---
title: Toeplitz Strong Extractor
url: https://www.emergentmind.com/topics/toeplitz-strong-extractor-tse
type: topic
---

# Toeplitz Strong Extractor

Toeplitz Strong Extractor (TSE) denotes the use of Toeplitz-matrix universal hashing as a strong seeded randomness extractor, typically in quantum random number generation and related privacy-amplification settings. In this formulation, the extractor maps an $n$-bit weak source and an independent seed to an $m$-bit output that is close to uniform even when the seed is public, provided the source has sufficient min-entropy and the output length satisfies the leftover-hash bound [2505.02868]. Recent work places Toeplitz-based strong extractors inside a broader stream-extractor framework grounded in universal$_2$ and almost dual universal$_2$ hashing, and proves that a stream implementation preserves the same quantum-proof security guarantees as the original block-wise protocol under quantum side information [2605.09556].

## 1. Formal definition and extractor model

A strong randomness extractor is defined as
$$
\text{Ext}: \{0,1\}^n \times \{0,1\}^d \to \{0,1\}^m,\quad (\text{Ext}(X,S), S) \approx_\varepsilon (U_m, S),
$$
where $X$ is a weak source over $\{0,1\}^n$, $S$ is a uniform seed of length $d$ independent of $X$, $U_m$ is a uniform $m$-bit string, and $\approx_\varepsilon$ denotes statistical distance at most $\varepsilon$ [2505.02868]. In the quantum setting, a seeded extractor $\mathrm{Ext}: \{0,1\}^n \times \{0,1\}^d \to \{0,1\}^m$ is strong if, for any classical-quantum state $\rho_{XE}$ with $H_{\min}(X|E) \ge k$ and a perfect seed $Y$, the joint output satisfies
$$
\left\| \rho_{ZYE} - U_m \otimes \rho_Y \otimes \rho_E \right\|_1 \le \varepsilon,
$$
with a smoothing correction $2\varepsilon' + \varepsilon$ when $H_{\min}^{\varepsilon'}(X|E) \ge k$ [2605.09556].

In QRNG practice, TSE denotes the universal$_2$ Toeplitz extractor that is strong in the seed, typically with public $Y$ and output length $m$ chosen via the quantum Leftover Hash Lemma (QLHL) [2605.09556]. The security claim is information-theoretic rather than computational: even if the seed is known, the output remains $\varepsilon$-close to uniform so long as the seed is uniform and independent of the source [2505.02868].

The canonical rate bound is the leftover-hash condition
$$
m \le k - 2\log\frac{1}{\varepsilon},
$$
or, in the quantum formulation used throughout the stream-extraction framework,
$$
m \le H_{\min}^{\varepsilon'}(X|E) - 2\log_2(1/\varepsilon),
$$
with the final trace-distance bound becoming $2\varepsilon' + \varepsilon$ under smoothing [2605.09556, 2505.02868]. Theorem 1 of the stream-extraction paper states that any universal$_2$ family indexed by a uniform seed forms an $(n,k,d,m,\varepsilon)$ quantum-proof strong extractor with error $\varepsilon = 2^{(m-k)/2}$ [2605.09556].

## 2. Toeplitz hashing as a universal$_2$ strong extractor

An $m \times n$ Toeplitz matrix is determined by its first column and first row, with the first element shared, so the seed length is
$$
d = m + n - 1
$$
[2505.02868]. In the notation of the stream-extraction work, an $m \times n$ Toeplitz matrix $T$ is determined by a seed $y \in \{0,1\}^{n+m-1}$, and the extractor computes over $\mathbb{F}_2$
$$
Z = T_y X \bmod 2
$$
[2605.09556].

Toeplitz matrices instantiate a universal$_2$ family. For any distinct $x \ne y$,
$$
\Pr_T[h_T(x)=h_T(y)] = 2^{-m}
$$
[2505.02868], and equivalently for the full Toeplitz family $\{T_y\}$,
$$
\Pr_Y[T_Y x = T_Y x'] \le 2^{-m}
$$
for any distinct $x,x' \in \{0,1\}^n$ [2605.09556]. This universal$_2$ property is the algebraic basis for applying the leftover-hash lemma and obtaining strong-extractor security.

The extractor itself is the linear map
$$
\mathrm{Ext}(x,T)=T\cdot x \pmod{2},
$$
with each output bit expressible as a sliding-window XOR convolution over $\mathrm{GF}(2)$:
$$
y_i = \bigoplus_{j=1}^{n} \left(ts_{i+j-1} \wedge x_j\right),\quad i=1,\dots,m
$$
[2505.02868]. This representation is central in both software and hardware implementations because it avoids materializing the full matrix and exposes regular structure for convolution, XOR reduction, and parallelization.

For large dimensions, Toeplitz multiplication reduces to an FFT-based linear convolution of length $n+m-1$ with complexity $O((n+m)\log(n+m))$ [2605.09556]. The stream-extraction paper gives the explicit convolution identity
$$
(C_{n-1} \,\|\, T_yx)=F^{-1}[F(y)\odot F(x')],
$$
with $x'=(x \,\|\, 0^{m-1})$ [2605.09556]. This FFT interpretation underlies the comparison between block and stream modes.

## 3. Quantum-proof security and parameter selection

Under universal$_2$ hashing, the QLHL gives the security-rate trade-off used to parameterize TSE under quantum side information [2605.09556]. If $H_{\min}^{\varepsilon'}(X|E)\ge k$, then choosing
$$
m = k - 2\log_2(1/\varepsilon)
$$
achieves trace distance at most $2\varepsilon' + \varepsilon$ [2605.09556]. The same functional dependence appears in the classical strong-extractor presentation of Toeplitz hashing, where $m \le k - 2\log(1/\varepsilon)$ is the necessary extraction condition [2505.02868].

For practitioners, the stream-extraction framework states that one should estimate $k$ with appropriate finite-size or non-i.i.d. analyses, use conservative entropy-rate assumptions to ensure composable security, choose $m$ with a safety margin to accommodate smoothing and confidence intervals, and report $\varepsilon_{\text{total}} = 2\varepsilon' + \varepsilon$ [2605.09556]. It explicitly notes that overestimating $m$ relative to $k$ increases $\varepsilon$, whereas underestimating the entropy rate is safe but reduces the extraction rate [2605.09556].

The paper’s benchmarks use $\varepsilon = 2^{-64}$ and $m = k - 128$, which is described as negligible compared to $n \approx 10^7$–$10^8$ [2605.09556]. By contrast, the FPGA implementation adopts a much smaller block size and a weaker benchmark security parameter: $n=1000$, $k \approx 325$ bits per block, and $\varepsilon = 2^{-12.5}$, yielding $m=300$ and extraction ratio $r = m/n = 0.3$ [2505.02868]. Additional extraction ratios $r \in \{0.5,0.6,0.8\}$ are also evaluated there, with corresponding seed lengths $d = 1499, 1599, 1799$ [2505.02868].

A common misconception is that passing statistical tests suffices to establish extractor security. The sources distinguish these notions sharply. Information-theoretic security is derived from universal hashing and the leftover-hash bound, while NIST STS 2.1.2 is used only as a finite-sample sanity check [2505.02868, 2605.09556].

## 4. From block Toeplitz extraction to stream Toeplitz extraction

Conventional Toeplitz extraction evaluates $Z=T_YX$ on a complete accumulated block $X$, which incurs FFT latency and requires buffering the entire block before extraction [2605.09556]. The stream formulation generalizes a stream-cipher-like implementation by shifting the expensive linear computation into an offline pre-processing stage that generates a pseudo-random mask, after which the online path consists only of XOR and slicing [2605.09556]. The paper emphasizes that this is still privacy amplification under universal$_2$ hashing rather than computational stream-cipher security [2605.09556].

For the standard Toeplitz stream extractor, the procedure is as follows [2605.09556]:

1. Choose $R \in \{0,1\}^{n-m}$ uniformly and $Y \in \{0,1\}^{n+m-1}$ uniformly and independently of $X$.
2. Construct a Toeplitz matrix $T_Y$ of size $(n-m)\times n$ from $Y$.
3. Compute the $n$-bit mask $W = T_Y^T R$.
4. As raw bits arrive, compute $X \oplus W$ on the fly and output the first $m$ bits:
   $$
   Z=(X\oplus W)_{0..m-1}.
   $$

This defines
$$
\mathrm{StreamT}: \{0,1\}^n \times \{0,1\}^{3n-2m-1}\to\{0,1\}^m
$$
with seed $(R\|Y)$ and stream seed length
$$
d_{\text{stream}} = (n-m) + (n+m-1) = 3n - 2m - 1
$$
[2605.09556]. The paper states that the stream Toeplitz construction is algebraically equivalent to TSE: it realizes the same linear map but computes the “keystream” $W$ offline and produces outputs $Z=(X\oplus W)_{0..m-1}$ online [2605.09556].

The main theorem is that streaming strictly preserves the quantum-proof security guarantees of the original block-wise protocol [2605.09556]. The proof relies on Tsurumaru’s equivalence between privacy amplification and error correction with quantum side information: linear universal$_2$ hashing implements both tasks, so replacing explicit hash evaluation by a precomputed linear mask and an online XOR is an algebraic rearrangement of the same linear map [2605.09556]. With seeds chosen uniformly and independently of $X$ and $E$, the stream output satisfies
$$
\left\| \rho_{ZE} - U_m \otimes \rho_E \right\|_1 \le \varepsilon
$$
with the same $\varepsilon$ as in the block protocol [2605.09556].

The strong property is preserved in $(R|Y)$, and the paper explicitly states that $Y$ can be reused across extractions, while the last $(n-m)$ bits of $(X\oplus W)$ can be harvested to refresh $R$ for another extraction with a small additive increase in $\varepsilon$ [2605.09556]. At the same time, it warns that the exact mask $W$ must not be reused across multiple raw blocks without care, because such reuse induces linear relations between outputs [2605.09556].

## 5. Structured variants: circulant and modified Toeplitz families

The stream-extraction framework extends beyond standard Toeplitz matrices to circulant and modified Toeplitz constructions [2605.09556]. This situates TSE within a broader family of linear extractors that preserve the same leftover-hash rate while trading seed length, algebraic structure, and convolution cost.

| Family | Block seed length $d$ | Stream seed length $d_{\text{stream}}$ |
|---|---:|---:|
| Toeplitz | $n+m-1$ | $3n-2m-1$ |
| Circulant | $n$ | $2n-m-1$ |
| Modified Toeplitz | $n-1$ | $2n-m-1$ |

The circulant extractor uses universal$_2$ circulant hashing with seed length $n$ [2605.09556]. For raw $x \in \{0,1\}^{n-1}$, one pads $x'=(x\|0)\in\{0,1\}^n$, forms the circulant $C_{x'}$, and computes
$$
z=(C_{x'}y \bmod 2)_{0..m-1}
$$
[2605.09556]. The stream conversion chooses $R \in \{0,1\}^{n-m-1}$, pads $R'=(R\|0^{m+1})\in\{0,1\}^n$, builds $C_{R'}$, chooses $Y\in\{0,1\}^n$, computes the $(n-1)$-bit mask
$$
W=(C_{R'}^T \cdot Y)_{0..n-2},
$$
and streams out $Z=(X\oplus W)_{0..m-1}$ [2605.09556]. The paper states that this stream extractor is strong and preserves the block-mode $\varepsilon$ under QLHL when seeds are uniform and independent [2605.09556].

Modified Toeplitz, associated in the source with Hayashi–Tsurumaru’s almost dual universal$_2$ construction, uses an $(n-1)$-bit seed and preserves the same leftover-hash rate $m \le k - 2\log(1/\varepsilon)$ [2605.09556]. The relevant condition is
$$
\Pr_Y[x \in (\ker f_Y)^\perp] \le \delta \cdot 2^{-(n-m)}
$$
for all $x \ne 0$ [2605.09556]. In block form, the structured matrix $M_Y$ yields
$$
z = h_Y(x) := (M_Y, I_m)\cdot x,
$$
with FFT-accelerated Toeplitz-like convolution $O(n\log n)$ plus $O(m)$ XOR [2605.09556]. In stream form, one chooses $R \in \{0,1\}^{n-m}$ and $Y \in \{0,1\}^{n-1}$, builds $M_Y$, computes
$$
W=(M_Y, I_{n-m})^T \cdot R,
$$
and outputs $Z=(X\oplus W)_{0..m-1}$ [2605.09556]. The same soundness $\varepsilon$ is preserved, and the extractor is strong in $(R|Y)$ [2605.09556].

This broader perspective suggests that “Toeplitz Strong Extractor” is often used narrowly in QRNG engineering, while the underlying algebra belongs to a larger class of linear, quantum-proof, seed-based extractors [2605.09556].

## 6. Algorithmics, hardware realization, and operational constraints

The computational profile of TSE depends strongly on whether it is implemented in block or stream mode. The stream-extraction paper summarizes the asymptotic costs as follows: block Toeplitz requires $O((n+m)\log(n+m))$, stream Toeplitz mask generation requires $O((2n-m)\log(2n-m))$ with online XOR cost $O(n)$, block circulant requires $O(n\log n)$, stream circulant mask generation requires $O(n\log n)$ with online XOR cost $O(n)$, and block modified Toeplitz requires $O(n\log n)+O(m)$ while the stream version requires $O(n\log n)$ plus linear concatenation and online XOR $O(n)$ [2605.09556].

At high entropy rates, the paper states that stream Toeplitz gains runtime by shortening the effective convolution length from $O(n+m)$ to $O(2n-m)$, whereas circulant and modified Toeplitz already have convolution length $O(n)$ in both modes and therefore show smaller block/stream differences [2605.09556]. It further notes that stream-total time equals mask-generation time plus read-and-XOR time, and that the qualitative gain comes from shifting nontrivial computation offline and reducing online latency and buffer requirements [2605.09556].

A concrete FPGA realization of block TSE is reported in “FPGA-based Toeplitz Strong Extractor for Quantum Random Number Generators” [2505.02868]. The implementation uses a Xilinx VC709 FPGA at 200 MHz, with block size $n=1000$, parallelism $K=40$, and batch size $L=4\times 10^4$ input bits [2505.02868]. The design stores the raw block $x$ and the Toeplitz string $ts$ of length $n+m-1$, aligns successive length-$n$ substrings of $ts$ with $x$, and performs bitwise AND followed by pipelined XOR reduction for each output bit [2505.02868]. Forty identical per-block extractor engines run in parallel, and sliding-window generation avoids materializing the full matrix [2505.02868].

The measured throughput is 26.57 Gbps at $r=0.3$, 13.30 Gbps at $r=0.6$, and 9.99 Gbps at $r=0.8$ [2505.02868]. The one-time overhead per run is 100,274 cycles, approximately 502 $\mu$s at 200 MHz, and the cycles per extraction are 6,021 for $r=0.3$, 10,021 for $r=0.5$, 12,021 for $r=0.6$, and 16,021 for $r=0.8$ [2505.02868]. The source attributes the throughput decline with increasing $r$ to the growth in $m$ and in the Toeplitz string length, which increases the amount of AND/XOR work per extraction [2505.02868].

Several implementation caveats are explicit in the two sources. Synchronization matters in stream mode: XOR must align bit-for-bit, and loss, insertion, or jitter in the raw stream corrupts $Z$; a counter or frame marker aligned to $W$ is suggested as mitigation [2605.09556]. In hardware, correctness depends on avoiding timing hazards in XOR trees, ensuring no metastability in shift registers, and properly zeroizing seed and intermediate buffers if sensitive [2505.02868]. For deployment, seed independence is critical: the FPGA paper notes that its LFSR-based seed generation from raw data is an engineering convenience for benchmarking and strictly compromises the strong-extractor assumption, so an independent seed source should be used in practice [2505.02868].

## 7. Validation, misconceptions, and design guidance

The two papers distinguish extractor security, empirical validation, and deployment practice with considerable precision. In the FPGA study, raw data from an in-house phase-noise-based QRNG digitized by an 8-bit ADC is processed, the min-entropy is evaluated as 2.6 bits per 8 raw bits, and NIST STS 2.1.2 is applied to raw and extracted outputs [2505.02868]. The datasets are 800 Kbits of raw data split into 100 sequences of length 8000 and 240 Kbits of extracted data split into 30 sequences of length 8000; Random Excursions and Random Excursions Variant are undefined because of small sample sizes, and some post-extraction failures are attributed to data-size limitations [2505.02868]. The reported conclusion is that post-processed data exhibits markedly improved statistical behavior compared to raw data [2505.02868].

The stream-extraction paper likewise states that extracted outputs pass NIST SP 800-22 tests for finite-sample sanity in addition to information-theoretic security [2605.09556]. A plausible implication is that empirical test batteries remain useful as implementation checks, but not as replacements for entropy estimation and QLHL-based parameter selection.

Several recurrent misconceptions are directly addressed by the source material. First, public seeds do not invalidate TSE; strong extractors are defined precisely so that security holds jointly with the seed [2505.02868, 2605.09556]. Second, reusing a public seed $Y$ is not the same as reusing the effective mask $W$; the former is compatible with the strong property, while the latter can induce linear relations unless the protocol explicitly accounts for them [2605.09556]. Third, statistical success alone does not certify privacy-amplification security; the decisive requirement is a valid lower bound on min-entropy and independent seed generation [2505.02868, 2605.09556].

The design checklist given for streaming TSE under quantum side information is explicit [2605.09556]. One fixes a target $\varepsilon$, obtains a conservative bound $H_{\min}^{\varepsilon'}(X|E)\ge k$, chooses $m = k - 2\log_2(1/\varepsilon)$ with possible safety margin, chooses among Toeplitz, circulant, and modified Toeplitz depending on seed-length and complexity trade-offs, generates the mask $W$ offline from independent seeds, XORs with the incoming raw stream online, and validates outputs statistically while reporting $\varepsilon_{\text{total}}$ for composable security [2605.09556]. Within this framework, TSE is best understood as a universal$_2$ linear hash whose block and streaming realizations are algebraically equivalent, but operationally different in latency, buffering, and seed-management requirements [2605.09556].

Source: https://www.emergentmind.com/topics/toeplitz-strong-extractor-tse