Homodyne-based quantum random number generator at 2.9 Gbps secure against quantum side-information

Quantum random number generators promise perfectly unpredictable random numbers. A popular approach to quantum random number generation is homodyne measurements of the vacuum state, the ground state of the electro-magnetic field. Here we experimentally implement such a quantum random number generator, and derive a security proof that considers quantum side-information instead of classical side-information only. Based on the assumptions of Gaussianity and stationarity of noise processes, our security analysis furthermore includes correlations between consecutive measurement outcomes due to finite detection bandwidth, as well as analog-to-digital converter imperfections. We characterize our experimental realization by bounding measured parameters of the stochastic model determining the min-entropy of the system’s measurement outcomes, and we demonstrate a real-time generation rate of 2.9 Gbit/s. Our generator follows a trusted, device-dependent, approach. By treating side-information quantum mechanically an important restriction on adversaries is removed, which usually was reserved to semi-device-independent and device-independent schemes.

The first mode is measured by applying ideal homodyne detection. The probability density that a measurement of the quadratureq outputs the value q 0 can be computed directly from the Wigner function: P (q 0 ) = dq dp dq e dp e W (q, p, q e , p e )δ(q − q 0 ) = 1 Given the measurement output q 0 , the conditional Wigner function of the second mode reads W (q e , p e |q 0 ) = 1 P (q 0 ) dq dpW (q, p, q e , p e )δ(q − q 0 ) (7) = 1 P (q 0 )(2π) 2 dp exp − 1 2 + n q 2 0 + p 2 + q 2 e + p 2 e − 2 n(n + 1) (pp e − q 0 q e ) (8) The Gaussian integral can be computed by completing the square: dp exp − 1 2 + n p 2 − 2 n(n + 1)pp e = exp 2n(n + 1) 1 + 2n Also note that exp − 1 2 + n q 2 e + 2 n(n + 1)q 0 q e = exp 2n(n + 1) 1 + 2n Coming back to the Wigner function of the conditional state, we obtain W (q e , p e |q 0 ) = 2π 1 + 2n We recognise that this is the Wigner function of a Gaussian state with first moments and CM Finally, if a gain factor g is applied to the output of the homodyne detection, yielding x = gq 0 , then the first moment becomes (18)

II. SUPPLEMENTARY NOTE 2: CONDITIONAL MIN-ENTROPY FOR GAUSSIAN STATES
In this Section we present the detailed calculations to obtain our expression of the conditional min-entropy starting from Theorem 24 of Ref. [2]. We start by recalling some well-known facts about Gaussian states of a single bosonic mode. A bosonic mode is identified by the quadrature operatorsq,p. A Gaussian state ρ is uniquely determined by the vector of first moments and the CM of the quadrature operators: The symplectic two-form is represented by the matrix The partition function of the state ρ is Theorem 24 of Ref. [2] established that, for any pair of Gaussian states ρ, γ such that V γ − V ρ > 0, the following holds: where ln denotes the natural logarithm, with I denoting the identity matrix, and Equation (23) differs from the statement of Theorem 24 of Ref. [2] by a factor 1/2 in the last term. This is due to a difference between our definition of the CM [in Eq. (20)] and that given in Eq. (15) of Ref. [2].
We put: for > 0, and We thus obtain, in the limit of → 0, That is, Recall that which yields

III. SUPPLEMENTARY NOTE 3: ADC CHARACTERIZATION
The setup for the ADC characterization is shown in Fig. 1. A sine wave of 60 Hz frequency was generated by a 24 bit sound card. The maximum amplitude of the sine was adjusted by a variable attenuator to match the input range of the ADC. A preamplifier (Standard Research Systems SR560) was used to bandpass filter the signal and as buffer to convert the high impedance output of the sound card to a 50 Ohm impedance as required by the ADC.
The measurement was performed as follows: We swept the amplitude of the sine wave from 0 to 2 23 − 1 in steps of 64. This yields 4 measurements with different voltage levels for each bin of the 16 bit ADC. For each amplitude setting, 10 periods of the sine wave were recorded by the ADC with a sampling rate of 1 GS/s, and the data was transferred to a computer via the FPGA. We analysed the data by determining the location of the maxima and minima and for each we calculated a histogram from 50,000 samples around the maximum and minimum, respectively. The 10 histograms were summed so that we obtained a histogram from 500,000 samples. To obtain the final histograms we combined the 4 measurements per ADC bin and normalized the probability distribution.

IV. SUPPLEMENTARY NOTE 4: ESTIMATION OF VARIANCES AND THE ENTROPY RATE
In this appendix we discuss the estimation of the variance, entropy rate and conditional variance of the noise and signal. To make things more concrete, we focus on the estimation of the signal variance σ 2 , the entropy rate h(X), and the conditional signal variance σ 2 X . Assume that T is the runtime of the experiment, and n signal measurements are performed at regular time intervals of δt = T /n. The spectral density computed from these data is a function of n discrete frequencies, denoted as ω j 's, taking values between 2π/T and 2πn/T . Below we work with the discrete variable λ j defined as λ j ≡ T ω j /n, which can be approximated by the continuous variable λ taking values with domain [0, 2π].
We estimate the spectral density f (λ) by applying the Welch's method, according to which the data are first divided in M (possibly overlapping) blocks, and then in each block the periodogram is computed, i.e., the discrete Fourier transform of the data contained in that very block. The spectral density is then estimated by taking the average over the periodograms. We assume that the periodograms, as random variables, are independent and identically distributed, and that each periodogram is distributed as the square of a Gaussian variable. Then the Welch's estimate of the spectral density is distributed as a (rescaled) χ 2 (k) variable with M degrees of freedom. Denoting as f 0 (λ j ) the Welch's estimate for the spectral density and as f (λ j ) its true value, then we can obtain a confidence interval by applying a tail bound of a χ 2 (k) variable. For example we can exploit the tail bounds (see e.g. [3]) For t 1 this yields, up to higher order terms, Let us first discuss the estimation of the entropy rate as approximated by the finite sum For each given j, 1 − P (t) is the probability that f (λ j ) ∈ [(1 − t)f 0 (λ j ), (1 + t)f 0 (λ j )], then it follows (from an application of the union bound) that This is equivalent to say that, with probability larger than 1 − nP (t), f (λ j ) lays between (1 − t)f 0 (λ j ) and (1 + t)f 0 (λ j ) for all j = 1, . . . , n. Therefore with probability at least equal to 1 − nP (t) = 1 − 2ne −M t 2 /8 . A further linear approximation for t 1 yields the confidence interval Finally, to take into account the overlap between adjacent periodograms, we replace M → γM , for γ < 1. For example, if the periodogram have a 50% overlap we put γ = 1/2. In conclusion, with an overlap of 50%, we obtain that for any given > 0, the entropy rate lies within the interval up to a probability not larger than . From the entropy rate we obtain a confidence interval for the conditional variance, σ X ∈ [σ − X , σ + X ], where Similarly, we obtain an estimate of the signal variance σ 2 by exploiting the relation from which we derive a confidence interval Along the same lines we obtain a confidence interval for the conditional noise variance, σ U ∈ [σ − U , σ + U ] (this must additionally includes systematic errors). To obtain a worst-case estimate of the min-entropy we consider the smaller value for the signal variance, σ − X , and the larger one for the noise, σ + U .

V. SUPPLEMENTARY NOTE 5: CHARACTERIZATION OF VACUUM FLUCTUATIONS POWER SPECTRAL DENSITY
Here, we describe the homodyne detector and show by including imperfections that the bound given in the main text is indeed always a lower bound on the vacuum fluctuations. As described in the main text we beat two lasers, the local oscillator with power P LO and an auxiliary signal laser with power P sig which is frequency detuned with respect to the local oscillator by ν.
The beams interfere at a beam splitter with splitting ratio R(ν) : 1 − R(ν), where the frequency dependence ν accounts for a frequency dependent common mode rejection of the homodyne electronics. We furthermore take into consideration the visibility of the interference χ ∈ (0, 1] and the quantum efficiencies η 1 and η 2 ∈ (0, 1] of the two photo diodes. After photo detection and current subtraction the beat signal current at time t reads i beat (t) = 2χ 2 (η 1 + η 2 ) R(ν)(1 − R(ν)) e ω P LO P sig cos(2πνt) .
Here ω is the absolute angular frequency of the local oscillator laser. The square of the root mean square (RMS) amplitude of the beat signal digitized by an analog-to-digital (ADC) converter as obtained by a power spectrum of acquired samples is then given by where G(ν) describes the overall gain of homodyne detector, possible filters and ADC analog input as well as includes the digitization into integers. We call TF := TF/P sig the transfer function. The power spectral density (PSD) of the vacuum fluctuations after photo detection and digitization reads where i dc1 and i dc2 are the direct photo currents generated by the photo diodes. Using the characterization of the transfer function from Eq. (49) yields In the last step we lower bounded the PSD of the vacuum fluctuations by using 1/χ ≥ 1 and where equality holds for η 1 = η 2 = 1, R = 0.5.

VI. SUPPLEMENTARY NOTE 6: CONTINUOUS-VARIABLE QUANTUM KEY DISTRIBUTION APPLICATION EXAMPLE
Continuous-variable quantum key distribution uses a Gaussian modulation of the coherent state excitation, i.e. of both the amplitude and phase quadrature components. For a single execution of the protocol a large amount of coherent quantum states, say 10 10 are generated and transmitted. For each quantum state 2 random numbers are required, the amplitude and the phase quadrature values. In practise these are discretized and for our example we choose an 8 bit resolution. Thus, 16 bit are required to generate 1 coherent state. Since our QRNG delivers 1024 random bits per single execution of the randomness extraction, N = 16bit·10 10 1024bit ≈ 1.6 × 10 8 runs are needed. We now assume that the QRNG ran N 1 times prior to the generation of the random numbers for QKD. Then the random number string for QKD has an epsilon stemming from the hashing of QKD hash = (N 1 + 1) hash + (N 1 + 2) hash + . . . + (N 1 + N ) hash = N · N 1 + (N · (N + 1)) 2 hash .
In our example we require that the random numbers used in the quantum key distribution system have an epsilon security parameter of less than 10 −9 . Assuming that the parameter estimation epsilon is constant over time and noticing that PE is one order of magnitude smaller, the series of random numbers must have an epsilon of QKD hash ≤ 10 −9 from hashing. After continuously running the QRNG for 10 years, where 352 is the number of acquired samples from the ADC per extraction run. Solving the above equation for hash and plugging in numbers for N 1 and N yields hash 10 −32 .