Source-linked AI summary
Secure heterodyne-based quantum random number generator at 17 Gbps
Marco Avesani, Davide G. Marangon, Giuseppe Vallone, Paolo Villoresi
TL;DR
Quantum random-number generators can be vulnerable to information leakage from implementation imperfections, while cryptographic uses require secure, high-rate output. The paper proposes a source-device-independent heterodyne protocol and demonstrates a secure generation rate of 17.42 Gbit/s.
Problem
Implementation imperfections can leak information correlated with generated numbers, and secure ultrafast generation is needed for applications such as cryptography.
Source: §I · p. 1Method
Results
17.42 Gbit/s was achieved as an equivalent secure generation rate, with the reduction from classical to quantum security changing the rate from 14.10 to 13.949 bits per sample.
Source: §IV · p. 5Takeaways & Limitations
The constant bound is determined by trusted measurement resolution, so all secure numbers remain available without real-time bound updates.
Source: §V · p. 5
Abstract
from arXiv · showhide
Random numbers are commonly used in many different fields, ranging from simulations in fundamental science to security applications. In some critical cases, as Bell's tests and cryptography, the random numbers are required to be both secure (i.e. known only by the legitimate user) and to be provided at an ultra-fast rate (i.e. larger than Gbit/s). However, practical generators are usually considered trusted, but their security can be compromised in case of imperfections or malicious external actions. In this work we introduce an efficient protocol which guarantees security and speed in the generation. We propose a novel source-device-independent protocol based on generic Positive Operator Valued Measurements and then we specialize the result to heterodyne measurements. The security of the generated numbers is proven without any assumption on the source, which can be even fully controlled by an adversary. Furthermore, we experimentally implemented the protocol by exploiting heterodyne measurements, reaching an unprecedented secure generation rate of 17.42 Gbit/s, without the need to take into account finite-size effects. Our device combines simplicity, ultrafast-rates and high security with low cost components, paving the way to new practical solutions for random number generation.
I. INTRODUCTION
Quantum randomness is valuable for cryptography, but implementation imperfections can leak information correlated with outcomes. This work proposes a source-device-independent heterodyne QRNG and reports secure generation above 17 Gbit/s.
I. INTRODUCTION
- Quantum measurements are theoretically unpredictable, but implementation imperfections can leak side information that helps an eavesdropper guess outcomes.Source: §I · p. 1
- Fully trusted QRNGs rely on strong device assumptions, while device-independent protocols avoid such assumptions but remain impractical to realize.Source: §I · p. 1
- Heterodyne detection measures both quadratures simultaneously, increasing generation rate relative to homodyne and avoiding an active switch.Source: §I · p. 1
- The protocol assumes a trusted detector but makes no source assumption, allowing an eavesdropper to control the source and model imperfect state preparation.Source: §I · p. 1
- Greater than 17 Gbit/s of secure random numbers were demonstrated with a compact fiber-optical setup using standard telecom components.Source: §I · p. 2
II. A HETERODYNE QRNG
The section describes a continuous-variable QRNG using heterodyne detection to measure two noisy quadratures at once. Its raw outputs require extraction, while cryptographic security must account for an eavesdropper who may control the source.
II. A HETERODYNE QRNG
- Heterodyne detection measures two noisy quadrature observables simultaneously, while fast photodiodes support high sampling rates in continuous-variable QRNGs.Source: §II · p. 2
- The heterodyne output X is distributed according to the Husimi probability density function.Source: §II · p. 2
- Because raw real and imaginary output values are typically nonuniform, a randomness extractor compresses them into shorter strings of i.i.d. random bits.Source: §II · p. 2
- For cryptographic security, the conditional quantum min-entropy must account for prior information an eavesdropper may gain by controlling the source.Source: §II · p. 2
A. Security of the CV protocol
The protocol bounds randomness from the measurement structure even when Eve controls the source, then specializes the bound to heterodyne detection. Its heterodyne entropy bound is constant and supports extractor calibration without numerical optimization.
A. Security of the CV protocol
- The protocol assumes a trusted local measurement apparatus but places no restrictions on ρA, which Eve may prepare to maximize her guessing probability.Eve can choose a decomposition of the state into component states and weights to maximize her probability of guessing Alice’s outcome.Source: A. Security of the CV protocol · p. 2
- Hmin(X|E) is lower-bounded for any POVM by −max_{x,τA} log2(Tr[ΠxτA]), independently of the input state.The bound follows from the POVM structure and applies to finite- and infinite-dimensional measurements.Source: A. Security of the CV protocol · p. 3
- Projective measurements make the general bound trivial, whereas overcomplete POVMs can yield a bound below one and permit randomness extraction.For projective measurements, a state can give an outcome probability of one; for overcomplete POVMs, the maximum can be less than one.Source: A. Security of the CV protocol · p. 3
- For heterodyne measurement, Hmin(X|E) is at least log2 π, and the bound is tight for states with positive Glauber-Sudarshan P(α) representation.Coherent and thermal states are cited as cases where the bound is tight.Source: A. Security of the CV protocol · p. 3
- The heterodyne entropy bound is constant, so Alice can calibrate an extractor to log2 π without repeatedly estimating Eve’s side information.The authors describe this as a conservative strategy for imperfect sources that avoids complex numerical maximization.Source: A. Security of the CV protocol · p. 3
B. Practical Bound
Finite measurement resolution makes the heterodyne min-entropy bound depend on the quadrature resolutions. Alice can obtain and keep this bound fixed while she trusts her characterized apparatus.
B. Practical Bound
- The experimental setup is schematic and uses only commercial off-the-shelf devices.The implementation is described as a compact all-fiber setup at telecom wavelength.Source: Figure 2 · p. 4
- The real-life min-entropy bound depends only on measurement resolution, which Alice can measure for her trusted apparatus and need not update.The discretized heterodyne outcomes have resolutions δq and δp for the two quadratures.Source: B. Practical Bound · pp. 3–4
IV. EXPERIMENTAL RESULTS
The heterodyne QRNG uses a compact telecom-fiber setup to sample both quadratures and process the signal for secure random-number generation. It reaches 17.42 Gbit/s, with the quantum min-entropy bound requiring only a small reduction from the classical rate.
IV. EXPERIMENTAL RESULTS
- A fiber-integrated 90-degree hybrid mixes the vacuum input with a 1550 nm local oscillator, and balanced detectors measure both quadratures for 10-bit sampling at 10 GSamples/s.The compact setup uses telecom components; the local-oscillator intensity is monitored continuously.Source: §IV · p. 4
- The detector signals are digitally filtered to a 1.25 GHz window and downsampled at 1.25 GSample/s to remove classical noise and oversampling correlations.The ADC records 10 bits for each quadrature per sample.Source: §IV · pp. 4–5
- The measured Husimi-function variance is slightly above the vacuum expectation because detector noise widens the distribution, and this noise is included in the quantum min-entropy analysis.The expected vacuum variance is 1/2 for both quadratures.Source: Figure 3 · p. 4, §IV · p. 5
- 17.42 Gbit/s is the equivalent secure generation rate, with the min-entropy reduction changing the rate from 14.10 to 13.949 bits per sample.The entropy bound is independent of the number of protocol rounds, and a Toeplitz extractor is calibrated using it.Source: §IV · p. 5
V. CONCLUSIONS
The work demonstrates a heterodyne-based continuous-variable source-device-independent QRNG whose security does not require assumptions about the quantum-state source. Its constant conditional min-entropy bound supports a reported 17.42 Gbit/s rate using off-the-shelf components.
V. CONCLUSIONS
- The demonstrated CV-SDI heterodyne QRNG requires no assumption on the quantum-state source and directly lower-bounds conditional min-entropy using the heterodyne POVM.The source may be imperfect or maliciously controlled.Source: §V · p. 5
- The conditional min-entropy bound is constant because it depends only on trusted measurement resolution, so no generated numbers are consumed to estimate or update it.The authors report 17.42 Gbit/s using off-the-shelf components.Source: §V · p. 5
Appendix A: Calibration
Calibration links detector voltages to phase-space quantities needed to evaluate security. The detector variance responds linearly to local-oscillator power across the tested range, and the fitted slopes provide the conversion.
Appendix A: Calibration
- Calibration before each run links detector voltage to phase-space quantities and enables calculation of δq and δp for security evaluation.The setup schematic identifies the laser, attenuator, polarization controller, beam splitter, hybrid, detectors, oscilloscope, and processing computer.Source: Appendix A · p. 5, Figure 5 · p. 6
- The signal-quadrature variance depends linearly on local-oscillator power over the tested range, with no detector-amplifier saturation.The fitted slopes are (2.783 ± 0.005) · 10^-2 V^2/W and (2.748 ± 0.004) · 10^-2 V^2/W for detectors one and two, respectively.Source: Appendix A · pp. 5–6, Figure 4 · p. 5
- The fitted slopes convert measured voltages into phase-space quantities, while the nonzero intercepts are attributed to electronic excess noise treated as side information available to Eve.The intercepts are (1.526 ± 0.005) · 10^-5 V^2 and (1.419 ± 0.004) · 10^-5 V^2 for the two detectors.Source: Appendix A · p. 6
Appendix B: Filtering, noise and autocorrelation
Digital filtering retains a frequency band with a substantial signal-to-noise gap while reducing detector classical noise, but filtering introduces time-domain correlations. Downsampling and randomness extraction address these correlations and the observed equipment-noise spikes.
Appendix B: Filtering, noise and autocorrelation
- A digitally selected 1.25 GHz band centered at 875 MHz avoids the technical-noise-affected DC–1 MHz region and maintains a signal-to-noise gap of at least 9.6 dB.The retained band is highlighted in the detector spectrum.Source: Appendix B · p. 6, Figure 6 · p. 6
- Brick-wall frequency filtering induces sinc-shaped time-domain autocorrelation, which is addressed by downsampling to match the autocorrelation’s first zero.The filtering reduces classical detector noise at the expense of generation rate.Source: Appendix B · p. 6
- After randomness extraction, the autocorrelation is flat and the initial-lag spikes caused by sampling-equipment noise are absent.The figure reports measurements for 5 · 10^7 filtered and extracted numbers.Source: Figure 7 · p. 6, Appendix B · p. 7
Appendix C: Statistical Tests
The extracted numbers passed the reported NIST and Dieharder tests, which the authors used to check their implementation. They caution that passing statistical tests does not certify randomness.
Appendix C: Statistical Tests
- All reported NIST and Dieharder tests passed on the extracted random numbers.Table I reports the test names, p-values, and results.Source: Appendix C · p. 7, Table I · p. 7
- Approximately 5.18 · 10^10 numbers were extracted from 7.5 · 10^10 raw numbers using a two-universal hash function.The extractor was calibrated with the value of Hmin(X|E)min from equation (10).Source: Appendix C · p. 7
- Passing the tests does not certify randomness; it only indicates that some patterns were absent from the analyzed data.The authors describe the tests as a double-check that their setup was working as expected.Source: Appendix C · p. 7