PaperlayerView exact revision on arXiv

Source-linked AI summary

Quantum Random Number Generators

Miguel Herrero-Collantes, Juan Carlos Garcia-Escartin

arXiv:1604.03304v2quant-ph

TL;DR

Quantum random number generation addresses the need for unpredictable entropy in applications such as simulation and cryptography. The review surveys QRNG technologies from radioactive decay to quantum optics, along with extraction, amplification, and device-independent protocols. QRNGs are mature technologies, with optical implementations routinely reaching megabits-per-second rates, although practical electronics and postprocessing can limit performance.

  • Problem

    Applications require physical unpredictability, while traditional random-number generators face speed, reproducibility, security, and trust limitations.

  • Method

    The review surveys QRNG entropy sources, including radioactive decay and optical quantum states, and discusses extraction, amplification, testing, and device-independent protocols.

  • Results

    Optical QRNGs routinely reach generation rates in the order of megabits per second, with promises of gigabit rates.

  • Takeaways & Limitations

    QRNGs are mature enough for applications and can provide entropy for seeding cryptographic generators or, after precautions and postprocessing, directly generating keys.

  • Takeaways & Limitations

    Radioactive-decay QRNGs require highly radioactive sources for fast rates, constraining their widespread use.

Abstract

from arXiv · show

Random numbers are a fundamental resource in science and engineering with important applications in simulation and cryptography. The inherent randomness at the core of quantum mechanics makes quantum systems a perfect source of entropy. Quantum random number generation is one of the most mature quantum technologies with many alternative generation methods. We discuss the different technologies in quantum random number generation from the early devices based on radioactive decay to the multiple ways to use the quantum states of light to gather entropy from a quantum origin. We also discuss randomness extraction and amplification and the notable possibility of generating trusted random numbers even with untrusted hardware using device independent generation protocols.

I. MOTIVATION

Randomness supports applications from simulation to cryptography, but algorithmic generators provide predictable sequences. This review surveys QRNG technologies and advanced protocols, emphasizing quantum-optical implementations and randomness processing.

  • Quantum random number generators use quantum mechanical effects, are mature enough for application, and have reached commercial products and online services.The review identifies at least eight existing commercial products and online servers providing quantum random numbers on demand.
  • The review covers radioactive decay, electronic noise, quantum optics, non-optical quantum phenomena, entropy measures, extraction, amplification, and statistical testing.It focuses especially on QRNGs based on quantum optics and on protocols that process or certify random strings.
  • Random numbers support simulation, cryptography, coordination in computer networks, lotteries, and randomized algorithms.
  • PRNGs generate fast, reproducible sequences from short seeds, but their outputs are algorithmically determined and can eventually repeat.Large periods delay visible repetition, but do not remove deterministic dependence on the internal state.
  • Advanced QRNG implementations generally achieve generation rates above the megabit per second, supporting applications requiring continuous random data.The review connects these rates with applications such as online casinos and Internet gambling.

B. Random numbers in simulation

Simulation needs random inputs that represent complex systems accurately, while cryptography additionally requires unpredictability and protection against compromised generators. The paper describes QRNGs as entropy sources and examines their practical constraints.

  • B. Random numbers in simulation: Random numbers support simulations of complex systems, including engineering, network, manufacturing, business, and computer-science problems.Simulation results are typically based on many cases chosen uniformly at random.
  • B. Random numbers in simulation: Faulty PRNGs can produce incorrect simulation results because long-range correlations or poor seeds distort computed outcomes.Recorded failures include Ising-model simulations, while a different generator produced the correct answer.
  • B. Random numbers in simulation: True RNGs are seldom used for simulation beyond seeding PRNGs because they are slower and their outputs are difficult to reproduce.Present QRNG rates remain a few orders of magnitude below those of good-quality PRNGs, although QRNGs have been used in Monte Carlo simulation.
  • C. Random numbers in cryptography: Cryptographic randomness must be uniform, unpredictable, and resilient to compromise of previous or current sequence values.The paper distinguishes forward security from backward security as practical unpredictability requirements.
  • C. Random numbers in cryptography: Cryptographically secure RNG design is vulnerable to insufficient seeding, as demonstrated by predictable or low-entropy seeds enabling brute-force attacks.The paper cites historical weaknesses in Netscape, OpenSSL, and Windows 2000 random-number generation.
  • C. Random numbers in cryptography: Physical RNGs, including QRNGs, can seed cryptographically secure PRNGs and may directly generate keys after precautions and postprocessing.Relevant precautions include online testing and attention to attacks and environmental sensitivity.

D. Random numbers in fundamental science

Quantum randomness is useful in experiments that test quantum theory or require decisions independent of hidden bias. The section explains how QRNGs supply entropy through measurement and postprocessing.

  • Quantum random numbers help experiments remove possible bias when choosing measurements or making decisions about quantum systems.The paper places QRNGs in a privileged position because quantum mechanics offers true randomness according to current understanding.
  • QRNGs can be integrated with experimental equipment or built from similar apparatus when testing quantum-theory predictions.The paper notes that these generators can support experiments on complementarity and nonlocality.
  • Bell-inequality experiments require random basis choices supplied either by an external QRNG and switch or by passive photon-path separation.A balanced beam splitter can provide the passive choice under appropriate conditions.
  • Delayed-choice experiments use true randomness to decide interferometer settings after a photon has entered the apparatus.The cited examples include Wheeler’s delayed-choice experiment, entanglement swapping, and quantum erasure.
  • A physical RNG combines an entropy source and postprocessing, converting measured physical quantities into bits and extracting a more uniform output.Raw bits may be biased, while extraction produces a smaller sequence using an estimate of available randomness.
  • More involved extraction can reduce discarded randomness but may lower overall bit rate because it is slower.The rate depends on the trade-off between increased raw production and processing speed or hardware complexity.

IV. ENTROPY ESTIMATION

Entropy measures quantify the randomness available from physical sources and guide extraction. The section contrasts average information with worst-case and adversary-aware measures, emphasizing estimation challenges.

  • Entropy measures quantify surprise in bits and provide mathematical descriptions of randomness for information processing.
  • Shannon entropy measures the average information extracted from one outcome and is maximized at log2 N for a uniform alphabet of size N.It offers a rough estimate of randomness rather than a worst-case guarantee.
  • A fair four-sided die has Shannon entropy H(X) = 2, whereas the loaded die example has H(X) = 1.75.For the given loaded-die encoding, the average description length is also 1.75 bits.
  • Min-entropy bounds every outcome probability by 2^-k and interprets k as the approximate number of uniform bits extractable from the distribution.Extractors can approach k output bits when supplied with ancillary random bits of good quality.
  • Conditional min-entropy measures how much information about one party’s measurement outcomes can be inferred from another party’s system.For classical distributions, its exponential form gives the optimal guessing probability from side information.
  • Smooth min-entropy is useful for single-sample randomness estimation and tightly bounds extractor output against correlations with an external attacker.Estimating min-entropy for general unknown sources is computationally difficult, and hidden correlations can remain in characterized quantum sources.

V. QUANTUM RANDOM NUMBER GENERATORS BASED ON RADIOACTIVE DECAY

Early quantum random number generators used radioactive decay detected by Geiger–Müller tubes, converting random particle arrivals into digital outputs with clock-and-counter circuits. The review describes fast-clock, slow-clock, time-difference, parity, and semiconductor-detector variants, including methods for correcting nonuniformity.

  • Radioactive-decay sources and detection: Radioactive decay provided an accessible source of physical randomness, while Geiger–Müller detectors amplified individual particle ionization events into output pulses.Under stable operating conditions, interarrival times are modeled exponentially and counts in fixed intervals follow a Poisson distribution.
  • Clock-and-counter architectures: The first generators combined digital counters with clocks whose frequencies were fast or slow relative to the detector’s mean count rate.A fast clock has ν > λ, whereas a slow clock has ν < λ.
  • Fast-clock method: In the fast-clock method, detector pulses trigger reading and resetting a clock-driven counter, using the counter value at detection as the random number.The counter accumulates fast-clock pulses between successive detections.
  • Slow-clock method: In the slow-clock method, the counter is read at fixed clock intervals, so each output equals the number of detector pulses during that period.A modulo M counter can produce values from 0 to M − 1, with M = 2 yielding binary output.
  • Time-based and parity methods: Time-difference generators compare consecutive detection intervals, while parity methods derive bits from whether the count in a fixed period is even or odd.HotBits outputs 0 when the first interval exceeds the next and 1 when it is shorter; parity provides a binary correction for nonuniform counts.
  • Refinements and semiconductor detectors: Later designs used semiconductor detectors and alternative circuitry to reduce high-voltage requirements or address nonuniformity, noise, and detector limitations.One approach converts exponential arrival times to uniform values with an RC circuit, while another uses a sufficiently fast N-bit counter to sample uniformly across 2^N values.

C. Limitations

QRNG implementations face practical limits involving bit rate, source requirements, detector recovery, radiation damage, environmental noise, and detector imperfections. Optical methods offer substitutes for radioactive sources, but their detectors and beam splitters can still introduce correlations and bias.

  • Radioactive decay: Radioactive-decay QRNGs usually achieve below a few hundred kilobits per second, limiting their use in high-rate applications.Their bit rate is constrained by detector dead time, which limits count rates to the MHz range.
  • Radioactive decay: Decay-based generators require highly radioactive sources for fast operation, creating safety burdens that hinder straightforward computer integration.Natural background radiation rarely produces more than a few counts per second, so reviewed fast generators used sources such as Cobalt-60, Strontium-90, Caesium-137, Americium-241, or Nickel-63.
  • Radioactive decay: Semiconductor detectors can suffer progressive radiation damage, and their long-term behavior requires further study.The output may retain randomness if efficiency declines slowly, but the review identifies the need for more long-term research.
  • Alternatives: Radioactive decay remains suitable for low-speed entropy sources, whereas demanding systems can use recent optical QRNGs as substitutes.The review specifically identifies optical generators as alternatives when high bit rates are required or radioactive sources are undesirable.
  • Electronic noise: Electronic-noise QRNGs can be difficult to certify as quantum because shot noise is mixed with thermal noise, environmental fluctuations, and memory effects.The review concentrates on generators where quantum effects are well isolated, while noting commercial exceptions based on semiconductor shot noise or quantum-dominated Zener-diode operation.
  • Quantum optics: Branching-path optical QRNGs can develop neighboring-bit anticorrelation and bias from detector dead time, unequal detection efficiencies, and beam-splitter coupling ratios.A detector click temporarily reduces sensitivity, while real optical components may split or detect unequally.

C. Time of arrival generators

Time-of-arrival generators derive random bits from photon arrival timing, but finite timing precision and processing choices determine usable entropy and bias. Resettable clocks and adequate resolution improve performance.

  • Time-arrival generators use detectors and timing circuitry, with variants based on clock parity, time bins, reshaped arrival distributions, and mixed time-space measurements.Some systems flatten exponential arrival statistics or assign binary strings to equal-probability time ranges.
  • Time-based QRNGs compare consecutive photon-arrival intervals, assigning a bit according to which interval is longer.The comparison t2 > t1 yields 1, while t1 > t2 yields 0.
  • Finite timing precision discretizes arrival times into clock counts, creating equal-time events and potentially noticeable digitization effects.With p bits of timing precision, there are N = 2^p possible time bins for photon arrivals.
  • A resettable clock eliminates many biases from imprecise time measurement, while a faster clock with more ticks per detection provides better resolution.In the Figure 7 example, the resettable clock produces 11, whereas the fixed clock produces 10.
  • Extraction algorithms can whiten digitized time differences, but converting exponential statistics into uniform bits requires additional hardware and processing.One implementation collects 432 least-significant time bits and whitens them with SHA-256.

D. Photon counting generators

Photon-counting generators obtain randomness from the number of detections in fixed intervals or bins. They use parity, comparisons, probability grouping, or extraction to address non-uniform count statistics and exploit available entropy.

  • Photon counts in a fixed interval T follow a Poisson distribution when arrival times are exponentially distributed.The probability of observing n photons is P(n) = (λT)^n/n! e^(-λT).
  • Photon-counting schemes generate bits from count parity, comparisons between adjacent bins, or grouped count outcomes with equal total probability.These approaches convert detection counts into binary outputs while targeting uniform probabilities.
  • Using only one bit per measurement can underuse the entropy available when λT is sufficiently large.Some generators dynamically select additional least-significant count bits according to the observed photon rate.
  • Alternative implementations subdivide detection intervals or reshape photon flux to make arrival statistics closer to uniform.These methods convert non-uniform Poisson statistics into a more uniform random variable.

E. Attenuated pulse generators

Attenuated-pulse and vacuum-fluctuation generators use photon detection or homodyne measurements to obtain entropy from optical quantum states. Their output rate and quality depend on balancing probabilities, detector and digitizer behavior, and extraction.

  • Attenuated-pulse generators aim for equal probabilities of detection and no detection, mapping clicks to 1 and no detections to 0.The complete system is adjusted to a detection probability of one half.
  • For a Poissonian source, λT = ln 2 ≈ 0.693 gives equal probabilities for zero photons and one or more photons.Practical tuning accounts for detector efficiency and optical path losses through the effective mean photon number ηλT.
  • Von Neumann extraction can discard paired outcomes to address residual bias and drift in attenuated-pulse generators.The method keeps click-empty and empty-detection pairs while discarding two empty pulses or two clicks.
  • Homodyne detection mixes vacuum with a local-oscillator laser and subtracts detector currents to measure the X quadrature for digitization.Quadrature values can be divided into bins and assigned bit values before hashing to remove residual correlations.
  • Vacuum-fluctuation QRNGs can reach Gbps rates, and squeezing increases quantum-noise entropy and potentially the extracted bit rate.Squeezed vacuum produces a larger uncertainty in the measured quadrature.

G. Generators based on the phase noise of lasers

Laser phase-noise generators convert quantum phase fluctuations into measurable amplitude variations using delayed interferometers. Their performance depends on delay, sampling, phase-drift control, and the distinction between quantum entropy and deterministic chaos.

  • An unbalanced Mach-Zehnder interferometer converts laser phase differences into amplitude variations that standard optical detectors can measure.The output variation is proportional to cos(φ(t) − φ(t + τ)).
  • Choosing a delay much longer than the laser coherence time and sampling intervals longer than the delay plus coherence time yields independent amplitudes.The phase difference becomes approximately Gaussian under τ ≫ τcoh.
  • Phase-noise generators extract bits from digitized voltages using least-significant bits, differences, or threshold comparisons around the mean.For Gaussian voltage signals, assigning 1 above zero and 0 below zero produces random bits.
  • Pulsed-laser implementations reduce phase correlations by regenerating a random phase for each pulse, then interfere consecutive pulses with a matched delay.The phase difference becomes an amplitude variation that is detected and filtered.
  • Passive phase compensation and system tuning increased a pulsed-laser generator’s rate to 43 Gbps.Faster sampling eventually increases correlations, so the sampling rate must be optimized relative to the system timescale.
  • Chaotic laser generators can reach hundreds of Gbps, but most unpredictability comes from deterministic chaotic evolution rather than quantum entropy.Quantum noise supplies a random seed that the chaotic process expands into a fast physical signal.

H. Generators based on amplified spontaneous emission

Amplified spontaneous emission and related optical noise sources provide strong quantum-origin entropy that can be sampled rapidly, while detector bandwidth, correlations, and threshold stability constrain performance.

  • ASE noise: Amplified spontaneous emission provides a strong quantum-origin signal whose independent frequency-band amplitudes support QRNG rates reaching Gbps.Detector speed usually limits the rate because ASE changes faster than the detection mechanism.
  • ASE noise: ASE noise, although a limitation in optical amplification, can be repurposed as an entropy source for quantum random number generation.It can dominate thermal and optical shot noise while remaining measurable with existing optical equipment.
  • Implementations: Commercial fiber-communication components generate filtered ASE that is amplified, spectrally selected, and converted into random bits through voltage detection and thresholding.Implementations include pumped erbium/ytterbium fibers, erbium-doped fiber amplifiers, semiconductor optical amplifiers, and single-detector schemes.
  • Alternative ASE sources: Superluminescent LEDs offer broadband ASE whose independent spectral regions can support multiple wavelength-multiplexed random bit streams.Their output has a flat spectrum over a wide frequency range.
  • Signal processing: Self-differencing produces a more symmetric voltage distribution, simplifying a zero-voltage threshold, while oversampling requires postprocessing to remove residual correlations.Adequate postprocessing can restore sequence quality when sampling exceeds the detected-noise linewidth.
  • Raman alternatives: Spontaneous Raman scattering provides an unamplified quantum randomness source using single-photon detectors, with scattered photons distributed across distinct spectral regions.In strongly frequency-shifted bands, phonon vacuum fluctuations can dominate interactions with the thermal phonon field.
  • Raman alternatives: 1 Mbps raw and 650 kbps postprocessed rates were demonstrated for a Raman-scattering generator, with correlations constrained by the Raman response time.Pump power can control photon generation rates to avoid frequency correlations.

J. Generators based on optical parametric oscillators

Optical parametric oscillators amplify vacuum-fluctuation phase randomness into macroscopic bistable fields, which can be compared interferometrically to produce binary outputs.

  • Quantum origin: OPO randomness originates from vacuum fluctuations initiating oscillation, producing phase states centered near 0 or π relative to the pump.The gain threshold and phase-dependent cavity dynamics determine the available stable states.
  • Binary extraction: Interfering outputs from two equal-power OPO cavities converts matching phases into constructive interference and opposite phases into destructive interference.The resulting high- and low-power outputs are distinguishable and can be thresholded into bits.
  • Binary extraction: The OPO scheme uses macroscopic phase inherited from vacuum fluctuations, while classical noise is negligible and does not alter the phase state.A beam splitter performs the phase-to-amplitude conversion needed for binary detection.
  • Speed limitation: Fresh randomness requires the cavity field to decay back to the quantum-noise level before oscillation restarts; otherwise residual fields correlate successive phase states.This regeneration requirement is the principal speed limitation of OPO-based QRNGs.
  • Speed limitation: 10 to 20 times the 1/e cavity decay time may be required for regeneration when pumping well above threshold.The exact regeneration time depends on cavity parameters and pump power.
  • Performance: Tens of kbps are achievable before serious correlation problems appear, while shorter cavities and higher repetition-rate pumps could enable Gbps operation.The proposed improvement relies on reducing cavity build-up time.
  • Variants: The approach can extend beyond second-order nonlinear materials to χ(3) effects in integrated optical parametric oscillators and to other bistable optical systems.Examples include semiconductor ring lasers and competing laser modes that amplify single-photon uncertainty.

VIII. NON-OPTICAL QUANTUM RANDOM NUMBER GENERATORS

Non-optical QRNGs derive entropy from radioactive decay, electronic tunneling and shot noise, atomic spin fluctuations, and other quantum systems, with certification methods addressing hardware trust.

  • Historical and electronic systems: Radioactive-decay QRNGs were the first quantum generators and remain in use, while their particle detection is analogous in many respects to optical photon-counting schemes.Alpha decay can also be viewed as a tunneling-based process.
  • Historical and electronic systems: Electronic QRNGs commonly use quantum tunneling and shot noise in semiconductor junctions, although their quantum contribution is generally less clearly defined.Properly implemented Zener-diode noise can approach an almost purely quantum regime.
  • Atomic and solid-state systems: Trapped-ion QRNGs are slower and more complex than optical systems but support device-independent and other quantum-certified random-number generation.Their value lies in experimental tests that certify aspects of quantum mechanics.
  • Atomic and solid-state systems: Alkali-vapor QRNGs measure spin noise through probe-beam polarization changes and threshold one polarization component to generate binary outputs.The spin noise is a random collective magnetic moment appearing even without an external magnetic field.
  • Atomic and solid-state systems: Spin-noise generation reaches the kbps range and is limited by system relaxation time, while shorter-coherence solid-state systems could support dephasing rates near 1 GHz.Samples taken below the relaxation time can be correlated.
  • Certification and trust: Quantum-randomness certification addresses the need to trust RNG devices or algorithms, including through self-testing and device-independent protocols.Device-independent approaches use quantum correlations to guarantee statistical independence under trusted physical assumptions.
  • Certification and trust: State-tomography self-testing can protect against an adversary controlling the entropy source when repeated measurements of a preserved state are possible, but its protection is limited.The method requires assuming that the measured state remains preserved throughout the process.
  • Certification and trust: A witness W>0 indicates incompatible measurements and bounds guessing probability, guiding how strongly a randomness extractor should compress raw bits.Smaller W values correspond to more classical behavior and fewer clean random bits.

B. Device independent quantum random number generators

Device-independent QRNGs certify randomness without trusting the internal device, using Bell-test correlations and physical-law constraints. The protocols expand or certify random bits, but practical implementations trade certification strength against generation speed and experimental demands.

  • B. Device independent quantum random number generators: Device-independent QRNGs address the problem of trusting the generator by certifying randomness from its output and physical-law constraints.The approach ignores internal device details and seeks output randomness whose failure would imply violation of a physical law.
  • B. Device independent quantum random number generators: Bell tests distinguish local realistic explanations from quantum behavior using correlations between measurements on spacelike separated entangled particles.A Bell violation supports quantum behavior, although experimental loopholes can leave alternative explanations.
  • B. Device independent quantum random number generators: A Bell-inequality violation provides a min-entropy bound, allowing nonuniform certified bits to be converted into uniform output with a randomness extractor.If the system admits a classical description, the entropy bound can be zero; entanglement provides a nonzero guarantee under the tested conditions.
  • B. Device independent quantum random number generators: Pironio et al.’s protocol produced n certified random bits while consuming a previously existing random sequence of order √n bits.The protocol used trapped-ion qubits to close the detection loophole, but generation was extremely slow and yielded only 42 certified random bits.
  • B. Device independent quantum random number generators: Vazirani and Vidick’s protocol produces n bits secure against quantum adversaries from a seed of order log^3 2 n bits, offering exponential expansion.The nonsignalling formulation preserves the general expansion result but changes the conditional min-entropy bound and still requires a uniform seed.
  • B. Device independent quantum random number generators: Optical and semi-device-independent implementations relax experimental requirements, including detection efficiency, dimensional assumptions, or entanglement requirements.Transition-edge sensors achieved about half a bit per second, while bounded-dimension approaches use single-photon transverse momentum.
  • B. Device independent quantum random number generators: Certification confidence can be increased by taking more measurements, but this reduces generation speed.This creates a direct practical trade-off between statistical certainty and throughput.
  • B. Device independent quantum random number generators: Device-independent generators implement randomness expansion: a small random seed and experimental results produce a longer sequence guaranteed to be random.These schemes can be framed under quantum or nonsignalling restrictions and use physical experiments to expand randomness.

C. Other forms of quantum certification

Contextuality-based QRNGs certify quantum-origin randomness without requiring entangled states, while randomness extraction converts imperfect physical outputs into near-uniform strings. Extractor choice depends on entropy estimates, output quality, speed, and hardware resources.

  • C. Other forms of quantum certification: Contextuality tests distinguish quantum randomness from classical noise while allowing untrusted devices in a less adversarial model.The manufacturer is not assumed to be actively deceptive, but the device may be faulty or poorly designed.
  • C. Other forms of quantum certification: KCBS-inequality violations certify a lower bound on output entropy without requiring entangled states.The certified output can be processed by a randomness extractor to obtain bits safely attributable to a quantum source.
  • C. Other forms of quantum certification: These contextuality QRNGs have optical implementations using photon qutrits in three paths and trapped-ion implementations using three-level ions.In the ion system, bits arise from detecting fluorescence during measurements lasting around 10 ms.
  • X. POSTPROCESSING: Postprocessing primarily performs randomness extraction to correct biases and correlations caused by imperfections in measurement and generation devices.It may also buffer samples and run health tests to check generator operation.
  • X. POSTPROCESSING: High entropy alone does not ensure suitability for cryptographic use because many protocols require an almost uniform random sequence.Randomized algorithms may tolerate weak sources, whereas cryptographic tasks such as encryption and secret sharing may not.
  • X. POSTPROCESSING: Statistical distance defines how close an extracted distribution is to a uniform distribution, with ε-closeness expressing the permitted maximum difference.Extraction transforms n raw bits into m bits that are ε-close to U_m for a small ε.
  • A. Randomness extractors: The source min-entropy limits extractable output, so an (n, m, k, ε)-extractor aims to produce m bits near uniform with m as close to k as possible.The source is assumed to have known min-entropy or structural properties such as independence or a Markov model.
  • A. Randomness extractors: Seeded extractors provide security against quantum attackers, while a fast lower-resource method trades computational efficiency for a larger seed compared with Trevisan extraction.Extractor selection is influenced by speed and hardware requirements, and incorrect entropy estimation can prevent the desired output properties.

XI. QUANTUM RANDOMNESS EXTRACTORS: RANDOMNESS EXPANSION AND RANDOMNESS AMPLIFICATION

Quantum randomness extractors extend classical extraction by using quantum systems to expand a short random seed or amplify weak randomness. The review distinguishes expansion, amplification, and privacy amplification as related but different tasks.

  • XI. QUANTUM RANDOMNESS EXTRACTORS: RANDOMNESS EXPANSION AND RANDOMNESS AMPLIFICATION: Quantum mechanics enables physical randomness extractors that use untrusted ancillary systems to expand uniform randomness or strengthen weak randomness.These protocols extend the role of quantum mechanics beyond serving as an entropy source.
  • XI. QUANTUM RANDOMNESS EXTRACTORS: RANDOMNESS EXPANSION AND RANDOMNESS AMPLIFICATION: Quantum randomness expansion starts with a small random seed and produces a longer sequence with strong randomness guarantees.Quantum randomness amplification instead combines a weak classical or quantum source with a quantum system to produce an arbitrarily close-to-uniform output.
  • XI. QUANTUM RANDOMNESS EXTRACTORS: RANDOMNESS EXPANSION AND RANDOMNESS AMPLIFICATION: Privacy amplification reduces an adversary’s information about a partially known string, producing a shorter sequence statistically uncorrelated with the attacker.Both classical and quantum algorithms exist, and extraction-related methods can guarantee independence from causally preceding events.
  • XI. QUANTUM RANDOMNESS EXTRACTORS: RANDOMNESS EXPANSION AND RANDOMNESS AMPLIFICATION: The section provides an overview of these concepts and directs readers to a separate review for the underlying mathematics.The treatment is conceptual rather than a full mathematical development.

A. Quantum randomness expansion

Quantum randomness expansion protocols use quantum experiments and a seed to produce longer, certified random strings, including in device-independent settings. Related work extends these schemes to weaker sources and different adversary models, while statistical tests diagnose suspicious output patterns.

  • A. Quantum randomness expansion: Quantum randomness expansion processes a weak source with a random seed to produce output as close to uniform as desired.Device-independent generators use Bell-test nonlocality both as a weak randomness source and as a privacy guarantee.
  • A. Quantum randomness expansion: Repeated simple protocols with finitely many quantum devices can increase output size arbitrarily while certifying security against quantum adversaries.Concatenation provides a route from limited devices to longer certified sequences.
  • A. Quantum randomness expansion: Semi-device-independent schemes relax trust assumptions, using bounded-dimension quantum states and avoiding entanglement in some implementations.Source-independent seeded extractors also address optical QRNG issues including losses, multiphoton pulses, and unbalanced beam splitters.
  • A. Quantum randomness expansion: Quantum-to-classical extractors measure quantum states correlated with an eavesdropper to maximize private random-bit output.The objective is to obtain randomness without revealing information to the adversary.
  • A. Quantum randomness expansion: Against quantum attackers, randomness expansion can be efficient, whereas privacy-amplification formulations face severe limitations against nonsignalling attackers.The review treats quantum-secure protocols as valid under the physical relevance of quantum mechanics.
  • A. Quantum randomness expansion: Device-independent protocols require a uniform seed both for Bell-test measurement settings and for extracting uniform bits from a sequence known only to have a min-entropy bound.This explains why expansion protocols do not by themselves eliminate the initial uniform-randomness requirement.
  • A. Quantum randomness expansion: Quantum randomness amplification removes the uniform-seed requirement by combining weak randomness with quantum devices to produce uniform bits.It addresses the impossibility of deterministic extraction from general limited-min-entropy sources.
  • A. Quantum randomness expansion: The Colbeck–Renner protocol deterministically amplifies Santha–Vazirani randomness using ancillary physical systems and remains robust against attackers beyond quantum mechanics.The protocol requires a large supply of imperfect randomness; later proposals address arbitrarily weak or bounded-nonzero-min-entropy sources.

XIII. DISCUSSION

Quantum random number generation has matured across diverse physical implementations, with optical systems reaching megabit-per-second rates while practical deployment remains constrained by processing, communication, and certification challenges. The review highlights the need to convert raw quantum entropy into usable, high-quality random bits and to improve device-independent generation.

  • Quantum random number generation uses diverse entropy sources, including radioactive decay, photon splitting, Raman-amplification noise, laser phase noise, and amplified spontaneous emission.
  • Optical quantum random number generators routinely reach generation rates in the order of megabits per second, with promises of gigabit rates.
  • Many proposals report extrapolated random-bit rates without fully addressing how to use the available bits or produce final usable outputs.
  • Commercial devices have bit rates with a gap around two orders of magnitude relative to the fastest possible laboratory rates, which matters when competing with pseudorandom generators in simulation.
  • Communication bottlenecks are viewed as engineering problems, whereas randomness extraction remains a more substantial limitation for converting measured raw bits into good-quality random bits.
  • Cryptographic applications can be sensitive to less than perfect uniformity, so QRNGs should include well-designed postprocessing such as seeded extractors or two-universal hashing.
  • Device-independent protocols can provide reliable random numbers without trusted hardware, but they remain experimentally challenging and produce bits at sluggish rates.
  • The field combines fundamental results with different QRNGs reaching the market, while the review introduces existing technologies and future directions.
Loading 1604.03304v2…