Introduction

Random number generation is important for many applications1,2. For cryptographic applications, random numbers should have good unpredictability in order to be secure under attack by the adversaries3. Genuine random numbers can never be generated by a classical device because any classical device bears in principle a deterministic description. Quantum mechanics, on the other hand, has intrinsic randomness and thus can be explored to construct a genuine random number generator. There have been many demonstrations of random number generators based on quantum principles4,5,6,7,8,9,10,11,12,13,14.

Self-certified random number generation is an advance made recently, where the randomness is guaranteed by violation of certain fundamental inequalities14,15,16. In particular, it was proposed in Refs. 14,15 that through violation of the Clauser-Horn-Shimony-Holt (CHSH) inequality, one can certify the generated random numbers in a device-independent fashion that is secure against the adversaries who have only classical side information17. The first proof-of-principle experiment for this scheme has been recently demonstrated14.

We consider here a scenario where the provider of the device is assumed to be honest. However, we still need to physically certify that the random numbers are generated due to the intrinsic uncertainty of quantum mechanics instead of some uncontrolled classical noise process in the device. In this case, we can use quantum contextuality manifested through the violation of certain Kochen-Specker (KS) inequality to certify the generated random numbers18,19. Quantum contextuality is a basic property of quantum mechanics, where the measurement outcomes depend on the specific context of the measurements20,21. Quantum contextuality would be revealed by violations of some KS inequalities and such violations can be observed even in a single indivisible system without any entanglement22,23,24,25,26,27. Because there is no need of entanglement, a certification scheme of random numbers based on the KS theorem can significantly simplify the experimental requirement and generate certified random numbers with a much higher speed18. A proof-of-principle experimental implementation of this idea has been reported with a photonic system quite recently18.

A particular type of the KS inequality, the Klyachko-Can-Binicioglu-Shumovsky (KCBS) inequality22, is convenient for certification of random numbers. Violation of the KCBS inequality has been observed before in a single-photonic system23. For experimental test of the KCBS inequality, there are two possible loopholes: the detection efficiency loophole if the detectors only register a subset of data due to their inefficiency and the compatibility loophole, which occurs if additional assumptions are required to guarantee that the observables with simultaneous assignment of values in the KCBS inequality are compatible with each other and remain identical when their measurement contexts change. The test of the KCBS inequality with the photonic system is immune to the compatibility loophole23, however, it requires the fair-sampling assumption due to the low photon detection efficiency and thus subject to the detection efficiency loophole.

In this paper, we report a random number generator certified by quantum contextuality with a single trapped ion, which allows us to close the detection efficiency loophole for the first time for the KCBS inequality. For the compatibility, we follow basically the same configurations as in Ref. 23, where errors in compatibible measurement settings only reduce the amount of the violations. Even with experimental noise and imperfections, we get significant violations of the KCBS inequality, which lead to lower bounds the minimum entropy of the generated random string. Compared to the experimental certification based on the CHSH inequality14, the generation rate of random numbers is increased by about four orders of magnitudes in our experiment, which is important for practical applications.

The paper is organized as follows. First, we introduce the KCBS inequality and show the experimental violation of this inequality. Then, we introduce the relation between the violation of the KCBS inequality and the minimum entropy of the generated random string for the case of an honest provider and compare the theoretical prediction with our experimental observation. The generated random bits are tested under uniform or biased choice of measurement settings. We conclude the paper by summarizing the results and discussing further improvements of our random number generation scheme.

Results

The KCBS inequality

The Kochen-Specker theorem states that the results of quantum mechanics cannot be fully explained by non-contextual classical theories which assume that the measurement outcomes of a physical system are predetermined and independent of their own and other simultaneous compatible measurements20,21. The KCBS inequality illustrates the conflict between quantum mechanics and non-contextual classical theory in the simplest possible system with the Hilbert space dimension d = 322.

The KCBS inequality is connected with the following simple algebraic equation.

where the value of ai is either 1 or −1. If the values of the observables are predetermined, the average of the left hand of the above equation should be no less than −3, leading to the following inequality:

In quantum mechanics, however, the outcomes of Ai do not have predetermined values, which allows violation of the KCBS inequality (2) for a specific state |ψ0〉 in systems with d ≥ 3. In the case of d = 3, we denote the bases by |1〉, |2〉 and |3〉 and the observable Ai, represented by Ai = 1 – 2 |vi〉 〈vi|, is the projector on the axis |vi〉. The maximal violation of the KCBS inequality (2) is achieved for the state along the symmetric axis of the pentagram shown in Fig. 1(a). Here |v1〉 = |1〉, |v2〉 = |2〉, |v3〉 = R1 (γ, 0) |v1〉, |v4〉 = R2 (γ, 0) |v2〉, |v5〉 = R1 (γ, 0) |v3〉 and , where γ = 51.83° and R1,2 denote the rotation operations between |1〉 to |3〉 and between |2〉 to |3〉, respectively. Maximal violation the KCBS inequality is achieved under the state (2), with the corresponding value .

Figure 1
figure 1

The representation in 3d space and pulse sequences of a state and measurement configurations for the maximal violation of the KCBS inequality (2).

(a) The five vectors form a regular pentagram, which represent observables A1, A2, ···, A5 that are the projectors on them. The vectors related to observables Ai, Ai+1 are orthogonal, which makes the neighboring observables compatible. The initial state |ψ0〉 for the maximal violation is located at the center axis (blue arrow) of the pentagram. The initial state and measurements of the compatible observables are realized by the pulse sequences shown in (b) and (c)-(g). (b) The pulse sequence to prepare . Here, R1 and R2 represent the coherent rotations between |1〉 to |3〉 and between |2〉 to |3〉, respectively, where θ = 41.97° and ϕ = 64.09°. The sequence starts from |3〉 state (black filled circle) after optical pumping. (c)–(g) The pulse sequences for the measurement configurations (c) A1A2, (d) A2A3, (e) A3A4, (f) A4A5, (g) , where γ = 51.84°. The important aspect of the configuration is that the measurement scheme for Ai is perfectly unchanged when it is measured with either Ai–1 or Ai+1 except A1, similarly to the photon realization23. The pulse sequence for the confirmation of the identicalness between A1 and is shown in Fig. 2(d). For the random number generation, we choose one of the five configurations shown in (c)–(g) based on software random numbers.

Full size image

Figure 1(b) shows the scheme for preparation of the initial state |ψ0〉 starting from the basis state |3〉 and Fig. 1(c)–(g) describe the implementation of the measurement configurations along the five axes. To ensure context independence, we emphasize that the measurement configuration of Ai remains the same when it is measured with either Ai–1 or Ai+1 (let A0 ≡ A5, A6 ≡ A1). For example, the scheme for the measurement A2 is exactly the same in the first [Fig. 1(c)] and the second stage [Fig. 1(d)]. To move to the second configuration, we perform a rotation between the states |1〉 and |3〉, which does not influence the state |2〉 that corresponds to the observable A2. Only the observable related to the state |1〉 is changed from A1 to A3.

The configuration for the measurement of A1 in Fig. 1(c) is not the same as that in Fig. 1(g), which is therefore denoted by . If A1 and are not identical, it is possible to violate the inequality (3) even in classical theory. To solve this problem, similarly to Ref. 23, we use a new inequality that includes the observable with the form

Note that the inequality (3) becomes the original KCBS inequality (2) when . Therefore, the difference between two measurements decrease the violation that can be obtained in the experiments23. Another possible way out is to introduce an empirical parameter to upper bounds the violation of compatibility, which would be similar in spirit to a recent work where a parameter in introduced to bound violation of the locality loophole for test of the Bell inequality28. Any imperfection in the initial state preparation or final measurements only leads to a reduction of violation of the KCBS inequality, so a significant violation of this inequality guarantees that the randomness comes from the quantum origin instead of a classical noise process.

Experimental violation of the KCBS inequality

The violation of the KCBS inequality have been observed with single photons18,23, however, those experiments are subject to the detection efficiency loophole. Here, we present the experimental violation of the KCBS inequality in a single trapped ion. Because of the high detection efficiency for the trapped ion, we close the detection efficiency loophole for the first time for this inequality.

We perform the test of the KCBS inequalities (2) with a single trapped 171Yb+ ion in a four-rod radio-frequency trap26,29. The qubit states are represented by the two internal levels in the S1/2 ground-state manifold, with |F = 1, mF = 0〉 ≡ |↑〉 and |F = 0, mF = 0〉 ≡ |↓〉. The transition frequency between |↑〉 to |↓〉 is ωHF = (2π)12642.821 MHz, determined by the hyperfine interaction.

The procedure of the experiment consists of Doppler cooling, initialization, coherent operation and detection (see the Method Section). The initial state preparation and the measurement configurations are shown in Fig. 1(b)-(g) and they are realized by two microwaves with the frequencies ω1 and ω2, which produce Rabi oscillations R1 (θ1, ϕ1) and R2 (θ2, ϕ2) between |1〉 to |2〉 and between |1〉 to |3〉, respectively. Here, θ1,2 and ϕ1,2 are controlled by the duration and phase of the microwaves. R1 (θ1, ϕ1) and R2 (θ2, ϕ2) are have the following explicit forms

For experimental convenience, we transform the observable Ai to Vi = (1 − Ai)/2, which is assigned to value vi = 0 when photons are detected or vi = 1 when no photons are detected. With Vi, the KCBS inequality (3) is rewritten as

We obtain 〈Vi〉 by mapping the axis vi to the state |3〉 and then measuring the probability P|3〉 (vi = 1) = 〈Vi〉 (Fig. 2(b)). For simplicity, let P|3〉 = P. The correlation terms 〈ViVi+1〉 are obtained by sequential measurements depicted in Fig. 2(c). First, we transfer Vi on the state |3〉 and apply the standard fluorescence detection scheme. If we detect photons, the state should not be |3〉 and we assign vi = 0 to the observable Vi, where the outcome of the correlation term ViVj vanishes and no further measurements are needed. If we detect no photons, we assign vi = 1 to the Vi. Then, we apply the swapping microwave π-pulse that converts Vj to |3〉 before another round of fluorescence detection. If we observe photons, vj = 0 and if no photons, vj = 1. We asign the value 1 to the correlation term ViVj only when we detect no photons for both rounds of measurements. We obtain the average of the correlation term 〈ViVj〉 = P (vi = vi+1 = 1) by repeating the same experimental sequence many times26.

Figure 2
figure 2

The trapped 171Yb+ ion system and detection schemes (a) The schematic diagram of trapped ion 171Yb+ experimental setup for observing the violation of the KCBS inequality and for generating random numbers certified by the inequality.

The three states |F = 1, mF = 0〉, |F = 1, mF = 1〉 and |F = 0, mF = 0〉 in the S1/2 ground state manifold are mapped onto |1〉, |2〉 and |3〉, respectively. One of the five measurement configurations in Fig. 1(c)–(g) is chosen by the software generated random number and the pulse sequence of the chosen setting is transfered to the arbitrary wave form generator and is applied to the ion through the amplifier. Depending on the photon counts on the PMT, we assign values on the observables mapped on the state |3〉. (b) The detection schemes for obtaining results of single observables Vi, Vj. First, Vi or Vj is mapped to the state |3〉 and apply the standard fluorescent detection method. If we detect photons (no photons), we assign zero (one) on the observable Vi or Vj. After repeating the same pulse sequence and the detection, we obtain the average value of the observable. (c) The sequential measurement scheme for the correlation ViVj. ViVj has a value one when both of Vi and Vj have one, where no photons are detected at each stage. (d) The experimental confirmation of the identicalness of V1 and . Ideally, whenever V1 has a result one (no photons), should have the same result (no photons). Any imperfection or changes in the system will cause the mismatch of them, which reduces the violation in the extended KCBS inequality (3).

Full size image

The expectation value is obtained by the scheme shown in Fig. 2(d). If ideally, the correlation shoud be same to 〈V1〉 since V1 is projection operator . The state |1〉 at the beginning of Fig. 1(g) corresponds to the observable V1, which is exactly the same configuration as in Fig. 1(c). Therefore, if photons are detected (v1 = 0) or not detected (v1 = 1) at the place where V1 would be measured, photons should be observed () or not be observed () for the shown in Fig. 2 (d). After repeating the sequence of Fig. 2(d), we acquire the probability that no photons are measured (), which gives by definition.

We randomly choose one of the five configurations (c)–(g) of Fig. 1 based on computer generated random numbers and perform the sequential measurements. We change the order of sequential measurements ( ViVi+1 or Vi+1Vi) with equal probability. We occasionally check the overlap of V1 and . We repeat the sequences 1 × 105 times and observe 〈χKCBS〉 = 3.852(0.030), which violates the extended KCBS inequality (3,4) by 31 σ. The detailed results of the measurements are summarized in Table 1. We emphasize that our result of the violation cannot be explained by any non-contextual classical theory which does not exploit the compatibility loophole (the detection loophole is closed in our experiment). In other words, any classical part of the system such as technical noise, imperfections and/or unexpected changes of control parameters can not produce the violation. Therefore, as long as we observe the violation of the inequality, we can ensure that the outcomes of our measurements originate from quantum mechanics.

Table 1 Experimental results for each of five settings and five joint probabilities for the KCBS inequality (4). We also perform the same experiments with exchanged order. The total trials of the experiment are 1 × 105. The standard deviations of the final result are 0.005 and 0.001 for the single observables and correlations, repectively as shown in the parenthesis. Our experimental test clearly shows the violation of the extended inequality (3) with 31 σ
Full size table

The relation between violation of the KCBS inequality and the min-entropy

We establish the relation between violation of the KCBS inequality (2, 4) and randomness of the generated string from the experiment, similar to the photonic demonstration18. We focus on the scenario with an honest provider of the device17 rather than the extreme adversary scenario where the device has been produced by a malicious manufacturer. Even though we trust the device provider, we still need to ensure that the randomness of the generated sequence is caused by quantum uncertainty instead of technical noise17. For this purpose, we assume: (1) the system can be described by quantum theory; (2) the input at lth trial is chosen from a random process that is independent and uncorrelated from the system and its value is revealed to the system only at step l; (3) the outcomes of the corresponding pairs of measurements at step l are compatible (the measurement of one observable does not influence on the marginal distribution of the results of the other observable); (4) the adversary does not have any capability of controlling the inside of the system. The first and the second assumptions here are identical to those made in the certification scheme of Bell's inequality14. The third is the contextuality assumption that replaces the role of locality assumption for the Bell inequality. The fourth is an assumption about the honest provider17.

We consider five sets of measurement configurations S = {A1A2, A2A3, A3A4, A4A5, A5A1}, where Ai is the observable with the output ai = ±1 and compatible with Ai–1 and Ai+1. We can rewrite the KCBS inequality (2) as

where P (ai = ai+1|AiAi+1) or P (ai ≠ ai+1|AiAi+1) is the probability that the output results are the same or different for a chosen measurement setting AiAi+1. Note that we change the sign of the inequality to make the derviation similar to that in Refs. 14,17,30. In our experiment, since we use the observable Vi (result vi = 0,1) intead of Ai and only distinguish the event of vi = vi+1 = 1 from others, the Eq. (5) is modified as

where P (vi = 1|Vi) is the probability that the output result vi is 1 at a measurement setting Vi. The result of terms inside {··· } is ideally zero and non-zero positive value can be occurred by experimental errors or imperfections, which only reduces the amount of violation from the optimal. Therefore, we can conclude that the experimental violations of the inequality (6) arise from solely quantum mechanical origin not any classical mean.

In our relization, we estimate the violation of the inequality (6) by repeating the sequences n times and additional runs ncc of the comparibility check, the measurement setting . The estimation of Eq. (5), obtained from the experimental data, is written as

where N (vi = 1|Vi) or N (vi = vi+1 = 1|ViVi+1) is the number of times that the outcome vi or vi and vi+1 is one under a measurement setting Vi or Vi and Vi+1, respectively. P (Vi) or P (ViVi+1) is the probability with which a measurement configuration Vi or Vi and Vi+1 is chosen. Note that positive result of terms inside {···} and [···] originates from the experimental flaws, which only reduces the amount of violation.

The randomness of a single generated bit vi from a measurement setting Vi can be characterized by the min-entropy , where P (vi|Vi) is the conditional probability of obtaining vi when the input setting Vi and the maximum is taken over all possible values of the output string. The theorem 1 of Ref. 17 shows that the min- entropy of the generated string after n trials is bounded by

where is a series of KCBS violation thresholds with the classical bound and the maximum violation and , with r the smallest probability of input choices miniP (Vi). The parameter parameter denotes the closeness between the resulting distribution that characterize k successive uses of the device and another extended distribution that is well defined mathematically. The function f is found by semidefinite programming at various expectations L. Fig. 3 presents how the min-entropies are affected by the confidence levels, and 1 − δ. When we set a high confidence level, , the bound on the min-entropy reduces as expected. Note that the certified min-entropy is only determined by measured value and the choice of , independent of experimental details.

Figure 3
figure 3

The min-entropy vs. the violation.

The function f(L) in Eq. (8) depending on the violation L of the KCBS inequality (5), which is calculated by semi-definite programming (SDP). The function at various confidence levels such as 90%, 99% and 99.9% are plotted for the uniform choices of measurement configurations, where and r = miniP (AiAi+1) = 1/5. Here we divide interval with the spacing . Given a measured and confidence level, we can estimate the min-entropy of a generated random string as summarized in Eq. (8). Note that we ignore the term log2 δ in Eq. (8) that does not have dependence on the trial n.

Full size image

Random number results

We perform ten thousand trials to generate random bits as described in the previous section: [Experimental violation of the KCBS inequality]. At each trial, we choose one of the five measurement configurations shown in Fig. 1 (c)−(g) by computer-generated random numbers, perform the sequence composed of Doppler cooling, state initialization and rotations for the chosen configuration and finally record the existence of fluorescence (see Method section). As explained, we obtain a random bit, i.e., 1 (or 0) with fluorescence (or no fluorescence) for each trial. The sequence takes about 10 ms, mainly limited by the wave-form loading time to the pulse generator. Note that the random generator based on the CHSH inequality produced a random bit per several min.

Figure 4 shows the min-entropies of generated strings discussed in the previous section: [The relation between violation of the KCBS inequality and the min-entropy]. We produce a string of length 1 × 105 with uniform choices of the measurement settings, P (Vi) = 1/5. As shown in Table 1, we observe the expectation , implying the min-entropy with 99% confidence. Note that the other confidence level δ does not have any noticable influence on the bound of min-entropy. Here we used the thresholds of KCBS violations .

Figure 4
figure 4

Comparison between theory and experimental results.

(a)(c)The min-entropy H∞ (v|V) (8) depending on the number of trials for (a) an uniform distribution of measurement settings P(Vi) = 1/5 and (c) a biased distribution with P (V1) = 1 − 4q, P (V2) = P (V3) = P (V4) = P (V5) = q, where q = 6(100000)−1/2 with the probablity of errors and δ = 0.001. The min-entropies H∞ (a|A) (8) are bounded by the relation of the violation of the KCBS inequality (8), where we set the 10 intervals of between and . The min-entropies are linearly increasing as the number of trial increases and the slopes are basically dependent on the thresholds of the intervals (blue), (green), (yellow) and (red). The black dots are obtained from the violation values that were observed at the number of trials. (b)(d) The correlation between the KCBS violations (8) and the min-entropy (8) of the strings for (b) the uniform input choices and (d) the baised settings. Here we divide the total 1 × 105 numbers by 10 division and show the KCBS violations and min-entropies in the division. We can clearly show that the monitor of at each division provides sufficient information to guarantee the min-entropy in the division.

Full size image

Fig. 4 shows clearly the advantage of our certification scheme, i.e., we can guarantee the min-entropy of the generated random string by only monitoring the violation independent of experimental details. Fig. 4(a) shows the accumulated behavior of the min-entropy as the number of experimental trials n increases. The solid lines show the theoretical linear increment of the minentropies and the slopes are determined by only the thresholds . Due to drifts of experimental parameters, the violations are fluctuating from one threshold to another, which accordingly introduces the changes to the min-entropy, accordingly. Fig. 4(b) shows details of the transient behavior of the generated random string. We monitor the violation for each batch of n = 1 × 104 trials and estimate the min-entropy in the batch. Fig. 4(b) reveals that the min-entropies are correlated to the violations and completely determined by the thresholds at given confidence level 99%. Here, we we do not need massive random tests to ensure the amount actual random number in the generated string. The amount of min-entropy of our random numbers is guaranteed by the the measured violations , regardless of unexpected changes of experimental parameters.

We also generate random bits with a biased choice of measurement settings, where P (V1) = 1 − 4q, P (V2) = P (V3) = P (V4) = P (V5) = q and q = αn−1/2 with α = 6 and n = 105. We observe basically the same behavior of the min-entropy for the generated stream except for a slightly smaller bound due to the non-uniform setting. We get the min-entropy bound from 1 × 105 rounds with violation of . For the biased choice of measurement settings, the output entropy (1.35 × 104) exceeds the input entropy (1.14 × 104) and we obtain 2.1 × 103 net random bits. For the case of uniform measurement settings, we always need more initial randomness and thus cannot obtain net randomness. This is similar to the random number generation scheme with the CHSH inequality, where to generate net randomness, one always needs to consider nonuniform measurement settings.

Finally, we carry out a series of random tests (see Methods)31 to examine the quality of our random numbers obtained by collecting the outcomes of the first measurement in each trial. As expected, our generated random numbers passed all the tests. Fig. 5 shows the summary of the test results. Actually the real randomness of our generated strings is already certified by the KCBS inequality, which is a much stronger statement than claiming that the produced numbers pass all the random tests, since no random tests on finite strings should be considered complete.

Figure 5
figure 5

The results for random tests.

The summary for the results of random tests31 on our generated random numbers. In the tests, we can consider the sequences as random if P – values of the tests are over the threshold that we set, 0.01. All of random numbers pass the listed tests.

Full size image

Discussion

In summary, we have demonstrated violations of the KCBS inequality using a single trapped ion, with the detection efficiency loophole closed for the first time. We use quantum contextuality to certify randomness of the measurement outcomes. The randomness of our device is ensured by observing violations of the inequality independent of experimental details. With our device, we already obtained a net output entropy. The device can generate random numbers with a higher speed, which is important for practical applications.

Methods

Experiment procedure

The experimental procedure consists of Doppler cooling, initialization, coherent operations and detection. After 1 ms Doppler cooling, the internal state of the ion is initialized to |3〉 by 3 μs standard optical pumping with efficiency 99.1%26. The states are coherently manipulated by the microwaves ω1 and ω2 that are resonant to the transitions between |1〉 and |3〉 and between |2〉 and |3〉, respectively. The quantum operations of the microwaves ω1 and ω2 are described by the rotation matrix R1 (θ1, ϕ1) and R2 (θ2, ϕ2), respectively. Here θ1, θ2 and ϕ1, ϕ2 are controlled by the duration and the phase of the applied microwaves. The 2 π times for both Rabi oscillations are adjusted to 29.5 μs, that is Ω1,2 = (2π) 33.9 kHz in frequency. The maximum probability of off-resonant excitation Ω2/(ω2 − ω1)2 is about 1.6 × 10−5, small enough to ensure independence of each Rabi oscillation. The standard fluorescent-detection method enables us to differentiate between one state versus the other two states of a qutrit. We observe on average 10 photons at 369.5 nm for the |1〉 or the |2〉 state and detect no photon for the |3〉 state. The state detection error rates for wrongly registering the state |3〉 and missing the state |3〉 are 0.9% and 1.9%, respectively, with the discrimination threshold nph = 1. As shown in Fig. 2(b), we transfer the information of obervable Ai (Aj) by π-pulse and apply the measurement sequence. Then we assign the value ai = 1 (aj = 1) on the obsevable Ai (Aj) when photons detected or ai = −1 (aj = −1) when no photons are detected. After repeating the same experimental procedures, we obtain the 〈Ai〉 (〈Aj〉). Here we emphasize that our setup is not subject to detection loophole and provide a value of the measurement at every trial.

Random test

We apply the random tests that are appropriate for the size of our random numbers, which are ‘Frequency’, ‘Block Frequency’, Cumulative Sums (Cusums)’, ‘Runs’, ‘Longest-Run-of-Ones in a Block (LROB)’, ‘Rank’, ‘Discrete Fourier Transform Test (FTT)’, ‘Approximate Entropy (AE), ‘Serial.’ The p-values of all the test, which are the probabilities that an ideal random number generator would produce less random sequence than the tested one. Therefore, a p-value of 0 simply means that the tested sequence appears to be completely non-random, whereas a p-value of 1 implies that the sequence in test appears to be perfectly random. The p-values lie in the open interval (0, 1) and if p-value is larger than a significance level θ, we accept the sequence as random for the test. Typically θ is chosen to be in the range [0.0001, 0.01] and we set θ = 0.01. Note that we use Von-Neumann extractor for the output strings to make uniform distributions, which reduces the size of random numbers to one quarter. We also note that the random tests are different from guaranteeing the amount of min-entropy in the generated string. In other words, even the data could not pass the random tests but still have the quoted min-entropy.