Long term test of a fast and compact Quantum Random Number Generator
Davide G. Marangon, Alan Plews, Marco Lucamarini, James F. Dynes, Andrew W. Sharpe, Zhiliang Yuan, Andrew J. Shields
LLong term test of a fast and compact Quantum Random Number Generator
D. G. Marangon, ∗ A. Plews, M. Lucamarini, J. F. Dynes, A.W. Sharpe, Z. L. Yuan, and A. J. Shields
Toshiba Research Europe Ltd, Cambridge Research Laboratory,208 Cambridge Science Park, Milton Road, Cambridge, CB4 0GZ, UK
Random numbers are an essential resource to many applications, including cryptography andMonte Carlo simulations. Quantum random number generators (QRNGs) represent the ultimatesource of randomness, as the numbers are obtained by sampling a physical quantum process thatis intrinsically probabilistic. However, they are yet to be widely employed to replace deterministicpseudo random number generators (PRNG) for practical applications. QRNGs are regarded asinteresting devices. However they are slower than PRNGs for simulations and are typically seenas clumsy laboratory prototypes, prone to failures and unreliable for cryptographic applications.Here we overcome these limitations and demonstrate a compact and self-contained QRNG capableof generating random numbers at a pace of 8 Gbit/s uninterruptedly for 71 days. During thisperiod, the physical parameters of the quantum process were monitored in real time by self-checkingfunctions implemented in the generator itself. At the same time, the output random numbers wereanalyzed with the most stringent suites of statistical tests. The analysis shows that the QRNG undertest sustained the continuous operation without physical instabilities or hardware failures. At thesame time, the output random numbers were analyzed with the most stringent suites of statisticaltests, which were passed during the whole operation time. This extensive trial demonstrates thereliability of a robustly designed QRNG and paves the way to its use in practical applications basedon randomness.
I. INTRODUCTION
Random numbers are essential in many fields of sci-ence and information technology. The two main ways togenerate them are either by iterating deterministic algo-rithm, the so-called pseudo random number generators(PRNG), or by sampling a natural physical process, theso-called true random number generators (TRNG). Al-though natural randomness has been acknowledged asthe ideal method to generate random numbers for simu-lations or cryptographic keys [1, 2], PRNGs are normallypreferred for these tasks [3, 4]. Simulation-wise, the typ-ical motivation is that TRNGs do not allow for resultsreproducibility. Cryptography-wise, TRNGs are believedto silently drift or break over time, thus compromisingsecurity.On the other hand, PRNGs are intrinsically pre-dictable and this can be exploited to break cryptographicsecurity [5–7]. Moreover, in Monte Carlo methods, thepresence of artefacts or patterns in the strings generatedby a PRNG can produce unreliable simulation results[8]. Finally, reproducibility can be easily achieved witha TRNG by recording the output number stream andreusing it. It is reasonable to expect that such an ap-proach will become increasingly viable as TRNGs’ gen-eration rates increases [9, 10].Motivated by this premise, we present in this work aTRNG that exploits the intrinsic randomness of a quan-tum optical process [11, 12] to meet both the reliabil-ity and the high generation rate demanded by applica- ∗ [email protected];Accepted in IEEE/OSA Journal of Lightwave Technology http://dx.doi.org/10.1109/JLT.2018.2841773 tions. We demonstrate the stable and continuous gen-eration of random numbers from this quantum randomnumber generator (QRNG) at 8 Gbit/s rate. The out-putted strings pass an extensive application of statisticalrandomness tests after a weak post-processing.With the exception of few recent works, e.g. [13–15], ultrafast generation rates from a QRNG are typi-cally achieved during proof of principle demonstrations.Lab equipment is used to generate the random signals,which are acquired by fast digital oscilloscopes [16–19].Then, analysis and post-processing of the recorded dataare done “offline”, but the reported generation rates areevaluated as if all these processes were performed “on thefly”. In addition, the statistical tests to assess the qual-ity of the numbers are applied just few times, typicallyonce, on a limited data sample, mostly because of theoscilloscope finite storing capacity. Drawing a conclusionfrom this small statistics requires the additional strongassumption that the analyzed sample is representative ofthe entire stream the generator would normally output.In this work, we present a self-contained small QRNGthat performs live analysis and live post-processing ofthe random signals. The device is capable of stable op-eration and is self-checking. The latter feature meansthat QRNG monitors some parameters of its main in-ternal components, to check whether they are operatingproperly. As a proof, we present the results of an unin-terrupted test of a QRNG lasted 71 days. The QRNG’sultrafast generation rate allowed us to rapidly collect suf-ficient data to repeatedly apply the most stringent bat-teries of statistical tests several times.In the following, we will review the QRNG’s main fea-tures and present the results of the long term test. a r X i v : . [ qu a n t - ph ] J u l IG. 1. The QRNG self-contained unit. The compact enclo-sure’s size is 10 × × . II. THE GENERATOR
The QRNG described in this work is based on the sameworking principle as the one presented in [21]. However,rather than performing a proof-of-principle experiment,we integrated all the optical and electronic componentsinto a stand-alone self-contained device, depicted in Fig-ure 1.The physical mechanism exploited to generate randomnumbers is the spontaneous emission from a pulsed laser[21]. The physical core of the generator comprises a 1550nm laser that emits steady state pulses with a repetitionrate of 1 GHz. The use of this wavelength was moti-vated by the wide availability of high bandwidth lasersand photodiodes at telecom wavelengths. Therefore, thegenerator realization is eased since it can be built by em-ploying standard commercial optical components. Thepulses are emitted by a distributed feedback (DFB) laserdiode in a standard 14-pin butterfly package integrat-ing a photodiode for power monitoring, and a thermistortogether with a thermoelectric cooling (TEC) for tem-perature regulation.The delay of 1 ns between two consecutive pulses is suf-ficient to empty the laser cavity between two successiveemissions. Therefore, each newly stimulated emission istriggered by a spontaneously emitted photon that car-ries the phase of the vacuum field, which is completelyrandom over the interval [0 , π ].This phase is then measured by interfering pairs of op-tical pulses in a one-bit-delayed fibre-based interferom-eter, whose optical output is sent to photodiode (PD).The PD is a commercial InGaAs/InP PIN receiver forclassical optical communication, featuring a bandwidthof 5 GHz. The PD converts the random intensity opticalinput into a randomly varying current that is sampled byan analog-to-digital converter (ADC) with 10-bit resolu-tion. These samples are therefore unpredictable by virtueof the physical uncertainty associated with the vacuumstate. This quantum uncertainty prevents a malevolent ad-versary to predict when a given number will be emit-ted. However, the adversary can still take advantage ofthe arcsine probability distribution of the interferometeroutput, and bet on the appearance of the most likelyintensity values, which are the ones at the extremes ofthe distribution. It is therefore necessary to manipu-late the numbers with a post-processing technique toremove this impairment. We use a finite impulse re-sponse (FIR) filter to unbias the numbers and to achievea flat distribution of the 8-bit integers [21, 22]. Thistechnique consists in transforming a raw integer sample x ( n ) into an unbiased one y ( n ), by means of the relation y ( n ) = b x ( n ) + b x ( n −
1) + · · · + b M x ( n − M ) mod 2 ,with binomial coefficients b i = M ! / ( i !( M − i )!). Afterthe FIR processing, the QRNG outputs a stable streamof unbiased numbers at 1 GB/s.It is worth clarifying that the FIR filter is not equiva-lent to a randomness extractor, which distills the entropyof the output string by compressing it [23]. The filterdoes not perform compressing, but simply scrambles theraw samples by dispersing each input x into M + 1 out-puts y as a pragmatic unbiasing algorithm. Hence, thefiltered output has exactly same entropy per bit as itsraw input. We stress that the actual entropy in the FIRfiltered output needs to be considered when used in sen-sitive cryptographic applications.On the other hand, it is worth emphasizing that forapplications where security is not a concern and gener-ation speed is required, e.g. Monte Carlo methods, theFIR filter remains extremely effective. This holds whenthe initial amount of entropy in the generated strings ishigh, like in our case with average raw entropy of 0.9 bits.This is shown in Sec. V, where a large number of strictstatistical tests are passed without applying temporal re-strictions on the generated strings.The compactness of the QRNG is achieved by embed-ding optical and electronic components into a printedcircuit board (PCB). The functions of driving and mon-itoring the devices and of processing and outputting thesignals are performed by an FPGA, which constitutes theelectronic and digital backbone of the generator.The versatility of the FPGA allows us to program dif-ferent functions for the live monitoring of the physical pa-rameters. This sort of sanity check is essential to discoverinstabilities or malfunctions that might affect the outputrandomness. In Figure 2, a logic scheme of the QRNG isreported with the main check functions reported.The main physical active component is the laser. Thelaser output power determines the maximal range of theinterference signal and hence the range of the current sig-nal sampled by the ADC. This has to be finely tuned suchthat the interference signal can span all the available dy-namical range without exceeding the upper digitizationlimit. To control power fluctuations due to the varia-tion of laser temperature, we provided the laser with atemperature controller and implemented a function thatmonitors both the laser output power and the laser tem- Accepted in IEEE/OSA Journal of Lightwave Technology DOI 10.1109/JLT.2018.2841773
IG. 2. Top: Logic blocks of the QRNG. The bottom rowrepresents the part of the device directly involved in the gen-eration of the random numbers. The top row represents thedigital functions that were implemented to monitor the sys-tem operation. Bottom: The foreground histogram (green)represents the interference intensity values measured by thePD and digitized by the ADC. The data are distributed ac-cording the expected arcsine distribution. The backgroundhistogram (red) represents the noise signal acquired betweentwo pulses. Both these histogram are continuously acquiredby the check functions implemented in the generator board. perature. This way, the user can be aware of the laserstatus and can abort the generation in case of a suddendrift from the optimal operating condition.The QRNG samples the PD output signal with a rateof 2 GS/s so that every 1 ns two data samples are gen-erated. The first sample collects the optical interferingsignal, the so-called foreground data, as depicted in theforeground (green) histogram in Figure 2 bottom. Thesecond sample collects the non-optical signal between twointerference pulses, i.e., the noise level of the PD (back-ground data), as depicted in the background (red) his-togram in Figure 2 bottom. The QRNG is programmedto continuously collect and histogram foreground andbackground data. This function is important for two rea-sons. On one hand, it allows the user to check whetherthe foreground distribution follows the theoretical inten-sity distribution pertaining to the interference process.On the other hand, it enables the monitoring of the back-ground data, which is useful to detect a malfunction ofthe laser driving system. In particular, this makes itpossible to detect light pulses emitted during the laser’soff time, which could hinder the phase randomization ofconsecutive pulses.In parallel to the histogram of the above physical dis-tributions, the QRNG computes also the distribution ofthe data after the FIR, to enable a comparison againstthe uniform distribution expected from unbiased num-bers.A standard USB communication protocol lets the userset the operational parameters of the device and read the
Parameter Value Unit
Laser Power 5.03 ± TABLE I. Laser output power (mW) monitored by the healthcheck functions of the QRNG.FIG. 3. Daily average values of the laser powers logged bythe power monitoring function. data produced by the monitor functions. High speed datainterfaces, such as 10G and SATA, are also provisionedfor outputting 8 Gb/s stream of random numbers. In thisstudy, the SATA interface is used to feed the random bitstream to a PC for statistical randomness tests.
III. TESTING STRATEGY
To assess the QRNG suitability to cryptographic ap-plications, we studied its response over a long period oftime. In particular we focused on the two following prop-erties:1)
Operational stability : the operational parametersof the components, such as the output power of the laseror its temperature, are required to not deviate from theoptimal values that maximize the output entropy. Forexample, a too low laser power would not match the dy-namic range of the ADC, whereas a too high power wouldsaturate the PD.2)
Randomness stability : the generation of unbiasednumbers has to be guaranteed for a prolonged and un-interrupted use of the device. Although the operationalparameters might stay stable and without drifts, possi-ble errors in the hardware and software implementationand/or failures of the unmonitored components, couldintroduce bias, correlation or artifacts in the outputtednumbers.We ran the device for 71 days without interruption.To check the operational stability (point (1)), we moni-tored and recorded the system’s operational parametersthrough the functions presented in Section II.A. To testthe randomness stability (point (2)), we applied statisti-cal tests in series and recorded the test results.The advantage of data logging is that it makes it possi-ble to perform an accurate a-posteriori analysis. In par-ticular, possible failures of the statistical tests can becompared against the values the physical parameters atthe time of failure. Concerning this last point, it is well
Accepted in IEEE/OSA Journal of Lightwave Technology DOI 10.1109/JLT.2018.2841773 arameter Value Unit
Shannon Entropy 9.27 ± ± TABLE II. Shannon entropy and min-entropy values calcu-lated from the foreground monitor function.FIG. 4. Shannon entropy (blue solid line) and min-entropy(red line) of the QRNG, as evaluated from the foregrounddata. understood that statistical tests on the outputted post-processed data cannot certify the unpredictability of thenumbers, as this is meant to be achieved with a theoret-ical model of the quantum process employed. However,they can detect some deviations from the optimal oper-ating conditions and possible hardware failures. In thissense, the foreground-background monitoring function isuseful to enable the comparison of the experimental dataagainst the theoretical model of the generator.
IV. PHYSICAL TESTING
During the whole testing period, the data of the mon-itor functions were recorded. In Table I, we report themean values and the standard deviations of laser power.This parameter was read by the monitor function fromthe photodiode embedded into the laser. In Figure 3, wedraw its average on intervals of 24 hours.From this result, it appears that the system is charac-terized by a stable performance. The laser power featuresaverage relative fluctuations of 0.2%, with a maximal reg-istered deviation of +2.1% from the mean value.Such stability was obtained by means of a temperaturecontroller that kept the laser temperature stable duringthe test. Readouts from the controller monitor functionregistered a temperature standard deviation of 0.33 C.As we already mentioned, it is important that the gen-erator keeps a stable laser power, to obtain a sampledistribution that spans the whole ADC range withoutsaturating the PD.The data of the foreground function correspond tothe frequency of the digitized interference intensity, X ,which falls in the interval [0 , p ( X ) of the events fromwhich the Shannon entropy and the min-entropy are eval- uated in real time. These two quantities are, respectively,equivalent to the average and minimal amount of unbi-ased bits that can be extracted from the raw samples X . As mentioned before, the distribution of the X val-ues is not uniform and therefore the entropies are alwayssmaller than the ten bits featured by the ADC.The benefit of having a temperature-controlled laserwith a stable output power is that it creates stable ex-perimental conditions to keep the amount of generatedrandomness almost constant. This is evident from thedata registered for the entropies.In Table II, we report the entropies mean values andstandard deviations for the whole testing period. In Fig-ure 4, the blue and red lines correspond to the dailyaverage of Shannon entropy and min-entropy respec-tively. We notice that both the entropies feature verylimited fluctuations, 0.2% and 0.45% for Shannon andmin-entropy, respectively, with a maximal registered vari-ation of +0.42% and +2.43%, respectively. Hence theQRNG always approaches the highest entropy values al-lowed by the physics of the process. The high entropycontent of the raw samples X made it possible an effec-tive application of the FIR unbiasing filter, as it will bedemonstrated by the test results in the next two sections. V. STATISTICAL TESTS
The task of performing the statistical tests of a ran-dom number generator is well studied and a multitude ofsolutions are available. Well-known batteries commonlyapplied such as “FIPS-140-2” [24] or “Die Hard” [25] areinadequate for our intended analysis, as they are eithertoo weak or too limited in the number of tests. A validalternative, featuring more stringent tests and an exten-sive number of batteries, is represented by the Test-U01and the NIST SP-800-22, which are those we have usedto test the QRNG.
A. Test-U01
The TestU01 suite [26] is acknowledged to be the moststringent collection of tests to assess RNG statisticalproperties. These tests can be applied singularly or asbatteries. For the long term test, we applied the largestbattery denominated “Big Crush”. This battery features106 tests selected to cover the widest spectrum of possibleproblems. A single run of Big Crush analyzes a datasetof approximately 1 . × Accepted in IEEE/OSA Journal of Lightwave Technology DOI 10.1109/JLT.2018.2841773
IG. 5. Number of p-values outside the confidence intervalin sets containing the results of four consecutive Big Crushbattery, which is the typical amount of times the battery wasapplied per day. The green line represents the daily meanvalue of n out . The dashed red line corresponds to the dailyacceptance range. creased the acquisition time to 73 minutes. However, itwas still small enough to apply the battery multiple timesper day, achieving an unprecedented assurance level forthe testing process.It is worth stressing that the multiple application ofa test is fundamental not only to track the generatorresponse, but also to rule out possible “lucky” or “un-lucky” results that could occur with a single shot appli-cation. When a test is applied to a string, one or morep-values are evaluated: if the result is inside the interval I BC = [0 . , . n out ofp-values outside I BC was in line with the statistical fluc-tuations for a sample of that size. Since the probability offailure is α = 0 . n out = α × , (cid:39) n out : by means of the Gaussian approximationto the binomial distribution, we evaluate an acceptancerange of 109 ≤ n out ≤ n out = 151, which is fully compatiblewith the expectations.Although the number of suspicious p-values was in linewith the expectations, it is necessary to assess the possi-ble presence of a “catastrophic failure” among the failedtests. For catastrophic failure is intended a p-value veryclose to 0 or to 1, e.g. 10 − , whose occurrence cannotbe justified in terms of the statistical fluctuations linkedto the size of the set of p-values. We verified that no p-value occurred outside the interval [10 − , − − ]. Forthe interval [10 − , − − ], we obtained n out = 2, whichis well within the acceptance range 0 ≤ n out ≤ FIG. 6. Number of uniformity p-values outside the confidenceinterval in sets containing the results of forty consecutive ap-plications SP-800-22 suite. The dashed red line correspondsto the daily acceptance range. were present. In fact, a concentration of very high n out values, in a limited amount of time, would clearly indi-cate the presence of a physical hardware problem.In Figure 5, we plot the n out value after regroupingthe p-values in subsets. Each subset contains 1,016 p-values, corresponding to four consecutive runs of the bat-tery. This is indeed the typical number of times thebattery was applied per day. The evaluated average of n out = 2 .
11 (green solid line in the plot) is in line with theexpected value of n out (cid:39) . × , n out = 7 at subset 59, which is slightly abovethe threshold of 6 (red dashed line in the plot) we didnot consider this fact as suspicious, since the p-valuesoutside the limits belonged each time to different tests.In addition, by cross-checking this result with both themonitor parameters (Figure 3 and 4) and with the resultsfrom another test suite (Figure 6), we did not observe anyparticularly suspicious variation.It is worth noticing that the values for n out were evenlydistributed during the whole testing period. This indi-cates that no hardware failures or drifts with a notice-able impact on the output randomness occurred duringthe whole testing period. B. NIST SP-800-22
Although the TEST-U01 represents the state of the artin statistical randomness testing, we analyzed the num-bers also with the test suite SP 800-22 developed by theNIST [27, 28]. This suite is commonly used for QRNGsand this would ease a comparison between our resultsand previous works.During the testing period, the battery was applied2,849 times. For each run we used a 1 Gbit input stringand we applied 15 tests. Differently from Big Crush,where each test analyzes different and very long subsam-ples of the input string, the NIST tests are all applied onthe same string. In particular, any new input string isdivided into L = 1 ,
000 substrings, each 106 bits long, sothat each test is applied L times. For the NIST suite thesignificance level is α = 0 . Accepted in IEEE/OSA Journal of Lightwave Technology DOI 10.1109/JLT.2018.2841773
IG. 7. Each column represents the weekly average passing ratio for each test. The passing ratio corresponds to the fractionof 1 Mbit long sub-strings featuring a p-value ≥ .
01. For a sample of L = 1,000 bits, the threshold to pass the test is 0.981and it is represented by the white line on top of each bar plot. For the “Random Excursion” and “Random Excursion Variant”tests, L (cid:39)
600 and the threshold is approximately 0.978.
If a test on a given substring yields a p-value ≥ . L p-values shouldfollow the uniform distribution. Hence, for each test,the suite evaluates the sub-string passing ratio and per-forms a goodness-of-fit (GOF) test on the observed p-value distribution. This second order test is performedby regrouping the L p-values in ten bins of width 0.1,and by computing a χ test statistic. The test on thewhole input string is then considered passed if the pass-ing ratio is approximately of 99%, and if the “uniformity”p-value associated to the corresponding χ test statisticis ≥ − .Each run yield 188 p-values, given that some tests fea-ture many variants. The overall number of the unifor-mity p-values generated during the 71 days amounts to535,612. For this sample size, the number n out of p-values < − , is expected to be comprised in the inter-val 32 ≤ n out ≤
76 and centred on the value n out = 54.We observed n out = 46 which is again fully compatiblewith the theory.Also for the NIST suite, we studied the temporal dis-tribution of n out . Each day, the NIST suite was ap-plied 40 times, yielding 7,520 p-values. In Figure 6, thepoints represent the value of n out per day. The solidgreen line corresponds to the daily average value of n out ,equal to 0.65, which is close to the expected value 0 . (cid:39) . × , L substrings is 98.1% (it is worthto specify that for the so called “Random Excursion”and “Random Excursion Variant” tests the sample sizeis L (cid:39) VI. CONCLUSION
We reported the results of an unprecedentedly long 71-day non-stop trial of a QRNG. We showed its capabilityto sustain uninterrupted operation while providing a con-tinuous, laminar flow of unbiased numbers at 8 Gbit/s.By analyzing the data recorded from the functions con-tinuously monitoring the physical parameters, we showedthat the generator maintained a stationary behavior,without drifting from the optimal experimental condi-tions. This stability enabled a constant success rate forthe most stringent battery of statistical tests, the BigCrush of Test-U01 suite. This is the first time that such
Accepted in IEEE/OSA Journal of Lightwave Technology DOI 10.1109/JLT.2018.2841773 n extensive test, with almost 300 applications of the BigCrush battery, is reported. To our knowledge, the onlyother reported example is with the QRNG developed byPicoQuant to which the Big Crush test was applied atotal of 60 times [29, 30].Once the generator is provided with acryptographically-strong randomness extractor, these re-sults show the suitability of the QRNG in cryptographicapplications, including quantum key distribution (QKD),for which it is essential to employ random numbers gen-erated from strictly non-deterministic generators. Infact, the ultrafast generation rate makes our QRNGcompatible with most of the current QKD systems,which typically feature maximum clock rates around 1GHz [31].We believe that the demonstrated speed, robust de- sign and stable operation of the quantum random num-ber generator will promote it as a valid alternative to thecurrent solutions adopted to generate random numbers.
ACKNOWLEDGMENTS
This project has received funding from the Euro-pean Union’s Horizon 2020 research and innovation pro-gramme under the Marie Sklodowska-Curie grant agree-ment No 750602, project: “Development of an Ultra-Fast, Integrated, Certified Secure Quantum RandomNumber Generator for applications in Science and In-formation Technology” ( UFICS-QRNG ). [1] N. Ferguson, B. Schneier, and T. Kohno,
Cryptographyengineering: design principles and practical applications ,John Wiley & Sons (2011).[2] M. Stipˇcevi´c and C¸ . K. Ko¸c,
True random number gen-erators , in
Open Problems in Mathematics and Compu-tational Science , 275–315, Springer (2014).[3] E. B. Barker and J. M. Kelsey,
SP 800-90Rev(a): Rec-ommendation for random number generation using de-terministic random bit generators (revised) , NIST Pubs(2007).[4] E. B. Barker and A. Roginsky,
SP 800-133: Recom-mendation for cryptographic key generation , NIST Pubs(2012).[5] I. Goldberg and D. Wagner,
Randomness and thenetscape browser , Dr Dobb’s Journal-Software Tools forthe Professional Programmer , 66 (1996).[6] A. Lenstra, J. P. Hughes, M. Augier, J. W. Bos,T. Kleinjung, and C. Wachter, Ron was wrong, Whitis right , IACR (2012), https://eprint.iacr.org/2012/064.pdf .[7] N. Heninger, Z. Durumeric, E. Wustrow, and J. A. Hal-derman,
Mining your Ps and Qs: detection of widespreadweak keys in network devices , in
USENIX Security Sym-posium , volume 8, 1 (2012).[8] A. M. Ferrenberg, D. Landau, and Y. J. Wong,
Montecarlo simulations: hidden errors from “good” randomnumber generators , Physical Review Letters , 3382(1992).[9] D. B. Thomas, L. Howes, and W. Luk, A comparison ofcpus, gpus, fpgas, and massively parallel processor ar-rays for random number generation , in
Proceedings ofthe ACM/SIGDA international symposium on Field pro-grammable gate arrays , 63–72, ACM (2009).[10] S. Mertens,
Random number generators: A sur-vival guide for large scale simulations , arXiv preprintarXiv:0905.4238 (2009).[11] H. Guo, W. Tang, Y. Liu, and W. Wei,
Truly randomnumber generation based on measurement of phase noiseof a laser , Physical Review E , 051137 (2010).[12] F. Xu, B. Qi, X. Ma, H. Xu, H. Zheng, and H.-K. Lo, Ultrafast quantum random number generation based onquantum phase fluctuations , Optics Express , 12366 (2012).[13] X.-G. Zhang, et al. , Note: Fully integrated 3.2 gbps quan-tum random number generator with real-time extraction ,Review of Scientific Instruments , 076102 (2016).[14] S. Tisa, F. Villa, A. Giudice, G. Simmerle, and F. Zappa, High-speed quantum random number generation usingcmos photon counting detectors , IEEE Journal of Se-lected Topics in Quantum Electronics , 23 (2015).[15] A. Wang, P. Li, J. Zhang, J. Zhang, L. Li, and Y. Wang, , Optics Express , 20452 (2013).[16] I. Kanter, Y. Aviad, I. Reidler, E. Cohen, and M. Rosen-bluh, An optical ultrafast random bit generator , NaturePhotonics , 58 (2010).[17] A. Argyris, S. Deligiannidis, E. Pikasis, A. Bogris, andD. Syvridis, Implementation of 140 gb/s true random bitgenerator based on a chaotic photonic integrated circuit ,Optics Express , 18763 (2010).[18] R. Sakuraba, K. Iwakawa, K. Kanno, and A. Uchida, Tb/s physical random bit generation with bandwidth-enhanced chaos in three-cascaded semiconductor lasers ,Optics Express , 1470 (2015).[19] X. Tang, et al. , Tbits/s physical random bit generationbased on mutually coupled semiconductor laser chaoticentropy source , Optics Express , 33130 (2015).[20] Z. Yuan, M. Lucamarini, J. Dynes, B. Fr¨ohlich, A. Plews,and A. Shields, Robust random number generation usingsteady-state emission of gain-switched laser diodes , Ap-plied Physics Letters , 261112 (2014).[21] M. Jofre, et al. , True random numbers from amplifiedquantum vacuum , Optics Express , 20665 (2011).[22] E. C. Ifeachor and B. W. Jervis, Digital signal processing:a practical approach , Pearson Education (2002).[23] D. R. Stinson,
Universal hash families and the leftoverhash lemma, and applications to cryptography and com-puting , J. Combin. Math. Combin. Comput. , 3 (2002).[24] Fips 140-2: Security requirements for cryptographic mod-ules (2001).[25] G. Marsaglia,
DIEHARD: A battery of tests of random-ness .[26] P. L’Ecuyer and R. Simard,
Testu01: A library forempirical testing of random number generators , ACM
Accepted in IEEE/OSA Journal of Lightwave Technology DOI 10.1109/JLT.2018.2841773 ransactions on Mathematical Software , 22 (2007), http://simul.iro.umontreal.ca/testu01/tu01.html .[27] A. Rukhin, J. Soto, J. Nechvatal, M. Smid, andE. Barker, SP 800-22rev1a: A statistical test suite forrandom and pseudorandom number generators for cryp-tographic applications , NIST Pubs (2010).[28] NIST: Random Number Generation and Testing, http://csrc.nist.gov/rng .[29] M. Wahl, M. Leifgen, M. Berlin, T. R¨ohlicke, H.-J. Rahn,and O. Benson,
An ultrafast quantum random numbergenerator with provably bounded output bias based on pho-ton arrival time measurements , Applied Physics Letters , 171105 (2011).[30] M. Wahl, M. Leifgen, M. Berlin, T. Rhlicke, H.-J. Rahn,and O. Benson, Addendum: “An ultrafast quantum ran-dom number generator with provably bounded output biasbased on photon arrival time measurements” [appl. phys.lett. 98, 171105 (2011)] , Applied Physics Letters ,159901 (2012).[31] A. R. Dixon, Z. Yuan, J. Dynes, A. Sharpe, andA. Shields,
Continuous operation of high bit rate quan-tum key distribution , Applied Physics Letters , 161102(2010). Accepted in IEEE/OSA Journal of Lightwave Technology8