# 8 GBit/s real-time quantum random number generator with non-iid samples

###### Abstract

Random numbers have a variety of applications for which specific quality requirements must be met. Perhaps the most demanding application is cryptography where the quality has a critical impact on security. Quantum random number generators (QRNGs) based on the measurement of quantum states promise perfectly unpredictable and private random numbers. However, all device dependent QRNGs introduce assumptions that are either hardly justified or indeed unnecessary, such as perfect purity of the states and no correlations between data samples. In this work we experimentally realize a QRNG based on the measurement of vacuum fluctuations that does not rely on these assumptions. Moreover, we demonstrate a real-time random number generation rate of 8 GBit/s using a Toeplitz randomness extractor and certify the security of the random numbers with a metrological approach based on system characterization. Our approach offers a number of practical benefits and will therefore find widespread applications in quantum random number generators. In particular our generated random numbers are well suited for today’s conventional and quantum cryptographic solutions.

Random numbers are ubiquitous in modern society. They are used in numerous applications ranging from cryptography, simulations and gambling to fundamental tests of physics. For most of these applications the quality of the random numbers is of utmost importance. If for instance cryptographic keys originating from random numbers are predictable, it will have severe consequences for the security of the internet. To ensure the security of cryptographic encryption, the random numbers must be truly random, i.e. completely unpredictable to everyone and thus private, and their randomness must be certified Frauchiger et al. (2013); Acin and Masanes (2016).

True unpredictability and privacy of the generated numbers can be attained through a quantum measurement process: By performing a projective measurement on a pure quantum state, and ensuring that the state is not an eigenstate of the measurement projector, the outcome is unpredictable and thus true random numbers can be generated. Moreover, since a pure state cannot be correlated to any other state in the universe, the generated numbers will be private. Certification gives the user a guarantee that the produced random numbers are indeed random. Since absolutely perfect randomness cannot be produced, certification comes in the form of a small error probability that describes how far the generated random numbers are from an ideal condition.

Device independent (DI) QRNGs based on the violation of a Bell inequality yield the strongest randomness certification with the lowest number of assumptions. They are as of today, however, highly impractical in real applications due to their high complexity and very low speed: Currently tested DI-QRNGs are based on atom Pironio et al. (2010) or photon entanglement Liu et al. (2018); Bierhorst et al. (2018), and produce random numbers of about and bit/s, respectively. It is nevertheless possible to reduce the complexity of the system by trading it with assumptions on the device. An important task in developing a RNG is therefore to optimize the trade-off between practicality (technical complexity and speed) and reliability (randomness certification, unpredictability and privacy).

Here, we consider a highly practical device dependent system which is based on homodyne detection of the (pure) quantum mechanical vacuum state. Such a simple system is amongst one of the absolute front-running QRNG technologies as it combines simplicity, cost-effectiveness, chip-integrability and extraordinary high speed. In comparison to previous implementations, we reduce the number of assumptions, in particular those that are not well justified by practical components. Our QRNG is therefore perfectly suited for applications like classical and in particular quantum key distribution, which require the highest security guarantees and high speed Pirandola et al. (2017).

There are four critical issues related to the performance of device dependent QRNG which have not yet been accounted for in a single implementation. Most of the previous QRNGs have treated all information side-channels as classical rather than quantum Gabriel et al. (2010); Fuerst et al. (2010); Symul et al. (2011); Xu et al. (2012); Haw et al. (2015); Nie et al. (2015); Shi et al. (2016); Abellán et al. (2014); Zhang et al. (2016a). Only by treating them quantum, the random numbers can be secure against a quantum-enabled adversary. Recently, this issue has been solved for a source-independent QRNG Avesani et al. (2018) which requires a more complex measurement apparatus. Furthermore it has often been assumed that measurements are uncorrelated in time Gabriel et al. (2010); Fuerst et al. (2010); Symul et al. (2011); Xu et al. (2012); Haw et al. (2015); Nie et al. (2015); Shi et al. (2016); Abellán et al. (2014); Zhang et al. (2016a); Avesani et al. (2018), but, the finite bandwidth of any real detection system introduces correlations which can only be removed approximately with (usually rate-reducing) post-processing techniques. Most previous implementations also do not use a conservative and rigorous approach – a metrology-grade approach Mitchell et al. (2015) – to determine the parameters relevant for extracting the amount of randomness by accounting for imperfections and calibration uncertainties. Finally, high-speed randomness extraction using an information theoretically secure randomness extractor has only been demonstrated recently Zhang et al. (2016a, b).

With our QRNG we solve all these aforementioned issues simultaneously: We compute the lower bound on the extractable quantum randomness by including the possibility for extracting quantum information by an adversary via side-channels. We account for correlated samples resulting from the finite bandwidth of the measurement apparatus. We perform a metrology-grade characterization of the measuring homodyne detector system to quantify their security. Finally, as a result, we produce random numbers in real-time with a rate of 8 Gbit/s using a Toeplitz randomness extractor on a fast field-programmable-gate-array (FPGA), exceeding the previous real-time speed record by more than a factor of two.

A schematic of our QRNG is shown in Fig. 1. An arbitrary quadrature of the vacuum state is measured using a balanced homodyne detector comprising a bright reference beam, a symmetric beam splitter and two photodiodes Shapiro (1985). The measurement outcomes ideally are random with a Gaussian distribution associated only with the Gaussian Wigner function of the vacuum quantum state Weedbrook et al. (2012). The actual measured Gaussian distribution, however, contains two additional independent Gaussian noise sources; excess optical noise and electronic noise, thereby contributing two side-channels. These must be accounted for in estimating the min-entropy of the source.

The amount of quantum randomness that can be extracted from the homodyne measurement of vacuum fluctuations is given by the leftover hash lemma Renner (2005); Tomamichel et al. (2011)

(1) |

Here is the min-entropy of a single measurement outcome drawn from a random variable conditioned on the quantum side-information held by an adversary, is the number of aggregated samples and is the distance between a perfectly uniform random string and the string produced by a randomness extractor. It is therefore clear that we need to find the min-entropy of our practical – thus imperfect – realization in order to bound the amount of randomness. We achieve this in a two-step approach: First we theoretically derive a bound for the min-entropy using a realistic security model and express it in terms of experimentally accessible parameters. Next, we experimentally deduce these parameters through a metrology-grade characterization Mitchell et al. (2015). Using such an approach we find the worst-case min-entropy compatible with the confidence intervals of our characterization and calibration measurements, thereby obtaining a string of -random bits that are trustworthy with the same level of confidence.

For the derivation of the min-entropy, we assume that the source state is represented by a Gaussian quantum Wigner function, symmetric in phase space, and the quantum process is stationary. In particular our security model includes quantum side-information and finite bandwidth effects.

First we consider an i.i.d. scenario where signals at different times are identically and independently distributed (thus neglecting bandwidth effects). We account for quantum side information by considering a source emitting thermal light with mean photon number and a malicious adversary holding a purification of that thermal state. Without loss of generality the purified state can be assumed to be a two-mode squeezed vacuum state, denoted as . The output of ideal homodyne detection has the probability density distribution , i.e. a Gaussian with zero mean and variance , where is a gain factor. A lower bound on the min-entropy is obtained as Tomamichel (2012) where is the operator norm and is a given Gaussian state. However, in practice an analog-to-digital converter (ADC) maps the continuous variables into discrete and bounded variables with a bin size . By optimizing the dynamic range of the ADC, we find a lower bound on min-entropy (details are provided in the Supplemental Material):

(2) |

Going beyond i.i.d., we now consider a more realistic scenario where the measured signal has a finite bandwidth. We make a distinction between the signal, i.e. the homodyne measurement of the quantum state including all additive noise processes, and the excess noise, i.e. all noise sources present in the measurement apart from the pure vacuum fluctuations, for instance electronic noise of the detector and intensity noise of the local oscillator laser. Let us first consider the ideal homodyne detection of vacuum fluctuations yielding the signal . From its power spectrum we can estimate the entropy rate of the signal , where Gray (2006) is the conditional variance. Notice that, unless the signal is i.i.d, is strictly smaller than the signal variance, denoted . Similarly, from the power spectrum of the excess noise we obtain the entropy rate of the noise .

Because of the finite bandwidth of the measuring apparatus both the signal and excess noise at a given time are correlated with their values at previous times. To filter out the effects of these correlations we consider the probability density distribution of conditioned on all past signal values, , where denotes the collection of values of all signals at times . Notice that the mean value depends on , whereas the conditional variance does not. This description is consistent with the assumption of a stationary Gaussian process Gray (2006). The conditioned variable at time is virtually independent on previous signal values, therefore we can apply the same reasoning as for the i.i.d. case above and identify which in turn implies , where is the variance of the additional classical noise that displaces the mean value to .

For the excess noise we similarly obtain the probability density distribution conditioned on past values, i.e., . The quantity of interest is the conditional excess noise variance , which represents the variance of the excess noise that is virtually independent of previous noise values. Therefore we identify . By exploiting the conditional distributions we have thus mapped the non-i.i.d. setting into the i.i.d. model described above with the identification and . Finally, to obtain a lower bound we treat the classical noise as quantum noise. This is done by replacing . The lower bound is then found by inserting and in Eq. (2) which is plotted in Fig. 2 for varying excess noise, ADC resolution and temporal correlations.

Using the above results, we are now in a position to estimate the min-entropy through a metrology-grade characterization of our setup. According to the security analysis, the min-entropy can be found by determining the variance as well as the conditional variances of the homodyne signal and the excess noise . To obtain a conservative, and thus reliable, estimate of the min-entropy, it is important that the determination of these parameters does not rely on any ideality assumptions of the homodyne detector. In previous studies on homodyne based QRNG, the sole presence of shot noise has been verified by characterizing its scaling with optical power. However, imperfect common-mode rejection, large intensity noise of the laser or stray light coupling into the signal port – likely to be an issue with integrated photonic chips – may unnecessarily constrain the extraction of random numbers. Furthermore this characterization method is not directly compatible with metrology-grade characterization as it is difficult to bound the estimation error on the shot noise level with a confidence interval. To circumvent these assumptions and issues we perform an independent, reliable and metrology-grade characterization of the measuring device.

We basically consider the homodyne detector as a box with an input and an output with minimal assumptions on its internal workings (see Fig 3a). Our strategy is thus to measure the transfer function of the box and to use this result to conservatively calibrate the power spectral density (PSD) of the vacuum fluctuations. This conservatively estimated result is then compared to the PSD of an actual noise measurement from which we deduce the conditional variances of the signal noise and the excess noise, and finally the min-entropy.

The transfer function of the box is measured by injecting a coherent state in form of a second laser beam (independent of the local oscillator laser) with low power into the signal port of the beam splitter as displayed in Fig. 3a. A typical beat signal is shown in Fig. 3b obtained by computing an averaged periodogram from the sampled signal. We record the transfer function by scanning the frequency of the signal laser. At each difference frequency we determine the power of the beat signal and normalize it to . At high signal-to-noise ratio the root-mean-square power of the beat signal is purely a function of the coherent state amplitude (i.e. the signal laser power) and independent of the noise properties of the two lasers and the detector.

The transfer function includes the efficiency of the interference, optical loss and the quantum efficiency of the photodiodes, as well as the frequency dependent gain of all amplifiers, the lowpass filter and the analog bandwidth of the ADC. Since the vacuum noise was amplified to optimally fill the range of the ADC we used a 20 dB electrical attenuator with flat attenuation over the frequency band of interest to avoid saturation, see Fig. 3a. The result of the transfer function characterization, normalized to a maximum gain of 1 is shown in Fig. 3c. Assuming linearity of the detector we obtain the PSD of the vacuum fluctuations by multiplying the transfer function with the shot noise energy contained in 1 Hz bandwidth, where is Planck’s constant and is the angular frequency of the local oscillator laser. By modelling the inner workings of the grey box we confirm in the supplementary material that using this procedure we indeed obtain a lower bound on the PSD of the vacuum fluctuations.

The conservatively estimated PSD of the vacuum fluctuations is shown in Fig. 4a together with the actually measured PSD of the signal. The spectra are clearly “colored” which indicates that the data samples are correlated and therefore non-i.i.d. This is further corroborated in Fig. 4b, where the autocorrelation of the signal is plotted. It justifies the importance of using the min-entropy relation associated with non-i.i.d. samples.

From the PSDs we calculate the three parameters for obtaining the min-entropy which are summarized in Table 1. Minimizing the min-entropy over the confidence set of the estimated parameters, yielded 10.7 bit per 16 bit sample for a failure probability of our parameter characterization of (i.e. the probability that the actual parameters are outside the confidence intervals). To verify the Gaussian assumption in our security proof we calculated the probability quantiles of the measured samples and compared those to the theoretical quantiles of a Gaussian distribution, see Fig. 4c.

Parameter | Mean | Confidence interval |
---|---|---|

Conditional quantum to | ||

excess noise ratio | -4.9 dB | |

Min-entropy | 10.7 bit | |

Calculated secure length | 640.7 bit | |

Extracted length | 640 bit |

Having calculated the min-entropy, the next step is to extract random numbers. This is done by using a strong extractor based on a Toeplitz matrix hashing algorithm in which the seed can be reused Wegman and Carter (1981); Zhang et al. (2016a, b). We chose matrix dimensions of bits and bits, corresponding to 80 input samples with a depth of 16 bit and an output length chosen as a multiple of 128 bit such that Eq. 1 was fulfilled with bit and . The recorded samples from the ADC were transferred into a first-in-first-out (FIFO) buffer in the FPGA using a 64 bit wide bus with a clock frequency of 250 MHz. The randomness extraction was then implemented with a clock rate of 125 MHz and processed 128 bit words at once: We sliced the full Toeplitz matrix column-wise into sub-matrices of (column) size 128. In each pipeline stage the 128 bit input vector was multiplied with the row-vectors of a sub-matrix in parallel. The seed of bits was kept in fast FPGA logic flip-flops and the sub-matrices were generated on the fly due to limited logic resources. The multiplication was performed using bit-wise AND and a subsequent XOR of all 128 bits which was implemented in a 3-stage pipeline to fulfill timing constraints. The resulting bits were stored in an accumulator register. The achieved throughput was 8 GBit/s.

In conclusion, we have demonstrated a QRNG based on the measurement of vacuum fluctuations with a real-time extraction at a rate of 8 GBit/s. Our QRNG has a strong security guarantee with a failure probability of , where is the number of QRNG runs in the past, is the security parameter related to the removal of side information (see Eq. 1) is the security parameter of the metrological grade parameter estimation and describes the security of the random bits used for seeding the randomness extractor. Since an adversary may have access to all quantum side information from the past, grows with time Frauchiger et al. (2013). We chose a value of to be able to generate Gaussian random numbers with security for a QKD run with samples requiring reseeding of the QRNG only once every 10 years. In our experiment the seed bits were chosen with a pseudo-random number generator, which did not allow us to give a security guarantee for . The generated random numbers passed both, the dieharder Brown (2018) and the NIST Rukhin et al. (2001) statistical batteries of randomness tests.

The real-time speed of our QRNG was limited to 8 GBit/s due to the small input size of the Toeplitz extractor required by our FPGA implementation. With a 5 times larger input size, a throughput of more than 10 GBit/s would be possible with the same security parameter. Nevertheless, our QRNG is perfectly suited for use in high-speed QKD links, for instance in GHz clocked discrete variable Dixon et al. (2008) as well as in high-speed continuous-variable QKD Huang et al. (2015). For Gaussian-modulated CVQKD the uniform random number distribution has to be converted to a Gaussian distribution which requires a larger random number generation rate. Furthermore, QKD requires quantified security and a guarantee of privacy of the random numbers as provided by our system. Further developments to guarantee reliable operation over a long time and to fulfill requirements by certification authorities would need to include power-on self-tests and online testing of the parameters in the security proof as well as the generated random numbers.

## Acknowledgements

The authors thank the Quantum Innovation Center Qubiz for support. TG, AK, DSN, NJ and ULA acknowledge support from the Danish National Research Foundation, Center for Macroscopic Quantum States (bigQ, DNRF142). TG, NJ, SP and ULA acknowledge the EU project CiViQ (grant agreement no. 820466). The authors thank Alberto Nannarelli for valueable discussions.

## Appendix A Supplementary Material

### a.1 Preliminaries

We describe the -mode states of the electromagnetic field within the Wigner function representation. We are dealing with Gaussian states whose Wigner function is completely characterized by the first and second moments of the field quadratures. The user of our quantum random number generator measures by homodyne detection a bosonic mode associated with the quadrature operators and . Without loss of generality we assume that an adversary (also called eavesdropper) holds a purifying system defined by one bosonic mode with quadrature operators , . We assume that the measured mode is in a thermal state with mean photon number. This implies that the mean values of the quadratures vanishes and the covariance matrix (CM) is

(3) | ||||

(4) |

where we adopted the convention that the vacuum variance is .

It is well know that the purification of a thermal state is a two-mode squeezed vacuum (TMSV) state, a Gaussian state with zero mean and CM Weedbrook et al. (2012)

(5) | ||||

(6) |

If the user measures the quadrature by homodyne detection, the measurement output is a continuous real-valued variable with probability density distribution

(7) |

where is a gain factor and

(8) |

denotes a Gaussian with mean and variance .

The correlations between the outcome of ideal homodyne detection and the quantum side information held by the eavesdropper are described by the classical-quantum (CQ) state

(9) |

where the integral is over the real line and is a Gaussian state with first moment

(10) |

and covariance matrix

(11) |

In our QRNG the continuous variable is mapped into a discrete and bounded variable by applying an analog-to-digital converter (ADC). We therefore consider a model in which is replaced by a discrete variable such that

(12) |

where ’s are intervals that discretize the outcome of homodyne detection. In a typical setting these non-overlapping intervals are of the form

(13) | ||||

(14) |

and for

(15) |

with and . This choice of the intervals reflects the way in which an ADC with range and bin size operates in mapping a continuous variable into a discrete one.

In terms of the discrete variable , the correlations with a fully quantum eavesdropper are then described by the state

(16) |

with

(17) |

### a.2 Lower bounds on the min-entropy with quantum side information

Given the state in Eq. (16),
the min-entropy of conditioned on reads Tomamichel (2012)
^{1}^{1}1Here stands for the logarithm in base and
for the natural logarithm.

(18) |

A first lower bound on the min-entropy is obtained by computing for a given choice of the state :

(19) | ||||

(20) |

where the last equality holds because is a CQ state. Here we put equal to a one-mode Gaussian state with zero mean and CM

(21) |

where the parameter will be optimized a posteriori to obtain a tight bound.

A second lower bound is obtained by applying the triangular inequality,

(22) | ||||

(23) |

which implies

(24) |

Note that and are both Gaussian states and therefore the above lower bound can be computed using the Gibbs-representation techniques developed in Ref. Banchi et al. (2015) and the techniques of Pirandola et al. (2017) for the relative entropy between two arbitrary Gaussian states. These earlier methods can be used to derive a formula for the Rényi relative entropy (see Theorem 5 of Ref. Seshadreesan et al. (2018)). By applying this formula we obtain

(25) |

This last expression allows us to write

(26) |

The supremum over can be computed for any given collection of intervals ’s. For intervals as in Eqs. (13)-(15) we obtain

(27) |

which for an optimal choice of yields our third lower bound

(28) |

We remark that this is in fact a family of lower bounds parameterized by , one should then find the optimal value of for which the bound is tighter.

At the lowest order in the lower bound in Eq. (28) simplifies to

(29) |

and putting, for example, we obtain

(30) |

### a.3 Comparison with classical side information

We can compare the lower bounds computed in the previous sections with an upper bound obtained under the assumption that the eavesdropper performs ideal homodyne detection.

If user and eavesdropper both apply homodyne detection, then they generate a pair of correlated Gaussian variables and such that

(31) | ||||

(32) |

The variable is then mapped into a discrete and bounded variable as described in Section A.1. Using an optimal choice of the range of the ADC, the min-entropy of conditioned on the is

(33) |

or, up to correction of order higher than ,

(34) |

Figure 5 shows the homodyne upper bound in Eq. (33) together with lower bound in Eq. (28) as function of , for and . Figure 6 shows instead the difference between the approximate homodyne upper bound in Eq. (34) and the approximate lower bound in Eq. (29), again for (notice that the difference does not depend on ). The plot shows that difference is as small as a fraction of a bit.

### a.4 Estimation of variances and the entropy rate

In this appendix we discuss the estimation of the variance, entropy rate and conditional variance of the noise and signal. To make things more concrete, we focus on the estimation of the signal variance , entropy rate and the conditional signal variance . Assume that is the runtime of the experiment, and signal measurements are performed at regular time intervals of . The spectral density computed from these data is a function of discrete frequencies, denoted as ’s, taking values between and . Below we work with the discrete variable defined as , which can be approximated by the continuous variable taking values with domain .

We estimate the spectral density by applying the Welch’s method, according to which the data are first divided in (possibly overlapping) blocks, and then in each block the periodogram is computed, i.e., the discrete Fourier transform of the data contained in that very block. The spectral density is then estimated by taking the average over the periodograms. We assume that the periodograms, as random variables, are independent and identically distributed, and that each periodogram is distributed as the square of a Gaussian variable. Then the Welch’s estimate of the spectral density is distributed as a (rescaled) variable with degrees of freedom. Denoting as the Welch’s estimate for the spectral density and as its real value, then we can obtain a confidence interval by applying a tail bound of a variable. For example we can exploit the tail bounds (see e.g. Lupo et al. (2018))

(35) | ||||

(36) |

For this yields, up to higher order terms,

(37) |

with

(38) |

Let us first discuss the estimation of the entropy rate

(39) |

as approximated by the finite sum

(40) |

For each given , is the probability that , then it follows (from an application of the union bound) that

(41) |

This is equivalent to say that, with probability larger than , lays between and for all . Therefore

(42) |

with probability at least equal to . A further linear approximation for yields the confidence interval

(43) |

Finally, to take into account the overlap between adjacent periodograms, we replace , for . For example, if the periodogram have a overlap we put . In conclusion, with an overlap of , we obtain that for any given , the entropy rate lies within the interval

(44) |

up to a probability not larger than .

From the entropy rate we obtain a confidence interval for the conditional variance, , where

(45) |

Similarly, we obtain an estimate of the signal variance by exploiting the relation

(46) |

from which we derive a confidence interval

(47) |

Along the same lines we obtain a confidence interval for the conditional noise variance, (this must additionally includes systematic errors). To obtain a worst-case estimate of the min-entropy we consider the smaller value for the signal variance, , and the larger one for the noise, .

## Appendix B Characterization of vacuum fluctuations power spectral density

Here, we open up the homodyne detector black box and show by including imperfections that the bound given in the main text is indeed a lower bound on the vacuum fluctuations. As described in the main text we beat two lasers, the local oscillator with power and an auxiliary signal laser with power which is frequency detuned with respect to the local oscillator by . The beams interfere at a beam splitter with splitting ratio , where the frequency dependence accounts for a frequency dependent common mode rejection of the homodyne electronics. We furthermore take into consideration the visibility of the interference and the quantum efficiencies and of the two photo diodes.

After photo detection and current subtraction the beat signal current at time reads

(48) |

Here is the absolute angular frequency of the local oscillator laser. The square of the root mean square (RMS) amplitude of the beat signal digitized by an analog-to-digital (ADC) converter as obtained by a power spectrum of acquired samples is then given by

(49) |

where describes the overall gain of homodyne detector, possible filters and ADC analog input as well as includes the digitization into integers. We call the transfer function.

The power spectral density (PSD) of the vacuum fluctuations after photo detection and digitization reads

(50) |

where and are the direct photo currents generated by the photo diodes. Using the characterization of the transfer function from Eq. 49 yields

(51) |

In the last step we lower bounded the PSD of the vacuum fluctuations by using and where equality holds for , .

## References

- Frauchiger et al. (2013) D. Frauchiger, R. Renner, and M. Troyer, arXiv , 1311.4547 (2013).
- Acin and Masanes (2016) A. Acin and L. Masanes, Nature 540, 213 (2016).
- Pironio et al. (2010) S. Pironio, A. Acín, S. Massar, A. B. De La Giroday, D. N. Matsukevich, P. Maunz, S. Olmschenk, D. Hayes, L. Luo, T. A. Manning, and C. Monroe, Nature 464, 1021 (2010).
- Liu et al. (2018) Y. Liu, X. Yuan, M.-H. Li, W. Zhang, Q. Zhao, J. Zhong, Y. Cao, Y.-H. Li, L.-K. Chen, H. Li, T. Peng, Y.-A. Chen, C.-Z. Peng, S.-C. Shi, Z. Wang, L. You, X. Ma, J. Fan, Q. Zhang, and J.-W. Pan, Physical Review Letters 120, 010503 (2018).
- Bierhorst et al. (2018) P. Bierhorst, E. Knill, S. Glancy, Y. Zhang, A. Mink, S. Jordan, A. Rommal, Y. K. Liu, B. Christensen, S. W. Nam, M. J. Stevens, and L. K. Shalm, Nature 556, 223 (2018).
- Pirandola et al. (2017) S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, Nature Communications 8, 15043 (2017).
- Gabriel et al. (2010) C. Gabriel, C. Wittmann, D. Sych, R. Dong, W. Mauerer, U. L. Andersen, C. Marquardt, and G. Leuchs, Nature Photonics 4, 711 (2010).
- Fuerst et al. (2010) M. Fuerst, H. Weier, S. Nauerth, D. G. Marangon, C. Kurtsiefer, and H. Weinfurter, Optics Express 18, 13029 (2010).
- Symul et al. (2011) T. Symul, S. M. Assad, and P. K. Lam, Applied Physics Letters 98, 231103 (2011).
- Xu et al. (2012) F. Xu, B. Qi, X. Ma, H. Xu, H. Zheng, and H.-K. Lo, Optics Express 20, 12366 (2012).
- Haw et al. (2015) J. Y. Haw, S. M. Assad, A. M. Lance, N. H. Y. Ng, V. Sharma, P. K. Lam, and T. Symul, Physical Review Applied 3, 054004 (2015).
- Nie et al. (2015) Y.-Q. Nie, L. Huang, Y. Liu, F. Payne, J. Zhang, and J.-W. Pan, Review of Scientific Instruments 86, 063105 (2015).
- Shi et al. (2016) Y. Shi, B. Chng, and C. Kurtsiefer, Applied Physics Letters 109, 041101 (2016).
- Abellán et al. (2014) C. Abellán, W. Amaya, M. Jofre, M. Curty, A. Acín, J. Capmany, V. Pruneri, and M. W. Mitchell, Optics Express 22, 1645 (2014).
- Zhang et al. (2016a) X.-G. Zhang, Y.-Q. Nie, H. Zhou, H. Liang, X. Ma, J. Zhang, and J.-W. Pan, Review of Scientific Instruments 87, 076102 (2016a).
- Avesani et al. (2018) M. Avesani, D. G. Marangon, G. Vallone, and P. Villoresi, arXiv , 1801.04139 (2018).
- Mitchell et al. (2015) M. W. Mitchell, C. Abellan, and W. Amaya, Physical Review A 91, 012314 (2015).
- Zhang et al. (2016b) X. Zhang, Y. Q. Nie, H. Liang, and J. Zhang, IEEE-NPSS Real Time Conference, RT 2016 , 1 (2016b).
- Shapiro (1985) J. H. Shapiro, IEEE Journal of Quantum Electronics QE-21, 237 (1985).
- Weedbrook et al. (2012) C. Weedbrook, S. Pirandola, R. García-Patrón, N. J. Cerf, T. C. Ralph, J. H. Shapiro, and S. Lloyd, Reviews of Modern Physics 84, 621 (2012).
- Renner (2005) R. Renner, Security of Quantum Key Distribution, Ph.D. thesis, ETH Zürich (2005).
- Tomamichel et al. (2011) M. Tomamichel, C. Schaffner, A. Smith, and R. Renner, IEEE Transactions on Information Theory 57, 5524 (2011).
- Tomamichel (2012) M. Tomamichel, A framework for non-asymptotic quantum information theory, Ph.D. thesis, ETH Zurich (2012).
- Gray (2006) R. M. Gray, Foundations and Trends in Communications and Information Theory 2, 155 (2006).
- Wegman and Carter (1981) M. N. Wegman and J. L. Carter, Journal of Computer and System Sciences 22, 265 (1981).
- Brown (2018) R. G. Brown, “http://www.phy.duke.edu/ Ìrgb/General/dieharder.php,” (2018).
- Rukhin et al. (2001) A. Rukhin, J. Soto, J. Nechvatal, M. Smid, E. Barker, S. Leigh, M. Levenson, M. Vangel, D. Banks, A. Heckert, J. Dray, and S. Vo, NIST Special Publication 800-22 (2001).
- Dixon et al. (2008) A. R. Dixon, Z. L. Yuan, J. F. Dynes, A. W. Sharpe, and A. J. Shields, Optics Express 16, 18790 (2008).
- Huang et al. (2015) D. Huang, P. Huang, D. Lin, C. Wang, and G. Zeng, Optics Letters 40, 3695 (2015).
- (30) Here stands for the logarithm in base and for the natural logarithm.
- Banchi et al. (2015) L. Banchi, S. L. Braunstein, and S. Pirandola, Physical Review Letters 115, 260501 (2015).
- Seshadreesan et al. (2018) K. P. Seshadreesan, L. Lami, and M. M. Wilde, Journal of Mathematical Physics 59, 072204 (2018).
- Lupo et al. (2018) C. Lupo, C. Ottaviani, P. Papanastasiou, and S. Pirandola, Physical Review A 97, 052327 (2018).