Differences between methods of hardware random number generators I'm reading about various hardware random number generators which - among others - implement the following approaches:


Analog-to-digital converter noise
Johnson–Nyquist noise
Reverse biased semiconductor junction
Avalanche diode with optional atmospheric noise
Edit: Modular entropy multiplication


What are the practical pros and cons of these approaches? Is any of these methods "better", more reliable, or more resistant to physical attacks than the others?
The Electrical Engineering SE would be a good resource for questions about specific sources of noise. Which method is best is not a a question for which you will find a good answer to. The "quality" of any method depends on which models of electronic components are used. They have different properties that don't make direct comparison easy:


Power use: Two sources that produce the same amount of "randomness" per second can have drastically different power requirements.
Price: How much you have to pay matters. Just because something is more expensive doesn't mean it's better at producing randomness. Even if it was it might not make a difference because things are either sufficiently unpredictable or they are not. Cheap components may work well enough. They may work better. They may be worse.
Rate: How much randomness can you extract from a single? How much per unit of time and how much per unit of power?
Unpredictability and Leaks: How much noise is known only to the HWRNG versus how much noise can be read by an outsider. (This is the reason you should not rely on atmospheric noise. Yes it is unpredictable, but two people in the same area on this planet will read somewhat similar noise signals.) What about side channel risks and protection? It doesn't do much good extracting noise from a random process if the HWRNG leaks information based on how much power it draws while generating random numbers. Or if you can literally hear part of the noise signal coming form capacitors.
Life-time and Stability - The behavior of some components change as they age. Some components may wear out the longer you use them. Some may change even without use. If you calibrate a system for producing noise as it is now, you might end up with a more predictable HWRNG sometime in the future.
Production - Variations between components of the same type means you might not be able to buy commodity components and use them interchangeably. Even if two components came from the same manufacturer. One should test the components and design a HWRNG that isn't too sensitive to variation.
Tamper-ability - Physical access is devastating but remote attacks can be too. I'm sorry I don't have links, but one method used in remote attacks is, I think, referred to as "illuminating" a device. It's when you "shine" an electromagnetic signal at a device. It can turn into a fault injection attack (making unpredictable behavior predictable) or a side channel attack (causing secret information to be bounced back.)




From a cryptography perspective the source of "randomness" or "unpredictability" does not really matter. We just need a signal that has entropy (a term for how much unpredictability there is in a signal) and a means of estimating how much entropy a system has. No one should be using raw readings from signals as their binary output.

Real HWRNGs typically output "whitened" noise. The raw signals from a noise-producing system do not necessarily (almost certainly don't) look like samples from a uniform statistical distribution. The input signals need to be processed to extract randomness. They're not 100% random so the bandwidth of the signal coming out will be less than the bandwidth going in. That's where the entropy estimate comes in. You do not want to emit 100 bits of random output if your un-whitened noise signal is only as unpredictable as 10 coin flips. (We say the input has only 10 bits of entropy in this case.)

Informally speaking the randomness is typically extracted by something like a cryptographic hash function. The signal going in is digitized and fed to the hash function. When enough data is processed, say an estimated 256 bits worth of entropy, the hash function is evaluated and the result is used as a seed/key for a deterministic random number generator. As long as the entropy estimator does not over-estimate the amount of entropy then this hybrid-system is a sound construction.



From this crypto-perspective what matters is efficiency (power use, bits per second, unpredictability) and security (unpredictability, stability, lack of side channels, difficulty with tampering). How we can get that out of hardware is a different type of problem in the realm of physics and electrical engineering.