Simple source device-independent continuous-variable quantum random number generator

Phase-randomized optical homodyne detection is a well-known technique for performing quantum state tomography. So far, it has been mainly considered a sophisticated tool for laboratory experiments but unsuitable for practical applications. In this work, we change the perspective and employ this technique to set up a practical continuous-variable quantum random number generator. We exploit a phase-randomized local oscillator realized with a gain-switched laser to bound the min-entropy and extract true randomness from a completely uncharacterized input, potentially controlled by a malicious adversary. Our proof-of-principle implementation achieves an equivalent rate of 270 Mbit/s. In contrast to other source-device-independent quantum random number generators, the one presented herein does not require additional active optical components, thus representing a viable solution for future compact, modulator-free, certified generators of randomness.

Figure 1

(a) Schematics of a typical CV-QRNG. The input state ${\rho }_A$ is assumed to be prepared by Alice, so it is trusted and lies within the security perimeter (red dashed line). The LO has a fixed phase, letting Alice measure one specific quadrature of the input field. (b) Schematics of SDI CV-QRNG. The input state is untrusted and can even be prepared by Eve, so it lies outside the security perimeter (green dashed line). The LO is phase randomized by using a gain-switched laser, which allows Alice to measure random quadratures of the input field. (c) Example of attack to (d) a typical CV-QRNG and (e) an SDI CV-QRNG, if Eve controls the input state. In (d), the LO has a fixed phase. Eve forges ${\rho }_A$ using $Q$-displaced squeezed states and guesses the raw numbers with high probability. However, Alice thinks she is measuring the vacuum state because the decomposition chosen by Eve mimics the $Q$ distribution of the vacuum. This compromises the security of the system. In (e), Alice does not trust the input state as she is in the SDI setting. She uses a phase-randomized LO so that Eve's guessing probability depends on the random angle of the quadrature selected by the LO. Alice can then spot the attack because the measurement distribution is wider than the one she expected from the vacuum input state.

Figure 2

Schematics of the setup. The LO is pulsed at 50 MHz via gain switching. PG: pattern generator; LO: local oscillator; VOA: variable optical attenuator; PM: power meter; SP: signal port; DL: delay line; BHD: balanced homodyne detector; Osc: oscilloscope.

Figure 3

(a) Example of the ringing observed in the output of the BHD when the LO is pulsed at 50 MHz with a duty cycle of 50%. The ac driving signal applied to the LO is shown in green, showing where the laser is on and off. The region from which samples were taken to generate the raw random numbers is highlighted in blue. The dashed lines show the ADC range used when acquiring data. (b) Autocorrelation evaluated on ${10}^6$ filtered raw data points with 95% confidence intervals for a white noise process (green), showing that this data is uncorrelated.

Figure 4

(a) Typical calibration line obtained during data acquisition, where the average power incident on each photodiode has been calculated from the power-meter measurements. (b) Probability density function (PDF) of filtered raw data converted into vacuum units (blue). Theoretical PDF for vacuum state input in the absence of excess noise (orange).

Figure 5

The blue points are the min-entropies corresponding to each data set acquired. The dashed lines indicate separate sessions in between which the setup was adjusted. For each session the entropy was estimated multiple times by periodically acquiring a calibration line approximately every 10 min. Hence, in a session multiple data sets were acquired, each of them with its own min-entropy bound. The minimum value of 5.53, circled in red, was used as the experimental bound for the min-entropy. Given the length of the input string, the length of the seed was chosen to obtain a probability $\epsilon \ge 2^{-100}$ of distinguishing the output data distribution from a uniform one. As indicated by the green horizontal line, we then distill 5.4 random bits from each raw 8-bit sample.