Characterization of a Quantum Random Number Generator Based on Vacuum Fluctuations

Abstract

Quantum random number generators (QRNGs) are currently in high demand across a large number of cryptographic applications as secure sources of true randomness. In this work, we characterize the conditions from which randomness can be extracted in a QRNG based on homodyne measurements of vacuum fluctuations by assessing the impact of experimental limitations, such as the digitizer resolution or the presence of excess local oscillator (LO) noise due to an unbalanced detection. Moreover, we propose an estimation method to quantify the excess entropy contribution introduced by an unbalanced detection and analyze the implementation of the post-processing algorithm. Finally, we submitted the generated numbers to a set of statistical tests to assess the quality of its output randomness and verified that it passes the standard libraries.

1. Introduction

Reliable random numbers (RNs) fulfil an essential role in multiple applications, such as gambling, computer simulations, statistical analysis, or cryptography [1,2]. Traditionally, pseudo-random number generators (PRNGs) have been able to suppress this demand through fast, and easily implemented deterministic algorithms. Unfortunately, their output is only dependent on an initial seed and the algorithm itself, and, therefore, becomes predictable to an adversary with enough computational resources, as an inherent periodicity can be found [2,3]. As a result, their implementation is not suitable for critical applications, such as quantum key distribution (QKD), where true unpredictability is required [4,5]. In answer to these shortcomings, hardware-based implementations have been developed. These extract randomness from measurements of some apparently unpredictable physical process, such as atmospheric or electrical noise [6,7]. However, such devices are generally slow and difficult to implement as the yielded entropy is hard to quantify due to their susceptibility to practical imperfections or external manipulation by a malicious adversary, which can compromise the quality of their output [8]. Additionally, it is hard to give a convincing argument for the randomness yielded by some of these devices, as many implementations simply rely on ignorance about the entropy source rather than intrinsic randomness. If the physical process measured is deterministic, such as the case of classical phenomena or a chaotic system, the final result is nonetheless still fundamentally predictable, and reasonable doubts about the randomness of the output can be posed [1].

In contrast to PRNGs, QRNGs explore the intrinsic probabilist nature of quantum phenomena as their source of randomness. Several implementations have been proposed, including generation schemes based on detection of radioactive decays [9,10], but most schemes explore the proprieties of quantum optics through protocols, such as measurements of photon polarization states [11], amplified spontaneous emission [12,13,14], photon arrival times [15,16,17,18], or phase noise from selected light sources [19,20]. Recently, some fully integrated solutions have also materialized by employing photonic integrated circuits, which removes the need for bulky implementations [21,22,23,24,25,26]. This is an important first step to reach mass deployment and allow these implementations to compete with the versatility shown by PRNGs. Unfortunately, further work is necessary to integrate all components into a single compact package, as customized designs and expensive electronic components are frequently the required trade-off. Furthermore, achieving a high-performance integrated randomness platform is technically challenging, as considerations, such as the presence of dark currents, or the responsivity and the bandwidth of the photodetectors significantly impact the generation rates achievable [25]. Perhaps one of the most promising and well-researched implementations employs homodyne measurements of the fluctuations of a vacuum-state as its entropy source, with several recent high-rate generation schemes being proposed [26,27,28,29,30,31]. This approach offers high generation rates using a simpler setup than heterodyne-based QRNGs, can potentially be implemented with widely available technologies and shows high potential for on-chip integration due to the low number of components required. Furthermore, the vacuum state is easily obtained and can not be reproduced by an attacker, which provides resilience against external perturbations [27]. Despite this, several challenges are still present, such as assuring a good balancing condition or a significant quantum noise level, which can lead to the introduction of security loopholes [32].

In this work, we propose a method to quantify the excess entropy contribution resultant from an unbalanced homodyne detection in a vacuum-based generation scheme and obtain an estimation of at least $0.0554$ bit for the considered balancing condition. Moreover, we analyze the impact of practical limitations on the performance of the implementation. Under these conditions, the implementation shows the potential to deliver a rate of $19.53$ $\mathrm{Mbit}$/$\mathrm{s}$. By treating all classical noise as knowable to an eavesdropper, we obtain unbiased true random numbers that pass a 98.1% proportion of the applied state-of-the-art statistical evaluations.

This paper is organized into 5 sections. In Section 2 we present a theoretical description of the vacuum-based QRNG. Posteriorly, in Section 3, we describe the experimental implementation. In Section 4 we analyze the impact of practical imperfections and propose our entropy estimation method. Moreover, we apply a set of statistical tests to assess the quality of the implementation. Finally, in Section 5, a brief conclusion is presented.

2. Theoretical Description

In Figure 1, a schematic model of a homodyne detection scheme is illustrated. Here, the local oscillator, represented by the destruction operator ${\widehat{a}}_{\mathrm{LO}}\left(t\right)$, is directed towards a lossless beamsplitter (BS), where one of the input ports is kept blocked so that only the vacuum state, ${\widehat{v}}_s\left(t\right)$, is present at the second input port.

Considering a certain complex reflection coefficient, $\mathcal{R}$, we can define the BS imbalance, $\Delta$, as ${\left|\mathcal{R}\right|}^2=\left(\frac{1}{2}+\Delta \right)$ [33]. Under these assumptions, the output signals, ${\widehat{a}}_{3,4}\left(t\right)$, can be described as given by the input–output relations for a lossless BS [34]:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill {\widehat{a}}_3\left(t\right)& =i\sqrt{\frac{1}{2}+\Delta }{\widehat{a}}_{\mathrm{LO}}\left(t\right)+\sqrt{\frac{1}{2}-\Delta }{\widehat{v}}_s\left(t\right)\hfill \\ \hfill {\widehat{a}}_4\left(t\right)& =\sqrt{\frac{1}{2}-\Delta }{\widehat{a}}_{\mathrm{LO}}\left(t\right)+i\sqrt{\frac{1}{2}+\Delta }{\widehat{v}}_s\left(t\right).\hfill \end{array}\end{array}$$

(1)

Subsequently, the output signals are attenuated by two VOAs, modeled as two lossless BS, and detected by two photodiodes. Here, the VOAs are introduced to allow for balancing of the HD, since neither the BS nor the photodetectors are ideal in a realistic application. In this framework, the efficiency of the photodetectors is modeled by imposing a virtual BS before a theoretical perfect photodetector. As illustrated, one of the output signals of the virtual BS will be lost while the other, ${\widehat{d}}_{3,4}\left(t\right)$, is directly received by the detector. Here, ${\widehat{v}}_{3,4}\left(t\right)$ and ${\widehat{v}}_{\mathrm{VOA}3,\mathrm{VOA}4}\left(t\right)$ denote, respectively, the vacuum states of the ${\mathrm{VOA}}_{3,4}$ and the respective photodiodes. Analogously to Equation (1):

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill {\widehat{d}}_3\left(t\right)& =i\sqrt{\left(\frac{1}{2}+\Delta \right){\eta }_3{\eta }_{\mathrm{VOA}3}}{\widehat{a}}_{\mathrm{LO}}\left(t\right)+\sqrt{\left(\frac{1}{2}-\Delta \right){\eta }_3{\eta }_{\mathrm{VOA}3}}{\widehat{v}}_s\left(t\right)\hfill \\ \hfill & +i\sqrt{{\eta }_3(1-{\eta }_{\mathrm{VOA}3})}{\widehat{v}}_{\mathrm{VOA}3}\left(t\right)+i\sqrt{1-{\eta }_3}{\widehat{v}}_3\left(t\right)\hfill \\ \\ \hfill {\widehat{d}}_4\left(t\right)& =i\sqrt{\left(\frac{1}{2}-\Delta \right){\eta }_4{\eta }_{\mathrm{VOA}4}}{\widehat{a}}_{\mathrm{LO}}\left(t\right)+\sqrt{\left(\frac{1}{2}+\Delta \right){\eta }_4{\eta }_{\mathrm{VOA}4}}{\widehat{v}}_s\left(t\right)\hfill \\ \hfill & +i\sqrt{{\eta }_4(1-{\eta }_{\mathrm{VOA}4})}{\widehat{v}}_{\mathrm{VOA}4}\left(t\right)+i\sqrt{1-{\eta }_4}{\widehat{v}}_4\left(t\right),\hfill \end{array}\end{array}$$

(2)

where ${\eta }_{3,4}$ denote the quantum efficiency of each photodetector, and ${\eta }_{\mathrm{VOA}3,\mathrm{VOA}4}$ express the transmissivities of each VOA [33].

The photocurrents yielded in each photodetector, ${\widehat{i}}_{3,4}\left(t\right)$, are posteriorly subtracted and amplified by a transimpedance amplifier (TIA). Thus, in an ideally balanced scenario, any fluctuations common to both detectors are cancelled and only fluctuations in photon arrivals are measured, the so-called shot noise [33,35]. In reality, the presence of excess noise is unavoidable, and the output signal will always contain at least electronic noise. The resultant output voltage, ${\widehat{V}}_H\left(t\right)$, is given by the convolution, ⊗, between the difference current, ${\widehat{i}}_H$, and the detector’s impulse response function, $h\left(t\right)$:

$$\left\{\begin{array}{c}{\widehat{V}}_H\left(t\right)=G_{\mathrm{TIA}}\left[{\widehat{i}}_e\left(t\right)+{\widehat{i}}_H\left(t\right)\right]\otimes h\left(t\right)\hfill \\ {\widehat{i}}_H\left(t\right)=q\left[{\widehat{d}}_3^{†}\left(t\right){\widehat{d}}_3\left(t\right)-{\widehat{d}}_4^{†}\left(t\right){\widehat{d}}_4\left(t\right)\right]\hfill \end{array}\right.,$$

(3)

where ${\widehat{i}}_e$ is the amplifier electronic noise, $G_{\mathrm{TIA}}$ is the transimpedance amplifier gain, q is the charge of the electron, and ${\widehat{d}}_{3,4}^{†}\left(t\right){\widehat{d}}_{3,4}\left(t\right)$ corresponds to the photon flux of each output beam. Here, the normalized impulse response function, $h\left(t\right)$, should consider both the impact of finite bandwidth of the photodetectors and the TIA’s time response. Nonetheless, this function can be mainly characterized by the latter contribution due to the much lower bandwidths typically presented by the amplifier. Consequently, in this analysis, an equal ideal response, $h_p\left(t\right)$, was considered for both photodiodes, such that $h_p\left(t\right)=\delta \left(t\right)$. Under these approximations, the impulse response function can be approximated in the frequency domain by a Butterworth filter:

$${\left|H\left(w\right)\right|}^2=\frac{1}{1+{\left(\frac{w}{2\pi \Delta f}\right)}^{2n}},$$

(4)

where n is the filter-order, and $\Delta f$ is the detector’s bandwidth [36]. In its turn, the strong coherent laser signal can be described as:

$${\widehat{a}}_{\mathrm{LO}}\left(t\right)=\widehat{\alpha }\left(t\right)exp\left(i(w_{LO}t+\theta \left(t\right))\right),$$

(5)

where $\widehat{\alpha }\left(t\right)$ is the time-dependent photon flux, $w_{LO}$ the frequency and $\theta \left(t\right)$ the initial phase of the laser [33]. Here, the time-dependence of the initial phase implies the existence of phase noise. This, however, does not result in an additional noise contribution as long as no phase shift, $\Delta \varphi$, is present between the output beams of the beamsplitter. In this analysis, identical optical path lengths are considered for both output arms, such that $\Delta \varphi =0$, and its contribution can be disregarded. Considering a null mean electronic current, $\langle {\widehat{i}}_e\left(t\right)\rangle$, and $\widehat{\alpha }\left(t\right)=\sqrt{F+\Delta f_{lo}\left(t\right)}$, where F is the time-independent mean photon flux and $\Delta f_{lo}\left(t\right)$ denotes the intensity fluctuations, the expected output voltage is given by:

$$\langle {\widehat{V}}_H\left(t\right)\rangle =q{G}_{\mathrm{TIA}}\gamma F\otimes h\left(t\right),$$

(6)

where:

$$\gamma =\left(\frac{1}{2}+\Delta \right){\eta }_3{\eta }_{\mathrm{VOA}3}-\left(\frac{1}{2}-\Delta \right){\eta }_4{\eta }_{\mathrm{VOA}4}.$$

(7)

The voltage variance, ${\sigma }_{\mathrm{H}}^2\left(t\right)$, can be obtained from the autocovariance function, $K\left(\tau \right)$, evaluated at $\tau =0$. For a ergodic stationary stochastic process, and assuming that:

$$\left\{\begin{array}{c}\langle {\widehat{i}}_e\left(t_1\right){\widehat{i}}_e\left(t_2\right)\rangle =2\frac{k_{\mathrm{B}}T}{R}\delta (t_1-t_2)\hfill \\ \langle \Delta f_{lo}\left(t_1\right)\Delta f_{lo}\left(t_2\right)\rangle =\mathrm{RIN}{F}^2\delta (t_1-t_2),\hfill \end{array}\right.$$

(8)

where $k_{\mathrm{B}}$ is the Boltzmann constant, T the temperature, R the load resistance of the TIA, and RIN represents the average relative intensity noise (RIN) over the detector’s bandwidth [36], the autocovariance function can be calculated through Equations (3) and (6) as:

$$\begin{array}{c}\hfill \begin{array}{cc}\hfill K\left(\tau \right)=[2G_{\mathrm{TIA}}^2\frac{k_{\mathrm{B}}T}{R}& +q^2{G}_{\mathrm{TIA}}^2\beta F\hfill \\ \hfill & +q^2{G}_{\mathrm{TIA}}^2\mathrm{RIN}{\gamma }^2{F}^2]{\int }_{-\infty }^{+\infty }d{\tau }^{\prime }h(t-{\tau }^{\prime })h(t-{\tau }^{\prime }+\tau ),\hfill \end{array}\end{array}$$

(9)

where:

$$\beta =\left(\frac{1}{2}+\Delta \right){\eta }_3{\eta }_{\mathrm{VOA}3}+\left(\frac{1}{2}-\Delta \right){\eta }_4{\eta }_{\mathrm{VOA}4}.$$

(10)

This cross-correlation can be greatly simplified through the Wiener-Khinchin theorem. Abiding by the previous definitions, we obtain the analytical expression:

$${\sigma }_{\mathrm{H}}^2(t=0)=\frac{2\pi }{3}{G}_{\mathrm{TIA}}^2\Delta f\left[2\frac{k_{\mathrm{B}}T}{R}+q^2\beta F+q^2\mathrm{RIN}{\gamma }^2{F}^2\right]+\frac{{\delta }_q^2}{12},$$

(11)

for a Butterworth’s filter of order $n=3$, considering $t=\tau =0$. Here, we considered the quantization error of an analog to digital converter (ADC) with a bin width of ${\delta }_q$, which yields a quantization error variance of $\frac{{\delta }_q^2}{12}$ [37].

Finally, it is possible to rewrite the Equations (6) and (11) in function of the wavelength-dependent responsivity, $\mathcal{R}\left(\lambda \right)$, and the optical power of the LO, $P_{LO}$. Assuming that ${\eta }_3={\eta }_4$:

$$\left\{\begin{array}{c}\langle {\widehat{V}}_H\left(t\right)\rangle =G_{\mathrm{TIA}}{\gamma }^{\prime }\hfill \\ {\sigma }_{\mathrm{H}}^2(t=0)=\frac{2\pi }{3}{G}_{\mathrm{TIA}}^2\Delta f\left[2\frac{k_{\mathrm{B}}T}{R}+q{\beta }^{\prime }+q\mathrm{RIN}{\gamma }^{\prime 2}\right]+\frac{{\delta }_q^2}{12},\hfill \end{array}\right.$$

(12)

where:

$$\left\{\begin{array}{c}{\beta }^{\prime }=\mathcal{R}\left(\lambda \right)P_{LO}\left[\left(\frac{1}{2}+\Delta \right){\eta }_{\mathrm{VOA}3}+\left(\frac{1}{2}-\Delta \right){\eta }_{\mathrm{VOA}4}\right]\hfill \\ {\gamma }^{\prime }=\mathcal{R}\left(\lambda \right)P_{LO}\left[\left(\frac{1}{2}+\Delta \right){\eta }_{\mathrm{VOA}3}-\left(\frac{1}{2}-\Delta \right){\eta }_{\mathrm{VOA}4}\right].\hfill \end{array}\right.$$

(13)

As described, this detection scheme yields an outcome defined by four main noise sources. In addition to electronic noise, which is independent of the incident optical power, excess LO noise, quadratically dependent on the impinging power, can appear as a consequence of the inability to completely cancel fluctuations of the local oscillator [35,38]. Particularly, quantum noise, whose variance is proportional to the LO power, is always present [33]. It is from these contributions that randomness can be extracted, as quantum noise measurements are proportional to the quadrature amplitude of the vacuum state, and, thus, obey a Gaussian distribution whose inherent uncertainty is guaranteed by quantum mechanics [39]. Finally, a small additional variance contribution is introduced by the quantization error in the uniform quantizer. The total variance is simply the sum of these contributions, and, thus, a preponderance of quantum noise should be guaranteed to preserve the generator’s output statistical quality.

3. Materials and Methods

A schematic representation of the implemented QRNG is shown in Figure 2. A continuous-wave laser at $1550.92$ $\mathrm{n}$$\mathrm{m}$ is used as the LO, and an optical bandpass filter (OBF) is applied to suppress its sideband frequencies. Posteriorly, the LO is split by a 90/10 BS (BS1) such that an optical power meter (OPM) in the 10% output arm allows real-time monitoring of the power level without tampering with the setup. The LO is then split by a second BS (BS2) with one of its input ports blocked to assure the purity of the vacuum state. After the BS2, the resulting output beams are detected by a pair of photodiodes on a ThorLabs PDB450C balanced amplified photodetector with an output bandwidth of 45 MHz. A VOA is placed in one of the output arms to allow precise adjustments of the BS2 splitting ratio. To better account for the differences in the responsivity of the photodiodes, the attenuation was set, such that the photocurrents measured were indistinguishable. The subsequent signal is amplified with a TIA and finally digitized by an 8-bit Picoscope 6403D ADC with a $\pm 50$ $\mathrm{m}$$\mathrm{V}$ acquisition range.

As previously described, the homodyne measurements also contain unwanted noise, such as electronic noise that is intrinsic to the electronic components in the experimental setup. Consequently, the RNs yielded by the QRNG are never truly random but contain simultaneously quantum and classical contributions. A randomness extraction process is thus required to suppress these contributions and attain secure true RNs since all classical noise can, in principle, be known and manipulated by an adversary. Consequently, the raw measurements are at last subjected to a post-processing algorithm that outputs a sequence of uniformly distributed random bits. This process requires obtaining a uniform distribution, quantifying the entropy that originates from quantum phenomena, $H_{\mathrm{quant}}$, and applying a randomness extractor.

Initially, to obtain a sequence of uniformly distributed bits, a binning process is applied to the Gaussian distribution of homodyne measurements. Here, a bit sequence of length n is assigned to all outcomes that fall in the same bin and, therefore, n-bit unbiased RNs are produced. The sequence length merely depends on the number of bins used, such that $2^n$ bins are required for a sequence of n bits [27,28]. The total entropy, $H_{\mathrm{total}}$, yielded by a bit sequence obtained through the binning process is given by the Shannon entropy, for a uniform distribution X:

$$H{\left(X\right)}_{\mathrm{total}}=-\sum _{i=1}{p}_i{log}_2{p}_i={log}_2\left(p_i\right)=n,$$

(14)

where $p_i$ is the probability of finding a sample on the i-th bin [40]. This same process can also be applied to assess the contribution of electronic noise. As such, measurements of these fluctuations are taken by removing the LO and the same binning is superimposed to its distribution. The entropy contribution originating from the electronic noise is given by:

$$H_{\mathrm{elec}}=-\sum _{i=1}^{2^n}{p}_i^{\mathrm{e}}{log}_2{p}_i^{\mathrm{e}},$$

(15)

where $p_i^{\mathrm{e}}$ is the probability of finding an electronic noise measurement in each bin. Although this quantity is relatively constant, periodic evaluations of the noise level can be made to ensure that it does not increase [27,41]. This constitutes the major contribution to the fraction of entropy originating from classical effects, $H_{\mathrm{class}}$. Nonetheless, on a practical generation scheme, an additional component will be introduced by excess LO noise due to an unbalanced detection, $H_{\mathrm{unbal}}$, such that:

$$H_{\mathrm{class}}=H_{\mathrm{elec}}+H_{\mathrm{unbal}}.$$

(16)

Through this method, we can establish the fraction of randomness that is possible to extract from each sample without compromising the generator’s outcome:

$$H_{\mathrm{quant}}=H_{\mathrm{total}}-H_{\mathrm{class}}.$$

(17)

As all entropies calculated depend on the binning applied, it is advantageous to find the binary sequence length n that maximizes the effective bits that can be extracted from each sample. Finally, the measurements are submitted to a randomness extractor, as described in Section 4.3.

4. Results and Discussion

To verify that there is a preponderance of quantum noise over electronic noise, the spectral density power was taken both with and without the LO, considering an input power of 12 $\mathrm{dBm}$, as can be seen in Figure 3.

For both cases, the high-frequency domain is defined by the cut-off frequency from the detector’s bandwidth at 45 MHz. Moreover, strong spectral contributions were observed at low frequencies. These can arise both from electric hum and an imperfect subtraction of the photocurrents since the HD has a finite common-mode rejection ratio of 30 dB. To suppress these frequencies, as well as flicker noise associated with the electrical circuit, an 8535 Inmet RF DC Block was applied after the amplification step. It acts as a high-pass filter, blocking all frequency components inferior to 7 $\mathrm{kHz}$. Consequently, the spectral curve below 40 MHz yields the relatively flat power density required for unbiased random number generation. In fact, no strong spectral peaks are observed for this interval, and the total noise clearance over electronic noise was measured to be at least 5 $\mathrm{dBm}$. This clearly shows the difficulty in obtaining an expressive quantum to classical noise ratio (QCNR), which limits the available quantum entropy.

4.1. Estimation of Entropy Due to Detection Unbalancing

As shown through Equation (12), an increase in the QCNR can be made by minimizing the electronic noise, for example, by controlling the setup temperature or using a detector with a lower noise floor. Unfortunately, such methods increase costs and introduce complexity to the implementation. Alternatively, a simple increase in the laser’s optical power can be made, since the shot noise variance increases linearly with the impinging power. Unfortunately, this is not always possible, as excess noise quadratically dependent on the LO power also appears as a consequence of an unbalanced detection, either due to a BS imbalance, different path losses, or different photodetector’s efficiencies between each path. To experimentally verify the presence of this quadratic power dependency, the detector’s characterization curve was obtained for an unbalanced condition by introducing a VOA before the BS1 and varying the LO optical power, as can be observed in Figure 4. Here, each variance was evaluated over $15.625\times {\mathrm{10}}^7$ noise samples, and the electronic noise level was assumed to remain constant throughout the experimental process. As expected by the theoretical description, the variance, ${\sigma }^2$, follows a quadratic dependency with the input power at BS2, $P_{\mathrm{LO}}$ [42]:

$${\sigma }^2=a{P}_{\mathrm{LO}}^2+b{P}_{\mathrm{LO}}+c.$$

(18)

A regression with $r^2=0.9853$ allows to obtain the coefficients: $c=$ $7.652{10}^{-7}$ ${\mathrm{V}}^2$, $b=$ $2.708\times {10}^{-7}$ ${\mathrm{V}}^2$/$\mathrm{m}$$\mathrm{W}$, $a=$ $3.277\times {10}^{-7}$ ${\mathrm{V}}^2$/$\mathrm{m}$${\mathrm{W}}^2$. This clearly highlights the quadratic dependency of the variance with the input power and illustrates the importance of achieving a well-balanced detection. As represented in Figure 4, the electronic noise level is independent of the optical power. Nonetheless, for an unbalanced detection, two distinct regions emerge. For low LO powers, the variance is dominated by these intrinsic electronic noise contributions and its increase can be mainly attributed to shot noise, which grows linearly with $P_{\mathrm{LO}}$. For higher impinging power, however, the excess RIN noise becomes more significant and constitutes the majority of the total noise due to the observed quadratic dependency. As described in Section 2, its impact is dependent on the balancing condition of the detection scheme.

At a given LO power, this manifests itself as an additional entropy contribution, $H_{\mathrm{unbal}}$, dependent on the scheme unbalancing, that should be correctly quantified to avoid overestimating the available quantum entropy, thus compromising the generator output. With this objective, we assessed the entropy contributions as a function of the homodyne detection unbalance, as represented in Figure 5.

Here, the LO power was fixed at approximately $1.33$ $\mathrm{dBm}$ to avoid saturating the TIA output signal. Posteriorly, the path attenuation was changed through the employment of a VOA, so that we can iterate over the detection’s asymmetry $\Delta P=\frac{P_1}{P_{\mathrm{total}}}$, defined as the ratio between the optical power measured at the output without the VOA, $P_1$, and the total impinging power, $P_{\mathrm{total}}$. It should be noted that this is theoretically distinct from simply varying the BS transmittance since the total power that reaches the photodetectors decreases with the additional attenuation. The electronic and quantum noise contribution were calculated as described is Section 3 for practical asymmetries of 50.75%, 55.28%, 59.72%, 64.90%, and 68.93%, yielding respective quantum contributions of $0.0836$, $0.1085$, $0.6793$, $1.083$, and $1.298$ bit from a total entropy of 5 bits. Additionally, a comparison with the theoretically expected values, obtained through Equation (11), is also presented, considering a measured RIN of $-135$ dB/Hz. The measured entropy, as can be seen in Figure 5a, appears to increase with the detection unbalancing. Since the total impinging optical power does not increase, it is trivial to attribute this to excess LO noise, and we conclude that a larger asymmetry increases the impact of the excess LO noise on the measured entropy.

To quantify $H_{\mathrm{unbal}}$, we start by calibrating the measurement scheme and consider that the most balanced state achievable (asymmetry of 50.75%) has a negligible excess LO noise contribution. Assuming that $H_{\mathrm{quant}}$ remains relatively constant, all posterior increases are thus the result of introducing excess LO noise. As seen in Figure 5b, this contribution increases linearly with the asymmetry. By contrast, as a consequence of a higher signal-to-noise ratio, the contribution from the electronic noise decreases in the same proportion that $H_{\mathrm{unbal}}$. We thus find that given a constant total entropy and impinging optical power, the fraction of entropy from classical effects is in reality constant and independent of the asymmetry. If the excess LO noise is unaccounted for, this results in more bits accessible to an eavesdropper. Naturally, our assumptions result in an overestimation of $H_{\mathrm{quant}}$, since our measurement scheme is always slightly unbalanced. To obtain an acceptable estimation, we performed a linearisation with $r^2=0.9523$ of the $H_{\mathrm{unbal}}$ values, which yields $H_{\mathrm{unbal}}=0.0741\Delta \mathrm{P}$. Then, knowing the maximum possible asymmetry, we estimate that $H_{\mathrm{unbal}}=0.0554\mathrm{bits}$ for our balanced implementation. We thus find a corrected quantum contribution of $0.0282$ bit, 66.3% lower than originally measured. Unfortunately, these assumptions hold true only when no additional attenuation is introduced. Here, the decrease in $P_{\mathrm{total}}$ leads to a reduction in the quantum noise contributions with an increasing attenuation, and thus this value should be adjusted accordingly. Nonetheless, the value obtained is an acceptable estimation for asymmetries close to a balanced detection. Although the electronic noise is still the major contribution to a balanced system, this method allows us to increase the QRNG security by discarding these insecure bits.

4.2. Noise Characterization

The electronic components within the homodyne detector induce correlation between samples taken at different instants of time in the digitizer. To ensure uncorrelated measurements and avoid randomness overlapping, a sampling rate of $39.06$ $\mathrm{M}$$\mathrm{Sa}$/$\mathrm{s}$ was chosen. Ideally, a sampling rate inferior to twice the detector’s bandwidth should be used, as described by the Nyquist sampling theorem. In Figure 6, the correlation coefficients were evaluated over $15.6\times {10}^6$ data points for a maximum delay of 100 samples. As can be seen, these rapidly drop to below $1.9\times {10}^{-3}$ at 12 $\mathrm{dBm}$ and $6.8\times {10}^{-4}$ for electronic noise samples. Although they never reach zero due to the signal’s finite bandwidth, these low values hint at a negligible correlation between samples, which is essential for any reliable random number generator.

For this implementation, we obtain a QCNR value of approximately 5 dB with an electronic noise variance of $0.67$ $\mathrm{m}$${\mathrm{V}}^2$. Approximately $17\times {10}^9$ noise samples were recorded, as well as periodical evaluations of the electronic noise, and a histogram for ${10}^7$ samples was plotted to verify that all noise follows the expected Gaussian distribution, as can be seen in Figure 7. Means of $0.1004$ $\mathrm{m}$$\mathrm{V}$ and $-0.1360$ $\mathrm{m}$$\mathrm{V}$ were calculated for the homodyne and electronic noise samples, respectively. These values could hint at a slightly unbalanced detection but are low enough to be disregarded. Each represented bin corresponds to a unique ADC value, which shows the concentration of measurements on a small number of bins due to the ADC resolution and acquisition range available.

Here, the ADC resolution and acquisition range also present another relevant consideration. For a given resolution, the acquisition range must be properly chosen as to not risk endangering the security of the implementation. For instance, a wide acquisition range will lead to the concentration of all samples on a small number of quantization levels [43]. Thus we misrepresent the Gaussian distribution and necessarily limit the randomness that can be extracted. The necessity to lower the extraction ratio in this situation is made obvious by the consideration that, with increasing acquisition ranges, the homodyne and electronic noise distributions will be progressively indistinguishable, since measurements are mapped to the same limited number of bins. In an extreme case, guessing the yielded outcome will become trivial to an adversary, as the limited number of unique values greatly increases the probability of finding a measurement in each particular bin. This can partially be compensated by increasing the ADC resolution and, thus, diminishing the outcome probability of each bin. On the other hand, a narrow acquisition range increases the probability of a measurement falling outside the considered interval and, consequently, leads to saturation of the first and last bins. In this case, the probability of these particular results increases, which could be used by an observant adversary to increase its chances of predicting the QRNG outcome. For the chosen ADC, at most, only 256 unique values can be represented. Furthermore, the selected $\pm 50$ $\mathrm{mV}$ acquisition range results in a large portion of the ADC range not being utilized. This further limits the performance of our implementation and, ideally, a more appropriate interval should be considered [43].

4.3. Randomness Extraction

With the aforementioned conditions, the effective entropy of our implementation converges to a sequence length of 4 bit, after which no significant increase in the effective bits extracted is achieved. This can be seen in Figure 8. The distribution is thus divided into 16 bins and the measurements are assigned to a 4-bit Gray sequence. The electronic noise yields a contribution of roughly $3.50$, $\mathrm{bit}$ which corresponds to an extraction ratio of $0.50$ $\mathrm{bit}$ from each sample. As expected, due to the QCNR value of 5 dB obtained, only a relatively small portion of bits is available to generate true RNs, which constitutes the main technical challenge of this implementation.

Two distinct randomness extractors were applied to the unprocessed bits: the SHA-512 cryptographic hash function and the Toeplitz-hashing extractor. The desired extraction ratio is achieved by hashing data subsets of appropriate length and merging the results. For the Toeplitz implementation, pseudorandom numbers are used as a seed of the hashing matrix, which can potentially influence the final RN security [44]. Ideally, sacrificing part of the QRNG output should be explored or, since this method constructs a strong extractor, a second source of randomness can be used to obtain a reusable seed [45]. The raw bits were thus subdivided into sequences of $2^{12}$ bits ($n=4096$) and hashed with different seeds. The output sequence length, m, of the Toeplitz hashing algorithm is chosen, such that the ratio is lower than the maximum allowed:

$$m=\lfloor 2^{12}p\frac{H_{\mathrm{quant}}}{H_{\mathrm{total}}}\rfloor ,$$

(19)

where p was arbitrarily chosen as $80\%$ to account for any potential entropy overestimation. Thus approximately $0.10$ random bits are obtained from each raw bit. By contrast, this consideration was disregarded for the SHA-512 extractor, and thus an extraction ratio of approximately $0.13$ random bits for each raw bit is roughly preserved. In this case, the output length m is set as 512 bit and the input sequence length is chosen such that:

$$n=\lceil 512\frac{H_{\mathrm{total}}}{H_{\mathrm{quant}}}\rceil .$$

(20)

The post-processing execution time severely limits the final bit rate since the algorithm implementation is incapable of keeping pace with the physical data generation rate. As such, a rate of 278 $\mathrm{kbit}$/$\mathrm{s}$ and $1.68$ $\mathrm{Mbit}$/$\mathrm{s}$ were reached with the Toeplitz and SHA-512 extractor, respectively. Nevertheless, this setup could theoretically achieve approximately $19.69$ $\mathrm{Mbit}$/$\mathrm{s}$.

4.4. Randomness Validation

To complement the validation of the implemented QRNG, a sample size of $6.8$ $\mathrm{Gbit}$ was subjected to three state-of-the-art suites of randomness tests: the TestU01’s SmallCrush library [46], Dieharder test battery [47], and NIST SP 800-22 statistical suite [48]. These results are, respectively, represented in

Table A1. TestU01’s SmallCrush results. For tests with multiple variants the worst case is reported.

	Toeplitz-Hashing		SHA-512
Statistical Test	p-Value	Result	p-Value	Result
BirthdaySpacings	0.38	PASSED	0.75	PASSED
Collision	0.02	PASSED	0.11	PASSED
Gap Chi-square	0.92	PASSED	0.53	PASSED
SimpPoker Chi-square	0.40	PASSED	0.32	PASSED
CouponCollector Chi-square	0.01	PASSED	0.68	PASSED
MaxOft Chi-square	0.40	PASSED	0.07	PASSED
MaxOft Anderson-Darling	0.85	PASSED	0.39	PASSED
WeightDistrib Chi-square	0.17	PASSED	0.98	PASSED
MatrixRank Chi-square statistic	0.40	PASSED	0.58	PASSED
HammingIndep Chi-square	0.33	PASSED	0.09	PASSED
RandomWalk1 H Chi-square	0.98	PASSED	0.91	PASSED
RandomWalk1 M Chi-square	0.88	PASSED	0.66	PASSED
RandomWalk1 J Chi-square	0.76	PASSED	0.83	PASSED
RandomWalk1 R Chi-square	0.44	PASSED	0.72	PASSED
RandomWalk1 C Chi-square	0.12	PASSED	0.16	PASSED

,

Table A2. Dieharder test suite with the default significance level $\alpha =0.000001$. A certain test run is successful if the p-value satisfies 0.000001 ≤p-value ≤ 0.999999. For tests with multiple variants the worst case is reported.

	Toeplitz-Hashing		SHA-512
Statistical Test	p-Value	Result	p-Value	Result
Diehard Birthdays	0.40675035	PASSED	0.81784655	PASSED
Diehard 32x32 Binary Rank	0.02168705	PASSED	0.46240278	PASSED
Diehard 6x8 Binary Rank	0.98421063	PASSED	0.67581951	PASSED
Diehard Bitstream	0.66303940	PASSED	0.93744997	PASSED
Diehard OPSO	0.42701312	PASSED	0.93850768	PASSED
Diehard OQSO	0.74489236	PASSED	0.94218224	PASSED
Diehard DNA	0.87945687	PASSED	0.77400353	PASSED
Diehard Count the 1s (stream)	0.30986065	PASSED	0.65195156	PASSED
Diehard Count the 1s (byte)	0.99239469	PASSED	0.70164035	PASSED
Diehard Parking Lot	0.56185317	PASSED	0.72169377	PASSED
Diehard Minimum Distance	0.16836407	PASSED	0.53282829	PASSED
Diehard 3d Sphere	0.92122584	PASSED	0.09348519	PASSED
Diehard Squeeze	0.68478371	PASSED	0.23210050	PASSED
Diehard Runs	0.95289230	PASSED	0.17701485	PASSED
Diehard Craps	0.18203675	PASSED	0.99248414	PASSED
Marsaglia and Tsang GCD	0.01817631	PASSED	0.00951490	PASSED
STS Monobit	0.43252666	PASSED	0.51032516	PASSED
STS Runs	0.24917333	PASSED	0.77819504	PASSED
STS Serial	0.97590450	PASSED	0.03058377	PASSED
RGB Bit Distribution	0.08876097	PASSED	0.99122344	PASSED
RGB Generalized Minimum Distance	0.18986042	PASSED	0.02234684	PASSED
RGB Permutations	0.01963750	PASSED	0.29229770	PASSED
RGB Lagged Sum	0.00849654	PASSED	0.75151327	PASSED
RGB Kolmogorov-Smirnov Test	0.38746113	PASSED	0.48506319	PASSED

and

Table A3. NIST test suite with the default $\alpha =0.01$ and a bit stream length of 13,525,308 bit. The minimum pass rate is 488/500 with the exception of the random excursion where it is 429/440 for the Toeplitz-hashing extractor. For tests with multiple p-values the smallest case is represented.

	Toeplitz-Hashing			SHA-512
Statistical Test	p-Value	Proportion	Result	p-Value	Proportion	Result
Frequency	0.526105	498/500	PASSED	0.870856	498/500	PASSED
BlockFrequency	0.459717	494/500	PASSED	0.538182	496/500	PASSED
CumulativeSums	0.168112	496/500	PASSED	0.090936	497/500	PASSED
Runs	0.307077	496/500	PASSED	0.562591	494/500	PASSED
LongestRun	0.844641	494/500	PASSED	0.595549	496/500	PASSED
Rank	0.550347	495/500	PASSED	0.486588	497/500	PASSED
FFT	0.820143	496/500	PASSED	0.916599	500/500	PASSED
NonOverlappingTemplate	0.010834	494/500	PASSED	0.012474	497/500	PASSED
OverlappingTemplate	0.000000	487/500	FAILED	0.000000	484/500	FAILED
Universal	0.047478	495/500	PASSED	0.662091	494/500	PASSED
Approximate entropy	0.921624	493/500	PASSED	0.691081	496/500	PASSED
Random excursions	0.039635	437/440	PASSED	0.159545	440/443	PASSED
Random-excursions variant	0.041438	437/440	PASSED	0.110705	437/443	PASSED
Serial	0.063615	499/500	PASSED	0.307077	499/500	PASSED
LinearComplexity	0.401199	492/500	PASSED	0.603841	497/500	PASSED

for data subjected to both random extractors. As can be seen, the output of both extractors passes the majority of statistical tests, which shows the effectiveness of the post-processing stage and is an excellent indicator of quality for the implement generator. No discernible difference was identified between the quality of the hashed variants. Nonetheless, the SHA-512 extractor implementation is significantly faster. However, in the NIST statistical suite (Table A3), it should be mentioned the failure of the OverlappingTemplate test. As described in [48], this test detects deviations in the expected number of occurrences of a given bit pattern B with a certain length m. With this objective, each bit sequence was divided into substrings of 1032 bit and a 1-bit sliding window was used to search for a 9-bit run of ones. Streams with too many or too few occurrences of 9-bit runs of ones will conclusively be rejected with a p-value $\le 0.01$. For multiple runs of the test, a uniform distribution of p-values is expected to occur, and a minimum of 488 runs must pass. In the OverlappingTemplate test, only 484 sequences satisfied this condition for the SHA-512 extractor variant. Conversely, 487 sequences passed this evaluation with the Toeplitz extractor, which indicates a marginally better result. A similar result can be seen in the distribution of p-values represented in Figure 9a,b for the SHA-512 and Toeplitz-hashed variants, respectively. Here, the former clearly shows a more pronounced deviation from a uniform distribution, with 20.6% of the values contained between $[0,0.1]$. Yet, the failure of both data variants is significant as it implies a flaw in the entropy source, entropy evaluation, or the randomness test itself, and not in the implementation of a particular randomness extractor. Consequently, although a conclusive reason for the observed result is difficult to give, a more extensive characterization of the entropy source and the raw output should be made to assess any potential correlations. This result may yet originate in undetected correlations induced by the TIA, or in some excess noise not properly accounted for, which leads to an overestimation of the available entropy and a reduction in the statistical distance to a uniform distribution. Additionally, the abnormal runs of ones can originate in the relatively small number of unique 4-bit sequences output by the generator. In the meantime, this problem may be mitigated by restricting the use of the output of this QNRG implementation as a seed to a cryptographically secure PRNG.

In this way, the presence of some bias, namely the yielding of an abnormal frequency of 9-bit sequences of ones (and consequently of zeros), is detected. Given these results, we are forced to reject the hypothesis that the QRNG yields an output arbitrarily close to a uniform distribution, although this does not imply the absence of useful randomness or that the output is periodic. In fact, the implementation successfully passes a significant majority of the evaluations, including the other randomness test suites, which highlights its viability as a randomness source.

As a complementary analysis, we calculated the correlation coefficients from all data variants, including the raw unprocessed variant where only the binning process was applied. As can be seen in Figure 10, the coefficients are significantly lower for the hashed variants, which shows that the randomness extraction process is effective at removing correlation between different samples. This result clearly supports the quality of this QRNG implementation.

5. Conclusions

In conclusion, a low-cost and high-speed QRNG based on homodyne measurements of vacuum fluctuations has been demonstrated and characterized. Detailed analysis of the main limiting factors to the implementation performance was made, and, in particular, a method for estimating the entropy contribution from the excess LO noise was presented. Results show that, when the total impinging power is constant, the entropy from classical contributions does not depend on the detection unbalancing, and, thus, the extractable randomness is constant. Through the proposed method, for an asymmetry of 50.75%, we find that only approximately 33.7% of the measured entropy can reliably be attributed to quantum fluctuations. Assuming that an eavesdropper has complete knowledge of electronic noise, an extraction rate of $0.5$ true random bits per sample was achieved, which allows a theoretical throughput up to $19.53$ $\mathrm{Mbit}$/$\mathrm{s}$. A randomness extraction operation is used to eliminate security loopholes introduced by electronic noise. This yields 192 $\mathrm{kbit}$/$\mathrm{s}$ by applying a Toeplitz-hashing extractor, and $1.68$ $\mathrm{Mbit}$/$\mathrm{s}$ with an SHA-512 extractor. The resultant true RNs pass a proportion of 98.1% of the applied statistical tests, including the standard Dieharder and TestU01’s SmallCrush tests as well as most of NIST suite, corroborating the presence of high-quality randomness.