Randomness is indispensable for a wide range of applications, ranging from Monte Carlo simulations to cryptography. Quantum random number generators (QRNGs) can generate true randomness by exploiting the fundamental indeterminism of quantum mechanics [1]. Most current QRNGs are photonic systems built with trusted and calibrated devices [2–7] that provide Gbit/s generation speeds at relatively low cost. However, a central issue for these QRNGs is how to certify and quantify the entropy of the genuine randomness, i.e., the randomness that originates from the intrinsic unpredictability of quantum-mechanical measurements. Entropy estimates for specific setups were recently proposed using sophisticated theoretical models [8–10]. Nevertheless, these techniques require complicated device characterization that may be difficult to accurately assess in practice.

A solution to estimating the entropy is the device-independent or self-testing QRNG [11–13], but its practical implementation is challenging because it requires loophole-free violation of Bell’s inequality, resulting in low generation rates of $\sim 1\mathrm{bit}/\mathrm{s}$ [12,13]. Recently, Lunghi et al. proposed a more practical solution that is based on a dimension witness [14], in which the randomness can be guaranteed based on a few general assumptions that do not require detailed device characterization. This scheme is highly desirable, as it focuses on real-world implementations with trusted but error-prone devices, although its implementation with a two-dimensional (qubit) system still suffers from low generation rates of tens of bits/second [14].

In this Letter, we propose and experimentally demonstrate a fast QRNG operating at a rate of 24 Mbits/s, in which we can quantify and monitor, in real time, the entropy of genuine randomness without a detailed characterization of the trusted but error-prone devices. Our approach uses time-energy entangled photon pairs with high-dimensional temporal encoding [15]. High-dimensional temporal encoding is advantageous when the average interval between photon detection events is much longer than a time-bin duration set by the detector timing resolution. Such situations arise in typical quantum information processing tasks when single-photon detectors have long recovery times or when the pair generation rate must be kept low to minimize multipair events [13,14]. The amount of genuine quantum randomness is quantified and monitored directly from observation of a nonlocal interference [16], and it is separated from other sources of randomness such as technical noise with a randomness extractor. We achieved the high generation rate by virtue of three experimental features: a high-dimensional time-energy entangled photon source capable of producing multiple random bits per photon, a high-visibility Franson interferometer for evaluating entanglement, and high-efficiency superconducting nanowire single-photon detectors (SNSPDs). As a consequence, we are able to demonstrate a high-performance QRNG with a tolerance of device imperfections.

Table 1 summarizes our protocol. An entanglement source generates high-dimensional entangled photon pairs. As an example, in the ideal case, the $N_d$-dimensional biphoton entangled state can be written as $|\psi ⟩=\frac{1}{\sqrt{N_d}}{\mathrm{\Sigma }}_{i=0}^{N_d-1}|i{⟩}_{\mathrm{A}}\otimes |i{⟩}_{\mathrm{B}}$, where $|i⟩$ represents a single photon at a discretized time interval $i$. This state is observed by two measurement systems, one for random number generation (RNG) and the other for testing. Randomness is generated in the RNG mode from the state held by system A, ${\rho }_{\mathrm{A}}$, which we assume is not pure and is correlated with environmental noise that models device imperfections. In the testing mode, the joint state is measured.

Table 1. Protocol for Quantum Random Number Generation

View Table

A key assumption of our approach is that the devices in the protocol are trusted, namely, they are not deliberately designed to fool the user, but the implementation may be imperfect. The central task is to estimate and monitor the amount of genuine randomness based only on measurements. This is a nontrivial task, as the observed randomness can have different origins. If the state ${\rho }_{\mathrm{A}}$ is a superposition of high-dimensional states, then the outcome $R_i$ cannot be predicted with certainty, even if the internal state is known, thus resulting in genuine quantum randomness. On the other hand, the randomness may be due to technical imperfections such as detector noise and temperature fluctuations, whose randomness clearly has no quantum origin, since the outcome $R_i$ can be perfectly guessed if the imperfections were well quantified.

In our approach, the amount of genuine randomness is monitored from the Franson visibility $V$ [16]. In particular, classical fields result in a $V$ that is no greater than 50%. For a maximally entangled state, $V$ would be 100% in the ideal case [17]. Conceptually, $V>50\%$ guarantees that the source’s output is entangled and thus contains genuine randomness. Rigorously, Ref. [18] has proven that if we assume the biphoton wave function is Gaussian, $V$ provides an explicit bound for the correlations in frequency measurement, which in turn upper-bounds the conditional maximum entropy (given system $\mathbf{B}$) via the theory developed in Ref. [19]. By using the entropic uncertainty relation for smooth entropies [20], we can determine the conditional min-entropy given the environmental noise, and thus the guessing probability, i.e., the amount of genuine randomness (see Section 1 of Supplement 1).

Our approach is different from Ref. [14], which is based on a dimension witness and was restricted to a two-dimensional system. Our system allows a much higher dimensionality, which can be chosen in the post-processing step [15] and was $N_d=2048$ dimensions in our experiment (see below). Our protocol provides self-monitoring because measurements of $V$ directly quantify the amount of genuine randomness in the observed data. A threshold value $V_0$ is preselected, and the randomness can be generated only when the observation satisfies $V>V_0$. Two particular advantages of this approach are that (i) the observation of $V$ does not rely on detailed models of the devices that are employed, and (ii) no loophole-free Bell inequality violation is required.

Figure 1 shows the experimental setup. Time-energy entangled photon pairs were generated via spontaneous parametric downconversion (SPDC) in a periodically poled ${\mathrm{KTiOPO}}_4$ (PPKTP) waveguide [21] that outputs multiple spatial modes at telecom wavelengths. The 46.1 μm grating period was designed for type II quasi-phase-matched wavelength-degenerate outputs at 1560 nm in the fundamental modes of the signal and idler fields. The phase-matching bandwidth was 1.6 nm, with a corresponding biphoton correlation time of 2 ps. The pump was a 780 nm continuous-wave (cw) diode laser with a measured coherence time of 2.2 μs, and the pump power coupled into the waveguide was monitored by a power meter. We extracted the fundamental signal and idler modes using a dichroic mirror to remove the pump and a 10 nm band pass filter to spectrally remove the higher-order SPDC spatial modes. The fundamental modes were coupled into a standard single-mode fiber, achieving an $\sim 81\%$ waveguide-to-fiber coupling efficiency. We used a polarization beam splitter to separate the orthogonally polarized signal and idler photons and send them to devices $\mathbf{A}$ and $\mathbf{B}$, respectively. Losses in the waveguide and from the waveguide to the fiber were $\sim 15\%$ and $\sim 12\%$, respectively. Overall, we measured a system efficiency of $\sim 50\%$, including the single-photon detector efficiency.

 

Fig. 1. Experimental setup. A cw diode laser pumps a PPKTP waveguide to generate time-energy entangled photon pairs. The orthogonally polarized signal and idler photons are coupled into a single-mode fiber, separated, and directed to $\mathbf{A}$ and $\mathbf{B}$, respectively. The signal photons in $\mathbf{A}$ are passively selected by a 90/10 ratio beam splitter for time-of-arrival measurement to generate random numbers or Franson measurement to check entanglement quality. HWP, half-wave plate; PBS, polarization beam splitter; C, coupler; OL, objective lens; DM, dichroic mirror; BPF, bandpass filter; PC, polarization controller; BS, beam splitter; PZT, piezoelectric transducer; SNSPD, superconducting nanowire single-photon detector; TDC, time-to-digital converter.

Download Full Size | PDF

A Franson interferometer is ideally suited for measuring the entanglement quality of a cw-pumped source of time-energy entangled light [15,18]. We set up a Franson interferometer with local dispersion cancellation that was composed of two identical unbalanced Mach–Zehnder interferometers (MZIs), in which the long arm was made of standard single-mode fiber and low-dispersion LEAF fiber, such that the differential group delay (due to dispersion) between the long and short arms was zero [17]. To achieve long-term stability, the MZIs were enclosed in a multilayered thermally insulated box whose temperature was actively stabilized. The long–short path mismatch of each MZI was measured to be $\mathrm{\Delta }T=3.2\mathrm{ns}$. We coiled the long-path fiber of each MZI on a closed-loop temperature-controlled heater to precisely match the $\mathrm{\Delta }T$ of the two MZIs. The variable relative phase shift between the two MZIs was set by a piezoelectric transducer fiber stretcher. By carefully fine-tuning the input polarizations and the temperatures, our time-energy entanglement source was found to have a Franson interference visibility $V$ of $98.8\pm 0.3\%$, as shown in Fig. 2.

 

Fig. 2. Franson interference. (a) Typical distribution of signal and idler arrival time difference in coincidence measurements; (b) observed interference fringe at the central peak of part (a) versus relative phase shift [proportional to piezoelectric transducer (PZT) voltage]. The observed raw visibility (without any subtraction) is $98.8\pm 0.3\%$.

Download Full Size | PDF

We performed a proof-of-concept implementation for the random basis choice passively with a 90/10 beam splitter, i.e., $q=0.9$, as in Table 1. The photon arrival times were measured by WSi SNSPDs [22] that were placed in a closed-cycle cryogenic system with sub-Kelvin operating temperatures (see Fig. 1). The SNSPDs were measured to have detection efficiencies of $\sim 85\%$, dark count rates of $\sim 400/\mathrm{s}$, timing jitters of $\sim 250\mathrm{ps}$, and maximum count rates of $\sim 2\mathrm{MHz}$ without detector saturation. To mitigate the long reset times of the SNSPDs and to achieve a higher generation rate, system $\mathbf{A}$ used a passive 50/50 beam splitter to distribute incident photons equally between two WSi SNSPDs and their data were interleaved. Hence, a total of four WSi SNSPDs were used, and their detection time outputs were recorded by time-to-digital converters.

In the experiment, both the time-bin duration $\delta$ and the frame size (dimensionality) $N_d$ were chosen in the data post-processing step by parsing the raw timing records into the desired symbol length. As long as the frame duration $N_d\delta$ is smaller than the pump coherence time, we can precisely characterize the dimensionality. For experimental simplicity, we set $\delta$ equal to the detector timing jitter. $N_d$ was optimized to be 2048 in order to produce the maximal genuine randomness per photon (Section 1 of Supplement 1).

In our proof-of-principle experiment, we recorded data for a maximum duration of 60 s. We monitored the Franson visibility before and after data recording to ensure that the experimental $V$ exceeded the preset threshold $V_0$ in order to extract nonzero random bits from the data. We set $V_0=98.5\%$ because it was the lower bound in most of the measurement runs in our experiment. We note that the amount of genuine randomness increases monotonically with increasing $V_0$, as shown in Fig. 3, and therefore it is desirable to use high-quality devices in order to achieve high Franson visibility $V>V_0$.

 

Fig. 3. QRNG throughput versus data collection running time. Solid red circles are experimental rates with $V_0=98.5\%$. The three curves are numerically evaluated results with different $V_0$ values, showing that a higher $V_0$ yields a higher throughput. For running times below 10 s, the finite data effect reduces the QRNG throughput substantially, whereas for a running time over 50 s, the throughput is already close to its asymptotic limit of 24.2 Mbits/s at $V_0=98.5\%$.

Download Full Size | PDF

We evaluated the autocorrelation of the raw generation-round data to be $\sim 0.001$, which satisfies the independent, identically distributed assumption made in our analysis. Using the theory developed in Section 1 of Supplement 1, we obtained 6.0 bits/photon genuine randomness at $N_d=2048$. After considering the unpaired-to-paired ratio of the SPDC output that we measured to be 1.8% (see Section 2 of Supplement 1), we extracted about 5.9 bits per ${\log }_2(2048)$-bit sample. We implemented a Toeplitz hashing extractor [8] to extract genuine random numbers. A Toeplitz hashing extractor extracts a random bit string $m$ by multiplying the raw sequence $n$ with the Toeplitz matrix ($n$-by-$m$ matrix, random seed). The seed length of random bits required to construct the Toeplitz matrix is $d=n+m-1$. In our implementation with MATLAB on a standard desktop computer, we chose the input and output bit-string lengths to be $n=4096$ and $m=4096\times 5.9/11\ge 2196$. Hence, a 4096-by-2196 Toeplitz matrix was generated in constructing the Toeplitz hashing extractor. The output random bits successfully passed all the tests in the Diehard test suite (see Table S2 of Supplement 1).

Figure 3 shows the experimental results for QRNG throughput for different running times. A longer running time produces more data, thus minimizing the finite data effect and yielding more randomness from the raw data. The results show that a continuous running time of $\sim 60\mathrm{s}$ can already produce randomness that is close to the asymptotic case of infinitely long operation. The measured count rates of the two SNSPDs for signal photon arrival times were 1.8 and 2.3 Mcounts/s. Hence, the final QRNG rate is $5.9\times 4.1=24.2\mathrm{Mbits}/\mathrm{s}$, which is many orders of magnitude higher than in previous experiments based on self-testing [12,13] or a dimension witness [14]. This dramatically faster rate benefits from the following factors: a high-dimensional entanglement system that generates multiple bits per photon, high-efficiency SNSPDs, a high-quality PPKTP waveguide SPDC source with high fiber-coupling efficiency, and high-visibility Franson interferometry.

To sum up, we have demonstrated a QRNG based on high-dimensional entanglement with a rate over 24 Mbits/s. Compared to the standard device-dependent approaches with fully calibrated devices, our QRNG delivers a stronger form of security requiring less characterization of the physical implementation. The performance is close to commercial QRNGs [23,24]. Though our approach offers a weaker form of security than a self-testing QRNG, it focuses on a scenario with trusted but error-prone devices. Together with other types of QRNGs demonstrated very recently in Refs. [25,26], we believe that our results constitute an important step toward generating truly random numbers for practical applications.

Our proof-of-principle experiment can be further improved in the following aspects. First, the Franson visibility was mainly limited by temperature fluctuations. Integrated photonics can improve the temperature stability, thus leading to higher interference visibility, as demonstrated recently in Ref. [27]. Second, the system can be operated at a different wavelength such as the visible or near-IR region, where inexpensive high-efficiency Si single-photon detectors can be used to replace the SNSPDs and potentially allow the system to be integrated with silicon photonics technology. Third, the randomness extraction was processed offline by software, which can be improved with a field-programmable gate array implementation for real-time extraction. Fourth, the monitoring of the visibility can be done in real time by continuously observing the Franson measurement. Last, to increase the security of the QRNG protocol, we note that a loophole-free Bell’s inequality test has been proposed for time-energy entanglement [28], thus making it possible to extend our high-dimensional entanglement system to function as a self-testing QRNG. Our QRNG is just one example of high-dimensional quantum information processing, which we believe is an important area for future study and practical applications.