate. The paper is therefore not a valid demonstration of a strong extractor in its current form.","major_comments":[{"comment":"The seed construction does not satisfy the leftover hash lemma. The Toeplitz string is generated by a 25-bit LFSR whose initial state contains only 23 bits sampled from the raw data plus two fixed ones. For a fixed seed, every row of the m×bs Toeplitz matrix is a linear function of the 25-bit LFSR state, so the matrix rank over GF(2) is at most 25. The per-block output T*x therefore lies in a subspace of dimension at most 25, and because there are at most 2^25 seeds, the entire output distribution for a block has support of size at most 2^50. A distribution supported on at most 2^50 points cannot be ε-close to uniform on {0,1}^300 for ε=2^-12.5; the statistical distance is essentially 1. This invalidates the strong-extractor guarantee and the m=300 parameter choice. In addition, using raw QRNG bits to seed the extractor violates the seed-independence requirement of the leftover hash lemma.","section":"II-A and II-B: LFSR-based seed and Toeplitz extractor"},{"comment":"The reported 'randomness extraction speed' is computed by dividing the full 800,000-bit raw sample by the extraction time, not by the 240,000 bits that the extractor actually outputs at ER=0.3. With 6021 clock cycles at 200 MHz, the extraction time is 30.105 μs; 800,000 bits divided by this time gives 26.57 Gbps, while the extracted output rate is 240,000 bits / 30.105 μs ≈ 7.97 Gbps. The benchmark should be reported on the output bit count. Also, the 100,274-cycle one-time overhead is excluded from Table I; for the single 800-kbit dataset this overhead is larger than the extraction cycles, and if included, the effective output rate is about 0.45 Gbps, so the paper should clarify whether the benchmark refers to the extraction core only.","section":"III, Table I and Fig. 4"}],"minor_comments":[{"comment":"The LFSR polynomial and tap positions are not specified, so the seed-generation and Toeplitz-string construction cannot be reproduced from the text.","section":"II-A"},{"comment":"The min-entropy value of 2.6 bits per 8-bit sample is asserted without describing the entropy model, the noise characterization, or a worst-case bound; the security parameter and the choice m=300 depend directly on this value.","section":"III"},{"comment":"NIST STS results are not evidence of security: only 240 kbits (30 strings of 8000 bits) are tested, several tests are undefined, and the post-extraction failures are dismissed as sample-size limitations; statistical tests cannot substitute for the provable guarantee that the extractor is supposed to provide.","section":"III, Fig. 5"},{"comment":"There are typographical errors: 'Topelitz' in Section II-A and 'Teoplitz' in Section IV should be 'Toeplitz'.","section":"II-A and IV"},{"comment":"The conclusion that ER=0.6 gives 13.3 Gbps repeats the same input/output conflation; all speed claims should be restated in extracted output bits per second.","section":"III and IV"},{"comment":"The authors state that hardware I/O interfacing was not performed during testing; the title and abstract should therefore qualify the reported speed as the extraction-core speed rather than an end-to-end post-processing throughput.","section":"II and III"}],"recommendation":"reject","confidential_remarks":"The fundamental concern is the LFSR seed: this is not a minor implementation detail but a break of the extractor's security proof, because the effective rank of the Toeplitz matrix is at most 25 and the output cannot be close to uniform. The throughput number is also mislabeled as output speed when it is actually raw-input throughput. I would not publish the current manuscript as a secure QRNG post-processor; a revision that replaces the LFSR with a properly generated uniform seed of length bs+m-1 and recomputes the correct output throughput could address these issues, but the present claims need to be withdrawn or substantially re-scoped."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Dear colleague,\n\nI read the FPGA Toeplitz extractor paper. The hardware work is real, but the headline claims don't survive. The 26.57 Gbps number is raw-input throughput, not extracted output, and the LFSR-seeded Toeplitz matrix has rank at most 25, so the leftover-hash-lemma guarantee is gone.\n\nWhat's genuinely useful: the paper gives a concrete VC709 implementation with 40 parallel Toeplitz blocks, measured cycle counts for four extraction ratios, a clear data path from ADC to output buffer, and it processes actual phase-noise QRNG data. The timing table is reproducible engineering documentation. As far as I can tell, this exact configuration is new, so the cycle counts are a real data point.\n\nThe soft spots are not minor. Section II-A says the 25-bit LFSR is seeded with 23 raw bits and two fixed ones, and the Toeplitz string is the LFSR output. Any window of an LFSR sequence is a linear function of the 25-bit initial state, so every row of the 300x1000 Toeplitz matrix lies in a 25-dimensional subspace. The m=300 output block has at most 2^48 possible values across the 2^23 actual seeds, or at most 2^50 if you count all 25 bits as free. That cannot be 2^-12.5-close to uniform on {0,1}^300. On top of that, taking the seed from the same raw sample violates the seed-independence requirement of the leftover hash lemma. This is a load-bearing error, not a stylistic concern.\n\nThe speed number has the same problem in a different form. Dividing the full 800,000-bit sample by the 6021-cycle extraction time gives 26.57 Gbps, but only 240,000 output bits are produced, so the actual output rate is about 8 Gbps at ER=0.3. Comparing 26.57 to prior single-channel TSE benchmarks is apples to oranges.\n\nThe NIST validation is thinner than it looks: 240 Kbits of extracted data split into 30 strings, with RE and REV undefined and some failures waved away. That is not enough to certify the extractor.\n\nWho is this for? FPGA engineers who want a detailed TSE data path will find useful material. But as a claimed provably secure extractor with a new speed benchmark, it is not there. I would send this version to a referee who knows extractors and FPGAs, mainly to confirm the seed flaw and the throughput accounting. It should not be accepted without replacing the LFSR seed with an independent random seed and reporting output bits per second. The engineering substance justifies one careful review, but the current claims are unsupported.","headline":"Real FPGA work with a broken proof: the LFSR-seeded Toeplitz matrix has rank at most 25, and the 26.57 Gbps benchmark counts input bits, not output.","tokens_in":7990,"tokens_out":5302,"would_cite":false,"duration_ms":56699,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"An FPGA-based Toeplitz strong extractor reports 26.57 Gbps at extraction ratio 0.3.","keywords":["Toeplitz hashing","strong extractor","randomness extraction","QRNG post-processing","FPGA implementation","leftover hash lemma","quantum random number generator","statistical randomness testing"],"falsifier":"Compute the rank of the Toeplitz matrix formed by any 1000-bit window of the LFSR output; if the rank is below $m=300$, then the extractor cannot provably produce 300 independent bits per block, and a chosen-seed test that fixes the 23 seed bits should reveal the output pattern.","tokens_in":6789,"feed_emoji":"🎲","tokens_out":9185,"duration_ms":87523,"temperature":0.7,"pith_summary":"Quantum random number generators need post-processing to turn biased raw bits into uniform output. This paper claims an FPGA-based Toeplitz strong extractor performs that distillation at 26.57 Gbps, a rate that would let a single post-processing channel keep pace with high-speed QRNG sources. The design runs 40 parallel blocks, uses a 25-bit LFSR to generate the Toeplitz seed, and validates the output with the SP 800-22 statistical tests. The reported speeds decrease as the extraction ratio increases, from 26.57 Gbps at 0.3 to 9.99 Gbps at 0.8.","feed_headline":"QRNG post-processing hits 26.57 Gbps on an FPGA","feed_subtitle":"A Toeplitz strong extractor converts phase-noise quantum raw bits at 26.57 Gbps when the extraction ratio is 0.3.","key_machinery":"The central object is the Toeplitz string: a bit string of length $b_s + m - 1$ whose overlapping substrings define a Toeplitz matrix in which each descending diagonal is constant. Because of that symmetry, the extractor never stores the matrix; it shifts the string by one bit per clock and AND-XORs the shifted substring with the input block. Forty blocks run in parallel on the FPGA, and the seed for the string comes from a 25-bit LFSR clocked once per output bit.","core_discovery":"On its own terms, the paper claims that a Toeplitz strong extractor built from AND/XOR binary matrix multiplication on an FPGA can distill phase-noise QRNG raw data into nearly uniform bits at 26.57 Gbps with an extraction ratio of 0.3, and at proportionally lower rates (13.3 Gbps at 0.6, 9.99 Gbps at 0.8) as the ratio rises. The design processes 40 blocks of 1000 bits in parallel, shifting a Toeplitz string to form the matrix rows and accumulating parity checks per output bit. For a sample of 800,000 raw bits the authors evaluate min-entropy as 2.6 bits per 8-bit symbol, set the output length to m=300 with security parameter $2^{-12.5}$, and report that the extracted output passes the applicable SP 800-22 statistical tests.","pith_inferences":["The reported throughput is a fabric-level benchmark; because the LFSR seed has only 25 bits of state, the per-block Toeplitz matrix has rank at most 25, so the leftover-hash-lemma guarantee does not carry the claimed 300 output bits per block.","A direct test of the extractor's security would be to replace the LFSR seed with a truly random seed refreshed each batch; the speed cost is the seed-transport bandwidth, and the paper does not budget for it.","The same 40-block architecture could be re-timed for an FFT-based Toeplitz product, which is named as future work; comparing the two on the same FPGA would separate the throughput gain of the parallel schedule from the matrix-multiplication structure."],"forward_implications":["At extraction ratio 0.3 the design sustains 26.57 Gbps; the speed falls to 9.99 Gbps at ratio 0.8.","Raising the extraction ratio costs additional clock cycles per output bit, which explains the monotone speed drop across the tested ratios.","For a stream long enough to amortize the 100,274-cycle startup overhead, the steady-state extraction rate is what matters for QKD use.","The extracted output passes the applicable SP 800-22 tests, with the random-excursion tests undefined because the sample is too short."],"supporting_citations":[{"why":"Supplies the min-entropy evaluation and leftover-hash-lemma output length calculation used to set m=300.","marker":"[20]"},{"why":"Provides the parallel and real-time post-processing scheme that motivates the block-parallel FPGA design.","marker":"[21]"},{"why":"Earlier FPGA Toeplitz hashing extractor whose hardware approach this implementation adapts.","marker":"[23]"},{"why":"Earlier 6 Gbps real-time QRNG extraction result used as an intermediate speed benchmark.","marker":"[24]"},{"why":"Reports 50 Gbps multi-channel and 12.5 Gbps single-channel post-processing, the benchmark the paper compares against.","marker":"[8]"},{"why":"Early phase-fluctuation QRNG with 441 Kbps Toeplitz post-processing, the low-speed baseline.","marker":"[22]"},{"why":"The statistical-test-suite documentation used to attribute undefined random-excursion results to short samples.","marker":"[25]"}],"fun_headline_variants":["FPGA Toeplitz extractor hits 26.57 Gbps for QRNG","26.57 Gbps Toeplitz extractor on FPGA for QRNG","Toeplitz strong extractor hits 26.57 Gbps on FPGA","QRNG post-processing at 26.57 Gbps with Toeplitz on FPGA","Toeplitz extractor on FPGA passes NIST at 26.57 Gbps"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The load-bearing premise is that the Toeplitz string is a uniformly random seed in the sense required by the leftover hash lemma; the paper draws it from a 25-bit LFSR seeded with 23 raw-data bits, which limits the seed space to no more than $2^{25}$ strings and makes the effective rank of the 1000-bit Toeplitz matrix at most 25.","fun_headline_variants_meta":{"raw":{"variants":["FPGA Toeplitz extractor hits 26.57 Gbps for QRNG","26.57 Gbps Toeplitz extractor on FPGA for QRNG","Toeplitz strong extractor hits 26.57 Gbps on FPGA","QRNG post-processing at 26.57 Gbps with Toeplitz on FPGA","Toeplitz extractor on FPGA passes NIST at 26.57 Gbps"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000516,"raw_usage":{"total_tokens":2461,"prompt_tokens":861,"completion_tokens":1600,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":477,"completion_tokens_details":{"reasoning_tokens":1488}},"tokens_in":477,"tokens_out":1600,"duration_ms":10413,"temperature":1.0,"reasoning_tokens":1488,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-16T04:08:01.956124+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Compute the rank of the Toeplitz matrix formed by any 1000-bit window of the LFSR output; if the rank is below $m=300$, then the extractor cannot provably produce 300 independent bits per block, and a chosen-seed test that fixes the 23 seed bits should reveal the output pattern.","supporting_citations":[{"cited_title":"Parallel and real-time post-processing for quantum random number generators,","cited_arxiv_id":null,"evidence_quote":"Provides the parallel and real-time post-processing scheme that motivates the block-parallel FPGA design."},{"cited_title":"Fpga implementation of toeplitz hashing extractor for real time post-processing of raw random numbers","cited_arxiv_id":null,"evidence_quote":"Earlier FPGA Toeplitz hashing extractor whose hardware approach this implementation adapts."},{"cited_title":"6 gbps real-time optical quantum random number generator based on vacuum fluctuation,","cited_arxiv_id":null,"evidence_quote":"Earlier 6 Gbps real-time QRNG extraction result used as an intermediate speed benchmark."},{"cited_title":"Ultrafast quantum random number generation based on quantum phase fluctuations,","cited_arxiv_id":null,"evidence_quote":"Early phase-fluctuation QRNG with 441 Kbps Toeplitz post-processing, the low-speed baseline."}],"review_version":1}