Quantum Random Number Generation with Uncharacterized Laser and Sunlight

As shown in Fig. 1, a conventional QRNG is composed of the randomness source and the detection device.[22] In the source part, it consists of a light source and a state preparation device. Generally, practical QRNGs[6, 7, 8] make use of specific models to describe the structure of the randomness source. While the SI-QRNG scheme[15] supplies the possibility of randomness generation without assuming neither the light source nor the state preparation devices.

First, we review the concept of SI-QRNG based on the scheme of Ref. [15]. The source independent randomness generation procedure is summarized by source, squashing, random sampling, parameter estimation, and randomness extraction, as follows.

• •

  The state preparation device is expected to prepare the light in the polarization state of $\ket{+}=(\ket{H}+\ket{V})/\sqrt{2}$, where $Z=\{\ket{H},\ket{V}\}$ is the computational basis. While no assumption is made on the photon source, it is untrusted and could be controlled by Eve. Thus, the actual prepared quantum state may have an arbitrary and unknown dimension. Randomness can still be quantified and extracted with the following steps.

• •

  The squashing process maps arbitrary quantum states into qubits and vacuum states. The vacuum components are regarded as loss. In practice, the squashing process can be realized by adding a series of spectrum, spatial and temporal filters to post-select the expected optical modes.

• •

  In the measurement, we randomly choose the $X=\{\ket{\pm}=(\ket{H}\pm\ket{V})/\sqrt{2}\}$ and $Z$ basis to measure according to a random seed. The random seed needed is exponentially smaller than the number of extracted random bits.[15]

  Suppose that the number of runs in total is $N$, including $N_{X}$ in the $X$ basis and $N_{Z}$ in the $Z$ basis. Due to the loss, the output of detection could be null. In this case, the number of qubits measured in total is $n$, including $n_{X}$ in the $X$ basis and $n_{Z}$ in the $Z$ basis. It is worth noting that this protocol is loss tolerance. In the ideal case, the measurement device chooses the measurement basis after confirming the received state is not a vacuum state. In practice, the measurement basis is chosen before the confirmation of loss, which is usually done by observing whether detectors click or not. However, the detection device does not anticipate the position of losses. Thus the effect of loss only decreases $n_{X}$ and $n_{Z}$, but the positions of the effective X and Z measurements are still uniformly random.

• •

  When measuring in the $X$ basis, the result of $\ket{-}$ is defined to be an error, and a double click is considered as a half error. Then, we can evaluate the phase error $e_{pZ}$ in the $Z$ basis according to the bit error rate $e_{bX}$ in the X basis and its statistical deviation $\theta$[23] according to

  	$\displaystyle\varepsilon_{\theta}$	$\displaystyle=\text{Prob}(e_{pZ}>e_{bX}+\theta)$		(1)
  		$\displaystyle\leq\frac{1}{\sqrt{q_{X}(1-q_{X})e_{bX}(1-e_{bX})n}}2^{-n\xi(\theta)},$

  where $\xi(\theta)=H(e_{bX}+\theta-q_{X}\theta)-q_{X}H(e_{bX})-(1-q_{X})H(e_{bX}+\theta)$. Here $q_{X}=n_{X}/n$ is the ratio of the $X$ basis measurement. $H(x)=-x\log_{2}(x)-(1-x)\log_{2}(1-x)$ is the binary Shannon entropy function.

  Since the dimension of the source is unlimited, it may emit multiphoton states. When using threshold detectors, multiphoton states may cause double clicks, which directly contribute to the error rate $e_{bX}$ and decrease the number of extracted random bits.

• •

  By utilizing the Toeplitz-matrix hashing method,[24] the phase error can be corrected by consuming $n_{Z}H(e_{bX}+\theta)$ number of bits with a failing probability of $2^{-t_{e}}$.[25] Thus, we can finally extract

  $$R_{0}=n_{Z}-n_{Z}H(e_{bX}+\theta)-t_{e}$$

  (2)

  number of random bits and the final failure probability (in trace-distance measure) is given by $\varepsilon=\sqrt{(\varepsilon_{\theta}+2^{-t_{e}})(2-\varepsilon_{\theta}-2^{-t_{e}})}$.

Here, $R_{0}$ is the number of extracted random bits without considering the imperfections of the measurement devices. In practice, the measurement bases may not be exactly complementary to each other, and the detection efficiencies of the two detectors might be different. With a slight modification to Eq. (2), the number of extracted random bits with imperfect measurement devices $R_{final}$ can still be quantified when these imperfections are characterized. On the other hand, dark counts of the detectors may also increase the phase error rate and decrease the number of extracted random bits. Since the dark counts are independent with respect to the measurement basis, the effect of dark counts can be regarded as noise of the photon source which has already been considered in the analysis.

In the original theoretical proposal, the $X$ and $Z$ basis measurements are assumed perfect. In our work, we also take measurement imperfections into account. Specifically, we consider the case that the actual measurement bases $X^{\prime}$ and $Z^{\prime}$ are not complementary to each other. In this case, we can make use of the general uncertainty relation for two general bases,[26]

where $\{\ket{x^{\prime}}\}$ and $\{\ket{z^{\prime}}\}$ are respectively the eigenstates of $X^{\prime}$ and $Z^{\prime}$, and $H(Z^{\prime})$ and $H(X^{\prime})$ are respectively the entropy of the measurement outcome of $X^{\prime}$ and $Z^{\prime}$. In quantum random number generation, we can regard $-\log_{2}{\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|^{2}}}$ as the randomness that we can obtained by measuring an eigenstate of the $X^{\prime}$ basis, and regard $H(X^{\prime})$ as the amount of states that are required to distill the eigenstate [27, 5]. That is, given $N$ copies of the quantum state $\rho$, one can effectively first perform a dephasing operation in the $X^{\prime}$ basis to collapse them into one of its eigenstates. Then we aim to distill the dephased state into a specific eigenstate, which costs $NH(X^{\prime})$ copies of states. For each eigenstate, it generates $-\log_{2}{\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|^{2}}}$ randomness. Therefore, the total randomness obtained is $-N\log_{2}{\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|^{2}}}-NH(X^{\prime})$ and each state generates $-\log_{2}{\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|^{2}}}-H(X^{\prime})$ randomness on average. In practice, the dephasing and distillation process can be equivalently achieved with the recently proposed coherence distillation protocols, which can be further reduced to a randomness extraction procedure. Therefore, the final randomness output for two general imperfect bases is

Note that the randomness output only depends on the term $\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|}$ instead of a full description of the $X^{\prime}$ and $Z^{\prime}$ bases.

In addition, we also consider the case that the measurement efficiencies in the two eigenstates are different. Suppose the efficiencies of projecting onto $\ket{0}$ and $\ket{1}$ are given by $\eta_{0}$ and $\eta_{1}$, respectively. Then according to the standard analysis in QKD[28], the randomness output will be further modified to

That is, the total randomness is rescaled with a factor $\frac{2\min(\eta_{0},\eta_{1})}{\eta_{0}+\eta_{1}}\leq 1$. The maximum value of 1 can be achieved when $\eta_{0}=\eta_{1}$. Here, we assume that the adversary has no information of the detection efficiency mismatch, otherwise there may exist attacks in analogy to the time-shift attack from QKD[29]. With such an assumption, the factor can be understood as a simple strategy that we randomly discard the measurement outcome of the higher efficiency detector such that the effective efficiencies of the two detectors are the same.

In experiment, the term ${\max_{x,z}{|\langle x\ket{z}|}}$ and the efficiency $\eta_{0},\eta_{1}$ can be first measured during a calibration procedure on the measurement device. Then, the SI-QRNG scheme can be applied to produce randomness according to the randomness rate formulas in Eq. (5).

As shown in Fig. 2, the experiment setup can be accordingly divided into two parts, the randomness source part and the detection part. While the detection part should be elaborately designed and carefully calibrated, the randomness source part can be uncharacterized or even untrusted.

In the detection part, filters in several dimensions are employed to rule out unexpected optical modes. Spectral filters, including two 100 GHz DWDMs and several interference filters, are used to guarantee that only photons with expected wavelength can enter, and the isolation on unwanted wavelength is over 60 dB. The coupling of single mode fibre excluded unwanted spatial modes. Finally, photons arrived at wrong time will be inspected and eliminated by a time-digital converter (TDC). The selection of measurement basis is realized by a Sagnac type interferometer and a phase modulator (PM) to obtain high visibility and stability, as shown in Fig. 2. For an input pulse with arbitrary polarization state of $\alpha\ket{H}+\beta\ket{V}$, where $\alpha^{2}+\beta^{2}=1$, it is split by a fibre polarized beam splitter (FPBS2) when entering the Sagnac interferometer. The length of fibre from PM to one port of FPBS2 is 25.2 meter shorter than to the other port. Thus, the time for the clockwise ($\ket{H}$) and anti-clockwise ($\ket{V}$) parts of the split pulses reach the PM are separated by around 126 ns, and finally back to FPBS2 at the same time. By carefully control the PM, the two parts of pulse can be applied by different phase, named $\varphi_{c}$ and $\varphi_{a}$. After combined again in FPBS2, the state of output pulse is $\alpha e^{i\varphi_{c}}\ket{H}+\beta e^{i\varphi_{a}}\ket{V}$, correspond to a unitary operation of $U_{F}$. A fibre polarization controller is employed to perform an additional unitary operation of $U_{C}$. Here,

Finally, after appropriate attenuation, the pulse is separated by FPBS3 and detected by two up-conversion single photon detectors with efficiency of $10\%$, dark count of 200 cps and dead time of 50 ns.[30] In this way, we can choose to perform $Z$ ($X$) basis measurement by setting $\varphi_{c}$ to be 0 ($-\pi/4$) and $\varphi_{a}$ to be 0 ($\pi/4$). The probability of measuring in the $Z$ ($X$) basis is selected as $99.6\%$ ($0.4\%$) in our experiment and the average photon number per pulse is selected around $13.9$ before detection to maximize the generation rate of random number. Generally, higher photon number per pulse brings higher error rate in the $X$ basis and higher double clicks probability in the $Z$ basis that need to be discarded, while lower photon number per pulse leads to lower $n_{z}$. Thus, there is a tradeoff for choosing a proper average photon number. The details of optimizing the probability of measuring in the $Z$ ($X$) basis and the average photon number per pulse is discussed in Methods.

As aforementioned, the detection may have imperfections. Therefore, the detection part is first calibrated by an auxiliary cw laser diode with expected wavelength of 1550.12 nm. Considering the imperfect measurement basis of $X^{\prime}$ and $Z^{\prime}$, an additional process is performed to estimate $\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|}$ in (5). Firstly, the input state is prepared as the eigenstate of $Z^{\prime}$ basis, that is, the ratio of photon counting between detector 1 and detector 2 is above 30 dB under $Z^{\prime}$ basis measurement. Then, in the $X^{\prime}$ basis measurement, the ratio of photon counting between detector 1 and detector 2 is measured and the bound of $-2\log{\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|}}$ is calculated to be 0.952.

Although the randomness source part can be untrusted, to demonstrate the high generation rate of the setup, a carefully calibrated randomness source is realized. An amplitude modulator (AM) is used to modulate the input photons to pulses with frequency of 4 MHz and the full width at half maximum (FWHM) of 100 ns. Another fibre polarized beam splitter (FPBS1), a half-wave plate (HWP) and a quarter-wave plate (QWP) is used to prepare the desired polarization state for the detection part.

As the photon source can be any light that does not need to be trustable, the choice of photon source is flexible. Here, we also demonstrate the use of the most common light in the nature — the sunlight, as the photon source to generate random numbers. A collimator mounted on an equatorial mount is placed on the rooftop to collect sunlight into a single mode fibre. The sun can be approximately considered as a area light source with divergence angle around 0.5^∘.[31] Thus, a common collimator with focus length of 11 mm is enough to collect sufficient photon intensities. About 49 nW of light can be collected into single mode fibre under a good weather after filtered by a 1550$\pm$1.5 nm bandpass filter.

The optimal input state for the detection part is the eigenstate of $X$ basis. However, input state with other polarization state does not affect the reliability of randomness. Although the error rate in the $X$ basis will increase and the random number generation rate will reduce. By rotating the HWP in randomness source part to different angles, the relationship between the input state and the error rate of $X$ basis measurement is shown as Fig. 3. Under the near optimal condition with the input state of $|+\rangle$, we performed the experiment for both laser and sunlight. The error rate in the $X$ basis measurement is $0.33\%$ for laser and $0.21\%$ for sunlight. The quantum random number generation rate is 1.81 Mbps for laser and 1.72 Mbps for sunlight. The detailed results is shown as Table 1. The extracted random bits can pass NIST randomness test as shown in Fig. 4.

To optimize the final quantum random number generation rate, some proper parameters should be chosen or measured in Eq. (5). The first term $\frac{2\min(\eta_{0},\eta_{1})}{\eta_{0}+\eta_{1}}$ depends on the efficiencies of the two detectors, and has a maximal value of 1 when the two efficiencies are equal. Thus, $\eta_{0}$ and $\eta_{1}$ are configured to be approximatively uniform ($\eta=10\%$) in our experiment. The second term $-2\log_{2}{\max_{x^{\prime},z^{\prime}}{|\langle x^{\prime}\ket{z^{\prime}}|}}$ depends on the accuracy of controlling the PC and the PM. Due to the imperfection of the actual measurement basis, this term is calculated to be 0.952. $t_{e}$ is chosen as 100.[35] Other terms are related to the average photon number $\lambda$ per pulse before detection. A low average photon number lowers $n_{z}$, while a high average photon number brings higher $e_{pz}$ and higher double click probability in the Z basis. We can rewrite the final random number generation rate as following

Here, G stands for the repetition rate of squash speed and equal to 4 MHz in our experiment. $p_{z(single-click)}$ is the probability that one and only one detector clicks for a pulse. As Poisson distribution for laser and multi-mode sunlight,

where $\lambda^{\prime}=\lambda\cdot\eta$. For large $n_{X}$, $e_{pZ}$ and $e_{bX}$ can be regarded as the same. The relationship between $\lambda$ and the final raw rate is shown int Fig. 3. The optimal $\lambda$ is about 14.4. For sunlight, the actual $\lambda$ of 11.6 is slightly deviated from the optimal value, due to the intensity fluctuate of sunlight. However, for a wide range of $\lambda$ the random number generation rate is not obviously dropped.

Data available on request from authors.

Y.-H.L., X.H., Y.C. and J.Y. designed the experiment; Y.-H.L., X.H., Z.-P.L. and J.-Y.G. performed research; Y.-H.L., X.H., and X.Y. analyzed data; X.Y. and X.M. provided the theoretical support; Q.Z., C.-Z.P. and J.-W.P. supervised the project. All authors contributed to the research and the preparation of the manuscript.

This work was supported by the National Natural Science Foundation of China (under Grant No. 11654005, U1738201, U1738142), the National Key Research and Development Program of China (under Grant No. 2017YFA0303901), the Shanghai Sailing Program, and the Chinese Academy of Sciences (CAS). Yuan Cao was supported by the Youth Innovation Promotion Association of CAS (under Grant No. 2018492). This is a post-peer-review, pre-copyedit version of an article published in npj Quantum Information. The final authenticated version is available online at: http://dx.doi.org/10.1038/s41534-019-0208-1.

The authors declare that there are no competing interests.

Correspondence and requests for materials should be addressed to Cao Yuan ([email protected]), Xiongfeng Ma ([email protected]) or Cheng-Zhi Peng ([email protected]).