Quantum random number generation on a mobile phone

INTRODUCTION

• High-quality random numbers support classical and quantum cryptographic protocols, including asymmetric keys, one-time pads, and quantum key distribution.A one-time pad requires a perfectly random key as long as the data, while quantum key distribution also requires many random numbers.Source: INTRODUCTION · p. 1
• Failures in random-number generation have compromised operating-system security, communications, digital rights management, and financial systems.Kerckhoffs’s principle places cipher security in the key, which must be chosen at random.Source: INTRODUCTION · p. 1
• Deterministic algorithms cannot ensure randomness and uniqueness, motivating physical generators; QRNG output cannot be predicted even by an attacker with complete device information.Earlier QRNGs used specialized hardware, while prior image-sensor generators based on moving scenes or readout noise had low randomness and throughput.Source: INTRODUCTION · p. 1
• The proposed approach extracts quantum-origin randomness from common illuminated image sensors, modeling each pixel as a lossy photon detector whose digitized signal enters extraction.The paper notes that cameras are integrated into phones, tablets, and laptops.Source: INTRODUCTION · p. 1, Figure 1 · p. 1

CONCEPT

• Random photon arrival times produce shot noise; photon counts follow a Poisson distribution with standard deviation √n̄, which a resolving detector can exploit for QRNG.The passage identifies shot noise as a property of the light field, not the detector.Source: CONCEPT · p. 1
• The detector model combines photon loss with photon-to-electron conversion and digitization; ζ≥1 ensures distinct digital codes for each electron count.Thermal, leakage-current, and readout noise generally add linearly to the signal and follow a normal distribution.Source: CONCEPT · pp. 1–2
• A measured output combines independent quantum and technical noise, but the security model treats technical noise as fully known to Eve and credits only quantum entropy.A single-shot measurement cannot distinguish the two noise components.Source: CONCEPT · p. 2, Figure 2 · p. 2
• Quantum entropy corresponds to the Poisson photon-count distribution, while encoding it over b bits yields average entropy H(Xq)/b<1, so an extractor is required.The detector must have ζ≥1 to collect the quantum entropy entirely.Source: CONCEPT · p. 2
• The extractor maps l>k lower-entropy input bits to k output bits by multiplying them modulo 2 by a random l×k matrix that is pre-generated and constant.The paper also bounds how far the output vector can deviate from a perfectly random bit string.Source: CONCEPT · p. 2

EXPERIMENT

• The study uses an ATIK 383L astronomy monochrome CCD and a Nokia N9 CMOS phone camera, using only its green pixels.The sensors have readout noise of a few electrons, quantum efficiencies up to 80%, and intrinsically parallel, high-rate operation.Source: EXPERIMENT · p. 2
• The camera checks verify that photon counts stay within the linear region and that each possible absorbed-photon count has enough digital codes, ζ≥1.The authors also check compliance with manufacturer specifications and appropriate operating conditions.Source: EXPERIMENT · p. 2
• A LED illuminates the camera, and concatenated raw binary pixel values pass through an extractor to produce quantum random numbers.The setup is described as fully and homogeneously illuminating the camera.Source: EXPERIMENT · p. 2, Figure 3 · p. 3

Characterization

• The ATIK and Nokia cameras convert each added electron into at least one digital-code increment, measuring 2.3 and 1.9 codes/electron, respectively.Illuminating the cameras with a known amount of light was used to check the conversion.Source: Characterization · p. 3
• A Fano factor near 1 marks the range where both detectors are most linear and shot noise dominates; Nokia N9 saturation occurs at 450 absorbed photons per pixel.At low illumination, technical noise drives the Fano factor above 1; saturation lowers it.Source: Characterization · p. 3, Figure 4 · p. 3
• The cameras’ measured readout noise is 10 e− for the CCD and 3.3 e− for the CMOS sensor.The passage identifies readout noise as the dominant technical noise for short exposures.Source: Characterization · p. 3

Random number generation

• The ATIK yields 8.9 quantum-entropy bits encoded over 16 bits (0.56 entropy per output bit), while the Nokia yields 6.4 over 10 bits (0.64).The cameras were illuminated to generate 1.5 × 10^4 e− and 410 e−, respectively.Source: Random number generation · p. 3
• At the operating conditions, quantum noise strongly dominates classical noise in both the ATIK and Nokia detectors.Figure 5 reports measurements for the ATIK (a) and Nokia (b).Source: Figure 5 · p. 4
• With compression factor 4 (for example, k = 500 and l = 2000), it would take an impossible ∼10^118 trials to notice a deviation from a perfectly random bit string.If everybody on Earth used such a device constantly at 1 Gbps, it would take 10^80 times the age of the universe to notice a deviation from a perfectly random bit string.Source: Random number generation · p. 4

RESULTS AND TESTS

• The evaluation collected 48 frames, approximately 5 Gbits of raw numbers, and processed them through a 2,000-bit-input, 500-bit-output extractor to generate 1.25 Gbits.Before extraction, entropy per bit remained below unity, with possible dead-pixel errors and electrical-noise correlations between pixel values.Source: RESULTS AND TESTS · p. 4
• Extraction is reported to maintain extremely good randomness quality when pixels are damaged, covered by dust, or affected by other problems.The extractor also increases mean entropy per bit.Source: RESULTS AND TESTS · p. 4
• The extracted bit strings passed the “die harder” battery, which includes NIST, Diehard, and additional tests.The passage reports results for both extracted bit strings.Source: RESULTS AND TESTS · p. 4

Speed

• Consumer-grade sensors acquiring 100 megapixels to 1 gigapixel per second can yield 300 Mbps to 3 Gbps after processing, at about 3 random bits per pixel.The passage suggests FPGA processing or an extractor embedded on a CMOS sensor chip for such rates.Source: Speed · p. 4
• Software extraction on a consumer device can sustain more than 1 Mbps, described as largely sufficient for most consumer applications.The passage contrasts this with higher rates achievable using FPGA or on-sensor processing.Source: Speed · p. 4

• The paper demonstrates a generator of random numbers of quantum origin using technology compatible with consumer and portable electronics.Source: CONCLUSION AND OUTLOOK · p. 4
• The authors expect the device’s simplicity and performance to make widespread use of quantum random numbers a reality.Source: CONCLUSION AND OUTLOOK · p. 4
• The authors anticipate an important impact on information security from widespread quantum random-number use.Source: CONCLUSION AND OUTLOOK · p. 4