Realization of a source-device-independent quantum random number generator secured by nonlocal dispersion cancellation

Abstract. Quantum random number generators (QRNGs) can provide genuine randomness by exploiting the intrinsic probabilistic nature of quantum mechanics, which play important roles in many applications. However, the true randomness acquisition could be subjected to attacks from untrusted devices involved or their deviations from the theoretical modeling in real-life implementation. We propose and experimentally demonstrate a source-device-independent QRNG, which enables one to access true random bits with an untrusted source device. The random bits are generated by measuring the arrival time of either photon of the time–energy entangled photon pairs produced from spontaneous parametric downconversion, where the entanglement is testified through the observation of nonlocal dispersion cancellation. In experiment, we extract a generation rate of 4 Mbps by a modified entropic uncertainty relation, which can be improved to gigabits per second by using advanced single-photon detectors. Our approach provides a promising candidate for QRNGs with no characterization or error-prone source devices in practice.


Introduction
Random numbers are important resources in scientific and practical applications. Classical random number generators deny the existence of unpredictability, which cannot provide secure randomness. In contrast, quantum random number generators (QRNGs) can generate genuine randomness from the inherent indeterminacy of quantum mechanics, 1,2 which have been applied in various quantum information processing tasks. [3][4][5] In the last decades, the generation of quantum random numbers has been extensively studied. Various high-speed and real-time QRNGs have been developed [6][7][8][9] and started to become commercial. 10,11 However, these QRNGs can only extract true randomness based on the strong assumption that the source and measurement devices are trusted. The device-independent QRNG (DI QRNG) 4,12,13 is able to access true randomness without any assumptions on the source and measurement devices, but it requires a loophole-free Bell test, resulting in great challenges in implementation and low efficiency. An alternative technique is semi-DI QRNG, where high speed and low-cost information-provable randomness can be generated based on a few justifiable assumptions on the system operation and its critical components, such as trusted sources, [14][15][16][17] the characterized measurement settings, [18][19][20][21][22][23][24] assumptions on the indistinguishability, or dimension of the input states. [25][26][27][28] For practical semi-DI QRNGs, security, generation rate, and practicality are highly desirable in applications. Particularly, any deviation of the realistic source from its theoretical modeling may affect the security and generation rate of true randomness. Source-DI QRNGs generating true randomness from an untrusted source provided convenient and characterized measurement devices, offer distinct advantages in semi-DI QRNGs, and have been extensively studied.
One kind of approach is based on measurement of the vacuum noise via homodyne detection. 23,[29][30][31] Benefiting from the fast detection speed, such a technique has achieved a random number generation rate as high as gigabits per second (Gbps); however, the homodyne detection requires a well modeled and calibrated local oscillator. In contrast, the single-photon detection technique, despite the drawback on detection speed, has the merit of easy operation and simple structure. With such a technique, source-DI QRNGs have also been reported 18,20 based on an assumption of the squashing model 32 in the detection devices. In this paper, we propose and experimentally demonstrate a secure and fast source-DI QRNG based on single-photon detection and entangled photons. The random bits are generated via the measurement of photon arrival time that is beneficial for producing high-dimensional QRNGs. 33,34 In our scheme, we use either photon of time-energy entangled photon pairs produced from spontaneous parametric downconversion (SPDC) as the entropy source. The security of our scheme relies on the observation of nonlocal dispersion cancellation (NDC), 35 which has been applied to guarantee the security of quantum key distribution tasks. [36][37][38] Moreover, we employ a modified entropic uncertainty relation (EUR) 39 to quantify the randomness to improve security. The experiment results show that the genuine quantum randomness can be extracted at a rate of 4 Mbps (megabits per second), which could reach the level of Gbps if using the advanced single-photon detectors with faster detection speed and lower temporal resolution.

Source-DI QRNG Protocol
In our protocol, we suppose an untrusted source produces a tripartite state ρ ABE with the reduced state ρ AB ¼ Tr E ½ρ ABE , where A and B are distributed to two noncommunicating observers named Alice and Bob, respectively, and E is held by the underlying eavesdropper Eve as a quantum memory or considered as the environment. In the ideal case, ρ AB is a pure time-energy entangled photon pair state generated via SPDC. Here we suppose that the SPDC source is pumped by a pulsed laser with a center frequency of ω p and a coherence time of σ coh and that the generated photon pairs have a correlation time of σ cor determined by phase-matching bandwidth. The ideal state can be written in the time and frequency domains, respectively, as follows: (1) where the joint time function ψðt A ; t B Þ and joint frequency function ϕðω A ; ω B Þ are given by Alice and Bob both have two trusted positive operator-valued measures (POVMs), denoted by T j δ ¼ fT j k g and D j δ ¼ fD j k g with j ∈ fA; Bg and k ∈ N. The measurement T j δ is the direct photon arrival time detection, expressed as p e iωt jωi j and δ is the detection precision of the system. The other measurement, D j δ , is the arrival time detection after the photons in Alice and Bob, respectively, undergo normal and anomalous dispersion with equal magnitudes, which can be written as 2π p e iðωtþβ j ω 2 ∕2Þ jωi j and β AðBÞ is the groupvelocity dispersion (GVD) coefficient in Alice (Bob) satisfy- However, in practice, we perform measurements T j δ and D j δ in a range from −N d δ∕2 to N d δ∕2, where N d is the frame size (dimensionality); thus the null measurements T ∅ j and D ∅ j can be defined when the photon arrives before or after the range, which limits the characterization of entanglement in high-dimensional quantum systems. 39 The null measurements can be expressed by Then the refined POVMs can be written as k¼−N d ∕2 ⋃D ∅ j . Alice and Bob choose two measurements, T δ and D δ , separately, which are switched through a classical random signal S with probabilities q and 1 − q, respectively. Before extracting random numbers, Alice and Bob record the joint outcomes of the measurements T δ to estimate the detection precision δ of the system. Then the outcomes of measurement T δ in Alice are recorded as the raw random bits, whereas the joint outcomes of the measurements D δ for Alice and Bob are utilized to certify the entanglement of source and estimate the amount of randomness.
In the process of certification for the source, the NDC 35 is available as a nonlocal test of the time-energy entanglement, where the dispersion effect can be nonlocally canceled when two time-energy entangled photons propagate in two media with equal magnitudes and opposite dispersion signs, respectively. We define the code distance associated with the outcomes of measurement D δ as a testing value d given by 38 where σ coh;D is the correlation time of the photon pairs when Alice and Bob both perform measurement D δ , and σ coh;D ¼ ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi σ 2 cor þ β 2 ∕4σ 2 coh p for the ideal state. The source can be certified to be time-energy entangled if d is less than the classical bound determined by the actual experimental parameters (see Appendix A for details). A preset value d 0 is selected here that is not larger than the classical bound, and the protocol is aborted when d > d 0 .
Since the source device is untrusted, the input state might be controlled by an eavesdropper, Eve, who can obtain the side information through system E. The amount of genuine randomness that can be extracted from Alice in measurement T δ is quantified by the conditional quantum min-entropy 40 defined as H min ðT A δ jEÞ ¼ −log 2 P guess ðT A δ jEÞ, where P guess ðT A δ jEÞ is the maximum probability that Eve guesses correctly the outcome of T δ conditional on her side information. In previous works, the lower bound of conditional quantum min-entropy H min ðT A δ jEÞ can be given by exploiting the EUR. 41,42 In practical implementations, the finite measurement range problem will significantly compromise the evaluation of secure min-entropy. To further improve security, we explore the extractable randomness lower bound with the modified EUR 39 based on smooth entropy by taking into account the finite measurement range. The ϵ-smooth conditional min-and maxentropies are defined as where B ϵ ðρÞ ¼ fρ 0 j 1 2 kρ − ρ 0 k tr ≤ ϵg is the set of operators within an ϵ distance of ρ. Then the modified EUR is written as 39 where and p ∅ A are the null probabilities for measurement T ∅ A and D ∅ A , respectively, which can be written as where σ coh 0 is the standard deviation of arrival-time distribution photon A after propagating through the dispersive medium. (12) is the maximum overlap for the POVMs T A δ and D A δ , excluding the null measurement POVM elements, satisfying 39 because the sets of POVMs over which the former is maximized are subsets of the sets over which the latter is maximized. Thus we obtain where β ¼ jβ A j (see Appendix B for details). The smooth conditional max-entropy H ϵ max ðD A< δ jBÞ ρ in Eq. (12) represents Bob's lack of knowledge about the measurement results of D A δ after Alice discards the null measurements, which can be bounded by 43 where function γð·Þ is formulated as and the statistical fluctuations Δ can be written as (20) where N A T is the total number of detections for T A δ in a processing unit.
Finally, we extract the secure random bits from the raw random bits by the Toeplitz-hashing extractor and claim that our QRNG scheme successfully generates a string of genuine random bits if all statistical tests are passed.

Experimental Demonstration
The experimental setup comprises an entanglement source and measurement devices, as shown in Fig. 1. The pump light is a pulsed laser with a repetition rate of 10 MHz and a measured coherence time of 2.1 ns, which is extracted from a continuouswave laser at 774.9 nm through a lithium niobate electro-optic modulator. It is adjusted to horizontal polarization by a polarization controller, then coupled into a 5-cm Ti-diffused periodically poled lithium niobate (Ti:PPLN) waveguide with a poling period of 9.2 μm. The time-energy entangled photon pairs are produced via the type-II SPDC process. After blocking out the pump by a long-pass filter and a 3-nm bandpass filter centered at 1550 nm, the output orthogonally polarized entangled photon pairs are spatially separated by a polarization beam splitter (PBS) and distributed to Alice and Bob, respectively. The wavelength-degenerate photon pairs are centered at 1549.8 nm with 0.7 nm full width at half-maximum (FWHM). The overall detection efficiencies are 20.5% for the photon to Alice and 20% for the photon to Bob, respectively. When the pump power coupled into the waveguide is 1 mW, the single-photon counting rates measured by superconducting nanowire single-photon detectors (SNSPDs) at Alice and Bob are 5 and 4.85 MHz, respectively, with the dark counting rate observed around 500 Hz and thus are ignored. The two-photon coincidence counting rate obtained by the time-to-digital converter (TDC) (PicoHarp-300) is 1 MHz. Thus the proportion of genuine entangled photons in Alice's detection can be estimated to be 97%.
Alice and Bob both randomly perform measurement T δ or D δ by a passive 90∶10 beam splitter, i.e., q ¼ 0.9 in protocol. Explicitly, the measurement T δ is implemented by directly measuring the arrival time at the SNSPD, while for the measurement D δ , arrival time detection is performed after the photons to Alice (Bob) propagate through a dispersion module composed of an optical circulator and a chirped (antichirped) Bragg grating with a GVD coefficient of −1440 ps 2 (1440 ps 2 ). The arrival time is detected by the SNSPDs, then recorded by the TDCs with the total time jitters estimated approximately as σ j ∼ 34 ps (1 standard deviation). The outcome rate of measurement T δ in Alice is n A T ¼ 4.5 MHz. To explore the performance of the source and certify the security of the scheme, we plot the coincidence curves of four combinations for two observers' measurements, as illustrated in Fig. 2. If Alice and Bob both make measurement T δ , the FWHM of the coincidence peak is Δ T ¼ 120 ps, as shown in Fig. 2(a), and thus the detection precision is calculated to be δ ¼ Δ T ∕ ffiffi ffi 2 p ¼ 84 ps based on the assumption that the resolution of all detectors is identical. If the measurements performed by Alice and Bob are different, coincidence peaks are broadened to 750 ps in Fig. 2(b) and 760 ps in Fig. 2(c) due to the dispersion effect. The slight difference between two peaks is caused by the slight difference in magnitude of GVD coefficients in Alice and Bob. If two observers both choose measurement D δ , as shown in Fig. 2(d), the peak recovers with a narrow FWHM of Δ D ¼ 160 ps, as shown in Fig. 2 ffiffiffiffiffiffiffiffiffiffiffiffi 2 ln 2 p Þ for Gaussian function] due to the NDC effect. In this case, the testing value d is calculated to be 0.64 according to Eq. (9), which is much smaller than the classical bound d c ¼ 1.35 (see Appendix C).
The preset value d 0 is set to be 0.64, since it is the upper bound in the vast majority of the measurement runs in our experiment. If d ≤ d 0 from the experimentally observed results, the protocol is passed, implying that we can evaluate and extract true randomness from the raw random bits to generate genuine random numbers.

Randomness Evaluation and Extraction
From the above results, we could calculate the randomness from the raw random bits according to Eqs.  where the total count N A T is deduced by the count rate n A T and the cumulative time τ as N A We plot the smooth min-entropy H ϵ low ðT A δ jEÞ ρ with respect to N A T and N d , as shown in Fig. 3   τ ¼ 100 s. Considering the proportion of genuine entangled photons of the SPDC is measured to be 97%, we can extract 0.900-bit genuine randomness per log 2 ð256Þ-bit sample. Hence, we generate a Toeplitz matrix with a scale of 80;000 × 9000 to extract genuine random numbers. As the outcomes rate is n A T ¼ 4.5 Mcounts∕s, the final generation rate of random numbers is 4 Mbps.
To test the quality of random numbers, we perform an autocorrelation coefficient test between the raw and final random data, where the raw data and final random data satisfy the Gaussian distribution and uniform distribution, respectively. As shown in Fig. 4, the final autocorrelation coefficients are below 0.001 within the 200-bit delay, which are significantly lower than the raw data. Furthermore, we perform a standard NIST test suite using 1000 samples of 1 Mb; the significant level is set as α ¼ 0.01. The NIST test is passed if P values are higher than 0.01 and the proportion value within the confidence interval of ð1 − αÞ AE 3 ffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffiffi ð1 − αÞα∕n p ¼ 0.99 AE 0.00944 for all tests. As shown in Fig. 5, the random bits in our scheme pass all 15 tests.

Conclusions and Discussions
In conclusion, we have proposed and experimentally demonstrated a scheme for a source-DI QRNG, where the random bits are generated by measuring the arrival time of single photons from an untrusted time-energy entangled photon pair source. The NDC effect is employed to testify the entanglement source and thus guarantee the security of true random number acquisition. With a high-quality PPLN waveguide SPDC source, we realized a fast generation of true random numbers with a generation rate of 4 Mbps, which were extracted by utilizing the modified EUR. In Table 1, we list several semi-DI QRNGs as a comparison. It shows that our work achieves a trade-off among security, speed, and practicality.
The generation rate of our protocol can be further increased to Gbps provided we use state-of-the-art single-photon detectors. For instance, the single-photon detector 45 with a temporal resolution of 29 ps could theoretically achieve optimal H ϵ low ðT A δ jEÞ ρ ¼ 2.66; combining with its maximum count rate of 2 GHz, the random number generation rate can reach 5.16 Gbps. Moreover, the source-DI QRNG we realized is based on the PPLN waveguide SPDC source, which may be further developed to be an integrated chip-scale device by exploring on-chip photon generation, manipulation, and detection techniques. We hope our approach can stimulate more such investigations.
Furthermore, our scheme provides a secure certification for quantum information and quantum communication tasks with an untrusted source based on dispersion cancellation. Recently, the work on the QKD protocol where the source is trusted but imperfect was proposed. 36 Our approach offers a way to certify the untrusted source via dispersion cancellation for this protocol, which enables us to access the source-DI QKD tasks.  Without a detailed characterization. c With additional assumption on the dimension of input states. d With additional assumption on the input energy.

Appendix A: The Definition of Testing Value
In this section, we provide the proof that the testing value d defined in Eq. (9) as the code distance for systems A and B in D δ basis can be used to certify the time-energy entanglement for the ideal state in Eq. (1). Let us consider the case that systems A and B are two separable photons or classical pulses. The spectrum and temporal functions of the photon A can be written as, respectively, where σ ν is the spectrum bandwidth (1 standard deviation) of the photon, and σ t is the temporal bandwidth. Meanwhile, ϕ c B ðωÞ and ψ c B ðtÞ for photon B are defined similarly with photon A. After two photons propagate through the dispersive medium, the intensity detected at Alice and Bob can be written as The joint detection probability that Alice's detector clicks at time t A and Bob's clicks at time t B simultaneously is Pðt A ; t B Þ ¼ I A ðt A ÞI B ðt B Þ, and the overall probability PðΓÞ of detecting two photons at a time lag Γ ¼ t A − t B can be calculated as where the correlation time thus given by and σ cor ¼ ffiffi ffi 2 p σ t is the origin correlation time. It has been proved that the origin correlation time σ cor and standard deviation in the spectrum intensity of the sum of frequency Δðω A þ ω B Þ for two separable photons satisfy the following inequality: 46,47 where Δðω A þ ω B Þ can be calculated to be ffiffi ffi 2 p σ ν . Hence, substituting this inequality into Eq. (25), we can obtain which defines the minimum broadening of temporal correlations between two separable photons after they propagate through two dispersive media with equal and opposite dispersion. By normalizing the correlation time σ cor;c into the detection A violation of this inequality implies the presence of entanglement, which is able to be used as a witness for the certification of time-energy entanglement. We denote the right-hand side of Eq. (28) as the classical bound d c .
Let us now consider the case that the source device distributes the entangled photon pairs with the state given by Eq. (1) to Alice and Bob, and they both choose measurement D δ , i.e., the arrival time after two photons traveled through the dispersive elements. The joint detection rate between two detectors is proportional to the Glauber second-order correlation function, where the joint time function becomes Then the correlation time of outcomes in measurement D δ can be calculated as and σ ω ¼ 1∕ð2σ coh Þ is the pump spectrum bandwidth. Thus the theoretical d for the ideal state given by Eq. (1) is achieved by In the limit of large coherence time σ coh , the testing value d reduces to We recall the measurements T A δ ¼ fT A k g and D A δ ¼ fD A k g, which can be expressed as where jX t i A ¼ a † ðtÞj0i satisfies the orthonormality condition hX t 1 jX t 2 i ¼ δðt 1 − t 2 Þ. Note that the measurements D A δ and T A δ can be transformed by the dispersion operator U 36 as where The associated observables of T A δ and D A δ can be, respectively, written as Based on the derivation in Ref. 38, the observable O A D can be further simplified as where Using the overlap result for maximally incompatible observables, 38,49 we can obtain

Appendix C: The Classical Bound of Experimental Testing Value
In our source-DI QRNG framework, the security of the scheme relies on the observation of d in experiment. To certify the entanglement, we need to calculate the classical bound of testing value in our experiment. Taking into account the time jitter of our detection systems in practice, the correlation time in Eq. (27) can be rewritten in a modified form, Recall that we measured the coincidence distribution and obtained σ 0 ¼ Δ T ∕ð2 ffiffiffiffiffiffiffiffiffiffi ffi 2 ln 2 p Þ with β ¼ 0 in Fig. 2(a), i.e., σ 2 0 ¼ 2σ 2 j þ σ 2 cor . Then combining the GVD coefficient β in our system, we can calculate the modified correlation time σ cor;c ≥ 100 ps and the corresponding classical bound d c ¼ 1.35.
Ji-Ning Zhang is now a PhD student at the School of Physics of Nanjing University. Her current research interests include quantum optics and quantum information.
Ran Yang is now a PhD student at the School of Physics of Nanjing University. His current research interests include quantum optics and quantum tomography.
Xinhui Li obtained her PhD in cryptography from Beijing University of Posts and Telecommunications in 2020. She was awarded a scholarship from the State Scholarship Fund which was selected through a rigid academic evaluation process organized by the China Scholarship Council to pursue her studies at the National University of Singapore from August 2017 to August 2018. She is now a postdoctoral fellow at the School of Physics of Nanjing University. She is currently working on the security of quantum information processing and the foundations of quantum correlations.
Chang-Wei Sun obtained his PhD from the School of Physics at Nanjing University in 2021. He works on nonlinear optics and quantum optics.
Yi-Chen Liu received his PhD from the School of Physics at Nanjing University in 2021. In 2021, he joined as a senior researcher at Qingdao University of Technology. His current research interests include nonlinear optics and quantum optics.
Ying Wei is now a PhD student at the School of Physics of Nanjing University. His current research interests include quantum simulation and quantum tomography.
Jia-Chen Duan is now a PhD student at the School of Physics of Nanjing University. His current research interests include nonlinear optics and integrated optical quantum technologies.
Zhenda Xie obtained his PhD from Nanjing University in 2011. From 2011 to 2016, he joined as a postdoctoral fellow at Columbia University in the City of New York and a research fellow at University of California, Los Angeles, respectively. He is now a professor at the School of Electronic Science and Engineering of Nanjing University. He is currently working on solid-state laser technology, nonlinear optics, and quantum optics.