PaperlayerView exact revision on arXiv

Source-linked AI summary

Maximization of Extractable Randomness in a Quantum Random-Number Generator

J. Y. Haw, S. M. Assad, A. M. Lance, N. H. Y. Ng, V. Sharma, P. K. Lam, T. Symul

arXiv:1411.4512v2quant-ph

TL;DR

Classical noise can compromise the security of QRNG measurements, and a systematic approach to ADC-range selection is needed. The paper optimizes the range using min-entropy conditioned on classical noise. It reports 14.11 bits out of 16 bits and a potential rate of up to 70 Gbit/s.

Abstract

from arXiv · show

The generation of random numbers via quantum processes is an efficient and reliable method to obtain true indeterministic random numbers that are of vital importance to cryptographic communication and large-scale computer modeling. However, in realistic scenarios, the raw output of a quantum random-number generator is inevitably tainted by classical technical noise. The integrity of the device can be compromised if this noise is tampered with, or even controlled by some malicious party. To safeguard against this, we propose and experimentally demonstrate an approach that produces side-information independent randomness that is quantified by min-entropy conditioned on this classical noise. We present a method for maximizing the conditional min-entropy of the number sequence generated from a given quantum-to-classical-noise ratio. The detected photocurrent in our experiment is shown to have a real-time random-number generation rate of 14 (Mbit/s)/MHz. The spectral response of the detection system shows the potential to deliver more than 70 Gbit/s of random numbers in our experimental setup.

I. INTRODUCTION

Quantum processes can provide indeterministic randomness, but classical noise can compromise a QRNG’s security, and systematic guidance is needed to choose the ADC range. This work optimizes that range using conditional min-entropy and reports the potential for more than 70 Gbit/s of secure random bits.

I. INTRODUCTION

  • Classical noise can taint QRNG measurements, and low QCNR may compromise the quality and security of generated sequences.QCNR quantifies quantum randomness relative to classical noise.Source: §I · p. 1
  • A systematic method for selecting the dynamical ADC range is needed because prior choices were justified by experimental observations.The ADC range affects how measurement outcomes are discretized.Source: §I · pp. 1–2
  • More than 70 Gbit/s of secure random bits is reported as achievable by applying the framework to a vacuum-state homodyne CV QRNG.The introduction describes the setup as capable of delivering more than 70 Gbps.Source: §I · p. 2
  • The proposed framework chooses the dynamical ADC range to maximize randomness quantified by min-entropy conditioned on classical noise.The paper reports that optimized range selection can yield nonzero secure randomness even when classical noise exceeds quantum noise.Source: §I · p. 2
  • The measurement device must be calibrated and trusted in most QRNGs, including this work.The introduction contrasts this assumption with certifiable randomness devices, for which high generation rates are experimentally challenging.Source: §I · p. 2

II. ENTROPY QUANTIFICATION

The section frames secure QRNG entropy as randomness in a measurement outcome conditioned on potentially adversary-accessible side information. It uses conditional min-entropy to quantify extractable randomness and treats the ADC range as an optimization setting.

II. ENTROPY QUANTIFICATION

  • The entropy evaluation conditions measurement outcome M on side information E that may be accessible, controllable, or correlated with an adversary.The section connects side-information-independent randomness with privacy amplification and randomness extraction.Source: §II · p. 2
  • The n-bit ADC model uses a central bin centered at zero and extreme bins to represent its finite input range.The bin width is δ = R/2^(n−1).Source: Figure 1 · p. 2
  • Conditional min-entropy quantifies the amount of almost uniform, independent randomness extractable from a biased measurement outcome given untrusted parameters.The worst-case formulation applies when an adversary may access classical noise; average conditional min-entropy is used for passive eavesdropping.Source: §II · p. 2

A. Characterization of noise and measurement

The measurement model combines vacuum-state quadrature values with classical noise, then discretizes the measured signal using an n-bit ADC. Because range selection affects saturation and unused bins, the secure-randomness optimization uses distributions conditioned on the classical noise.

A. Characterization of noise and measurement

  • The measured signal is M = Q + E, where Q is the vacuum quadrature and E is classical noise; the measurement PDF is their convolution.The model assumes the classical noise is Gaussian, centered at zero, with variance σ²E.Source: A. Characterization of noise and… · p. 2
  • QCNR is defined by the ratio between the variances of quantum noise and classical noise.The quantum-noise variance is normalized to one.Source: A. Characterization of noise and… · pp. 2–3
  • Figure 2 simulates measured-distribution probabilities against quadrature values for different ADC ranges, illustrating how range choice can leave bins unoccupied or oversaturated.The simulations use n = 8 and QCNR = 10 dB.Source: Figure 2 · p. 3
  • An n-bit ADC discretizes the signal into 2^n bins, with out-of-range inputs accumulated in the first and last bins.Overestimating the range can leave bins unused, while underestimating it causes edge saturation and more predictable outcomes.Source: A. Characterization of noise and… · p. 3
  • For secure QRNG design, the range should be optimized over the measurement distribution conditioned on classical noise, not the unconditioned measured distribution.The conditional PDF is the quantum-signal PDF shifted by the classical-noise outcome.Source: A. Characterization of noise and… · p. 3

B. Worst-case conditional min-entropy

The section defines worst-case conditional min-entropy as a security measure against classical side information and optimizes the dynamical ADC range to maximize it. With a bounded classical-noise excursion, secure randomness remains extractable even when classical noise exceeds quantum noise.

B. Worst-case conditional min-entropy

  • Worst-case conditional min-entropy is tied to the adversary’s maximum guessing probability and to the secure bits extractable independently of classical noise.The analysis assumes the eavesdropper knows the classical noise with arbitrary precision.Source: B. Worst-case conditional min-entropy · pp. 3–4
  • With unbounded classical noise, worst-case conditional min-entropy is zero; bounding noise to −5σE ≤ e ≤5σE is stated to hold 99.9999% of the time.Extreme noise can make an edge-bin outcome almost certain, while the stated bound makes the worst case finite.Source: B. Worst-case conditional min-entropy · p. 4
  • Optimizing R prevents endpoint-bin saturation from becoming the peak conditional probability, improving the attainable worst-case conditional min-entropy.For the illustrated range −10σE ≤e ≤10σE, the optimized endpoint saturations do not exceed the maximum probability within the dynamical range.Source: B. Worst-case conditional min-entropy · p. 4
  • The range optimization is generalized to account for a dc offset ∆, including an offset deliberately induced by an eavesdropper.The offset may also arise intrinsically in the electronic signal.Source: B. Worst-case conditional min-entropy · p. 5
  • A nonzero amount of secure randomness remains extractable when classical noise exceeds quantum noise, and increasing n raises secure randomness per bit.The reported robustness is examined over 5σE ≤|e + ∆| ≤20σE; higher QCNR requires less resolution to reach a given secure fraction.Source: B. Worst-case conditional min-entropy · p. 5, Figure 4 · p. 5
  • At QCNR = −3 dB, at least approximately 22-bit digitization recovers 85% of the randomness per bit.The result is for |∆| = 0 and |e| ≤5σE.Source: Figure 5 · p. 5

C. Average conditional min-entropy

Average conditional min-entropy evaluates secure randomness using the average optimal guessing probability given classical-noise information. Under the assumption that an eavesdropper can listen to, but not control, that noise, it is more robust to reduced QCNR than worst-case conditional min-entropy.

C. Average conditional min-entropy

  • Table I reports optimized average conditional min-entropy and dynamical ADC range for 8- and 16-bit ADCs.The passage identifies the table's scope but does not provide its cell values.Source: Table I · p. 6
  • Average conditional min-entropy is quantified from the average optimal probability of guessing the discretized measurement given discretized classical noise.The eavesdropper is assumed to have access to the classical noise information.Source: C. Average conditional min-entropy · pp. 5–6
  • The optimized average conditional min-entropy remains significant when classical noise is comparable to quantum noise, unlike conventional unoptimized QRNG operation.As QCNR approaches infinity, it coincides with the worst-case conditional min-entropy; worst-case entropy is a lower bound on the average quantity.Source: C. Average conditional min-entropy · p. 6
  • Average conditional min-entropy is more robust than worst-case conditional min-entropy as QCNR degrades, allowing more secure bits at a given QCNR.This comparison assumes the eavesdropper cannot influence the device, as in a trusted laboratory.Source: C. Average conditional min-entropy · p. 6

A. Physical setup and characterization

The experiment measures vacuum fluctuations with balanced homodyne detection and samples two down-converted frequency bands. At the measured QCNRs, the 16-bit ADC channels yield average conditional min-entropy of 14.19 bits each.

A. Physical setup and characterization

  • The 1550-nm, 60-mW local oscillator drives balanced homodyne detection, amplifying vacuum-quadrature fluctuations across a 3-GHz detection bandwidth.The balanced photodetectors have 30 dB common-mode rejection.Source: A. Physical setup and characterization · p. 6
  • The signal is mixed down at 1.375 GHz and 1.625 GHz, then low-pass filtered and digitized in two 16-bit channels at 250 MSamples per second.The measured bands are 1.25–1.50 GHz and 1.50–1.75 GHz; processing uses an FPGA.Source: A. Physical setup and characterization · pp. 6–7
  • Both sampled channels have about 13 dB QCNR clearance, and the figure reports approximately 10 dB average QCNR across the broadband detector response.The Figure 7 caption identifies the shaded gap between measured signal and classical noise as available quantum randomness.Source: Figure 7 · p. 7
  • 14.19 bits of average conditional min-entropy were measured for each channel using a 16-bit ADC.The corresponding worst-case conditional min-entropies were 13.76 bits for channel 0 and 13.75 bits for channel 1; the average-entropy evaluation assumes the eavesdropper cannot manipulate classical noise.Source: A. Physical setup and characterization · p. 7
  • The two channels had average QCNR clearances of 13.52 dB and 13.32 dB, respectively.Both channels had intrinsic dc offsets of −0.02σQ.Source: A. Physical setup and characterization · p. 7

B. Upper bound of extractable min-entropy

The paper relates the detector bandwidth and digitization resolution to a Nyquist maximum data rate, then estimates the extractable randomness within that limit. For the measured setup, the authors project a potential rate above 70 Gbit/s with a fast enough ADC.

B. Upper bound of extractable min-entropy

  • The Nyquist maximum data rate is C = 2H log2 V, with H the spectral bandwidth and V = 2^n the quantization level.The paper identifies sampling rate and digitization resolution as limits on extractable randomness.Source: B. Upper bound of extractable… · p. 7
  • With a fast enough ADC, our detectors can potentially extract up to 70 Gbit/s of random bits, using a 16-bit ADC and 14.11 bits out of 16 at average 10 dB QCNR clearance.The shot-noise-limited, technical-noise-free bandwidth is around 2.5 GHz out of 3 GHz.Source: B. Upper bound of extractable… · p. 7
  • The setup's photon number gives an approximately 14.9-bit maximum min-entropy per sample with a perfect photon-number-resolving detector.The authors note that increasing laser power raises this bound only logarithmically with intensity.Source: B. Upper bound of extractable… · p. 7

C. Randomness extraction

The paper uses AES-128 hashing to extract almost uniformly distributed randomness, retaining half the conditional min-entropy because a detailed cryptanalysis is outside its scope. The implementation reports 3.55 Gbps in real time and projects up to 35 Gbit/s across the detector bandwidth.

C. Randomness extraction

  • The vacuum-state measurement has a Gaussian distribution, so postprocessing is used to produce shorter, almost uniformly distributed strings.The paper notes that ad hoc extractors may fail if non-negligible correlations exist among raw bits.Source: C. Randomness extraction · p. 7
  • 3.55 Gbps is the final real-time guaranteed-secure random-number generation rate using AES extraction.If approximately 2.5 GHz of detector bandwidth is sampled with sufficient resources, the rate could reach 35 Gbit/s, or 14 Mbps/MHz.Source: C. Randomness extraction · p. 8
  • The implementation retains half of its conditional min-entropy to obtain an almost perfectly uniform output with AES-128 hashing.The authors state that detailed cryptanalysis of their framework is beyond the paper's scope.Source: C. Randomness extraction · p. 8
  • The generated random numbers consistently pass the NIST and DieHard statistical tests.The results are available on the Australian National University Quantum Random Number Server.Source: C. Randomness extraction · p. 8

IV. CONCLUDING REMARKS

The paper frames secure randomness around conditional min-entropy when classical noise may be known or controlled by an adversary. Optimizing the ADC range broadens the conditions for extracting secure randomness, while the authors identify quantum side information and fuller cryptanalysis as possible extensions.

IV. CONCLUDING REMARKS

  • Optimizing the dynamical ADC range permits nonzero secure randomness even when classical noise is comparable to quantum noise, and relaxes the high-QCNR requirement.The framework uses worst-case conditional min-entropy when an adversary can access classical noise, and average conditional min-entropy when a third party is restricted to passive eavesdropping.Source: §IV · p. 8
  • The authors apply the framework to their CV QRNG and use efficient cryptographic hashing to extract randomness quantified by average conditional min-entropy.Source: §IV · p. 8
  • The framework’s possible extensions include smoothing worst-case min-entropy, incorporating quantum side information, and further cryptanalysis to increase throughput.Source: §IV · p. 8
  • The authors conclude that appropriate calibration can preserve secure random numbers even when electronic noise is fully known, with potential practical value for quantum key distribution.They also state that relaxing the detector’s QCNR requirement may allow smaller, more cost-effective QRNGs.Source: §IV · p. 8

Appendix A: Optimized conditional min-entropy with dc offset

The appendices extend the conditional-entropy analysis to offset and discretization settings, describe a bound under limited laser power, and discuss extraction and implementation details. The supplied passages give the scope and procedures but do not provide the optimized table values or the complete bound.

Appendix A: Optimized conditional min-entropy with dc offset

  • A nonzero signal offset can be modeled with a shifted reference frame; the conditional min-entropy analysis is generalized to this case, with results tabulated for 8-bit and 16-bit ADCs.The model describes an offset that could be induced by a malicious party during sampling.Source: Appendix A · p. 9, Table II · p. 10, Table III · p. 10

Appendix B: Binning of electronic noise - from eavesdropper’s perspective

  • The eavesdropper’s electronic noise is discretized using its ADC range and bin width, and the derivation considers an eavesdropper with unbounded range and digitization resolution.The optimized range is determined numerically for a given range, with the table captions identifying 8-bit and 16-bit ADC cases.Source: Appendix B · p. 9, Table II · p. 10, Table III · p. 10

Appendix C: Upper bound on Hmin for limited laser power

  • With finite coherent-state amplitude, the conditional min-entropy is bounded; the bound is attained when ADC bins distinguish neighboring photon-number events and the end-bin probabilities are sufficiently small.For large amplitude, the conditional distribution tends toward a discretized Gaussian with zero mean and unit variance.Source: Appendix C · p. 10

Appendix D: Notes on the Leftover Hash Lemma

  • The leftover hash lemma makes the universal-hash output statistically close to uniform, while cryptographic extraction requires sacrificing bits according to the desired security parameter.The universal-hash construction also makes the output independent of its seed.Source: Appendix D · pp. 10–11

Appendix E: AES hashing and auto-correlation

  • The AES-based implementation discards four most significant bits before hashing and half of the hash output, yielding a reported real-time throughput of 3.55 Gbits/s.The four discarded input bits are used to reduce autocorrelation; the raw-sample autocorrelation is reported as low and consistent with near-independent samples.Source: Appendix E · p. 11, Figure 9 · p. 11
Loading 1411.4512v2…