True randomness from an incoherent source

Truly random numbers are required in many branches of science and technology, from fundamental research in quantum mechanics¹ to practical applications such as cryptography.² While a pseudorandom number generator can expand a short random seed into a long train of apparent “random” bits using deterministic algorithms, the entropy of generated random numbers is still bounded by the original short random seed. To generate true randomness, researchers have been exploring various physical processes.

Quantum random number generation is an emerging technology,^3,4 which can provide high-quality random numbers with proven randomness. Different from physical random number generators exploring chaotic behaviors of classical systems, a quantum random number generator (QRNG) harnesses the truly probabilistic nature of fundamental quantum processes.^5,6

In general, the process of random number generation can be divided into two steps: the measurement step and the randomness extraction step. In the first step, a well-defined measurement is performed on a well-characterized entropy source. Ideally, in this step, the measurement system should only detect the intrinsic quantum noise of the entropy source. In practice, both the source and the detection system are not perfect and will introduce additional technical noises. In the worst-case scenario, the technical noises could be accessible to (or even controlled by) a malicious adversary (Eve) and thus cannot be trusted. Furthermore, the raw output of the detector may not be uniformly distributed. The second step in random number generation is to perform randomness extraction to generate uniformly distributed random numbers uncorrelated to the untrusted technical noises.^7–14 In practice, to conduct randomness extraction effectively, the quantum noise should be dominant over the technical noises.

Among various QRNG implementations, schemes based on photonic technology have drawn a lot of attention for high rates, low cost, and the potential of chip-size integration.^15,16 Both single photon detectors and optical homodyne detectors have been employed in photonic QRNGs. The latter is especially appealing in practice since highly efficient photodiodes working at room temperature can be applied. Several QRNG schemes based on optical homodyne detection, exploring fundamental noises such as vacuum fluctuation^17–20 and laser phase noise,^21–25 have been studied extensively. Remarkably, a QRNG based on laser phase noise has been employed in a recent loop-hole free Bell experiment.²⁶ 

Nevertheless, there are still practical challenges in existing schemes. In a QRNG based on vacuum noise,^17–20 one major source of technical noises is the electrical noise of the homodyne detector. We remark that building a high-speed homodyne detector with electrical noise significantly below the shot noise is technically challenging.^27–29 This may in turn limit the operating speed of this type of QRNG. In a QRNG based on laser phase noise,^21–24 fiber interferometers with large arm imbalance (on the order of nanoseconds) are commonly employed. To achieve high random number generation rates, either phase stabilization of the fiber interferometer²¹ or high-speed modulation of the laser source²³ is required. In a more recent chip-size design,¹⁶ instead of using a cumbersome fiber interferometer, the outputs from two independent distributed feedback (DFB) lasers are mixed at a beam splitter. Random numbers are generated by operating one laser in a gain switching (GS) mode, while the other laser in a continuous wave (CW) mode. Essentially, the laser in the GS mode provides a train of phase randomized laser pulses, while the laser in CW mode acts as a phase reference in coherent detection. To achieve a high interference visibility, sophisticated temperature control is required to match and stabilize the wavelengths of the two lasers.

In this paper, we demonstrate a random number generation scheme based on measuring quadrature fluctuations of a single mode thermal state using an optical homodyne detector. This scheme is implemented by beating a broadband amplified spontaneous emission (ASE) source with a single mode local oscillator (LO) at a symmetric beam splitter and performing differential photo-detection. Similar to the design in Ref. 16, our scheme does not require a fiber interferometer of large arm imbalance, which makes it very appealing in chip-size integration. Furthermore, both the ASE source and the LO are operated in the CW mode, no active intensity modulation or phase (and polarization) control is required.

Note that even though the output of the ASE source is broadband, the optical homodyne detector selectively detects photons in the same spatial-temporal (and polarization) mode as the LO. The intrinsic “filtering” function of the LO allows us to perform single mode measurement without actually preparing a single mode thermal state, which greatly simplifies the implementation. Since the bandwidth of the ASE source is tens of nanometers, it is very easy to align the central wavelength of the LO within the spectral range of the ASE source.

Our scheme is different from previous studies in Refs. 30 and 31, where direct detection (rather than coherent detection) is employed to measure the ASE-ASE beat noises. Comparing with the QRNG based on measuring the vacuum noise, our scheme can tolerate much higher detector noises. This is because the quadrature variance of a single mode thermal state with an average photon number of n is 2n+1 times as large as that of vacuum noise.³² By preparing a thermal state with a large average photon number, we can effectively increase the quantum noise-to-detector noise ratio.

At the first sight, it seems controversial to generate true randomness from an incoherent source since intrinsic randomness is deeply connected to quantum coherence.³³ We remark that while truly quantum randomness can only originate from a superposition (pure) state, the input state ρ to the measurement device does not have to be pure so long as the system entangled with ρ cannot be accessed by Eve. One illustrative example is the QRNG based on radioactivity, where electrons from a radioactive source, such as $90$Sr, are registered by a Geiger-Mueller tube at random times.^34,35 In this case, at the time right before the measurement, the joint state of the radioactive nuclei and the electron can be described by

where $|Un$ (⁠$|Dn$⁠) represents undecayed (decayed) nuclei, $|0e$ (⁠$|1e$⁠) represents 0 (1) electron emitted, respectively, and α and β are normalization coefficients.

While the state $|ψ$ in (1) is pure, the state accessible to the Geiger-Mueller tube (the measurement device) is a mixed state given by $ρe=α2|00|+β2|11|$⁠. To generate secure random numbers, one underlying assumption is Eve cannot access (or control) the radioactive source (otherwise, Eve may acquire a copy of the random bit by measuring the quantum state of the source). The same argument can also be applied to QRNGs based on laser phase noise^21–24 or amplified spontaneous emission,^30,31 where the emitted photons accessible to the detector are entangled with atoms in the light source. In this paper, our discussion is based on this “trusted” device scenario. Note that this is different from the assumptions adopted in the so-called source-independent QRNG,^36,37 where the state input to the detector could be entangled with the environment accessible to Eve, which thus cannot be trusted.

The experimental setup is shown in Fig. 1. A fiber amplifier (PriTel, Inc.) with a vacuum state input is employed as an incoherent broadband source. Previous studies have shown that the ASE noise generated by a fiber amplifier is thermal.^38,39 We have conducted conjugate homodyne detection and verified the photon statistics of a single mode component (selected by the LO) of the ASE source follows Bose-Einstein distribution,⁴⁰ as expected from a single mode thermal state. To facilitate the estimation of the photon number per mode arrived at the optical homodyne detector and reduce the power of unused light, a 0.8 nm optical bandpass filter centered at 1542 nm is placed after the ASE source (BP in Fig. 1). A laser source with a central wavelength of 1542 nm (Clarity-NLL-1542-HP from Wavelength Reference) is employed as the LO. Note that it is not necessary to stabilize the laser frequency since it can never drift out the above 0.8 nm range under normal operation. To prevent the saturation of the photodetector, an optical attenuator is applied to reduce the LO power to about 4 mW.

The outputs from the ASE source and the LO laser beat at a 50:50 fiber beam splitter (BS in Fig. 1) and the differential interference signal is measured by a 350 MHz balanced photo-receiver (from Thorlabs, BD in Fig. 1). While the output of the ASE source is unpolarized, the LO will automatically pick out the same polarization mode as itself. No polarization control is required. The overall efficiency η of the detection system, including coupling losses and insertion losses of optical components and the quantum efficiency of photodiode, has been determined to be 0.5. An analog-to-digital converter (ADC) is used to sample the output of the balanced receiver. All the optical components are single mode fiber pigtailed.

The system shown in Fig. 1 allows us to measure a randomly chosen (due to random phase relation between the LO laser and the ASE source) quadrature of a single mode thermal state. The output is expected to be truly random following a Gaussian distribution with a zero mean and a variance of 2n+1 in the shot-noise unit,³² where n is the average photon number of the ASE source in the mode determined by the LO. To calibrate the average photon number n, an optical power meter is used to measure the output power P of the ASE source after the optical filter. Using the relation of ν = c/λ, we can determine the total mode number N corresponding to a bandwidth of Δλ and a time window of Δt = 1 s as

where λ(ν) is the central wavelength (frequency) of the filtered ASE light and c is the speed of light in vacuum. The factor 2 is due to the two polarization modes generated by the ASE source. The effective average photon number n (after taking the detection efficiency of the optical homodyne detector into account) can be determined from the optical power P using

where h is the Planck constant. Experimentally, P is measured to be 29.0 μW. Given η = 0.5, Δλ = 0.8 nm, and λ = 1542 nm, the average photon number n has been determined to be about 555 per mode. This suggests that the expected quadrature variance of this source is about three orders of magnitude larger than the vacuum noise, which is a significant advantage of this scheme.

In the first experiment, a 12-bit data acquisition board (Texas Instruments) was employed to sample the output of the homodyne detector. The maximum sampling rate is mainly limited by the bandwidth of the photodetector: if the sampling rate is close to or above the detector bandwidth, adjacent samples will show significant correlation. Given the detector bandwidth is 350 MHz, a sampling rate of 100 MHz was chosen in our experiments. Limited by the memory size of the data acquisition board, 10⁵ samples were collected in this experiment. The histogram of the raw data together with a Gaussian fit curve is shown in Fig. 2. The raw data fit a Gaussian distribution reasonably well, as expected from a single mode thermal state. The deviation from a perfect Gaussian distribution can be attributed to the systematic errors of the data acquisition board, including its nonlinearity.

To further justify the Gaussian assumption, we perform a chi-square test for goodness of fit⁴¹ using 1000 samples from the above raw data.⁴⁶ The chi-square test yields an α value of 0.35, indicating that there is no good reason to reject the Gaussian hypothesis.

To determine the variance of the experimental data in the shot-noise unit, we also measured the detector noise (by turning off both the ASE source and the LO) and the vacuum noise (by turning on the LO only) separately. The measurement results are shown in Fig. 3. Comparing Fig. 2 with Fig. 3, it is obvious that the quantum noise is much larger than both the vacuum noise and the detector noise. This allows us to apply a low-cost, noisy detector to implement our scheme. By comparing the data in Fig. 3(a) with that in Fig. 3(b), the detector noise has been determined to be 0.62 in the shot-noise limit. After being normalized to the vacuum noise, the variance of the Gaussian random numbers shown in Fig. 2 has been determined to be 963 in the shot-noise unit, corresponding to a single mode thermal state with an average photon number of 481. Note that this average photon number is about 13% smaller than the value estimated from optical power P using (3). We suspect that this discrepancy is mainly due to the errors in determining the bandwidth of the optical filter and the efficiency of the detector.

In the second experiment, an 8-bit oscilloscope (Agilent) was used to acquire 10⁷ samples at a sampling rate of 100 MHz. The autocorrelation of the collected data is shown in Fig. 4. The correlation coefficients for lags larger than zero are below 10⁻³ and within the range of the statistical uncertainty due to the finite sample size. This highlights the high quality of the entropy source.

While the above Gaussian distributed raw data could be useful in certain applications, uniformly distributed random bits are more common in practice. There are different ways to generate binary random numbers from the Gaussian output of the homodyne detector. One simple way is to feed the Gaussian raw data into a voltage comparator, which is essentially a 1-bit ADC. By balancing the efficiencies of the two photodiodes and choosing a suitable threshold voltage, one random bit can be generated from each raw sample. To improve the random number generation rate, multi-bit ADC can be employed.

In our experiment, we use the internal 8-bit ADC of the oscilloscope to sample the output of the homodyne detector. An 8-bit ADC converts an analog input into one of the 256 (2⁸) output bins. If the widths of the 256 bins have been tailored in a way so that the Gaussian distributed analog input will result in a digital output uniformly distributed among the 256 bins, then we could generate 8 random bits per detection. However, since the ADC in our experiment has an equal bin size, the digital outputs (raw samples) are not uniformly distributed. Here, we implement a Toeplitz-hashing extractor⁴² to generate binary random bits from the 8-bit raw samples.

We represent the 8-bit output of the ADC as random variable X. The maximum number of random bits that can be extracted from each 8-bit raw sample is lower bounded by the minimum-entropy of X, which is defined as

where $Pmax=maxx∈{0,1}8Pr[X=x]$ quantifies the maximal probability that X to be one of the 2⁸ binary sequences. Using (4), the minimum-entropy of the raw data has been determined to be $Hmin=6.4$⁠. This suggests that in the asymptotic case, we can generate on average 6.4 random bits from each 8-bit raw sample, corresponding to an efficiency of 0.8 bits per raw bit. We remark that if the untrusted technical noise of the system makes a significant contribution to the output, conditional minimum-entropy should be employed to estimate the extractable randomness.¹⁰ 

We apply a Toeplitz-hashing extractor to generate nearly perfect random bits from the raw data. A Toeplitz-hashing extractor extracts an m-bit random sequence by multiplying an n-bit raw sequence with an n-by-m Toeplitz matrix. The Toeplitz matrix is constructed from a long (n + m − 1 bits) but a reusable random seed. In our implementation, we choose m = 256 and n = 400, corresponding to an efficiency of 0.64 bits per raw bit (or 5.12 bits per raw sample). According to the leftover hash lemma,⁴³ the security parameter $ε$ of the randomness extractor is determined by

Using n = 400, m = 256, and $Hmin=6.4$⁠, the security parameter can be determined to be $ε$ = 2⁻³², which means the statistical distance between the extracted random sequence and the prefect random sequence is bounded by $ε$ = 2⁻³².⁴⁴ To evaluate the quality of the random bits generated from the randomness extractor, 1 Gb random numbers are generated and fed into the standard NIST statistical test suite.⁴⁵ As summarized in Table I, our random number generator passes all the 15 NIST tests.

Limited by the bandwidth of the detector, the sampling rate used in our experiment is 100 mega samples per second. Combined with the hashing efficiency of 5.12 bits per raw sample, the equivalent random number generation rate is 512 Mbps. To further increase the rate, one straightforward way is to use a detector with a larger bandwidth. For example, using a 15 GHz detector, the sampling rate can reach 10 Giga samples per second (GSps).¹⁴ The corresponding random number generation rate could be 51.2 Gbps. Of course, in practice, a faster detector tends to have a higher electrical noise that may reduce the quantum noise-to-electrical noise ratio. The achievable rate has to be evaluated based on actual characteristics of the system. One interesting question is given a noiseless detector and ADC with arbitrarily high precision, what is the ultimate limit of the random number generation rate? This question has been addressed in Refs. 7 and 10. In fact, if the detector is noiseless and can resolve the photon number of the input state, then instead of performing homodyne detection, we can measure the photon number of the thermal state directly. The photon number distribution of a thermal state is given by³² 

where $⟨n⟩$ is the average photon number per sampling time window. It is easy to see that the maximum probability is $Pmax=P(0)=1/(1+⟨n⟩)$⁠. From (4), the minimum-entropy of the source is $Hmin=log2(1+⟨n⟩)$⁠. For example, if the output power of the thermal source is 1 mW (at 1550 nm) and the sampling rate is 10 GSps, then the average photon number within the sampling window (100 ps) is about $7.8×105$⁠. In principle, we could generate 19.6 random bits per sample.

One appealing feature of our scheme is its simple and robust design: both the incoherent source and the LO are operated in the CW mode; no active modulation or phase (or polarization) stabilization is required. Its compact design also opens the door to chip-size integration. In fact, a fully integrated QRNG on an InP platform has been demonstrated recently, where the laser sources, beam splitter, and photodetectors are all integrated on a single chip.¹⁶ Since our scheme can be implemented with similar components, we expect the integration technologies developed there can also be applied in our scheme.

In summary, we propose and demonstrate a high-quality photonic entropy source for random number generation. By mixing the output of a broadband incoherent source with a single mode LO at a beam splitter and performing differential photo-detection, the quadrature fluctuations of a single mode thermal state can be explored to generate true randomness. Experimentally, a quadrature variance about three orders of magnitude larger than the vacuum noise is observed, suggesting this scheme can tolerate much higher technical noises in comparison with QRNG based on measuring the vacuum noise. The high quality of this entropy source is evidenced by the small correlation coefficients of the acquired data. By applying Toeplitz-hashing extractor on the Gaussian distributed raw data, unbiased random bits have been generated with an efficiency of 5.12 bits per sample. The output of the Toeplitz extractor successfully passes all the NIST statistical tests.

This work was performed at Oak Ridge National Laboratory (ORNL), operated by UT-Battelle for the U.S. Department of Energy under Contract No. DE-AC05-00OR22725. The author acknowledges support from ORNL laboratory directed research and development program (LDRD), the U.S. Department of Energy Cybersecurity for Energy Delivery Systems (CEDS) program under Contract No. M614000329, and the U.S. Office of Naval Research (ONR).

This manuscript has been authored by UT-Battelle, LLC under Contract No. DE-AC05-00OR22725 with the U.S. Department of Energy. The publisher, by accepting the article for publication, acknowledges that the United States Government retains a non-exclusive, paid-up, irrevocable, world-wide license to publish or reproduce the published form of this manuscript, or allow others to do so, for United States Government purposes. The Department of Energy will provide public access to these results of federally sponsored research in accordance with the DOE Public Access Plan (http://energy.gov/downloads/doe-public-access-plan).