Realization of a source-device-independent quantum random number generator secured by nonlocal dispersion cancellation

Ji-Ning Zhang; Ran Yang; Xinhui Li; Chang-Wei Sun; Yi-Chen Liu; Ying Wei; Jia-Chen Duan; Zhenda Xie; Yan-Xiao Gong; Shi-Ning Zhu

doi:10.1117/1.AP.5.3.036003

Abstract

Quantum random number generators (QRNGs) can provide genuine randomness by exploiting the intrinsic probabilistic nature of quantum mechanics, which play important roles in many applications. However, the true randomness acquisition could be subjected to attacks from untrusted devices involved or their deviations from the theoretical modeling in real-life implementation. We propose and experimentally demonstrate a source-device-independent QRNG, which enables one to access true random bits with an untrusted source device. The random bits are generated by measuring the arrival time of either photon of the time–energy entangled photon pairs produced from spontaneous parametric downconversion, where the entanglement is testified through the observation of nonlocal dispersion cancellation. In experiment, we extract a generation rate of 4 Mbps by a modified entropic uncertainty relation, which can be improved to gigabits per second by using advanced single-photon detectors. Our approach provides a promising candidate for QRNGs with no characterization or error-prone source devices in practice.

Keywords

nonlocal dispersion cancellation quantum randomness source device independence time–energy entanglement

1 Introduction

Random numbers are important resources in scientific and practical applications. Classical random number generators deny the existence of unpredictability, which cannot provide secure randomness. In contrast, quantum random number generators (QRNGs) can generate genuine randomness from the inherent indeterminacy of quantum mechanics,1^,2 which have been applied in various quantum information processing tasks.3^–5

In the last decades, the generation of quantum random numbers has been extensively studied. Various high-speed and real-time QRNGs have been developed6^–9 and started to become commercial.10^,11 However, these QRNGs can only extract true randomness based on the strong assumption that the source and measurement devices are trusted. The device-independent QRNG (DI QRNG)4^,12^,13 is able to access true randomness without any assumptions on the source and measurement devices, but it requires a loophole-free Bell test, resulting in great challenges in implementation and low efficiency. An alternative technique is semi-DI QRNG, where high speed and low-cost information-provable randomness can be generated based on a few justifiable assumptions on the system operation and its critical components, such as trusted sources,14^–17 the characterized measurement settings,18^–24 assumptions on the indistinguishability, or dimension of the input states.25^–28

For practical semi-DI QRNGs, security, generation rate, and practicality are highly desirable in applications. Particularly, any deviation of the realistic source from its theoretical modeling may affect the security and generation rate of true randomness. Source-DI QRNGs generating true randomness from an untrusted source provided convenient and characterized measurement devices, offer distinct advantages in semi-DI QRNGs, and have been extensively studied.

Sign up for Advanced Photonics TOC. Get the latest issue of Advanced Photonics delivered right to you！Sign up now

One kind of approach is based on measurement of the vacuum noise via homodyne detection.23^,29^–31 Benefiting from the fast detection speed, such a technique has achieved a random number generation rate as high as gigabits per second (Gbps); however, the homodyne detection requires a well modeled and calibrated local oscillator. In contrast, the single-photon detection technique, despite the drawback on detection speed, has the merit of easy operation and simple structure. With such a technique, source-DI QRNGs have also been reported18^,20 based on an assumption of the squashing model32 in the detection devices. In this paper, we propose and experimentally demonstrate a secure and fast source-DI QRNG based on single-photon detection and entangled photons. The random bits are generated via the measurement of photon arrival time that is beneficial for producing high-dimensional QRNGs.33^,34 In our scheme, we use either photon of time–energy entangled photon pairs produced from spontaneous parametric downconversion (SPDC) as the entropy source. The security of our scheme relies on the observation of nonlocal dispersion cancellation (NDC),35 which has been applied to guarantee the security of quantum key distribution tasks.36^–38 Moreover, we employ a modified entropic uncertainty relation (EUR)39 to quantify the randomness to improve security. The experiment results show that the genuine quantum randomness can be extracted at a rate of 4 Mbps (megabits per second), which could reach the level of Gbps if using the advanced single-photon detectors with faster detection speed and lower temporal resolution.

2 Source-DI QRNG Protocol

In our protocol, we suppose an untrusted source produces a tripartite state $ρ_{A B E}$ with the reduced state $ρ_{A B} = {Tr}_{E} [ρ_{A B E}]$ , where $A$ and $B$ are distributed to two noncommunicating observers named Alice and Bob, respectively, and $E$ is held by the underlying eavesdropper Eve as a quantum memory or considered as the environment. In the ideal case, $ρ_{A B}$ is a pure time–energy entangled photon pair state generated via SPDC. Here we suppose that the SPDC source is pumped by a pulsed laser with a center frequency of $ω_{p}$ and a coherence time of $σ_{coh}$ and that the generated photon pairs have a correlation time of $σ_{cor}$ determined by phase-matching bandwidth. The ideal state can be written in the time and frequency domains, respectively, as follows: $Ψ_{A B}^{t} = \iint ψ (t_{A}, t_{B}) e^{i ω_{p} (t_{A} + t_{B}) / 2} {| t_{A} ⟩}_{A} {| t_{B} ⟩}_{B} d t_{A} d t_{B},$ (1) $Ψ_{A B}^{ω} = \iint ϕ (ω_{A}, ω_{B}) {| ω_{A} ⟩}_{A} {| ω_{B} ⟩}_{B} d ω_{A} d ω_{B},$ (2)where the joint time function $ψ (t_{A}, t_{B})$ and joint frequency function $ϕ (ω_{A}, ω_{B})$ are given by $ψ (t_{A}, t_{B}) = \frac{1}{\sqrt{2 π σ_{coh} σ_{cor}}} e^{- {(t_{A} - t_{B})}^{2} / 4 σ_{cor}^{2} - {(t_{A} + t_{B})}^{2} / 16 σ_{coh}^{2}},$ (3) $ϕ (ω_{A}, ω_{B}) = \frac{1}{\sqrt{π / 2 σ_{coh} σ_{cor}}} e^{- {(ω_{A} - ω_{B})}^{2} σ_{cor}^{2} / 4 - {(ω_{A} + ω_{B})}^{2} σ_{coh}^{2}},$ (4)where ${| t_{A} ⟩}_{A} ({| t_{B} ⟩}_{B})$ and ${| ω_{A} ⟩}_{A} ({| ω_{B} ⟩}_{B})$ represent photons $A (B)$ at time $t_{A} (t_{B})$ and frequency $ω_{A} (ω_{B})$ .

Alice and Bob both have two trusted positive operator-valued measures (POVMs), denoted by $T_{δ}^{j} = {T_{k}^{j}}$ and $D_{δ}^{j} = {D_{k}^{j}}$ with $j \in {A, B}$ and $k \in N$ . The measurement $T_{δ}^{j}$ is the direct photon arrival time detection, expressed as $T_{k}^{j} = \int_{k δ}^{(k + 1) δ} {| X_{t} ⟩}^{j} {⟨ X_{t} |}^{j} d t,$ (5)where $| X_{t} ⟩^{j} = \int_{- \infty}^{\infty} \frac{d ω}{\sqrt{2 π}} e^{i ω t} | ω ⟩^{j}$ and $δ$ is the detection precision of the system. The other measurement, $D_{δ}^{j}$ , is the arrival time detection after the photons in Alice and Bob, respectively, undergo normal and anomalous dispersion with equal magnitudes, which can be written as $D_{k}^{j} = \int_{k δ}^{(k + 1) δ} {| Y_{t} ⟩}^{j} {⟨ Y_{t} |}^{j} d t,$ (6)where $| Y_{t} ⟩^{j} = \int_{- \infty}^{\infty} \frac{d ω}{\sqrt{2 π}} e^{i (ω t + β_{j} ω^{2} / 2)} | ω ⟩^{j}$ and $β_{A (B)}$ is the group-velocity dispersion (GVD) coefficient in Alice (Bob) satisfying $β_{A} = - β_{B}$ .

However, in practice, we perform measurements $T_{δ}^{j}$ and $D_{δ}^{j}$ in a range from $- N_{d} δ / 2$ to $N_{d} δ / 2$ , where $N_{d}$ is the frame size (dimensionality); thus the null measurements $T_{j}^{Ø}$ and $D_{j}^{Ø}$ can be defined when the photon arrives before or after the range, which limits the characterization of entanglement in high-dimensional quantum systems.39 The null measurements can be expressed by $T_{j}^{Ø} = \int_{- \infty}^{- N_{d} δ / 2} {| X_{t} ⟩}^{j} {⟨ X_{t} |}^{j} d t + \int_{N_{d} δ / 2}^{\infty} {| X_{t} ⟩}^{j} {⟨ X_{t} |}^{j} d t,$ (7) $D_{j}^{Ø} = \int_{- \infty}^{- N_{d} δ / 2} {| Y_{t} ⟩}^{j} {⟨ Y_{t} |}^{j} d t + \int_{N_{d} δ / 2}^{\infty} {| Y_{t} ⟩}^{j} {⟨ Y_{t} |}^{j} d t .$ (8)

Then the refined POVMs can be written as $T_{δ}^{j} = {T_{k}^{j}}_{k = - N_{d} / 2}^{N_{d} / 2} ⋃ T_{j}^{Ø}$ and $D_{δ}^{j} = {D_{k}^{j}}_{k = - N_{d} / 2}^{N_{d} / 2} ⋃ D_{j}^{Ø}$ .

Alice and Bob choose two measurements, $T_{δ}$ and $D_{δ}$ , separately, which are switched through a classical random signal $S$ with probabilities $q$ and $1 - q$ , respectively. Before extracting random numbers, Alice and Bob record the joint outcomes of the measurements $T_{δ}$ to estimate the detection precision $δ$ of the system. Then the outcomes of measurement $T_{δ}$ in Alice are recorded as the raw random bits, whereas the joint outcomes of the measurements $D_{δ}$ for Alice and Bob are utilized to certify the entanglement of source and estimate the amount of randomness.

In the process of certification for the source, the NDC35 is available as a nonlocal test of the time–energy entanglement, where the dispersion effect can be nonlocally canceled when two time–energy entangled photons propagate in two media with equal magnitudes and opposite dispersion signs, respectively. We define the code distance associated with the outcomes of measurement $D_{δ}$ as a testing value $d$ given by38 $d = \sqrt{\frac{2}{π}} \frac{σ_{coh, D}}{δ},$ (9)where $σ_{coh, D}$ is the correlation time of the photon pairs when Alice and Bob both perform measurement $D_{δ}$ , and $σ_{coh, D} = \sqrt{σ_{cor}^{2} + β^{2} / 4 σ_{coh}^{2}}$ for the ideal state. The source can be certified to be time–energy entangled if $d$ is less than the classical bound determined by the actual experimental parameters (see Appendix A for details). A preset value $d_{0}$ is selected here that is not larger than the classical bound, and the protocol is aborted when $d > d_{0}$ .

Since the source device is untrusted, the input state might be controlled by an eavesdropper, Eve, who can obtain the side information through system $E$ . The amount of genuine randomness that can be extracted from Alice in measurement $T_{δ}$ is quantified by the conditional quantum min-entropy40 defined as $H_{\min} (T_{δ}^{A} | E) = - \log_{2} P_{guess} (T_{δ}^{A} | E)$ , where $P_{guess} (T_{δ}^{A} | E)$ is the maximum probability that Eve guesses correctly the outcome of $T_{δ}$ conditional on her side information. In previous works, the lower bound of conditional quantum min-entropy $H_{\min} (T_{δ}^{A} | E)$ can be given by exploiting the EUR.41^,42

In practical implementations, the finite measurement range problem will significantly compromise the evaluation of secure min-entropy. To further improve security, we explore the extractable randomness lower bound with the modified EUR39 based on smooth entropy by taking into account the finite measurement range. The $ϵ$ -smooth conditional min- and max-entropies are defined as $H_{\min}^{ϵ} {(A | B)}_{ρ} = \max_{ρ^{'} \in B^{ϵ} (ρ)} H_{\min} {(A | B)}_{ρ^{'}},$ (10) $H_{\max}^{ϵ} (A | B)_{ρ} = \max_{ρ^{'} \in B^{ϵ} (ρ)} H_{\max} (A | B)_{ρ^{'}},$ (11)where $B^{ϵ} (ρ) = {ρ^{'} | \frac{1}{2} {‖ ρ - ρ^{'} ‖}_{tr} \leq ϵ}$ is the set of operators within an $ϵ$ distance of $ρ$ . Then the modified EUR is written as39 $H_{\min}^{ϵ} {(T_{δ}^{A} | E)}_{ρ} \geq H_{low}^{ϵ} {(T_{δ}^{A} | E)}_{ρ} = - 2 \log_{2} (\sqrt{f_{+} (p_{T_{δ}^{A}}^{Ø} (ρ), ϵ)} + \sqrt{f_{+} (p_{D_{δ}^{A}}^{Ø} (ρ), ϵ)} + \sqrt{1 - f_{-} (p_{D_{δ}^{A}}^{Ø} (ρ), ϵ)} \sqrt{c^{<} (T_{δ}^{A}, D_{δ}^{A})} ({\sqrt{2}}^{H_{\max}^{ϵ} {(D_{δ}^{A <} | B)}_{ρ}})),$ (12)where $f_{\pm} (p_{i}^{Ø} (ρ), ϵ) = 2 ϵ - ϵ^{2} + 2 p_{i}^{Ø} (ρ) ϵ^{2} - 4 p_{i}^{Ø} (ρ) ϵ \pm 2 (1 - ϵ) \sqrt{p_{i}^{Ø} (ρ) ϵ [1 - p_{i}^{Ø} (ρ)] (2 - ϵ)} + p_{i}^{Ø} (ρ),$ (13)and $p_{T_{δ}^{A}}^{Ø} (ρ) = Tr [ρ_{A} T_{A}^{Ø}]$ , $p_{D_{δ}^{A}}^{Ø} (ρ) = Tr [ρ_{A} D_{A}^{Ø}]$ are the null probabilities for measurement $T_{A}^{Ø}$ and $D_{A}^{Ø}$ , respectively, which can be written as $p_{T_{δ}^{A}}^{Ø} (ρ) = 1 - \frac{1}{\sqrt{2 π} σ_{coh}} \int_{- N_{d} δ / 2}^{N_{d} δ / 2} e^{- \frac{t_{A}^{2}}{2 σ_{coh}^{2}}} d t_{A},$ (14) $p_{D_{δ}^{A}}^{Ø} (ρ) = 1 - \frac{1}{\sqrt{2 π} σ_{co h^{'}}} \int_{- N_{d} δ / 2}^{N_{d} δ / 2} e^{- \frac{t_{A}^{2}}{2 σ_{co h^{'}}^{2}}} d t_{A},$ (15)where $σ_{co h^{'}}$ is the standard deviation of arrival-time distribution photon $A$ after propagating through the dispersive medium.

Additionally, $c^{<} (T_{δ}^{A}, D_{δ}^{A})$ in Eq. (12) is the maximum overlap for the POVMs $T_{δ}^{A}$ and $D_{δ}^{A}$ , excluding the null measurement POVM elements, satisfying39 $c^{<} (T_{δ}^{A}, D_{δ}^{A}) = \max_{T_{δ}^{A}, D_{δ}^{A} \neq Ø} {‖ \sqrt{T_{δ}^{A}} \sqrt{D_{δ}^{A}} ‖}_{\infty}^{2},$ (16)where ${‖ \cdot ‖}_{\infty}$ denotes the maximum singular value. $c^{<} (T_{δ}^{A}, D_{δ}^{A})$ can be the upper bound by the $c (T_{δ}^{A}, D_{δ}^{A}) = \max_{T_{δ}^{A}, D_{δ}^{A}} {‖ \sqrt{T_{δ}^{A}} \sqrt{D_{δ}^{A}} ‖}^{2}$ because the sets of POVMs over which the former is maximized are subsets of the sets over which the latter is maximized. Thus we obtain $c^{<} (T_{δ}^{A}, D_{δ}^{A}) \leq c (T_{δ}^{A}, D_{δ}^{A}) = \frac{δ^{2}}{4 π^{2} β},$ (17)where $β = | β_{A} |$ (see Appendix B for details). The smooth conditional max-entropy $H_{\max}^{ϵ} (D_{δ}^{A <} | B)_{ρ}$ in Eq. (12) represents Bob’s lack of knowledge about the measurement results of $D_{δ}^{A}$ after Alice discards the null measurements, which can be bounded by43 $H_{\max}^{ϵ} (D_{δ}^{A <} | B)_{ρ} \leq \log_{2} γ (d_{0} + Δ),$ (18)where function $γ (\cdot)$ is formulated as $γ (x) = (x + \sqrt{1 + x^{2}}) {(\frac{x}{\sqrt{1 + x^{2}} - 1})}^{x},$ (19)and the statistical fluctuations $Δ$ can be written as $Δ = N_{d} \sqrt{\frac{1}{q (q - 1) N_{T}^{A}} \ln (ϵ / 4 - 2 \sqrt{2 (1 - (1 - p_{T_{δ}^{A}}^{Ø} (ρ))^{N_{T}^{A}})})},$ (20)where $N_{T}^{A}$ is the total number of detections for $T_{δ}^{A}$ in a processing unit.

Finally, we extract the secure random bits from the raw random bits by the Toeplitz-hashing extractor and claim that our QRNG scheme successfully generates a string of genuine random bits if all statistical tests are passed.

3 Experimental Demonstration

The experimental setup comprises an entanglement source and measurement devices, as shown in Fig. 1. The pump light is a pulsed laser with a repetition rate of 10 MHz and a measured coherence time of 2.1 ns, which is extracted from a continuous-wave laser at 774.9 nm through a lithium niobate electro-optic modulator. It is adjusted to horizontal polarization by a polarization controller, then coupled into a 5-cm Ti-diffused periodically poled lithium niobate (Ti:PPLN) waveguide with a poling period of $9.2 μ m$ . The time–energy entangled photon pairs are produced via the type-II SPDC process. After blocking out the pump by a long-pass filter and a 3-nm bandpass filter centered at 1550 nm, the output orthogonally polarized entangled photon pairs are spatially separated by a polarization beam splitter (PBS) and distributed to Alice and Bob, respectively. The wavelength-degenerate photon pairs are centered at 1549.8 nm with 0.7 nm full width at half-maximum (FWHM). The overall detection efficiencies are 20.5% for the photon to Alice and 20% for the photon to Bob, respectively. When the pump power coupled into the waveguide is 1 mW, the single-photon counting rates measured by superconducting nanowire single-photon detectors (SNSPDs) at Alice and Bob are 5 and 4.85 MHz, respectively, with the dark counting rate observed around 500 Hz and thus are ignored. The two-photon coincidence counting rate obtained by the time-to-digital converter (TDC) (PicoHarp-300) is 1 MHz. Thus the proportion of genuine entangled photons in Alice’s detection can be estimated to be 97%.

Figure 1.Experimental setup of the source-DI QRNG. (a) Entanglement source: the time–energy entangled photon pairs are generated from the Ti:PPLN waveguide pumped by a pulsed laser with a duration of 5 ns, which are separated by a PBS. (b) Measurement device: photons are passively selected for measurement $T_{δ}$ or $D_{δ}$ by a 90:10 beam splitter (BS) after being coupled to fiber in Alice and Bob sides. PC, polarization controller; FI, filter; C-BG, chirped Bragg grating; OC, optical circulator; SNSPD, superconducting nanowire single-photon detector; and TDC, time-to-digital converter.

Alice and Bob both randomly perform measurement $T_{δ}$ or $D_{δ}$ by a passive $90 ∶ 10$ beam splitter, i.e., $q = 0.9$ in protocol. Explicitly, the measurement $T_{δ}$ is implemented by directly measuring the arrival time at the SNSPD, while for the measurement $D_{δ}$ , arrival time detection is performed after the photons to Alice (Bob) propagate through a dispersion module composed of an optical circulator and a chirped (antichirped) Bragg grating with a GVD coefficient of $- 1440 {ps}^{2}$ ( $1440 {ps}^{2}$ ). The arrival time is detected by the SNSPDs, then recorded by the TDCs with the total time jitters estimated approximately as $σ_{j} \sim 34 ps$ (1 standard deviation). The outcome rate of measurement $T_{δ}$ in Alice is $n_{T}^{A} = 4.5 MHz$ .

To explore the performance of the source and certify the security of the scheme, we plot the coincidence curves of four combinations for two observers’ measurements, as illustrated in Fig. 2. If Alice and Bob both make measurement $T_{δ}$ , the FWHM of the coincidence peak is $Δ_{T} = 120 ps$ , as shown in Fig. 2(a), and thus the detection precision is calculated to be $δ = Δ_{T} / \sqrt{2} = 84 ps$ based on the assumption that the resolution of all detectors is identical. If the measurements performed by Alice and Bob are different, coincidence peaks are broadened to 750 ps in Fig. 2(b) and 760 ps in Fig. 2(c) due to the dispersion effect. The slight difference between two peaks is caused by the slight difference in magnitude of GVD coefficients in Alice and Bob. If two observers both choose measurement $D_{δ}$ , as shown in Fig. 2(d), the peak recovers with a narrow FWHM of $Δ_{D} = 160 ps$ , as shown in Fig. 2(d), corresponding to $σ_{D} = 68 ps$ [ $σ_{D} = Δ_{D} / (2 \sqrt{2 \ln 2})$ for Gaussian function] due to the NDC effect. In this case, the testing value $d$ is calculated to be 0.64 according to Eq. (9), which is much smaller than the classical bound ${\bar{d}}_{c} = 1.35$ (see Appendix C).

Figure 2.Photon coincidence counts (CCs) recorded for four measurement combinations of two observers (denoted as $A$ and $B$ ) in 10 s.

The preset value $d_{0}$ is set to be 0.64, since it is the upper bound in the vast majority of the measurement runs in our experiment. If $d \leq d_{0}$ from the experimentally observed results, the protocol is passed, implying that we can evaluate and extract true randomness from the raw random bits to generate genuine random numbers.

4 Randomness Evaluation and Extraction

From the above results, we could calculate the randomness from the raw random bits according to Eqs. (12)–(20). The null probabilities $p_{T_{δ}^{A}}^{Ø} (ρ) = 1 - f_{err} (0.0140 N_{d})$ and $p_{D_{δ}^{A}}^{Ø} (ρ) = 1 - f_{err} (0.0138 N_{d})$ can be obtained with $σ_{coh} = 2.1$ and $σ_{co h^{'}} = 2.15 ns$ in our experiment, where $f_{err}$ is the error function.44 The statistical fluctuation $Δ$ defined in Eq. (20) is obtained by setting the smooth entropy parameter $ϵ = 10^{- 10}$ , where the total count $N_{T}^{A}$ is deduced by the count rate $n_{T}^{A}$ and the cumulative time $τ$ as $N_{T}^{A} = n_{T}^{A} τ (1 - p_{T_{δ}^{A}}^{Ø} (ρ))$ .

We plot the smooth min-entropy $H_{low}^{ϵ} (T_{δ}^{A} | E)_{ρ}$ with respect to $N_{T}^{A}$ and $N_{d}$ , as shown in Fig. 3. It can be seen that $H_{low}^{ϵ} (T_{δ}^{A} | E)_{ρ}$ increases with $N_{T}^{A}$ , while for a given $N_{T}^{A}$ , with the increasing $N_{d}$ , $H_{low}^{ϵ} (T_{δ}^{A} | E)_{ρ}$ first keeps growing due to increasing measurement range and then declines for larger statistical fluctuation, where the maximum value can be obtained by optimizing $N_{d}$ . The maximal entropy values are obtained to be 0.778, 0.877, 0.903, and 0.913 for four processing units with frame size $N_{d} = 232$ , 246, 250, and 256, respectively.

Figure 3.Smooth entropy $H_{low}^{ϵ} (T_{δ}^{A} | E)_{ρ}$ with respect to the frame size $N_{d}$ for different processing units $N_{T}^{A}$ . The dotted lines represent the entropy evaluated from the experimental data. The red triangles represent optimal results.

As a trade-off between the entropy bound and practicality, the processing unit is set as $N_{T}^{A} = 4.5 \times 10^{8}$ , corresponding to the highest min-conditional entropy of 0.917 bit per count with $N_{d} = 256$ , $p_{T_{δ}^{A}}^{Ø} (ρ) = 4 \times 10^{- 7}$ , $p_{D_{δ}^{A}}^{Ø} (ρ) = 6 \times 10^{- 7}$ , and $τ = 100 s$ . Considering the proportion of genuine entangled photons of the SPDC is measured to be 97%, we can extract 0.900-bit genuine randomness per $\log_{2} (256)$ -bit sample. Hence, we generate a Toeplitz matrix with a scale of $80, 000 \times 9000$ to extract genuine random numbers. As the outcomes rate is $n_{T}^{A} = 4.5 Mcounts / s$ , the final generation rate of random numbers is 4 Mbps.

To test the quality of random numbers, we perform an autocorrelation coefficient test between the raw and final random data, where the raw data and final random data satisfy the Gaussian distribution and uniform distribution, respectively. As shown in Fig. 4, the final autocorrelation coefficients are below 0.001 within the 200-bit delay, which are significantly lower than the raw data. Furthermore, we perform a standard NIST test suite using 1000 samples of 1 Mb; the significant level is set as $α = 0.01$ . The NIST test is passed if $P$ values are higher than 0.01 and the proportion value within the confidence interval of $(1 - α) \pm 3 \sqrt{(1 - α) α / n} = 0.99 \pm 0.00944$ for all tests. As shown in Fig. 5, the random bits in our scheme pass all 15 tests.

Figure 4.Autocorrelation coefficients of raw random data and final random data.

Figure 5.Results of NIST statistical test suite.

5 Conclusions and Discussions

In conclusion, we have proposed and experimentally demonstrated a scheme for a source-DI QRNG, where the random bits are generated by measuring the arrival time of single photons from an untrusted time–energy entangled photon pair source. The NDC effect is employed to testify the entanglement source and thus guarantee the security of true random number acquisition. With a high-quality PPLN waveguide SPDC source, we realized a fast generation of true random numbers with a generation rate of 4 Mbps, which were extracted by utilizing the modified EUR. In Table 1, we list several semi-DI QRNGs as a comparison. It shows that our work achieves a trade-off among security, speed, and practicality.


Refs.	Uncharacterized Source	Uncharacterized Measurement	Finite-size Analysis	Finite Measurement Ranges Considered^a	Generation Rate
15	×	√	×	—	5.7 kbps
17	×	√	√	×	47.8 Mbps
20	√	×	√	—	1 Mbps
21	√	×	√	×	8.05 Gbps
24	√	×^b	√	—	1 Mbps
25	√^c	√	√	—	23 bps
27	√^d	√	√	—	1.25 Mbps
31	√	×	√	×	17 Gbps
This work	√	×	√	√	4 Mbps

Table 1. Features of our protocol as compared to the features of existing semi-DI QRNG protocols.

View all Tables

The generation rate of our protocol can be further increased to Gbps provided we use state-of-the-art single-photon detectors. For instance, the single-photon detector45 with a temporal resolution of 29 ps could theoretically achieve optimal $H_{low}^{ϵ} (T_{δ}^{A} | E)_{ρ} = 2.66$ ; combining with its maximum count rate of 2 GHz, the random number generation rate can reach 5.16 Gbps. Moreover, the source-DI QRNG we realized is based on the PPLN waveguide SPDC source, which may be further developed to be an integrated chip-scale device by exploring on-chip photon generation, manipulation, and detection techniques. We hope our approach can stimulate more such investigations.

Furthermore, our scheme provides a secure certification for quantum information and quantum communication tasks with an untrusted source based on dispersion cancellation. Recently, the work on the QKD protocol where the source is trusted but imperfect was proposed.36 Our approach offers a way to certify the untrusted source via dispersion cancellation for this protocol, which enables us to access the source-DI QKD tasks.

6 Appendix A: The Definition of Testing Value

In this section, we provide the proof that the testing value $d$ defined in Eq. (9) as the code distance for systems $A$ and $B$ in $D_{δ}$ basis can be used to certify the time–energy entanglement for the ideal state in Eq. (1).

Let us consider the case that systems $A$ and $B$ are two separable photons or classical pulses. The spectrum and temporal functions of the photon $A$ can be written as, respectively, $ϕ_{A}^{c} (ω) \propto e^{- \frac{ω^{2}}{4 σ_{ν}^{2}}},$ (21) $ψ_{A}^{c} (t) \propto e^{- \frac{t^{2}}{4 σ_{t}^{2}}},$ (22)where $σ_{ν}$ is the spectrum bandwidth (1 standard deviation) of the photon, and $σ_{t}$ is the temporal bandwidth. Meanwhile, $ϕ_{B}^{c} (ω)$ and $ψ_{B}^{c} (t)$ for photon $B$ are defined similarly with photon $A$ . After two photons propagate through the dispersive medium, the intensity detected at Alice and Bob can be written as $I_{A} (t_{A}) = {| \int \frac{d ω_{A}}{\sqrt{2 π}} ϕ_{A}^{c} (ω_{A}) e^{i (ω_{A} t_{A} + β ω_{A}^{2} / 2)} |}^{2}, I_{B} (t_{B}) = {| \int \frac{d ω_{B}}{\sqrt{2 π}} ϕ_{B}^{c} (ω_{B}) e^{i (ω_{B} t_{B} + β ω_{B}^{2} / 2)} |}^{2} .$ (23)

The joint detection probability that Alice’s detector clicks at time $t_{A}$ and Bob’s clicks at time $t_{B}$ simultaneously is $P (t_{A}, t_{B}) = I_{A} (t_{A}) I_{B} (t_{B})$ , and the overall probability $P (Γ)$ of detecting two photons at a time lag $Γ = t_{A} - t_{B}$ can be calculated as $P (Γ) = \int I_{A} (t_{A}) I_{B} (t_{B}) d t_{A} \propto e^{- \frac{Γ^{2}}{2 σ_{cor, c}^{2}}},$ (24)where the correlation time thus given by $σ_{cor, c}^{2} = σ_{cor}^{2} + 2 β^{2} σ_{ν}^{2},$ (25)and $σ_{cor} = \sqrt{2} σ_{t}$ is the origin correlation time.

It has been proved that the origin correlation time $σ_{cor}$ and standard deviation in the spectrum intensity of the sum of frequency $Δ (ω_{A} + ω_{B})$ for two separable photons satisfy the following inequality:46^,47 $σ_{cor} Δ (ω_{A} + ω_{B}) \geq 1,$ (26)where $Δ (ω_{A} + ω_{B})$ can be calculated to be $\sqrt{2} σ_{ν}$ . Hence, substituting this inequality into Eq. (25), we can obtain $σ_{cor, c}^{2} \geq σ_{cor}^{2} + \frac{β^{2}}{σ_{cor}^{2}},$ (27)which defines the minimum broadening of temporal correlations between two separable photons after they propagate through two dispersive media with equal and opposite dispersion. By normalizing the correlation time $σ_{cor, c}$ into the detection precision $δ$ , the testing value $d$ for a pair of separable photons can be written as $d \geq \sqrt{\frac{2 σ_{cor}^{2}}{π δ^{2}} + \frac{2 β^{2}}{π δ^{2} σ_{cor}^{2}}} .$ (28)

A violation of this inequality implies the presence of entanglement, which is able to be used as a witness for the certification of time–energy entanglement. We denote the right-hand side of Eq. (28) as the classical bound $d_{c}$ .

Let us now consider the case that the source device distributes the entangled photon pairs with the state given by Eq. (1) to Alice and Bob, and they both choose measurement $D_{δ}$ , i.e., the arrival time after two photons traveled through the dispersive elements. The joint detection rate between two detectors is proportional to the Glauber second-order correlation function, $G^{(2)} (t_{A}; t_{B}) = {| ⟨ Y_{t}^{A} (t_{A}) Y_{t}^{B} (t_{B}) | Ψ_{A B}^{ω} ⟩ |}^{2} = {| ψ_{D} (t_{A}, t_{B}) |}^{2},$ (29)where the joint time function becomes $ψ_{D} (t_{A}, t_{B}) = \frac{1}{2 π} \iint ϕ_{A B} (ω_{A}, ω_{B}) e^{i \frac{β}{2} (ω_{A}^{2} - ω_{B}^{2}) - i (ω_{A} t_{A} + ω_{B} t_{B})} d ω_{A} d ω_{B} .$ (30)

Then the correlation time of outcomes in measurement $D_{δ}$ can be calculated as $σ_{cor, D}^{2} = \iint {(t_{A} - t_{B})}^{2} {| ψ_{D} (t_{A}, t_{B}) |}^{2} d t_{A} d t_{B} = \iint {(t_{A} - t_{B})}^{2} {| ψ_{A B} (t_{A}, t_{B}) |}^{2} d t_{A} d t_{B} + β^{2} \iint {(ω_{A} + ω_{B})}^{2} {| ϕ_{A B} (ω_{A}, ω_{B}) |}^{2} d ω_{A} d ω_{B} = σ_{cor}^{2} + β^{2} σ_{ω}^{2},$ (31)and $σ_{ω} = 1 / (2 σ_{coh})$ is the pump spectrum bandwidth. Thus the theoretical $d$ for the ideal state given by Eq. (1) is achieved by $d = \sqrt{\frac{2 σ_{cor}^{2}}{π δ^{2}} + \frac{β^{2}}{2 π σ_{coh}^{2} δ^{2}}} .$ (32)

In the limit of large coherence time $σ_{coh}$ , the testing value $d$ reduces to $d = \sqrt{\frac{2 σ_{cor}^{2}}{π δ^{2}}},$ (33)which is obviously smaller than the classical bound $d_{c}$ .

7 Appendix B: The Maximum Overlap of $T_{δ}^{A}$ and $D_{δ}^{A}$

We recall the measurements $T_{δ}^{A} = {T_{k}^{A}}$ and $D_{δ}^{A} = {D_{k}^{A}}$ , which can be expressed as $T_{k}^{A} = \int_{k δ}^{(k + 1) δ} {| X_{t} ⟩}^{A} {⟨ X_{t} |}^{A} d t, D_{k}^{A} = \int_{k δ}^{(k + 1) δ} {| Y_{t} ⟩}^{A} {⟨ Y_{t} |}^{A} d t,$ (34)where $| X_{t} ⟩^{A} = a^{†} (t) | 0 ⟩$ satisfies the orthonormality condition $⟨ X_{t_{1}} | X_{t_{2}} ⟩ = δ (t_{1} - t_{2})$ . Note that the measurements $D_{δ}^{A}$ and $T_{δ}^{A}$ can be transformed by the dispersion operator $U$ 36 as $D_{δ}^{A} = U T_{δ}^{A} U^{†},$ (35)where $U = \frac{1}{\sqrt{2 π β}} \int_{- \infty}^{+ \infty} d t_{1} \int_{- \infty}^{+ \infty} d t_{2} e^{- i (t_{1} - t_{2})^{2} / 2 β} {| X_{t_{1}} ⟩}^{A} {⟨ X_{t_{2}} |}^{A} .$ (36)

The associated observables of $T_{δ}^{A}$ and $D_{δ}^{A}$ can be, respectively, written as $O_{T}^{A} = \int_{- \infty}^{+ \infty} d t t {| X_{t} ⟩}^{A} {⟨ X_{t} |}^{A}, O_{D}^{A} = \frac{1}{2 π β} \int_{- \infty}^{+ \infty} d t \int_{- \infty}^{+ \infty} d t_{1} \int_{- \infty}^{+ \infty} d t_{2} t e^{- i (t_{1}^{2} - t_{2}^{2}) / 2 β + i (t_{1} - t_{2}) t / β} {| X_{t_{1}} ⟩}^{A} ⟨ X_{t_{2}} |^{A} .$ (37)

Based on the derivation in Ref. 38, the observable $O_{D}^{A}$ can be further simplified as $O_{D}^{A} = \int_{- \infty}^{+ \infty} d t t | X_{t} ⟩^{A} ⟨ X_{t} |^{A} + \frac{β}{i} \int_{- \infty}^{+ \infty} d t {| X_{t} ⟩}^{A} \frac{\partial}{\partial t} {⟨ X_{t} |}^{A}, = O_{T}^{A} + 2 π β O_{ω}^{A},$ (38)where $O_{ω}^{A} = \int_{- \infty}^{+ \infty} \frac{d ω}{2 π} ω | ω ⟩^{A} {⟨ ω |}^{A}$ is the observable of frequency. According to the commutation relation $[O_{T}^{A}, O_{ω}^{A}] = i$ ,48 we can derive the commutation relation of $O_{T}^{A}$ and $O_{D}^{A}$ as follows: $[O_{T}^{A}, O_{D}^{A}] = i 2 π β .$ (39)

Using the overlap result for maximally incompatible observables,38^,49 we can obtain $c (T_{δ}^{A}, D_{δ}^{A}) = \frac{δ^{2}}{4 π^{2} β} .$ (40)

8 Appendix C: The Classical Bound of Experimental Testing Value

In our source-DI QRNG framework, the security of the scheme relies on the observation of $d$ in experiment. To certify the entanglement, we need to calculate the classical bound of testing value in our experiment.

Taking into account the time jitter of our detection systems in practice, the correlation time in Eq. (27) can be rewritten in a modified form, ${\bar{σ}}_{cor, c}^{2} \geq 2 σ_{j}^{2} + σ_{cor}^{2} + \frac{β^{2}}{σ_{cor}^{2}} .$ (41)

Recall that we measured the coincidence distribution and obtained $σ_{0} = Δ_{T} / (2 \sqrt{2 \ln 2})$ with $β = 0$ in Fig. 2(a), i.e., $σ_{0}^{2} = 2 σ_{j}^{2} + σ_{cor}^{2}$ . Then combining the GVD coefficient $β$ in our system, we can calculate the modified correlation time ${\overline{σ}}_{cor, c} \geq 100$ ps and the corresponding classical bound ${\bar{d}}_{c} = 1.35$ .

Ji-Ning Zhang is now a PhD student at the School of Physics of Nanjing University. Her current research interests include quantum optics and quantum information.

Ran Yang is now a PhD student at the School of Physics of Nanjing University. His current research interests include quantum optics and quantum tomography.

Xinhui Li obtained her PhD in cryptography from Beijing University of Posts and Telecommunications in 2020. She was awarded a scholarship from the State Scholarship Fund which was selected through a rigid academic evaluation process organized by the China Scholarship Council to pursue her studies at the National University of Singapore from August 2017 to August 2018. She is now a postdoctoral fellow at the School of Physics of Nanjing University. She is currently working on the security of quantum information processing and the foundations of quantum correlations.

Chang-Wei Sun obtained his PhD from the School of Physics at Nanjing University in 2021. He works on nonlinear optics and quantum optics.

Yi-Chen Liu received his PhD from the School of Physics at Nanjing University in 2021. In 2021, he joined as a senior researcher at Qingdao University of Technology. His current research interests include nonlinear optics and quantum optics.

Ying Wei is now a PhD student at the School of Physics of Nanjing University. His current research interests include quantum simulation and quantum tomography.

Jia-Chen Duan is now a PhD student at the School of Physics of Nanjing University. His current research interests include nonlinear optics and integrated optical quantum technologies.

Zhenda Xie obtained his PhD from Nanjing University in 2011. From 2011 to 2016, he joined as a postdoctoral fellow at Columbia University in the City of New York and a research fellow at University of California, Los Angeles, respectively. He is now a professor at the School of Electronic Science and Engineering of Nanjing University. He is currently working on solid-state laser technology, nonlinear optics, and quantum optics.

Yan-Xiao Gong obtained his PhD in optics from the University of Science and Technology of China in 2009. In 2009, he joined as a postdoctoral fellow at Nanjing University. From 2011 to 2017, he worked in the Department of Physics of the Southeast University. He is now a professor at the School of Physics of Nanjing University. He is currently working on nonlinear optics, quantum optics and integrated optical quantum technologies, and quantum information.

Shi-Ning Zhu obtained his PhD from Nanjing University in 1996 and is the group leader of Dielectric Superlattice Laboratory at Nanjing University. His research interests include condensed matter optics, quasiphase matching physics and nonlinear optics, optoelectronic functional materials, quantum optics, and metamaterials.

References

[1] X. Ma et al. Quantum random number generation. NPJ Quantum Inf., 2, 16021(2016).

[2] M. Herrero-Collantes, J. C. Garcia-Escartin. Quantum random number generators. Rev. Mod. Phys., 89, 015004(2017).

[3] B. G. Christensen et al. Detection-loophole-free test of quantum nonlocality, and applications. Phys. Rev. Lett., 111, 130406(2013).

[4] Y. Liu et al. Device-independent quantum random-number generation. Nature, 562, 548-551(2018).

[5] T. Paraïso et al. A photonic integrated quantum secure communication system. Nat. Photonics, 15, 850-856(2021).

[6] F. Xu et al. Ultrafast quantum random number generation based on quantum phase fluctuations. Opt. Express, 20, 12366-12377(2012).

[7] B. Bai et al. 18.8 Gbps real-time quantum random number generator with a photonic integrated chip. Appl. Phys. Lett., 118, 264001(2021).

[8] Y. Guo et al. 40 Gb/s quantum random number generation based on optically sampled amplified spontaneous emission. APL Photonics, 6, 066105(2021).

[9] T. Gehring et al. Homodyne-based quantum random number generator at 2.9 Gbps secure against quantum side-information. Nat. Commun., 12, 605(2021).

[10] Quantum random number generator-picoquant(2023).

[11] Quantum random number source QuantumCTek-quantum secures every bit(2023).