PaperlayerView exact revision on arXiv

Source-linked AI summary

Source-independent quantum random number generation

Zhu Cao, Hongyi Zhou, Xiao Yuan, Xiongfeng Ma

arXiv:1508.04880v2quant-ph

TL;DR

Practical QRNGs can leave the source’s randomness uncertain because source models may rely on assumptions that are difficult to verify. This paper proposes a source-independent scheme that allows arbitrary source dimensions and demonstrates it experimentally, reporting a generation rate of 5 × 10^3 bit/s under practical detector efficiency.

  • Problem

    Practical QRNGs may fail to provide reliable randomness when a complicated or untrusted source deviates from its assumed model.

    Source: §I · p. 2

  • Method

    The SIQRNG trusts a characterized measurement setup compatible with a squashing model, while its analysis treats the source as untrusted and uses QKD-related parameter-estimation and extraction techniques.

    Source: §I · p. 2, §III · p. 3, A. Squashing model · p. 4

  • Results

    5 × 10^3 bit/s: the experimental SIQRNG achieved this relatively high rate under practical detector efficiency.

    Source: §IV · p. 7

  • Takeaways & Limitations

    The scheme is presented as loss tolerant, with potential for high-loss implementations such as integrated optical chips or systems using inefficient, low-cost single-photon detectors.

    Source: §I · p. 2

    The experimental demonstration used passive basis choice; demonstrating the scheme with active basis choice remains future work, and the beam splitter may also be uncharacterized.

    Source: §V · pp. 7–8

Abstract

from arXiv · show

Quantum random number generators can provide genuine randomness by appealing to the fundamental principles of quantum mechanics. In general, a physical generator contains two parts---a randomness source and its readout. The source is essential to the quality of the resulting random numbers; hence, it needs to be carefully calibrated and modeled to achieve information-theoretical provable randomness. However, in practice, the source is a complicated physical system, such as a light source or an atomic ensemble, and any deviations in the real-life implementation from the theoretical model may affect the randomness of the output. To close this gap, we propose a source-independent scheme for quantum random number generation in which output randomness can be certified, even when the source is uncharacterized and untrusted. In our randomness analysis, we make no assumptions about the dimension of the source. For instance, multiphoton emissions are allowed in optical implementations. Our analysis takes into account the finite-key effect with the composable security definition. In the limit of large data size, the length of the input random seed is exponentially small compared to that of the output random bit. In addition, by modifying a quantum key distribution system, we experimentally demonstrate our scheme and achieve a randomness generation rate of over $5\times 10^3$ bit/s.

I. INTRODUCTION

Quantum generators promise randomness from quantum uncertainty, but existing physical generators and source models leave uncertainty about whether the output is genuinely random. This paper motivates a source-independent QRNG that trusts a characterized measurement device rather than the source, including sources of arbitrary and unknown dimension.

I. INTRODUCTION

  • Pseudorandom generators are deterministic, while hardware generators based on classical processes are not known to be truly random.Pseudorandom sequences can have long-range correlations that undermine cryptographic security and scientific simulations.Source: §I · p. 1
  • A malfunctioning source can emit classical signals that produce fixed outputs, while the measurement results alone cannot distinguish this from a functioning source.The source may send Z-basis states instead of the superpositions used to generate quantum randomness.Source: Figure 1 · p. 1, §I · p. 2
  • Existing QRNGs often rely on complicated source models, sometimes including a fixed known dimension, whose assumptions about source randomness cannot be experimentally verified.The paper identifies removing the dimension assumption as a key challenge for device-independent analysis.Source: §I · p. 2
  • Device-independent QRNGs avoid trusting devices but require Bell-inequality violations, and the paper cites loss intolerance and very low generation rates as practical drawbacks.The authors present their source-independent scheme as loss tolerant, with potential use in high-loss implementations.Source: §I · p. 2
  • The proposed source-independent QRNG trusts a well-characterized measurement device while allowing the source to have arbitrary, unknown dimension.The analysis incorporates multiphoton components and losses, and uses complementary uncertainty relations, phase error correction, random sampling, and a squashing model.Source: §I · p. 2

III. ANALYSIS

The analysis treats the SIQRNG as a randomness-expansion protocol and adapts QKD security techniques to estimate and extract randomness. Its biased measurement choice uses a constant number of X-basis measurements, unlike the cited QKD protocol.

III. ANALYSIS

  • The SIQRNG is a randomness-expansion scheme: a random seed generates extra independent randomness.Parameter estimation is analogous to phase-error estimation in QKD, and randomness extraction is mathematically equivalent to privacy amplification.Source: §III · p. 3
  • The protocol’s parameter estimation parallels QKD phase-error estimation, while its randomness extraction is mathematically equivalent to QKD privacy amplification.The passage also distinguishes its biased measurement choice from biased-basis QKD.Source: §III · p. 3
  • Unlike the cited biased-basis QKD protocol, the SIQRNG uses a constant number of X-basis measurements, even as data size grows.In the cited QKD protocol, that number must grow without bound as the data size tends to infinity.Source: §III · pp. 3–4

A. Squashing model

The measurement model assumes a squashing-compatible trusted device that reduces arbitrary-dimensional signals to qubits or vacuum before basis measurement. The paper notes that verifying this compatibility is practically challenging.

A. Squashing model

  • The squashing model maps an arbitrary-dimensional source signal to a qubit or vacuum, after which vacua are discarded and qubits are measured in X or Z.Threshold detectors with random bit assignments for double clicks can satisfy the stated assumption; because X results are discarded, half the double-click ratio can instead be added to the X-basis error rate.Source: A. Squashing model · p. 4
  • Verifying squashing compatibility is challenging; the paper describes equal detector response across four qubits and filtering optical modes as relevant checks.A trusted source can be used beforehand for measurement tomography, but detailed validation is left for future work.Source: A. Squashing model · p. 4
  • The randomness analysis allows Eve to choose a valid squashing operator, provided its output is a qubit or vacuum.The subsequent entropy analysis focuses on the squashed qubits measured in the Z basis.Source: A. Squashing model · p. 4

B. Complementary uncertainty relation

The protocol uses X-basis tests to estimate phase errors and connect the source’s imperfect preparation to the randomness of Z-basis outcomes. Randomness extraction then plays the role of phase error correction, with security expressed using a composable trace-distance parameter.

B. Complementary uncertainty relation

  • X-basis sampling estimates the phase error rate, allowing a virtual phase-error-correction step to justify extracting randomness from Z-basis outcomes.Because phase error correction can commute with the Z-basis measurement, it can be performed after measurement as randomness extraction.Source: B. Complementary uncertainty relation · p. 4
  • The number of final random bits is determined by the Z-basis sample size, its phase error rate, and a parameter controlling the correction-failure probability.The failure probability is 2^-te; Toeplitz hashing implements the extraction.Source: B. Complementary uncertainty relation · p. 4
  • The fidelity-based failure probability can be converted to a trace-distance security parameter for composable security.The analysis uses the fidelity measure before converting it to the trace-distance measure.Source: B. Complementary uncertainty relation · p. 5
  • Toeplitz hashing produces output independent of the random bits used to construct the matrix, so the matrix can be reused.The extractor is described as strong under the Leftover Hash Lemma.Source: B. Complementary uncertainty relation · p. 5
  • An alternative derivation using an uncertainty relation and an extended Leftover Hash Lemma yields a trace-distance security parameter of order 2^-te/2, consistent with the main approach.The alternative approach combines the uncertainty relation with an extension of the Leftover Hash Lemma [47] to the quantum scenario.Source: B. Complementary uncertainty relation · p. 5

C. Finite key analysis

Finite data causes statistical fluctuations in the X-basis sampling used to bound the phase error rate. The analysis bounds that rate from the sample and shows that, at large data sizes, the seed can be exponentially shorter than the output.

C. Finite key analysis

  • Finite runs cause statistical fluctuations, so the phase error rate must be bounded from the finite X-basis sample rather than treated as known.The X-basis error rate is measured on randomly sampled squashed qubits.Source: C. Finite key analysis · p. 5
  • Randomly choosing X-basis measurements leaves the Z-basis phase errors to be inferred by sampling; their estimated rate determines the randomness extraction rate.The protocol bounds the Z-basis error count from the X-basis sample using a deviation parameter for statistical fluctuations.Source: C. Finite key analysis · p. 5
  • The X-basis sample fraction and deviation bound trade off against the final-bit fraction, so the sample size should be optimized.The stated failure probability for this sampling step is εθ = 2^-100 in later postprocessing.Source: C. Finite key analysis · p. 5
  • At large data sizes, the input seed is exponentially small compared with the output-bit length, yielding exponential randomness expansion.For a fixed failure probability, the number of X-basis samples can remain constant as the total data size grows.Source: C. Finite key analysis · p. 5

D. Practical issues

The practical analysis allows multiphoton emissions and losses within the stated measurement model, but detector-efficiency mismatch remains an assumption requiring further analysis. It also specifies how double clicks and source intensity affect the error rate and extraction rate.

D. Practical issues

  • When multiphoton emissions raise the double-click rate enough to push the phase-error bound to one-half, no random bits can be extracted and the protocol aborts.Multiphotons are allowed because the source dimension is uncharacterized, but their double clicks contribute to the X-basis error rate.Source: D. Practical issues · pp. 5–6
  • Loss tolerance relies on basis-independent measurement in the squashing model, with basis choice made after losses so effective X-basis sample positions remain uniform.Loss reduces the number of effective X measurements but not the uniformity required for random sampling.Source: D. Practical issues · p. 6
  • The protocol assumes equal detector efficiencies; a mismatch slightly decreases the rate under the stated rate adjustment, whose detailed analysis is left for future work.The adjustment uses the ratio between the minimum and maximum efficiencies of the two detectors.Source: D. Practical issues · p. 6
  • Double clicks are counted as half an error in the X-basis error rate rather than discarded, because discarding them could leave a strong-pulse attack unnoticed.This treatment follows the squashing model’s random assignment for double clicks.Source: D. Practical issues · p. 6
  • Basis selection uses a random seed to choose X-basis positions uniformly from the full set before the positions of losses are known.The procedure uses a diluted, partially random string to extend a short seed.Source: D. Practical issues · p. 6
  • Increasing source intensity raises detections but also double clicks and the phase-error rate, creating a trade-off that requires intensity optimization.The trade-off is between the number of Z-basis outcomes and their phase-error rate.Source: D. Practical issues · p. 6

IV. EXPERIMENT DEMONSTRATION

The experiment demonstrates SIQRNG with a laser source treated as an infinite-dimensional coherent state and a user-owned measurement device. Randomness generation persists at high loss, with a measured rate above 5 × 10^3 bit/s under practical detector efficiency.

IV. EXPERIMENT DEMONSTRATION

  • The laser source is modeled as an infinite-dimensional coherent state, while the user’s measurement device uses filtered optical modes and passive basis choice.A biased beam splitter selects the X or Z basis; a time-division-multiplexed photon detector simulates four detectors.Source: §IV · pp. 6–7, Figure 3 · p. 6
  • The phase error rate increases with loss and can exceed 20%, yet the SIQRNG scheme still generates random numbers.The authors attribute the increase to dominant dark counts at high loss and to statistical fluctuations as data size shrinks.Source: §IV · p. 7, Figure 4 · p. 7
  • Under practical detector efficiency, the randomness generation rate still achieves 5 × 10^3 bit/s; it decreases as loss increases, and the experimental demonstration uses fixed source intensity.Source: §IV · p. 7
  • With a 50 ns detector dead time, the scheme’s maximum rate is 20 Mbps for a single-photon source, while practical coherent-state implementations can reach about 2 Mbps.The coherent-state estimate accounts for errors and finite data size effects.Source: §IV · p. 7
  • Toeplitz-matrix hashing substantially reduces autocorrelation in the final data, and all reported NIST tests pass.The tests are applied after extracting final random numbers from the raw data.Source: §IV · p. 7

V. CONCLUSION

The authors propose and experimentally demonstrate a source-independent, loss-tolerant QRNG using passive basis choice. They identify source operation, basis choice, and simultaneous tolerance of loss and speed as relevant implementation boundaries or future directions.

V. CONCLUSION

  • The proposed source-independent, loss-tolerant QRNG is experimentally demonstrated with passive basis choice.The authors note that the beam splitter, as part of the measurement device, may also be uncharacterized.Source: §V · p. 7
  • The final data show significantly smaller absolute autocorrelation than the raw data; even perfectly random strings cannot have zero autocorrelation because of finite-key-size effects.For 91 Mbit of final data extracted from 115-Mbit raw data, all NIST-test P values exceed 0.01; the stated passing criterion also requires at least 96% of sequences to satisfy P > 0.01.Source: Figure 6 · p. 8, Figure 7 · p. 8
  • When the source operates properly, protocol speed is comparable to a trusted polarization-based QRNG limited by single-photon detectors, approximately 100 Mbps [53].Source: §V · p. 8
  • An active-basis-choice demonstration is identified as future work, alongside investigation of schemes that tolerate large losses while generating fast random numbers under minimal practical assumptions.Source: §V · p. 8
  • A LED source is described as a possible adaptation, and the setup could also test quantum features of macroscopic sources.For a LED, the text proposes adding a polarizer for the |+⟩ direction; gated detection makes continuous or pulsed sources possible.Source: §V · p. 8
  • The cited related work also targeted provable randomness with untrusted sources, but assumed a source dimension and did not account for multiphotons, device imperfections, or losses.The authors contrast this with their use of the squashing model for arbitrary-dimensional systems and practical imperfections.Source: §V · p. 8

Appendix A: Calculation of the number of effective X-basis measurements

The appendix analyzes the asymptotic number of effective X-basis measurements. Its derived condition is independent of the data-size parameter n.

Appendix A: Calculation of the number of effective X-basis measurements

  • The derivation starts from Eq. (5), fixes εθ < 2^-100, and focuses on the exponent after treating polynomial terms as relatively small.The appendix notes that n is normally below 10^12 for fast postprocessing.Source: Appendix A · p. 8
  • For small q, the appendix approximates the entropy expression in its bound and rearranges it to obtain the n-independent condition.Source: Appendix A · pp. 8–9
  • The derived condition for effective X-basis measurements is independent of n in the asymptotic limit.Source: Appendix A · p. 9

Appendix B: Proof of the random sampling property for a type of QRNG input after loss

Appendix B proves that when measurement bases are chosen before possible loss, the surviving X-basis positions are uniformly sampled among valid positions. This preserves the applicability of the random-sampling technique under that timing of basis choice.

Appendix B: Proof of the random sampling property for a type of QRNG input after loss

  • When basis choices are fixed before loss, the surviving X-basis positions are uniformly sampled among valid positions, so the random-sampling technique still applies.The proof establishes this property for the specified input and measurement setting.Source: Appendix B · p. 9
  • The input is a uniformly random string of length N with Nx 0s and Nz 1s; 0 denotes an X-basis measurement and 1 a Z-basis measurement.The positions of the Nz 1s are equally likely among the N positions.Source: Appendix B · p. 9
  • After loss, nx and nz count the valid X- and Z-basis measurements, respectively, and n is their total.The measurement device ideally chooses its basis after confirming the state was not lost; the appendix considers choosing it before that confirmation.Source: Appendix B · p. 9
  • A symmetry argument shows that every surviving pattern with nx X-basis positions has the same probability, proving the sampling property.The proof also notes that the property holds whether losses are basis-dependent or basis-independent, and for independent identically distributed input.Source: Appendix B · p. 9

Appendix C: Random seed dilution

Appendix C describes deterministic expansion from a uniformly random seed by mapping it bijectively to the input support. Because the number of X-basis choices is constant, the seed-length-to-run ratio becomes negligible as N grows.

Appendix C: Random seed dilution

  • The input can be generated by mapping a uniformly random seed bijectively to the uniformly random input support.The construction is deterministic, so randomness is needed only for the seed.Source: Appendix C · p. 9
  • As N grows, the initial random seed length divided by the number of runs becomes negligible because c1, the number of X-basis measurements, is constant.The passage states that the input min-entropy and uniformly random seed length have an upper bound, but the bound itself is not supplied here.Source: Appendix C · pp. 9–10
Loading 1508.04880v2…