Simple source device-independent continuous-variable quantum random number generator
Peter Raymond Smith Davide G. Marangon Marco Lucamarini Zhiliang Yuan Andrew Shields




Toshiba Research Europe Ltd, 208 Cambridge Science Park, Milton Road, Cambridge, CB4 0GZ, United Kingdom
Cambridge University Engineering Department, 9 JJ Thomson Avenue, Cambridge, CB3 0FA, United Kingdom

Corresponding author: davide.marangon@crl.toshiba.co.uk
Toshiba Research Europe Ltd, 208 Cambridge Science Park, Milton Road, Cambridge, CB4 0GZ, United Kingdom

Toshiba Research Europe Ltd, 208 Cambridge Science Park, Milton Road, Cambridge, CB4 0GZ, United Kingdom

Toshiba Research Europe Ltd, 208 Cambridge Science Park, Milton Road, Cambridge, CB4 0GZ, United Kingdom

Toshiba Research Europe Ltd, 208 Cambridge Science Park, Milton Road, Cambridge, CB4 0GZ, United Kingdom


Phase-randomized optical homodyne detection is a well-known technique for performing quantum state tomography.
So far, it has been mainly considered a sophisticated tool for laboratory experiments but unsuitable for practical applications.
In this work, we change the perspective and employ this technique to set up a practical continuous-variable quantum random number generator.
We exploit a phase-randomized local oscillator realized with a gain-switched laser to bound the min-entropy and extract true randomness from a completely uncharacterized input, potentially controlled by a malicious adversary.
Our proof-of-principle implementation achieves an equivalent rate of 270 Mbit/s.
In contrast to other source-device-independent quantum random number generators, the one presented herein does not require additional active optical components, thus representing a viable solution for future compact, modulator-free, certified generators of randomness.


Simple source device-independent continuous-variable
 quantum random number generator
    A. J. Shields
    December 30, 2023
=====================================================================================





§ INTRODUCTION


Randomness is an essential resource in many areas of science and information technology.
The problem of accessing true randomness has recently led to the proposal of a variety of random number generator designs <cit.>.
So-called “device-independent” (DI) quantum-random-number generators (QRNGs) minimize the assumptions underlying the randomness generation process by associating it
with the violation of Bell inequalities <cit.>. However, the complexity of the setups and small generation rates strongly limit their practical use.

Trusted QRNGs exploit a trusted environment for the preparation and the measurement of the quantum states from which the random numbers are extracted.
This makes it possible to build compact and fast generators, suitable for real-world applications.
However, due to their very nature, any hidden side channel in the trusted environment compromises the unpredictability of the generated numbers.

Semi-device-independent QRNGs represent an intermediate solution to achieve a high level of practicality.
 They introduce a minimal set of assumptions either on the measurement <cit.> or on the preparation <cit.> parts of the generator.
The latter, so-called source device-independent (SDI) QRNGs, relieve the user (Alice) from the burden of a perfect quantum state preparation.
The most paranoid scenario is when an evil party (Eve) replaces Alice's input state with her own state so that the generated numbers look random to Alice but actually are not.
In this framework, Alice can
counteract Eve's attack by applying measurements that are out of Eve's reach.

In this work we introduce a continuous-variable (CV) SDI QRNG with which we demonstrate generation rates of 270 Mbit/s.
Typical CV-QRNGs feature optical homodyne detection to measure a quadrature observable of an input quantum state <cit.>.
The quadrature is selected by the phase of a classical field, the so-called local oscillator (LO), which interferes with the input field.
The LO is typically a continuous-wave laser.
In our SDI protocol, the laser is pulsed and gain switched such that each pulse features a random phase <cit.>.
This allows us to use the tomographic technique of phase-randomized homodyne detection <cit.> for random number generation, the security of which follows from randomly changing the phase of the LO.

Unlike other recently introduced SDI CV-QRNGs <cit.>, ours features the same optical setup as a typical CV-QRNG. No additional optical components are  required. 
The phase randomization of the LO, which is the key element of our generator, is obtained without resorting to a phase modulator. This let us relax the security assumptions on the input state without increasing the complexity of the setup. 
We refer to Fig. <ref> to illustrate the difference between our SDI CV-QRNG and a typical one.

CV-QRNGs use balanced homodyne detection (BHD) to measure a quadrature observable 𝒬 of an input state ρ_A.
This corresponds to Alice applying the quadrature operator Q̂_θ= 1/√(2)( e^iθ/2â^†+e^-iθ/2â) on ρ_A, where â^† and â are the creation and annihilation operators such that [â,â^†]=1 holds and θ is the phase of the LO, which is usually fixed.
The eigenvalue equation for Q̂_θ is Q̂_θ|q_θ⟩ =q_θ|q_θ⟩, with q_θ a real number. 

Since the generator is characterized by a finite resolution δ, the measurements of the quadratures return the raw random numbers q_θ,k, where  k is the bin index of the intervals I_δ^k=(k-δ/2,k+δ/2], with the central bin corresponding to k=0 [Typically the number of bins matches the cardinality of the ADC alphabet, see <cit.>.].





The discretized quadrature spectrum, Q_θ,δ defines the random variable associated with the measurement outcomes: each result is obtained with probability 𝔭(q_θ,k)=[ρ_AQ̂^k_θ,δ]=∫_I_δ^k dq⟨q_θ|ρ_A|q_θ⟩, where 
Q̂^k_θ,δ=∫_I_δ^k dq|q_θ⟩⟨q_θ| are the elements of Alice's positive operator-valued measure (POVMs) applied on ρ_A.
If the input state can be trusted to be pure, the maximal number of independent and identically distributed (iid) bits extractable per  measurement is given by the min-entropy H_min( Q_θ,δ) = -log_2 Q_θ,δ, where Q_θ,δ = max_k𝔭(q_θ,k) is the guessing probability <cit.>
Typically CV-QRNGs trust the input state to be the vacuum <cit.>, ρ_A=|0⟩⟨0| [see Fig. <ref>-a], for which the LO's phase is irrelevant due its to the rotational invariance in phase space.
The associated outcome distribution |⟨0|q⟩|^2 is Gaussian with zero mean and variance σ^2_|0⟩=1/2, such that the min-entropy is given by

    H_min( Q_δ) _|0⟩ =-log_2 erf(δ/2) .


However, in the SDI paradigm,  the measurement is assumed to be under Alice's control whereas the input state is uncharacterized and even assumed to be controlled by Eve [see Fig. <ref>(b)].

An example attack [Fig. <ref>(c).] can clarify the difference between the two cases [Figs. <ref>(d) and <ref>(e)].
Suppose that Eve controls the input state.
In the non-SDI case, Fig. <ref>(d), she knows that Alice measures ρ_A along the 𝒬 quadrature selected by the LO phase θ, which is fixed.
Eve can then input a displaced squeezed state such that she can predict q_θ,k with high confidence.
To conceal her attack, Eve displaces the states so that the probabilities 𝔭(q_θ,k) measured by Alice are the same as those she would expect from her trusted input vacuum state.
Clearly, Alice could never spot this attack and she would overestimate the actual randomness of the samples.
In the limit of infinite squeezing, Eve could predict each outcome with certainty and the actual min-entropy would become zero.
In the SDI case on the contrary, Fig. <ref>(e),

Alice measures the input field on a quadrature randomly selected by the LO, which is assumed to be inaccessible to Eve.
This foils Eve's strategy based on a squeezed input.
Without knowing Alice's LO phase, Eve cannot determine the correct squeezing direction for her attack.
This makes the distribution measured by Alice broader than the one corresponding to the vacuum, σ^2_M > σ^2_|0⟩, which unveils the attack.



§ BOUND FOR THE ENTROPY
 WITH PHASE RANDOMIZATION

In the presence of an adversary controlling the source, the maximal number of iid bits distillable with a randomness extractor is given by the min-entropy H_min( Q_θ,δ|E) conditioned on the quantum side information available to Eve.
This quantity considers a purification ρ_AE of the input state ρ_A:
the system E, e.g. a quantum memory, is entangled with Alice's system A and held by Eve who measures it to predict Q_θ,δ.
The quantum conditional min-entropy is then defined as

    H_min( Q_θ,δ|E)=-log_2 max_{Q̂_θ,E}∑_k=-∞^∞𝔭(q_θ,k) [ Q̂_θ,E^k ρ_E^k]

with ρ_E^k being the post-Alice-measurement state of E, on which Eve applies the POVM {Q̂_θ,E} <cit.>.

In the following we will lower bound H_min( Q_θ,δ|E) by phase randomizing Alice's states, a procedure typically used to enhance the performance of quantum key distribution with weak coherent states <cit.>.

To show the efficacy of this procedure, consider the following example. Eve shares with Alice a two-mode squeezed-vacuum state
AE = (1-γ^2)∑_n,m=0^∞γ^m+n|n⟩_E⟨n|⊗|m⟩_A⟨m| ,
where γ = tanhr and r the squeezing parameter.

Although the quadrature fluctuations look random to Alice, the numbers are not private, as Eve can learn them from her part of the state.
However, if Alice's input is phase randomized, ρ_AE becomes
AE,φ_av^pr = (1-γ^2)∑_n=0^∞γ^2n|n⟩_E⟨n|⊗|n⟩_A⟨n| ,

which is a separable state that guarantees the privacy of Alice's numbers.

We generalize this example by considering the density matrix of a pure bipartite state in the Fock basis

    AE = ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗|n⟩_A⟨m|.

Alice phase randomizes the input by applying the phase shift operator Û_φ = e^-iφn̂ to her part of the system,

    AE^pr =   ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗Û_φ|n⟩_A⟨m|Û^†_φ
    
    =   ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗|n⟩_A⟨m|e^-i(n-m)φ,

with the phase uniformly distributed in the interval φ∈{0,2π}.
Since Eve does not know the φ values, the state AE^pr is averaged to

    AE, φ_av^pr = ∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|⊗|n⟩_A⟨n| .

This relation shows that phase randomization returns the same outcome as a quantum non demolition measurement of the photon number <cit.> that disentangles A from E. In fact, Eq. (<ref>) can be also rewritten in a manifestly separable form <cit.>.

Equation (<ref>) also entails that Alice's most generic input state after phase randomization is a classical mixture of Fock states, as is clear from _E AE,φ_av^pr = ∑_n p_n|n⟩_A⟨n|_A
with p_n= ∑_k ρ^k,k_n,n. Therefore  
it is equally secure to consider that Eve inputs such a mixture rather than preparing a general state AE.
The side information is now related to the ensembles {p_n,|n⟩} 
and the conditional min-entropy becomes

    H_min( Q_δ|E)_pr=-log_2max_{p_n,|n⟩}∑_n p_n max_k[Q̂^k_δ|n⟩⟨n|]

with the external maximization performed over all Eve's possible {p_n,|n⟩} compatible with A,φ_av^pr <cit.>.

Alice can now easily bound Eq. (<ref>) by noticing that the largest guessing probability is obtained when Eve inputs the vacuum state |0⟩⟨0|.
In fact, the argument of the external maximization is a convex combination of probabilities; hence it is automatically upper bounded by its maximum element, that is, Q_δ_|0⟩≃δ/√(π).
The vacuum is the Fock state with the narrowest uncertainty in the phase space, which implies

    max_k Q̂^k_δ n  < max_k Q̂^k_δ 0 = Q_|0⟩

 for n≥ 1.
Hence, among all the possible {p_n,|n⟩}, the trivial decomposition {p_0=1,|0⟩} is the best forging strategy for Eve, which implies the following bound for the conditional min-entropy

    H_min( Q_δ|E)_pr≥ H_min( Q _δ)_|0⟩ .

Consequently, when Alice performs phase randomization, Eve's best attack is to input the vacuum state.



§ SDI CV-QRNG WITH PHASE RANDOMIZED LO


The scheme presented in the previous section is SDI if we assume that a phase modulator randomizing the input state is part of Alice's measuring setup and Eve cannot access it.
This assumption is hardly justifiable in practice.
For example, this phase modulator could be probed by external bright pulses <cit.>.
Fortunately, there is no need for this phase randomizer in our setup as the phase randomization comes for free from a LO generated by a gain-switched laser.

As we show in Appendix A, Eve's density matrix after Alice's state phase randomization and  quadrature measurement with a fixed phase θ,

    E^I = _A [(Id_E⊗Q̂_θ,δ^k)^†∫^2π_0 dφ/2πÛ^†_φAEÛ_φ(Id_E⊗Q̂_θ,δ^k)  ],

 is equal to the phase averaged matrix obtained by Alice after applying a randomly φ-phase shifted  quadrature operator Q̂^ps_θ,ϕ,

    E^II = _A [∫^2π_0 dφ/2π(Id_E⊗Q̂^ps_θ,ϕ) AE(Id_E⊗Q̂^ps_θ,ϕ)^†],

where Q̂^ps_θ,ϕ= Û_φQ̂_θ,δ^kÛ^†_φ.
Therefore the two situations are equivalent securitywise.

The feasibility of the SDI protocol is greatly simplified by having E^I =  E^II in Eqs. (<ref>) and (<ref>).
Firstly, because applying Û_φ=e^-iφn̂ to Q̂_θ,δ^k corresponds to shifting the LO by a phase φ,
we can replace the phase modulator with a phase-randomized LO, by exploiting the process of phase diffusion in gain switched lasers <cit.>.
This has practical consequences on security as Eve cannot tamper with a phase modulator placed on the input port.
Moreover if a real phase modulator were used to randomize the LO phase, another RNG would be necessary to properly drive it.



§ EXPERIMENTAL REALIZATION


We now move on to show the phase-randomized SDI CV-QRNG in operation.
The setup is shown in Fig. <ref>.
The LO is a 1550 nm laser diode, with an integrated optical isolator, gain-switched to produce phase randomized pulses.
Its output first travels through a variable optical attenuator (VOA) and is then split by a 99:1 fibre coupler.
The 1% output is connected to a power meter to monitor the power of the LO.
The 99% output is split by a 50:50 coupler. The other input of the 50:50 coupler is left open such that any input state potentially controlled by an adversary could enter.
A microelectromechanical systems (MEMS) VOA on one output arm of the 50:50 coupler balances the power incident on the two photodiodes of a commercial wideband homodyne detector.
An optical delay line is used to match the arrival times of the pulses.
The output of the BHD is digitised using an oscilloscope with an analog-to-digital converter (ADC) resolution of eight bits and a sampling frequency of 40 GSamples/s.
The main advantage of this protocol is that the setup required is identical to a typical trusted CV-QRNG despite offering SDI assurance.
The phase randomization of the LO is a vital part of the security of this protocol.
In practical future implementations, in addition to the power meter for monitoring the intensity, Alice could add an interferometer to monitor the actual phase randomization of the LO.
The LO could be further protected from potential external phase seeding attacks by placing an additional optical isolator in front of it.


To gain-switch the laser, the dc bias is set just below threshold and the laser is driven above threshold by applying an ac voltage from a pattern generator.
When the laser cavity is empty, the lasing action is triggered entirely by spontaneous emission, which inherits its random phase from the vacuum <cit.>.
This condition holds for repetition frequencies up to 2.5 GHz <cit.>.
However, we limit the clock rate to 50 MHz to minimise the signal ringing due to the imperfect response of the BHD circuit to higher frequency pulses.


An example of the ringing observed is shown in Fig. <ref>A, in which the region from which the raw random numbers were sampled is highlighted.
The chosen pulsing frequency also allows us to minimize the correlations introduced by the finite bandwidth of the detector <cit.>.

Filtering and randomness extraction are performed offline. We first apply a 1.6 GHz low pass filter to remove the noise above the bandwidth of the detector, then sub-sample the resulting data taking one point every laser pulse, giving an equivalent sampling rate of 50 MSamples/s.
The low frequency noise is removed by modulating at 25 MHz then applying a low pass filter.
The autocorrelation evaluated on a set of 10^6 filtered points with the 95% confidence intervals for lags of 0 to 400 is reported in Fig. <ref>B, showing the absence of correlations due to low-frequency noise.



§ BOUNDING THE MIN-ENTROPY


To bound the conditional min-entropy, we estimate the resolution δ in vacuum units.
During our practical calibration, the signal port is blocked to provide a reference vacuum state input.
We measure the variance of the filtered data at different LO powers P and fit a calibration line.
The intercept corresponds to the contribution of the electronic noise to the overall variance, whereas the gradient, m, can be used to estimate the contribution of the quantum noise.
A typical calibration line is shown in Fig. <ref>A.
In the absence of electronic noise, the variance in ADC units would be given by mP and the measurement resolution in vacuum units δ=δ_ADC/√(2mP), where δ_ADC is the resolution of the oscilloscope ADC.
The solid line in Fig. <ref>B represents the theoretical vacuum distribution used to bound the min-entropy of the raw numbers whose distribution is represented by the histogram.
According to our framework, Alice does not make any assumptions on the input state entering the signal port and therefore on the raw distribution that she will observe.
However, since in our proof of principle experiment there was no external source, it is reasonable to assume that the vacuum was actually the main input state.
The histogram of the raw data is then Gaussian but wider than reference vacuum distribution because it includes excess noise.



Using Eqs. (<ref>) and Eq. (<ref>), we obtain a typical conditional min-entropy of H_min( Q_δ|E)_pr≥ 5.53 bits.
To extract iid bits we implement a Toeplitz hashing using a seed from another QRNG, described in <cit.>.
Given the length of the input string, the length of the seed was chosen to obtain a probability ϵ≥ 2^-100 of distinguishing the output data distribution from a uniform one <cit.>.
As a result, 5.4 random bits were distilled from each raw 8 bit sample.
With the 50 MHz sampling rate, this provides a secure generation rate of 270 Mbit/s.

To assess the implementation of the randomness extractor, we applied two standard statistical tests,  NIST <cit.> and TestU01 <cit.>.
The data gathered was split into blocks of 125 MB for the NIST tests.
The Rabbit and Alphabit batteries from the TestU01 suite were applied to all 900 MB of data at once.
The post-processed data passed all of these tests.
Detailed results  are reported in Appendix B.



§ CONCLUSION

In this work we presented an experimental SDI CV-QRNG based on phase randomized balanced homodyne detection capable of generating secure random numbers at an equivalent rate of 270 Mbit/s. Due to the SDI nature of the generator, no assumption on the input state was required.

The  achieved generation rate was limited by the ringing observed in the output of the balanced homodyne detector.
Any reduction of this impairment could significantly increase the generation rate.

In contrast to earlier SDI CV-QRNGs, this implementation does not require active optical components or the use of heterodyne detection. The gain-switched local oscillator provides the necessary phase randomization for the QRNG without adding components such as a phase randomizer and a random number generator to drive it. This also makes the setup robust against attacks probing the internal components. These features and the overall compactness of the generator are promising for a future integration on chip.


This project has received funding from the European Union’s Horizon 2020 research and innovation program under Marie Sklodowska-Curie Grant Agreement No. 750602,“Development of an Ultra-Fast, Integrated, Certified SecureQuantum Random Number Generator for Applications in Science and Information Technology”(UFICS-QRNG). P.R.S. gratefully acknowledges financial support from the EPSRC (Award No. 1771797) CDT in Integrated Photonic and Electronics Systems and Toshiba Research Europe, Limited.




§ APPENDIX A: EQUIVALENCE BETWEEN PHASE-RANDOMIZED INPUT AND PHASE-RANDOMIZED LOCAL OSCILLATOR


In the following, we will explicitly demonstrate E^I =  E^II, where E^Iand E^II are defined in Eqs. (<ref>) and (<ref>) in the Main Text. We will argue that from a security perspective it is equivalent to place a phase randomiser at the input of the generator or to use a phase-randomized local oscillator. The equivalence will be proven by showing that Eve's reduced density matrix is the same in the two cases.





The most general Alice-Eve density matrix written in the Fock basis is


    AE = ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗|n⟩_A⟨m|,


where
{k_E}_k= 0…∞ and {l_E}_l= 0…∞
are Eve's basis states and
{n_A}_n= 0…∞ and {m_A}_m= 0…∞
are Alice's basis states.

We define the phase shift operator Û_φ = e^-iφn̂, where n̂ is the photon number operator, and rewrite Eq. (4) of the main text as



    AE^pr   =  ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗( 1/2π∫^2π_0 dφÛ_φ|n⟩_A⟨m|Û_φ^†) 
        = ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗( 1/2π∫^2π_0 dφ e^ -i(n-m)φ|n⟩_A⟨m|)  
        = ∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|⊗|n⟩_A⟨n| .



We then consider the action of Alice's quadrature operator.
For ease of notation, in the following we will use the quadrature projector in the approximation of infinite resolution Q̂_θ= |q_θ⟩⟨q_θ|, by dropping the reference to the interval δ and outcome k.

We then have

    (Id_E⊗Q̂_θ) AE^pr(Id_E⊗Q̂_θ) ^†

and evaluate the reduced state of Eve referred to in the main text by E^I by tracing out Alice's degrees of freedom:


    E^I    = tr_A [(Id_E⊗Q̂_θ) AE^pr(Id_E⊗Q̂_θ) ^†] 
        = ∑_r ⟨r|[ ∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|( Q̂_θ|n⟩_A⟨n|Q̂_θ^†) ] |r⟩
        = ∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|∑_r ⟨r| q_θ⟩⟨ q_θ|n⟩_A ⟨n| q_θ⟩⟨ q_θ|r⟩
       =∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|  |⟨ q_θ|n⟩_A|^2 ∑_r ⟨ q_θ|r⟩⟨r| q_θ⟩
       =∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|   |⟨ q_θ|n⟩_A|^2 ⟨ q_θ|∑_r |r⟩⟨r| q_θ⟩
       =∑_k,l,nρ^k,l_n,n|k⟩_E⟨l|  |⟨ q_θ|n⟩_A|^2



We now consider Alice applying a randomly phase-shifted quadrature operator Q̂^ps_θ,ϕ= Û_φQ̂_θÛ^†_φ on her part of the system, such that now the overall phase averaged state is:



    AE^pr    =∫^2π_0 dφ/2π(Id_E⊗Q̂^ps_θ,ϕ) AE(Id_E⊗Q̂^ps_θ,ϕ)^†
       = ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ(Û_φQ̂_θÛ^†_φ) |n⟩_A ⟨m|( Û_φQ̂_θÛ^†_φ) 
       =  ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ e^-i(m-n)φÛ_φQ̂_θ|n⟩_A ⟨m|Q̂_θÛ_φ^†




By tracing out Alice's degrees of freedom, we obtain Eve's density matrix E^II:


    E^II   = tr_A [AE^pr] 
       = ∑_r ⟨r|( ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ  e^-i(m-n)φÛ_φ| q_θ⟩⟨ q_θ| n⟩_A ⟨ m| q_θ⟩⟨ q_θ|Û_φ^†) |r⟩
       = ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ  e^-i(m-n)φ∑_r ⟨r|Û_φ| q_θ⟩⟨ q_θ|n⟩_A ⟨m| q_θ⟩⟨ q_θ|Û_φ^†|r⟩
       = ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ  e^-i(m-n)φ∑_r,s⟨r|Û_φ|s⟩⟨s| q_θ⟩⟨ q_θ|n⟩_A ⟨m| q_θ⟩⟨ q_θ|Û_φ^†|r⟩
       =∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ e^-i(m-n)φ∑_r,s e^ -i(s-r)φ⟨r|s⟩⟨s| q_θ⟩⟨ q_θ|n⟩_A ⟨m| q_θ⟩⟨ q_θ|r⟩
       =  ∑_k,l,n,mρ^k,l_n,m|k⟩_E⟨l|⊗1/2π∫^2π_0 dφ e^-i(m-n)φ∑_r ⟨r| q_θ⟩⟨ q_θ|n⟩_A ⟨m| q_θ⟩⟨ q_θ|r⟩
       = ∑_k,l,nρ^k,l_n,n|k⟩_E⟨l| |⟨ q_θ|n⟩_A|^2,


which is equal to Eve's density matrix in Eq. (<ref>), thus completing the proof.




§ APPENDIX B: EXPERIMENTAL BOUND TO THE MIN-ENTROPY

As explained in the main text, we calculate a bound on the min-entropy based on the gradient of a calibration line obtained by varying the power of the LO and measuring the variance of the filtered output. We assume that this relationship holds for the data gathered following this calibration. The performance of the system and hence the min-entropy is likely to change over time due to degradation of the components and changing environmental conditions. Our system therefore automatically obtains a new calibration line periodically (approximately every 10 min), allowing the value of the min-entropy used in the randomness extraction to be updated if necessary.
By taking into account the error in the gradient m associated with the fit, we calculate conservative estimates of the min-entropy from the calibration lines obtained when gathering the data discussed in the main text.
The resulting values are plotted in Fig. <ref>.
The vertical dashed lines indicate when parts of the setup were adjusted, changing the maximum LO power incident on the detector.
As expected, we see a corresponding change in the min-entropy. This highlights our systems’ ability to respond to changes in operating conditions and continue to extract iid bits.
The difference between the largest and smallest values of min-entropy obtained over all of the acquisitions is less than 2 %. The corresponding difference over the longest uninterrupted set of acquisitions is less than 1 %, highlighting the stability of our system. Furthermore, the number of iid bits extracted from each 8 bit sample, shown in green, is far below the minimum min-entropy bound obtained compared to the variation in values seen.


§ APPENDIX C: RESULT OF THE NIST TESTS

In Table <ref>, the results of a typical run of the NIST test  are reported.
The test is applied on 10^3 strings after application of the randomness extractor, and each string has a length of 10^6 bits.
49
fxundefined [1]
 ifx#1

fnum [1]
 #1firstoftwo
 secondoftwo
 
fx [1]
 #1firstoftwo
 secondoftwo
 





noop [0]secondoftwo

ref[1]@startlink#1@href
href[1]#1@endlink
anitize@url [0]`
12`$12`&12`#12`1̂2`_12`%12
startlink[1]
endlink[0]

rl [1]href #1












@bib@innerbibempty

[Herrero-Collantes and Garcia-Escartin(2017)]herrero2017quantum
  author author M. Herrero-Collantes and author J. C.  Garcia-Escartin, @noop  journal
  journal Reviews of Modern Physics volume
  89, pages 015004 (year 2017)NoStop
[Pironio et al.(2010)Pironio, Acín, Massar, de La Giroday, Matsukevich, Maunz,
  Olmschenk, Hayes, Luo,
  Manning et al.]pironio2010random
  author author S. Pironio, author A. Acín,
  author S. Massar, author A. B. de La Giroday, author D. N. Matsukevich, author P. Maunz, author
  S. Olmschenk, author
  D. Hayes, author L. Luo, author T. A.  Manning,  et al., @noop  journal journal Nature volume 464,  pages 1021 (year 2010)NoStop
[Liu et al.(2018a)Liu, Yuan, Li, Zhang,
  Zhao, Zhong, Cao,
  Li, Chen, Li et al.]liu2018high
  author author Y. Liu, author X. Yuan, author M.-H. Li, author
  W. Zhang, author Q. Zhao, author J. Zhong, author Y. Cao, author Y.-H. Li, author
  L.-K. Chen, author
  H. Li,  et al., @noop 
  journal journal Physical Review Letters  volume 120, pages 010503 (year 2018a)NoStop
[Liu et al.(2018b)Liu, Zhao, Li, Guan,
  Zhang, Bai, Zhang,
  Liu, Wu, Yuan et al.]liu2018device
  author author Y. Liu, author Q. Zhao, author M.-H. Li, author
  J.-Y. Guan, author
  Y. Zhang, author B. Bai, author W. Zhang, author W.-Z. Liu,
  author C. Wu, author
  X. Yuan,  et al., @noop 
  journal journal Nature volume 562, pages 548
  (year 2018b)NoStop
[Shen et al.(2018)Shen,
  Lee, Thinh, Bancal,
  Cerè, Lamas-Linares, Lita,
  Gerrits, Nam, Scarani, and  Kurtsiefer]Shen2018
  author author L. Shen, author J. Lee, author L. P. Thinh, author
  J.-D. Bancal, author
  A. Cerè, author A. Lamas-Linares, author A. Lita, author T. Gerrits, author S. W. Nam,
  author V. Scarani,  and  author C. Kurtsiefer,  @noop  journal journal Physical Review
  Letters volume 121, pages 150402
  (year 2018)NoStop
[Lunghi et al.(2015)Lunghi,
  Brask, Lim, Lavigne,
  Bowles, Martin, Zbinden,  and Brunner]Lunghi2015
  author author T. Lunghi, author J. B. Brask,
  author C. C. W. Lim, author Q. Lavigne, author
  J. Bowles, author A. Martin, author H. Zbinden,  and author N. Brunner, @noop  journal journal Physical Review Letters volume 114,  pages 150501 (year 2015)NoStop
[Cao et al.(2016)Cao,
  Zhou, Yuan, and Ma]Cao2016
  author author Z. Cao, author H. Zhou, author X. Yuan,  and author
  X. Ma, @noop  journal
  journal Physical Review X volume 6,  pages 011020 (year 2016)NoStop
[Brask et al.(2017)Brask,
  Martin, Esposito, Houlmann,
  Bowles, Zbinden, and Brunner]Brask2017
  author author J. B. Brask, author A. Martin,
  author W. Esposito, author R. Houlmann, author
  J. Bowles, author H. Zbinden,  and author N. Brunner, @noop  journal journal Physical Review Applied volume 7,  pages 054018 (year 2017)NoStop
[Van Himbeeck et al.(2017)Van Himbeeck, Woodhead, Cerf, García-Patrón, and Pironio]VanHimbeeck2017
  author author T. Van Himbeeck, author E. Woodhead, author N. J. Cerf,
  author R. García-Patrón,
   and author S. Pironio,  @noop  journal journal Quantum volume 1, pages 33 (year
  2017)NoStop
[Fiorentino et al.(2007)Fiorentino, Santori, Spillane,
  Beausoleil, and Munro]Fiorentino2007
  author author M. Fiorentino, author C. Santori,
  author S. Spillane, author R. Beausoleil,  and author W. Munro, @noop 
  journal journal Physical Review A volume 75, pages 032334 (year
  2007)NoStop
[Li et al.(2011)Li,
  Yin, Wu, Zou, Wang, Chen, Guo, and Han]Li2011
  author author H.-W. Li, author Z.-Q. Yin,
  author Y.-C. Wu, author X.-B. Zou, author
  S. Wang, author W. Chen, author G.-C.  Guo,  and author Z.-F.  Han, 10.1103/PhysRevA.84.034301 journal journal Physical Review A volume 84, pages 034301 (year
  2011)NoStop
[Vallone et al.(2014)Vallone, Marangon, Tomasin, and  Villoresi]Vallone2014
  author author G. Vallone, author D. G. Marangon, author M. Tomasin,   and author P. Villoresi,  @noop  journal journal Physical Review
  A volume 90, pages 052327 (year 2014)NoStop
[Gabriel et al.(2010)Gabriel, Wittmann, Sych, Dong, Mauerer, Andersen, Marquardt, and Leuchs]Gabriel2010
  author author C. Gabriel, author C. Wittmann,
  author D. Sych, author
  R. Dong, author W. Mauerer, author U. L.  Andersen, author C. Marquardt,  and author G. Leuchs, @noop  journal journal Nature
  Photonics volume 4, pages 711
  (year 2010)NoStop
[Symul et al.(2011)Symul,
  Assad, and Lam]Symul2011
  author author T. Symul, author S. Assad,  and  author P. K. Lam, @noop
   journal journal Applied Physics Letters  volume 98, pages 231103 (year 2011)NoStop
[Haw et al.(2015)Haw,
  Assad, Lance, Ng,
  Sharma, Lam, and Symul]Haw2015
  author author J. Haw, author S. Assad, author A. Lance, author
  N. Ng, author V. Sharma, author P. Lam,  and author T. Symul, @noop  journal journal Physical Review Applied volume 3,  pages 054004 (year 2015)NoStop
[Shi et al.(2016)Shi,
  Chng, and Kurtsiefer]Shi2016
  author author Y. Shi, author B. Chng,  and  author C. Kurtsiefer,  @noop  journal journal Applied Physics
  Letters volume 109, pages 041101
  (year 2016)NoStop
[Haylock et al.(2018)Haylock, Peace, Lenzini, Weedbrook, and Lobino]Haylock2018
  author author B. Haylock, author D. Peace,
  author F. Lenzini, author C. Weedbrook,  and author M. Lobino, 10.22331/q-2019-05-13-141 journal journal Quantum volume 3, pages 141 (year
  2019)NoStop
[Guo et al.(2018)Guo,
  Liu, Li, Cheng, Wu, and Guo]guo2018enhancing
  author author X. Guo, author R. Liu, author P. Li, author
  C. Cheng, author M. Wu,  and author Y. Guo, @noop  journal journal Entropy volume 20, pages
  819 (year 2018)NoStop
[Raffaelli et al.(2018)Raffaelli, Ferranti, Mahler, Sibson, Kennard, Santamato, Sinclair, Bonneau, Thompson, and  Matthews]Raffaelli2018
  author author F. Raffaelli, author G. Ferranti,
  author D. H. Mahler, author P. Sibson, author
  J. E. Kennard, author
  A. Santamato, author
  G. Sinclair, author
  D. Bonneau, author M. G. Thompson,  and author J. C. Matthews, @noop  journal
  journal Quantum Science and Technology volume 3, pages 025003 (year
  2018)NoStop
   [Zheng et al.(2018)Zheng,
  Zhang, Huang, Yu, and  Guo]Zheng2018
  author author Z. Zheng, author Y.-C. Zhang,
  author W. Huang, author S. Yu,  and author
  H. Guo, 10.1063/1.5078547 journal journal Review of Scientific Instruments volume 90, pages 043105 (year
  2019)NoStop
   [Gehring et al.(2019)Gehring, Lupo, Kordts, Nikolic, Jain, Pedersen, Pirandola, and Andersen]Gehring2019
  author author T. Gehring, author C. Lupo,
  author A. Kordts, author
  D. S. Nikolic, author N. Jain, author T. B.  Pedersen, author S. Pirandola,  and author U. L. Andersen, @noop  journal journal arXiv preprint
  arXiv:1812.05377  (year 2019)NoStop
[Jofre et al.(2011)Jofre,
  Curty, Steinlechner, Anzolin,
  Torres, Mitchell, and Pruneri]Jofre2011
  author author M. Jofre, author M. Curty,
  author F. Steinlechner, author G. Anzolin, author
  J. Torres, author M. Mitchell,  and author V. Pruneri, @noop  journal journal Optics Express volume 19, pages 20665 (year 2011)NoStop
[Abellán et al.(2014)Abellán, Amaya, Jofre, Curty, Acín, Capmany, Pruneri, and Mitchell]abellan2014ultra
  author author C. Abellán, author W. Amaya,
  author M. Jofre, author M. Curty, author
  A. Acín, author
  J. Capmany, author V. Pruneri,  and author M. Mitchell, @noop  journal
  journal Optics Express volume 22,  pages 1645 (year 2014)NoStop
[Yuan et al.(2014)Yuan,
  Lucamarini, Dynes, Fröhlich, Plews, and Shields]yuan2014robust
  author author Z. Yuan, author M. Lucamarini,
  author J. Dynes, author B. Fröhlich, author
  A. Plews,  and author
  A. Shields, @noop  journal journal Applied Physics Letters volume 104, pages 261112 (year
  2014)NoStop
[Mitchell et al.(2015)Mitchell, Abellan, and Amaya]mitchell2015
  author author M. W. Mitchell, author C. Abellan,   and author W. Amaya, 10.1103/PhysRevA.91.012314 journal journal Physical Review A volume 91, pages 012314 (year 2015)NoStop
[Abellán et al.(2015)Abellán, Amaya, Mitrani, Pruneri, and Mitchell]abellan2015
  author author C. Abellán, author W. Amaya,
  author D. Mitrani, author V. Pruneri,  and author M. W. Mitchell, 10.1103/PhysRevLett.115.250403 journal journal
  Physical Review Letters volume 115, pages 250403 (year 2015)NoStop
[Munroe et al.(1995)Munroe,
  Boggavarapu, Anderson, and Raymer]Munroe1995
  author author M. Munroe, author D. Boggavarapu,
  author M. Anderson,  and  author M. Raymer, @noop 
  journal journal Physical Review A volume 52, pages R924 (year
  1995)NoStop
[Leonhardt et al.(1996)Leonhardt, Munroe, Kiss, Richter, and Raymer]Leonhardt1996
  author author U. Leonhardt, author M. Munroe,
  author T. Kiss, author
  T. Richter,  and author
  M. Raymer, @noop  journal journal Optics Communications volume 127, pages 144 (year
  1996)NoStop
[Lvovsky et al.(2001)Lvovsky, Hansen, Aichele, Benson, Mlynek, and Schiller]Lvovsky2001
  author author A. I. Lvovsky, author H. Hansen,
  author T. Aichele, author O. Benson, author
  J. Mlynek,  and author
  S. Schiller, @noop  journal journal Physical Review Letters volume 87, pages 050402 (year
  2001)NoStop
[Marangon et al.(2017)Marangon, Vallone, and Villoresi]Marangon2017
  author author D. G. Marangon, author G. Vallone,   and author P. Villoresi,  @noop  journal journal Physical Review
  Letters volume 118, pages 060503
  (year 2017)NoStop
[Xu et al.(2017)Xu,
  Li, Yang, Wei, Su, Huang, Zhang, and Guo]Xu2017
  author author B. Xu, author Z. Li, author J. Yang, author
  S. Wei, author Q. Su, author W. Huang, author Y. Zhang,  and  author H. Guo, 10.1088/2058-9565/ab0fd9 journal journal Quantum Science and Technology volume 4, pages 025013 (year
  2019)NoStop
[Avesani et al.(2018)Avesani, Marangon, Vallone, and  Villoresi]Avesani2018
  author author M. Avesani, author D. G. Marangon, author G. Vallone,   and author P. Villoresi,  @noop  journal journal Nature
  Communications volume 9, pages 5365
  (year 2018)NoStop
[Note1()]Note1
  note Typically the number of bins matches the cardinality of the
  ADC alphabet, see <cit.>.Stop
[Konig et al.(2009)Konig,
  Renner, and Schaffner]konig2009operational
  author author R. Konig, author R. Renner,   and author C. Schaffner,  @noop  journal journal IEEE Transactions
  on Information theory volume 55, pages
  4337 (year 2009)NoStop
[Furrer et al.(2014)Furrer,
  Berta, Tomamichel, Scholz,  and Christandl]furrer2014position
  author author F. Furrer, author M. Berta,
  author M. Tomamichel, author V. B. Scholz,  and author M. Christandl, @noop 
  journal journal Journal of Mathematical Physics  volume 55, pages 122205 (year 2014)NoStop
[Coles et al.(2017)Coles,
  Berta, Tomamichel, and Wehner]coles2017entropic
  author author P. J. Coles, author M. Berta,
  author M. Tomamichel,  and  author S. Wehner, @noop 
  journal journal Reviews of Modern Physics  volume 89, pages 015002 (year 2017)NoStop
[
esman et al.(2004)Gottesman, Lo, Lutkenhaus, and  Preskill]Gottesman2004
  author author D. Gottesman, author H.-K. Lo,
  author N. Lutkenhaus,  and  author J. Preskill, @noop
   journal journal Information Theory, 2004. ISIT
  2004. Proceedings. International Symposium on Information Theory , pages 136
  (year 2004)NoStop
[Lo and Preskill(2005)]Lo2005a
  author author H.-K. Lo and author J. Preskill,  @noop  journal journal arXiv preprint
  quant-ph/0504209  (year 2005)NoStop
[Zhao et al.(2010)Zhao,
  Qi, Lo, and Qian]zhao2010security
  author author Y. Zhao, author B. Qi, author H.-K. Lo,  and author
  L. Qian, @noop  journal journal New Journal of Physics volume 12, pages 023024 (year
  2010)NoStop
[Pirandola(2013)]pirandola2013entanglement
  author author S. Pirandola, @noop  journal journal New
  Journal of Physics volume 15, pages
  113046 (year 2013)NoStop
[Law et al.(2014)Law,
  Bancal, Scarani et al.]Law2014
  author author Y. Z. Law, author J.-D. Bancal,
  author V. Scarani,  et al., @noop  journal journal Journal
  of Physics A: Mathematical and Theoretical volume
  47, pages 424028 (year 2014)NoStop
[Lucamarini et al.(2015)Lucamarini, Choi, Ward, Dynes, Yuan, and Shields]lucamarini2015practical
  author author M. Lucamarini, author I. Choi,
  author M. B. Ward, author J. F. Dynes, author
  Z. Yuan,  and author
  A. J. Shields, @noop  journal journal Physical Review X volume 5, pages 031030 (year
  2015)NoStop
[Henry(1982)]henry1982theory
  author author C. Henry, @noop  journal journal IEEE
  Journal of Quantum Electronics volume 18, pages 259 (year 1982)NoStop
[Shen et al.(2010)Shen,
  Tian, and Zou]Shen2010practical
  author author Y. Shen, author L. Tian,  and  author H. Zou, @noop 
  journal journal Physical Review A volume 81, pages 063814 (year
  2010)NoStop
[Marangon et al.(2018)Marangon, Plews, Lucamarini, Dynes, Sharpe, Yuan, and Shields]marangon2018long
  author author D. Marangon, author A. Plews,
  author M. Lucamarini, author J. Dynes, author
  A. Sharpe, author Z. Yuan,  and author A. Shields, @noop  journal journal Journal of Lightwave Technology  volume 36, pages
  3778 (year
  2018)NoStop
[Tomamichel et al.(2011)Tomamichel, Schaffner, Smith, and  Renner]tomamichel2011leftover
  author author M. Tomamichel, author C. Schaffner, author A. Smith,   and author R. Renner,  @noop  journal journal IEEE Transactions
  on Information Theory volume 57, pages
  5524 (year 2011)NoStop
[Frauchiger et al.(2013)Frauchiger, Renner, and Troyer]Frauchiger2013
  author author D. Frauchiger, author R. Renner,
   and author M. Troyer,  @noop  journal journal arXiv preprint
  arXiv:1311.4547  (year 2013)NoStop
[Bassham III et al.(2010)Bassham III,Rukhin, Soto, Nechvatal, Smid, and  Barker]nist
  author author L. Bassham III, author A. Rukhin, author J. Soto,
  author J. Nechvatal, author M. Smid,  and author
  E. Barker, @noop  title Sp 800-22rev1a: A statistical test suite for random and
  pseudorandom number generators for cryptographic applications,  (year 2010)NoStop
[nis()]nistURL
  @noop  title Nist “random number generation
  and testing", howpublished
  <http://csrc.nist.gov/rng>NoStop
[L'Ecuyer and Simard(2007)]testu01
  author author P. L'Ecuyer and author R. Simard, @noop  journal journal ACM
  Transactions on Mathematical Software volume 33,  pages 22 (year 2007)NoStop


