Quantum Random Number Generation on a Mobile Phone

Quantum random number generators (QRNGs) can significantly improve the security of cryptographic protocols by ensuring that generated keys cannot be predicted. However, the cost, size, and power requirements of current Quantum random number generators have prevented them from becoming widespread. In the meantime, the quality of the cameras integrated in mobile telephones has improved significantly so that now they are sensitive to light at the few-photon level. We demonstrate how these can be used to generate random numbers of a quantum origin.

Popular Summary

Random numbers play an essential role in securing modern communications; cryptographic keys should be generated randomly to ensure that they cannot be guessed. However, computers are deterministic devices, incapable of generating true randomness. On the other hand, random number generators based on the laws of quantum mechanics can generate random bits in a provable way. Since random number generators typically require specialized hardware, such as single-photon detectors, they are rarely accessible to consumers. We show that it is actually possible to generate random numbers with a quantum origin using consumer-grade hardware, such as the image sensors included in many computers, tablets, and mobile phones.

The image sensors in many consumer devices are able to detect at the few-photon level, and they can resolve the quantum noise needed to generate genuinely random numbers. We demonstrate this fact on both a CCD camera and a Nokia mobile phone illuminated by a LED. We adjust the level of illumination to maximize quantum uncertainty in the number of detected photons (without exceeding the linear regime of the detector). The raw data from the detectors are sent to an extractor that condenses the randomness of each pixel into approximately 3 bits with a very high-quality randomness.

Our method enhances the security of generated cryptographic keys and prevents attacks on security systems that rely on exploiting weaknesses in their random number generators. By showing that consumer devices have reached a state where they can directly be used for the implementation of some quantum technologies, we expect that our results will impact information security.

Figure 1

A detector, or indeed each pixel of an image sensor, can be modeled as having 100% efficiency but are preceded by a lossy element (beam splitter) with transmission $\eta$. For each absorbed photon, the detector generates an electron. This charge is then converted into a voltage and amplified before being digitized and sent to further processing, i.e., a randomness extraction stage.

Figure 2

Working principle and assumptions. (a) We measure a number $n$ of photoelectrons on an image sensor’s pixel with a probability $P(n)$. Assuming that the detector is operating in a linear regime, this measured distribution will be the combination of quantum uncertainty (b) and technical noise (c). From a single shot measurement, we cannot distinguish these two noise components; however, we assume that, to our adversary, the technical noise is fully deterministic.

Figure 3

Random number generator setup. A camera is fully and homogeneously illuminated by a LED. The raw binary representation of pixel values is concatenated and passed through a randomness extractor. This extractor outputs quantum random numbers.

Figure 4

Fano factor (variance/mean) of the devices employed in this experiment. We operate in the region where the Fano factor is 1 and the detector is most linear.

Figure 5

Statistics of the number of photons detected by a single-photon detector (ID Quantique ID100) in 1ms, which, as expected for most sources, follows a Poisson distribution.

Figure 6

Measurement of the quantum and classical noise of our ATIK (a) and Nokia (b) detectors. At the operating conditions, quantum noise strongly dominates.

Figure 7

Autocorrelation of the output bit string. The value of the correlation is limited by the finite sample size.

Figure 8

Test results for some of the Diehard battery of tests for random number generators. The represented $p$ value is the result of a Kolmogorov-Smirnov test of 100 $p$ values. The suite also performs a large number of other tests, which our RNG pass, e.g., $0.01<p\text{value}<0.99$.