Maximization of Extractable Randomness in a Quantum Random-Number Generator

The generation of random numbers via quantum processes is an efficient and reliable method to obtain true indeterministic random numbers that are of vital importance to cryptographic communication and large-scale computer modeling. However, in realistic scenarios, the raw output of a quantum random-number generator is inevitably tainted by classical technical noise. The integrity of the device can be compromised if this noise is tampered with or even controlled by some malicious party. To safeguard against this, we propose and experimentally demonstrate an approach that produces side-information-independent randomness that is quantified by min-entropy conditioned on this classical noise. We present a method for maximizing the conditional min entropy of the number sequence generated from a given quantum-to-classical-noise ratio. The detected photocurrent in our experiment is shown to have a real-time random-number generation rate of $14(\mathrm{Mb}\mathrm{i}\mathrm{t}/\mathrm{s})/\mathrm{MHz}$. The spectral response of the detection system shows the potential to deliver more than $70\mathrm{Gbit}/\mathrm{s}$ of random numbers in our experimental setup.

Figure 1

Model of the $n$-bit ADC, with analog input in the ADC dynamical range $[-R+\delta /2,R-3\delta /2]$ and bin width $\delta =R/2^{n-1}$. We choose the central bin centred around 0, the lowest bin $i_{\min }=-2^{n-1}$ centered around $-R$, and the highest bin $i_{\max }=2^{n-1}-1$ centered around $R-\delta$.

Figure 2

Numerical simulations for the measured distribution probabilities $P_{M_{\text{dis}}}(m_i)$ versus quadrature values, with different dynamical ADC range parameters $R=$ (a) 5, (b) 2, and (c) 8. Without optimization, one will have either oversaturated or unoccupied ADC bins, which will compromise both the rate and the security of the random-number generation. The parameters used are $n=8$ and $\mathrm{QCNR}=10\mathrm{dB}$. The quadrature values are normalized to quantum noise.

Figure 3

Numerical simulations of (a) conditional probability distributions $P_{M_{\text{dis}}|E}(m_i|e)$, with $e=\mathbf{\{}-10{\sigma }_E,0,10{\sigma }_E\mathbf{\}}$ (from left to right) and $R=5$. Without optimizing $R$, when $e=\pm 10{\sigma }_E$, saturations in the first and last bins affect the maximum of the conditional probability distribution. Inset: $P_{M_{\text{dis}}|E}(m_i|e)$, with $e=\mathbf{\{}-100{\sigma }_E,0,100{\sigma }_E\mathbf{\}}$ (from left to right). Unbounded classical noise will lead to zero randomness due to the oversaturation of dynamical ADC. (b) Optimized $P_{M_{\text{dis}}|E}(m_i|e)$, with $e=\mathbf{\{}-10{\sigma }_E,0,10{\sigma }_E\mathbf{\}}$ (from left to right). From Eq. (11), the optimal $R$ is chosen to be 5.35. The saturations do not exceed the maximum of the conditional probability distribution whenever $-10{\sigma }_E\le e\le 10{\sigma }_E$. The parameters are $n=8$, $\mathrm{QCNR}=10\mathrm{dB}$. Dashed lines indicate $m_i=\pm 10{\sigma }_E$. The quadrature values are normalized to vacuum noise.

Figure 4

(a) Optimized $H_{\min }(M_{\text{dis}}|E)$ and (b) normalized $H_{\min }(M_{\text{dis}}|E)$ as a function of QCNR for different $n$-bit ADCs. Shaded areas: $5{\sigma }_E\le |e+\mathrm{\Delta }|\le 20{\sigma }_E$. The extractable bits are robust against the excursion of the classical noise, especially when the QCNR is large. A nonzero amount of secure randomness is extractable even when the classical noise is larger than the quantum noise. The extractable secure randomness per bit increases as the digitization resolution $n$ is increased.

Figure 5

Normalized worst-case conditional min entropy $H_{\text{min}}(M_{\text{dis}}|E)$ as a function of $n$-bit ADC for different QCNR values. $|\mathrm{\Delta }|=0$ and $|e|\le 5{\sigma }_E$. The interplay between the QCNR and digitization resolution $n$ is shown, where one can improve the rate of secure randomness per bit either by improving the QCNR or increasing $n$. Inset: Zoom in for $H_{\min }(M_{\text{dis}}|E)/n\ge 0.85$ (dashed line). Even when the classical noise is more dominating compared to the quantum noise ($\mathrm{QCNR}=-3\mathrm{dB}$), 85% of the randomness per bit can be recovered by having at least approximately 22 bits of digitization.

Figure 6

Schematic setup of CV QRNG, where a continuous-variable homodyne detection is performed on the quantum vacuum state followed by mixing down at 1.375 and 1.625 GHz. The mixing signals are generated by voltage-controlled oscillators. The dynamical ADC range of the ADC is chosen appropriately according to the QCNR and ADC digitization resolution $n$ to maximize the extractable randomness. The raw output, which consists of both quantum and classical contributions, will be postprocessed by field-programmable gate array. A cryptographic hashing function (AES-128) is applied to extract secure randomness quantified by conditional min entropy.

Figure 7

Spectral power density from the CV QRNG. The measured signal is mixed down at 1.375 and 1.625 GHz (dashed lines), where the laser is shot-noise limited and far from low-frequency technical noise. The QCNR clearances are about 13 dB for both channels, which are sampled at 250 MSample/s. The shaded region between the measured signal and classical noise indicates the available quantum randomness in our broadband 3-GHz photocurrent detectors, with an average QCNR of approximately 10 dB. The peaks in the classical signal are due to technical noise and pickup signals from radio stations. The peak at 2.4 GHz is due to the Wi-Fi transmissions. The resolution and video bandwidth are both 1 MHz.

Figure 8

Model of the $n$-bit ADC, with analog input in the ADC dynamical range $[-R+\delta /2,R-3\delta /2]$ and bin width $\delta =R/2^{n-1}$. Offset of the distribution is modeled by another reference frame $m^{\prime }$ centered at offset $\mathrm{\Delta }$. In the original frame $m$, the lowest and highest bins are now centered around $-R-\mathrm{\Delta }$ and $R-\delta -\mathrm{\Delta }$.

Figure 9

Autocorrelation plots of raw samples for (a) channel 0 and (b) channel 1 evaluated from a typical record of $10^7$ consecutive samples. Each sample is 12 bits, where the four most significant bits are discarded from 16-bit raw data. The low values of autocorrelation between the samples are consistent with our raw data being close to independent and identically distributed random variables. Dashed lines show the theoretical standard deviation of truly random $10^7$ points.