Introduction

Random number plays an important role in many applications where unpredictability is a key1,2, especially in cryptographic protocols3,4,5 where security is assured because of unpredictability. Though there are some statistical tests6,7,8 which can convice us about the random nature of the observed sequence, it is almost impossible to discriminate between a predetermined random string of bits that comes from a dishonest provider or malicious random number generator (RNG) and a true random sequence. In the first case the sequence may pass all the statistical tests but still can be completely predictable to the provider or anyone else who wants to eavesdrop. Therefore, generation of genuine randomness and its certification is generally considered impossible with only classical methods. Quantum physics brings out high unpredictability and probabilistic behaviour as an inherent property of nature9. Therefore, one can expect certification of true randomness in quantum systems to come purely from the principles of quantum physics.

The random nature of quantum mechanics10 has gained a lot of interest from the time of it’s inception. Though the description of quantum system is probabilistic, the probabilistic prediction of a theory does not necessarily imply that it is intrinsically random. There can be some limitation to the formalism and a more complete theory can describe it in a completely deterministic way11,12. However, previous works13,14,15 suggests that using the nonlocal correlation between two particles can generate the randomness which is truly intrinsic. For example, like measuring entangled particles one can assess the randomness of the process independent of it’s quantum description which cannot be described deterministically within the framework of any no-signalling theories. Nonlocality has been proved as an important resource in many information processing tasks like random number generation protocols16,17, randomness expansion16,18,19 and amplification20,21 protocols, and quantum key distribution15,22,23. Though there is no direct connection between nonlocality and entanglement24,25, it is known that any pure entangled states are nonlocal. Using this nonlocality of observed statistics in bipartite Bell scenario, a device independent Quantum Random Number Generator (QRNG) has been suggested16. Other than that, various other approaches to built an efficient QRNG have been developed and all of them can be classified under three categories, trusted device, self-testing, and semi self-testing17. Though the device-independent or self-testing QRNG is more secure compared to two other protocols, it is unsuitable in some cases because of the slow generation of random numbers with time constrained under current technologies.

In this report we propose a QRNG solely based on the superposition and entanglement property of the quantum walk and we use pure states which associates the nonlocal behaviour as described before. The motivation for using quantum walk is propelled by multiple advantages it can offer along with ability to generate multi-bit from a single qubit. The practical limit is bounded by the experimentally implementable number of steps of quantum walks in any system like, NMR26,trapped ions27,28, cold atoms29, and photonic systems30,31,32,33. Our analytical and numerical analysis shows that the randomness of an initial state of the particle is being enhanced using the quantum walk dynamics. The result suggests that it’s dependency on the initial state is very weak and this ensures that a significantly high randomness is seen even when randomness in initial state is zero.

Discrete-Time Quantum Walk

The Discrete Time Quantum Walk (DTQW) is defined on the Hilbert space \( {\mathcal H} ={ {\mathcal H} }_{c}\otimes { {\mathcal H} }_{p}\) where \({ {\mathcal H} }_{c}\) is the Hilbert space of the particle/walker and \({ {\mathcal H} }_{p}\) is the position Hilbert space34,35,36,37,38,39,40,41. In this paper we consider one-dimensional DTQW with the particle having two internal degrees of freedom. Therefore, \({ {\mathcal H} }_{c}\) is spanned by the basis states \(\{|\uparrow \rangle ,|\downarrow \rangle \}\) and we will call it coin space. For the position space the basis states will be \(\{|i\rangle :i\in {\mathbb{Z}}\}\). Each step of DTQW comprises of quantum coin operation,

$$C(\theta )=[\begin{array}{cc}\cos \,\theta & -i\,\sin \,\theta \\ -i\,\sin \,\theta & \cos \,\theta \end{array}]$$
(1)

followed by a position shift operator defined as

$${{\mathscr{S}}}_{x}\equiv \sum _{x}{\textstyle [}|\uparrow \rangle \langle \uparrow |\otimes |x-1\rangle \langle x|+|\downarrow \rangle \langle \downarrow |\otimes |x+1\rangle \langle x|{\textstyle ]}.$$
(2)

The resulting operation \({\mathscr{W}}(\theta )=[{{\mathscr{S}}}_{x}(C(\theta )\otimes 1)]\) evolves the particle in superposition of position space which has no classical analogue and quite advantageous for many information processing tasks and an integral part of quantum simulation schemes. The state of the walker after t-steps will be \(|{\psi }_{t}\rangle ={\mathscr{W}}{(\theta )}^{t}|{\psi }_{in}\rangle \), where \(|{\psi }_{in}\rangle \) is the initial state of the walker or the particle. In our consideration

$$|{\psi }_{in}\rangle =(\cos \,\delta |\uparrow \rangle +{e}^{i\eta }\,\sin \,\delta |\downarrow \rangle )\otimes |x=0\rangle .$$
(3)

Using this initial state we will study the behaviour of the randomness under quantum walk dynamics.

Results

Randomness in coin and position space

Here, we consider a specific form of quantification of randomness in a quantum system termed as intrinsic randomness of measurement42. It has been quantified as a coherence measure and clarifies the operational aspect of quantum coherence. Since the QRNG protocol we propose is solely based on DTQW dynamics, it is necessary to have a good measure of randomness contained in both position and coin space. For evaluating the randomness associated with coin space we have to trace out the part of Hilbert space associated with position space from the density matrix and from the reduced density matrix we can compute the randomness as described in Methods section. Similarly, by tracing out the coin space we can calculate the randomness incorporated with the position space. One important point to note here is that the randomness computed is explicitly of quantum origin and is of different nature from any randomness originated through classical stochastic process.

Randomness in the initial state

If the initial state of walker is of the form given in Eq. (3) (we will omit x whenever no confusion arises), corresponding density matrix would be

$${\rho }_{in}=|{\psi }_{in}\rangle \langle {\psi }_{in}|=({\cos }^{2}\delta |\uparrow \rangle \langle \uparrow |+{e}^{-i\eta }\,\sin \,\delta \,\cos \,\delta |\uparrow \rangle \langle \uparrow |+{e}^{i\eta }\,\sin \,\delta \,\cos \,\delta |\downarrow \rangle \langle \uparrow |+{\sin }^{2}\delta |\downarrow \rangle \langle \downarrow |)\otimes |0\rangle \langle 0|.$$
(4)

Using the preceding expression it is easy to calculate the randomness associated with coin and position space individually. For coin space it would be dependent on the parameter δ only and can be expressed as,

$${R}_{i}({\rho }_{in}^{c})=-({\cos }^{2}(\delta ){\rm{l}}{\rm{n}}({\cos }^{2}(\delta ))+{\sin }^{2}(\delta ){\rm{l}}{\rm{n}}({\sin }^{2}(\delta )).$$
(5)

Since the walker initially is fixed at one position their is no inherent randomness associated with position. Thus, randomness associated with initial position space will be 0. This supports the viability of randomness quantification process.

Randomness after t- steps

After t-steps, the generic form of the walker can be written as \(|{\psi }_{t}\rangle =\)\({\textstyle (}\sum _{x}\,{a}_{x,t}|\uparrow \rangle +{b}_{x,t}|\downarrow \rangle {\textstyle )}\otimes |x\rangle \), which is the outcome of the operation \({\mathscr{W}}{(\theta )}^{t}\) on the initial state. Therefore, the density matrix corresponding to the state would be,

$${\rho }_{t}=|{\psi }_{t}\rangle \langle {\psi }_{t}|=\sum _{x,y}\,({a}_{x.t}{a}_{y,t}^{\ast }|\uparrow \rangle \langle \uparrow |+{a}_{x,t}{b}_{y,t}^{\ast }|\uparrow \rangle \langle \uparrow |+{b}_{x,t}{a}_{y,t}^{\ast }|\downarrow \rangle \langle \uparrow |+{b}_{x,t}{b}_{y,t}^{\ast }|\downarrow \rangle \langle \downarrow |)\otimes |x\rangle \langle y|.$$
(6)

Now using this expression we can compute the randomness associated with the position and coin space individually and both together.

Randomness in coin space

The walker has two internal degrees of freedom and total randomness is being distributed in the form of probability amplitude associated with the \(|\uparrow \rangle \) and \(|\downarrow \rangle \) states. By tracing out the position space, we will be remained with the reduced density matrix denoted by \({\rho }_{in}^{c}\) expressed in the form, \({\rho }_{t}^{c}={\rho }_{11}|\uparrow \rangle \langle \uparrow |+{\rho }_{12}\)\(|\uparrow \rangle \langle \downarrow |+{\rho }_{21}|\downarrow \rangle \langle \uparrow |+{\rho }_{22}|\downarrow \rangle \langle \downarrow |\). So, the randomness can be expressed as

$${R}_{i}({\rho }_{t}^{c})=-({\rho }_{11}\,\mathrm{ln}\,{\rho }_{11}+{\rho }_{22}\,\mathrm{ln}\,{\rho }_{22})=\sum _{x}|{a}_{x,t}{|}^{2}\,\mathrm{ln}\,|{a}_{x,t}{|}^{2}+|{b}_{x,t}{|}^{2}\,\mathrm{ln}\,|{b}_{x,t}{|}^{2}.$$
(7)

In Fig. 1 we show the randomness in the coin space as function of δ which fixes the initial state before the walk and after 50 step of walk using different coin operation parameter θ. Irrespective of the initial state, that is, even when initial state’s randomness is zero, we can see an high value of randomness after 50 steps of DTQW. From the analytical results presented in the “Supplementary Information” and the numerical results we can say that the same behaviour will be seen even after small number of steps.

Figure 1
figure 1

Intrinsic randomness in the coin space (particle) as a function of initial state parameter δ before implementing quantum walk and after implementing 50 step of quantum walk using difference coin operation parameter θ. Though we see some dependency on δ, a significant enhancement of randomness is seen even when the randomness in the initial state is zero.

Full size image

Randomness in position space

We can use the randomness of the state extended in superposition of position space to extract intrinsically random classical bit string out of it. Extraction process is discussed in extracting randomness section following this. For quantification of randomness in position space we will follow the same recipe as we used in quantifying randomness in coin space. If the dynamics of the walker involves t number of steps of walk then we know that generic state can be written as \({\psi }_{t}=\sum _{x}\,({a}_{x,t}|\uparrow \rangle +{b}_{x,t}|\downarrow \rangle )\otimes |x\rangle \), and \({\rho }_{t}=|{\psi }_{t}\rangle \langle {\psi }_{t}|\). By tracing out the coin space we will get the form as \({\rho }_{t}^{p}=\sum _{i,{i}^{\text{'}}}\,{\rho }_{i,{i}^{\text{'}}}|i\rangle \langle {i}^{\text{'}}|\). To calculate the randomness inherited by the reduced state, we need the diagonal entries in computational basis that is, ρi,i. The density matrix after time t can be written in the form,

$${\rho }_{t}=|{\psi }_{t}\rangle \langle {\psi }_{t}|=\sum _{x,y}\,{\textstyle (}{a}_{x.t}{a}_{y,t}^{\ast }|\uparrow \rangle \langle \uparrow |+{a}_{x,t}{b}_{y,t}^{\ast }|\uparrow \rangle \langle \downarrow |+{b}_{x,t}{a}_{y,t}^{\ast }|\downarrow \rangle \langle \uparrow |+{b}_{x,t}{b}_{y,t}^{\ast }|\downarrow \rangle \langle \downarrow |{\textstyle )}\otimes |x\rangle \langle y|$$
(8)

therefore,

$${\rho }_{t}^{p}=\mathop{\sum }\limits_{x,y=-t}^{t}\,({a}_{x,t}{a}_{y,t}^{\ast }+{b}_{x,t}{b}_{y,t}^{\ast })\otimes |x\rangle \langle y|.$$
(9)

Comparing the two expression for \({\rho }_{t}^{p}\) we can write down the form of the randomness as

$${R}_{i}({\rho }_{t}^{p})=\sum _{x}\,{\textstyle (}|{a}_{x,t}{|}^{2}+|{b}_{x,t}{|}^{2}{\textstyle )}{\rm{l}}{\rm{n}}{\textstyle (}|{a}_{x,t}{|}^{2}+|{b}_{x,t}{|}^{2}{\textstyle )}.$$
(10)

In Fig. 2, randomness in position space after 25 step of quantum walk as a function of initial state parameter δ is shown. Before the walk, randomness in position space is zero therefore, what we note after 25 steps of walk is a significant quantity of randomness in the system even though it varies a bit as function of δ and for different value of θ. In the inset of Fig. 2, randomness in complete system, coin and position space together is shown. We see an overall boost in the randomness when compared to randomness in position space alone.

Figure 2
figure 2

Intrinsic randomness in position space as a function of initial state parameter δ after 25 step of walk using different coin operation parameter θ. It is evident from the figure that randomness shows some dependency on the initial state, however, the variation is very small when compared to the zero randomness in the initial stage. Inset in the figure is the randomness when both coin and position space are taken together. We see a unit increase in the randomness when both the space are taken into account.

Full size image

Extracting randomness

The working principle of a QRNG is to make use of the quantum phenomena such as superposition of quantum states and measurement to obtain classical output string which is desirable to be random enough to pass any statistical tests. It is known before measuring that, a two-level system can acquire random classical bit string from the random outcome of the measurement. We will see how a qubit quantum walk can generate single random bit and a multi-random bit string and its advantages over using a single copy of qubit system.

From coin space

We have already discussed the procedure to quantify randomness in coin space and our analysis shows it’s dependence on the initial state of the walker. With evolution of the walk, a clear enhancement of the randomness in comparison to the initial state is seen. That is, after t- steps the particle evolves according to the dynamics and probability amplitude corresponding \(|\uparrow \rangle \) and \(|\downarrow \rangle \) states will keep changing after each step. To get the random classical bit out of it we have to use a detector to detect the state of the walker after any arbitrary number of steps. Here we will trust both, the device implementing quantum walk and detector to get intrinsically random classical bit. Walker will be in the superposition state \({a}_{x,t}|\uparrow \rangle +{b}_{x,t}|\downarrow \rangle \) before the detection and it would collapse on either of these two states after measurement and we will code a classical bit 0 or 1 for detecting \(|\uparrow \rangle \) and \(|\downarrow \rangle \) state, respectively. Here, the bit commitment is arbitrary and we could use the opposite commitment too. Since quantum mechanics assures us the outcome being inherently random, we cannot have a prior knowledge about the outcome before detection. Therefore, we can expect a perfectly random classical series of string as output by repeating this scheme for several times.

From position space

We will use the same kind of extraction process in the position space as in the coin space. The advantage of using the position space is its ability to generate a multiple-random bit string rather than a single bit after each round of extraction like it is in coin space. More explicitly, after t-steps walk, tracing out the coin space, we can write the generic state in position space in the form \(|{\psi }_{t}\rangle =\mathop{\sum }\limits_{x=-t}^{t}\,{a}_{x,t}|x\rangle \), which is in superposition of all possible states corresponding to each position. To make a measurement we have to place a position resolving detectors (or a multiple - detector at each position) where the particle will be detected. If we use the standard version of DTQW then,

$$|{\psi }_{t}\rangle ={a}_{t,t}|t\rangle +{a}_{t-2,t}|t-2\rangle +{a}_{t-4,t}|t-4\rangle +\cdots +{a}_{-t+2,t}|-t+2\rangle +{a}_{-t,t}|-t\rangle .$$
(11)

We can define the state of the detector using a simple mathematical formula, 2n = 2t. If n is an integer then we will use n number of quantum bits to denote the state of the detectors and if n is not an integer then the maximum number of quantum bits needed to specify all detectors is \(\{n|\mathop{{\rm{\min }}}\limits_{n}{2}^{n}\ge 2t\}\). If 2t = 2n then the detector states will be defined as follows:

Bit commitment scheme with position

Detected position of walker

Corresponding state

−t

\(|00\cdots 0\rangle \), 0 appears n times

−t + 1

\(|00\cdots 1\rangle \), 0 appears n − 1 times

\(\vdots \)

\(\vdots \)

\(\vdots \)

\(\vdots \)

t − 1

\(|11\cdots 0\rangle \), 1 appears n − 1 times

‘t

\(|11\cdots 1\rangle \), 1 appears n times.

Therefore, if the particle is being detected at position t then we will note the n bit string associated with the detector at which it is measured. Below we present a table with an example of bit commitment scheme after 8 step of quantum walk

Bit commitment scheme after 8 step of walk

Detected position of walker

State of the walker

−8

\(|0000\rangle \)

−7

\(|0001\rangle \)

−6

\(|0010\rangle \)

−5

\(|0011\rangle \)

−4

\(|0100\rangle \)

−3

\(|0101\rangle \)

−2

\(|0110\rangle \)

−1

\(|0111\rangle \)

1

\(|1000\rangle \)

2

\(|1001\rangle \)

3

\(|1010\rangle \)

4

\(|1011\rangle \)

5

\(|1100\rangle \)

6

\(|1101\rangle \)

7

\(|1110\rangle \)

8

\(|1111\rangle \)

Here we have not committed any bit string for position 0. However, we can assign a bit 0 or 1 arbitrarily or we can avoid committing a bit string for this or any specific position according to the choice of the client who wants to generate the random number. In DTQW evolution we know that after odd (even) number of steps of walk, positions identified with even (odd) number will have zero probability of finding a particle. This will eliminate the occurrence of half of the configuration of multi-bit random number. To address this concern we can use split-step quantum walk43,44 or directed quantum walk45,46.

Split-step quantum walk

In a one-dimensional split-step quantum walk (SS-QW) the shift operator is divided into two parts denoted by S− and S+. These operations are defined as

$$\begin{array}{rcl}{S}_{-} & = & \sum _{x}\,|x-1\rangle \langle x|\otimes |\uparrow \rangle \langle \uparrow |+1\otimes |\downarrow \rangle \langle \downarrow |;\\ {S}_{+} & = & \sum _{x}\,1\otimes |\uparrow \rangle \langle \uparrow |+\langle x+1|\langle x|\otimes |\downarrow \rangle \langle \downarrow |.\end{array}$$
(12)

Unlike standard form of DTQW, here two different coin operators dependent on two different parameters θ1 and θ2 are used. Therefore, the resulting operation will be defined as,

$${\mathscr{W}}({\theta }_{1},{\theta }_{2})=[1\otimes C({\theta }_{2})]{S}_{-}[1\otimes C({\theta }_{1})]{S}_{+},$$
(13)

where for the coin operator we used the same form as above. After t steps of walk the state will be

$$|{\psi }_{t}\rangle ={\mathscr{W}}{({\theta }_{1},{\theta }_{2})}^{t}|{\psi }_{in}\rangle $$
(14)

and it can be written in the form \(|{\psi }_{t}\rangle =\mathop{\sum }\limits_{x=-t}^{t}\,({a}_{x,t}|\uparrow \rangle +{b}_{x,t}|\downarrow \rangle )\otimes |x\rangle \). Here the probability amplitude will be non-zero for each position and state will be of the form,

$$|{\psi }_{t}\rangle ={a}_{t,t}|t\rangle +{a}_{t-1,t}|t-1\rangle +{a}_{t-2,t}|t-2\rangle +\cdots +{a}_{-t+1,t}|-t+1\rangle +{a}_{-t,t}|-t\rangle .$$
(15)

We can calculate the randomness using the pure state density matrix and by tracing out the coin space as we did in standard DTQW case. In Fig. 3 we show the schematic representation of generation of four bit random number after four step of SS-QW.

Figure 3
figure 3

Schematic representation four bit random number generation from a single qubit after four step of SS-QW. If the state of the walker is also considered, we will effectively have five bit random number after measurement.

Full size image

Directed quantum walk

To define the directed discrete time quantum walk (D-QW) in one dimension, we will be using one directed edge connecting two vertices of the graph and (n − 1) self looping edges at each vertex and we will assign a basis vector to each edge. Then every state at each edge can be expressed as linear combination of the states \(|x,\to \rangle ,|x,1\rangle ,|x,2\rangle \cdots |x,n-1\rangle \) where x is non-negative integer and → indicates edge along the line and each number comes from distinct self loop. The action of shift operation is defined as \({S}_{x}|x,\to \rangle =|x+1,\to \rangle \) and \({S}_{x}|x,i\rangle =|x,i\rangle ,i\in [1,n-1]\). Therefore, the shift operator takes the form

$${S}_{x}=\sum _{x,i}\,|\to \rangle \langle \to |\otimes |x+1\rangle \langle x|+|i\rangle \langle i|\otimes |x\rangle \langle x|.$$
(16)

Coin operation has the form \(C\equiv {\textstyle [}\begin{array}{cc}\alpha & \beta \\ \beta & -\alpha \end{array}{\textstyle ]}\) where \(\alpha =1/\sqrt{n}\) and \(\beta =\sqrt{\frac{n-1}{n}}\). Therefore, one step of D-QW comprises of two operation \({{\mathscr{W}}}_{d}={S}_{x}[C\otimes {\mathbb{1}}]\). After t steps of D-QW the state will be \({|\psi \rangle }_{t}={{\mathscr{W}}}_{d}^{t}|{\psi }_{in}\rangle \).

$$|{\psi }_{t}\rangle ={a}_{0,t}|0\rangle +{a}_{1,t}|1\rangle +{a}_{2,t}|2\rangle +\cdots +{a}_{t-1,t}|t-1\rangle +{a}_{t,t}|t\rangle .$$
(17)

In Fig. 4, randomness in the system as function of number of steps is shown when measurement are made only in the position space and in both, position and coin space (inset). The increase in randomness shows the way number of equivalent quantum bit the system mimics using a single qubit. The plot shows the randomness for all three types of quantum walk evolution. Due to non-zero probability at all position space, the randomness is more (maximizes) for the SS-QW than the randomness obtained for standard DTQW (Fig. 4). In D-QW the number of positions on which probability amplitude is non-zero is equivalent to number of position space with non-zero probability in standard DTQW, the randomness measure is also identical (Fig. 4). In the inset we have shown the randomness in both, coin and position space together. Inclusion of coin space enhances the randomness in the system by a small amount.

Figure 4
figure 4

Randomness with number of steps in standard DTQW, SS-QW, and D-QW. Due to non-zero probability at all position space in SS-QW we can see a maximum randomness compared to other two. Amount of randomness measure corresponds to equivalent number of qubit it can mimic in the process. Inset in the figure is the randomness when both coin and position space are taken together.

Full size image

Advantages of using both space

If we take into account both, the coin and position degrees of freedom, we can generate an extra bit compared to the string of bits from position space alone. The reason is very obvious as we have seen already how internal degrees of freedom of the particle is able to generate one classical random bit after a single round of evolution. Therefore, when we use both, we will get random classical bit string coming from both spaces. The extraction process is same as discussed before but the detectors at each possible positions should be capable of capturing the information about internal state of the walker along with detecting the position of the walker.

In this scheme using dynamic evolution of qubit, from a given position space we can generate a uniform length classical multi-bit string rather than a single bit from a standard single particle QRNG. The randomness depends only on the device’s trustedness.

Randomness quantification under noise

An important part of any cryptographic protocol is to ensure it’s security under many possible attacks. It is in general impossible to make it secure under any arbitrary attacks but we can prove its security considering some realistic cases. One of these cases will be the difficulty to create a perfect pure state as different kind of noises will mix it up resulting a mixed state. Now the concern is that an Eavesdropper can have access of these noises and he or she might be able to get some information about the measurement outcomes using this correlation with the system. This is highly undesirable as we want to use this measurement outcome as random number in other cryptographic protocols. Let us consider the case where instead of starting with pure state some noise is mixed and we will consider a purified state \(|{\psi }^{CPE}\rangle \) which is being shared by the walker and the adversary Eve. This is the state in the larger Hilbert space \({ {\mathcal H} }_{{\mathscr{C}}}\otimes { {\mathcal H} }_{{\mathscr{P}}}\otimes { {\mathcal H} }_{ {\mathcal E} }\) where the walker does not have the access to the Hilbert space \({ {\mathcal H} }_{ {\mathcal E} }\). Purification implies that the state of the walker will be \({\rho }^{CP}=T{r}_{E}(|{\psi }^{CPE}\rangle \langle {\psi }^{CPE}|)\). Upon obtaining the outcome e with probability pe by doing projective measurement on Eve’s system, the state of the walker will be \(|{\psi }_{e}^{CP}\rangle =\langle {\psi }_{e}^{E}|{\psi }^{CPE}\rangle \). The measurement of randomness corresponding to the walker’s state would be \({R}_{i}(|{\psi }_{e}^{CP}\rangle )\) and the total randomness can be quantified as \(\sum _{e}\,{p}_{e}{R}_{i}(|{\psi }_{e}^{CP}\rangle )\). Now Eve’s optimal strategy would be to choose a measurement basis which will maximize her side information about the measurement outcome, equivalently saying minimizing the randomness of the walker’s measurement outcome. Therefore, the total randomness can be quantified as

$${R}_{i}({\rho }^{CP})=\sum _{min({p}_{e},{\psi }_{e}^{E})}\,{p}_{e}{R}_{i}(|{\psi }_{e}^{CP}\rangle ).$$
(18)

An other description of effect noise on the randomness in the system will be in the form of decoherence in DTQW evolution. A simple form of introducing decoherence into DTQW evolution will be in the form of bit flip noise, that is, ρ(t) of the complete system as outlined in Eq. (6) after every time step t will be in the form \(\rho (t)=p[({\sigma }_{x}\otimes 1)\rho (t){({\sigma }_{x}\otimes 1)}^{\dagger }]+(1-p)\rho (t)\). Here p is the noise level and σx is bit flip operation. This bit flip noise results in decrease in spread of the wavepacket in position and correspondingly the randomness in the system also decreases. However, when we calculate the randomness after such evolution we will have contribution from both, quantumness in the system and from the noise process. Therefore, while using DTQW with noise, all the randomness we obtain cannot be attributed to the quantum origin. To give a quantitative picture of the randomness of quantum origin in DTQW system, in Fig. 5 we present a plot of extractable randomness in complete DTQW system with noise of different level and the randomness of quantum origin for the corresponding noise level.

Figure 5
figure 5

Randomness with number of steps in standard DTQW in presence of bit flip noise in coin space. With increase in noise some decrease in randomness is seen. The randomness in system with noise will have contribution from both, quantum origin as well as noise. To show that we have plotted randomness (R) for noiseless evolution and for evolution with different noise level p. The van Neumann entropy (E) and the randomness of quantum origin is also shown. Though overall randomness does not see a significant decrease, a substantial decrease in randomness from quantum origin is seen.

Full size image

When their is no noise in the dynamics (p = 0, R0) we see a study increase in randomness with number in steps and all the randomness can be attributed to the quantum origin. With increase in noise level (p = 0.1 and p = 0.4, R) we first seen a steep increase in randomness and with time it will be lower than the randomness of quantum origin when p = 0. For non-zero p we have show the value of von Neumann entropy, E(t) = −tr[ρ(t) ln (ρ(t)], a good measure of randomness due to noise in the system. Therefore, the contribution of randomness of quantum origin can be quantified in the form QR(t) = R(t) − E(t). This value becomes very small with increase in p and time t and for p = 0.4 its almost zero. We should note that this method of evaluating randomness of quantum origin is valid only for the system with ρ(t) is a pure state when their is no noise (that is, when E(t) = 0 for p = 0). However, though contribution of randomness from quantum origin decrease with in increase in noise level, the overall randomness of the system will continue to scale the same way as the spread of the DTQW scales with noise.

Randomness as guessing probability

Out of many possible attacks one can consider is the fact that the detectors are correlated with an adversary’s system. Upon obtaining a specific outcome, the state of the adversary would be changed accordingly and measuring the correlated system in her lab, Eve can get some useful information about the outcome of the QRNG. However, considering our case, the detectors are placed at every possible positions where the particle can be detected and corresponding state can be written as i where i is a n− bit string as we suggested in the extraction procedure.

If the probability distribution of the random variable (measurement outcome) being denoted by PI then consider an adversary whose states \({\rho }_{i}^{E}\) depends on the random variable I which corresponds to the Classical-Quantum state \({\rho }_{PE}:\,=\sum _{i\in I}\,{P}_{I}(i)|i\rangle \langle i|\otimes {\rho }_{E}^{i}\). If \(P(I|E)=\sum _{i\in I}\,{P}_{I}(i)Tr({\pi }_{i}{\rho }_{i}^{E})\) (πi is the POVM on Eve’s system), it is the probability of guessing the outcome of position measurement using the optimal measurement strategy by the adversary. For this it has been proved47 that P(I|E) is related to the min− entropy by the relation \(P(I|E)={2}^{-{H}_{min}(I|E)}\) where the min− entropy is defined by \({H}_{min}(I|E):\,=-\,{{\rm{\inf }}}_{{\sigma }_{E}}{D}_{\infty }({\rho }_{PE}\parallel {{\mathbb{1}}}_{P}\otimes {\sigma }_{E})\) and \({D}_{\infty }(\rho |\sigma ):\,={\rm{\inf }}\{\lambda \in {\mathbb{R}}:\rho \le {2}^{\lambda }\sigma \}\).

Methods

Randomness quantification

The intrinsic randomness of a quantum system is related to the random outcomes of the measurement on the system42. If we measure a pure state \(\rho =|\psi \rangle \langle \psi |\), (where \(|\psi \rangle =\sum _{i}{a}_{i}|i\rangle \)) in the basis |i〉 considering projective measurement, then measurement outcomes are intrinsically random.

According to Born’s rule \({p}_{i}=Tr[{P}_{i}\rho ]=\langle i|\rho |i\rangle =\langle i|\sum _{j,k}\,{a}_{j}{a}_{k}|j\rangle \langle k||i\rangle =|{a}_{i}{|}^{2}\) will be the probability of obtaining the i’th outcome. Pi are the rank one projectors on the basis states. Then randomness of the output random variable is defined as

$${R}_{i}(\rho =|\psi \rangle \langle \psi |)=-\,\sum _{i}\,{p}_{i}\,\mathrm{ln}\,{p}_{i}.$$

Which is the Shannon entropy function of the probability distribution {pi}. In another way it can be written as Ri(ρ = |ψ〉〈ψ|) = S(ρdiag), where ρdiag is the density matrix that has only diagonal terms of ρ in the computational basis {i}. If we think ρ as a n × n matrix, having only diagonal terms ρii in the computational basis then the randomness inherited by state ρ can be quantified as

$${R}_{i}(\rho )=-\,\mathop{\sum }\limits_{i=1}^{n}\,{\rho }_{ii}\,\mathrm{ln}\,{\rho }_{ii}.$$
(19)

From the preceding expression we can note that the information of diagonal elements which corresponds to probability distribution of each of the two basis state quantum walk in position space is sufficient to obtain the randomness in the system. Therefore, an analytical expression for ax,t and bx,t, amplitudes of the basis state |↑〉 and |↓〉 at position x and time t for noiseless and decoherent quantum walk can be obtained from the Fourier analysis of the walk as described in refs. 48,49. respectively. Using the first and the second moments, analytical expression for the asymptotic behaviour has also been presented in the same references.

Discussion and Conclusion

Many of the existing protocols for Quantum Random Number Generator (QRNG) are based on quantum state preparation and measurement schemes. We introduce here a QRNG based on quantum dynamics which can be controlled rather than the “prepare and measure” methods. In addition to that, our paper includes the following important results and advantages to develop a QRNG protocol using quantum walk.

For Discrete Time Quantum Walk (DTQW), the quantification process for the randomness inherited by the state (for both, pure and mixed) has been prescribed.

After implementing the DTQW, we have analysed the dependency of the quantified intrinsic randomness on the initial state parameter δ and walk evolution parameter θ. We have provided the analytical calculation (see Appendix) for short time and numerical results for long time evolution to prove the fact that in both, position and coin space, the randomness is almost independent of the walk evolution parameter θ. Though the randomness in position space shows some dependence on the initial state parameter δ, the degree of dependence is very small compared to the initial state randomness, which is being calculated as zero. A significant enhancement of randomness with the increase in number of steps of DTQW is an other important thing that has been highlighted.

We have suggested a scheme to extract random number both, from measurement on coin space and position space outcomes individually and together. Our extraction scheme shows the use of single particle and incorporating position degrees of freedom with it to generate a bit string of random number after measurement. We have also established that the long bit string out of single run of the single particle system can be obtained by increasing the dimension of position Hilbert space. This clearly implies that the bit-rate can be made higher depending on the position space dimension we can control under current technologies. Many earlier results have demonstrated ways to control probability distribution of the DTQW50,51,52,53,54,55,56. Therefore, the probability distribution of the walk can be engineered to get a uniform probability distribution which is desired in any cryptographic protocols or any other distribution. This helps us to design a QRNG protocol which is capable enough to give us the random numbers from a desired probability distribution and any undesired nature will directly indicate the presence of adversary or hardware failure.

The main idea of our work was to construct a protocol for generating multiple random bits using quantum walk of a single particle. Recent experimental demonstration of using position degree of freedom along with polarization and orbital angular momentum degree of freedom, a muti-qubit entangled state has been reported57. Therefore, realization of multi qubit state using extended position space is not far from experimental feasibility. We have also shown the advantages of using SS-QW over D-QW or standard DTQW in extracting higher randomness with all possible combination of multi-bit string. This behaviour is expected because for the SS-QW where the degrees of freedom in position space with non-zero probability is double. In comparison with other two, the probability amplitude at all the possible positions using SS-QW effectively contribute to the expression of randomness.

Now the question can arise about the probability distribution of the position space, where uniformity of the distribution is desired for the security purpose. Controlled distribution of quantum walk can in general be engineered to pick the desired distribution using position dependent coin operations and along with phase operations. Recently, an experimental demonstration of engineering any arbitrary state by controlled dynamics generated by quantum walk has been reported56. This strongly supports feasibility of our scheme where a desired probability distribution will act as an additional resource. However, a crucial point of our QRNG scheme is that, we use the inherent randomness of the quantum dynamics which is completely controlled under the person or organization who wants to produce random bits for any further cryptographic application.

QRNG based on state preparation and measurement scheme where state can be manipulated in such a way that the observer of the random sequence of bits can think of it as a perfectly random whereas the output can be completely predictable to the adversary who is sending the states. In our scheme we have shown how the randomness is almost independent of the initial state after few steps of quantum walk and since dynamics involves quantum interference, the output is random enough to produce random bits string in a secure lab where he/she has the full control of the quantum walk dynamics. The only issue with the hardware failure or malfunctioning, such that dynamics can be highly localized i.e the probability distribution of finding particle within some specific range of positions is really high therefore there might be some chances that it can be predicted but we have been able to produce a solution for that by using an engineered state and dynamics which are capable of producing the uniform or any desired probability distribution, non-occurrence of this desired probability distribution can signal the hardware malfunction therefore the person or organization are ready to rectify it or completely abandon the protocol.

Noise on quantum walk affects the spread of the wavepacket in position space that will proportionally decrease the randomness in the systems. As shown in our results, though a overall randomness does not significantly decrease with noise, contribution of randomness from quantum origin does see a substantial decrease. This goes well with an established understanding to decrease in entanglement between the coin and position space of the quantum walker with increase in noise.