Better Randomness with Single Photons

# Better Randomness with Single Photons

Lukas Oberreiter 3. Physikalisches Institut, Universität Stuttgart and Stuttgart Research Center of Photonic Engineering (SCoPE), Pfaffenwaldring 57, Stuttgart, D-70569, Germany    Ilja Gerhardt 3. Physikalisches Institut, Universität Stuttgart and Stuttgart Research Center of Photonic Engineering (SCoPE), Pfaffenwaldring 57, Stuttgart, D-70569, Germany Max Planck Institute for Solid State Research, Heisenbergstraße 1, D-70569 Stuttgart, Germany
###### Abstract

Randomness is one of the most important resources in modern information science, since encryption founds upon the trust in random numbers lenstra__2012 (). Since it is impossible to prove if an existing random bit string is truly random, it is relevant that they be generated in a trust worthy process. This requires specialized hardware for random numbers, for example a die galton_n_1890 () or a tossed coin feller__1968 (). But when all input parameters are known, their outcome might still be predicted laplace__1951 (). A quantum mechanical superposition allows for provably true random bit generation schmidt_joap_1970 (); erber_n_1985 (). In the past decade many quantum random number generators (QRNGs) were realized stefanov_jmo_2000 (); jennewein_rosi_2000 (); gabriel_np_2010 (); abellan_oe_2014 (); sanguinetti_prx_2014 (). A photonic implementation is described as a photon which impinges on a beam splitter Frauchiger et al. (2013), but such a protocol is rarely realized with non-classical light bronner_ejop_2009 (); branning_josab_2010 (); Gräfe et al. (2014) or anti-bunched single photons. Instead, laser sources or light emitting diodes stefanov_a_1999 (); jennewein_rosi_2000 (); quantique_w_2010 () are used. Here we analyze the difference in generating a true random bit string with a laser and with anti-bunched light. We show that a single photon source provides more randomness than even a brighter laser. This gain of usable entropy proves the advantages of true single photons versus coherent input states of light in an experimental implementation. The underlying advantage can be adapted to microscopy and sensing.

A basic photonic quantum random bit generator is described as follows: a (single) photon imposes on a beam splitter and is either reflected () or transmitted () (Fig. 1a). Behind every output port a single photon detector is placed, generating an electrical pulse for an incoming photon. The generator has two outcomes and . Experimentally, the incoming light commonly does not consist of single photons, but a coherent state of a laser. This can be described as several copies of the same pure state enk_prl_2001 (), sufficient to realize a quantum superposition.

The difference between a laser and a single photon source on a beam splitter is denoted as for a laser, with the average photon number . The single photon source is described by . Furthermore, the temporal photon statistics differs. A single photon source obeys an “anti-bunched” photon statistics, proving that no two photons are emitted at the same time (Fig. 1d). The coherent state of a laser shows a function of unity for all delay times . Therefore, the arrival times of single photons on the randomness device are different. Here we compare the different outcomes of the QRNG with different photonic input states. We disregard all other sources of side-information known to an external adversary.

The normalized single photon correlation function reads as

 g(2)(τ) = ⟨I(t)I(t+τ)⟩⟨I(t)⟩2 (1) = ρ22(τ)limτ→∞ρ22(τ)=1−e−(k+Γ)|τ| . (2)

denotes the pumping rate, the inverse of the longitudinal lifetime of the emitter, and the excited state population. The emission rate is given through the probability, that the system will be in the exited state at thermal equilibrium multiplied with :

 λ(k) = Γ⋅limτ→∞ρ22(τ)=kΓk+Γ . (3)

This shows the typical saturation behavior of a two level system. At high count-rates the so-called “anti bunching dip” is narrow. At the resulting photon statistics of a laser and a single photon source are equal. This is evident in the following plots, where the laser and single photon source emission forms one point for a emission rate of photons per second. We assume a -time of 10 ns, a value corresponding to single organic dye molecules, colloidal nano crystals, and the negatively charged nitrogen-vacancy center. The maximum emission rate is 10 photons per second. This capped brightness seems to be disadvantageous for the generation of random bits, since a laser can be assumed to generate more generator outcomes per unit time, due to its higher brightness. The (anti-)correlation of subsequent detection events of a single emitter might also introduce some correlations, such that one detection event might introduce some predictability for the next detector outcome.

A single photon detector introduces many technical implications before a photon is converted into an electrical “click”. First, single photon detection is limited by a detector quantum efficiency . When avalanche photo diodes (APDs, e.g. ‘Excellitas’) are used, the quantum efficiency is above 60% in a spectral range of 550 to 800 nm [\NAT@swatrue\NAT@parfalse\NAT@citexnum[][]optoelectronics__2001]. The finite temporal length of an electrical click and an active quenching operation delay the next detection event (Fig. 1b). This is the “dead time” of the photon detector, . The conversion process introduces some time delay and, more importantly, electrical jitter. This is a fluctuating delay between an incoming photon and a generated electrical pulse. The temporal spread is described by (Fig. 1c). The histogram of joint detection events is a Gaussian distribution with a long tail tan_tajl_2014 (). This is the convolution of both jitter functions of each of the detectors alone, and measured to be 250 ps. There are more subtleties with single photon detectors, such as dark counts, after-pulsing and a break-down flash. These effects are not considered in the following, since they do not become relevant to the description here.

Electrical jitter will lead to the fact that the subsequent order of some events might be confused. It is not clear, if the event and then the event was detected, or if it was vice versa. To exclude this ambiguity, we introduce a coincidence window, , which is started with every succesful detection event. A coincidence is observed, when the other detector clicks within . To determine an upper bound of the permutation probability, , we calculate the one-sided bound, that two simultaneous incoming photons are detected as subsequent events:

 ϵ=∫−τcwτ=−∞1σjitt√2πe−12(τσjitt)2dτ=12erfc(τcw√2σjitt) . (4)

We choose a of 2 ns. This is chosen such that the probability to confuse events is lower than 1 confusion per year at the maximal possible click rate (1/). We could discard these events, but since they contain some usable entropy, their inclusion will lead to more extractable random bits.

For comparison, we consider the temporal photon detection probability in the experimental configuration. With a different -function the waiting time distribution is changed. Commonly, the photon statistics is measured in a start-stop fashion, i.e. the difference in arrival times of two subsequent events on the detectors are histogrammed. This does not result in the the real -function. The latter would be a histogram over all following photon arrival times. The transition between both functions is introduced by the -formalism Reynaud (1983): defines the number density for the emission of any following photon at time 111 is still defined as unity when only the emission properties are analyzed, but will become relevant later. Here, accounts for any losses and efficiencies in the system. describes the probability density for the next photon.

Mathematically they are related by Reynaud (1983):

 K(τ)=L−1[L[J(τ)]1+L[J(τ)]] , (5)

where denotes the Laplace transform of the function . With the function it is possible to derive in an iterative way to the waiting time distribution for the th photon (). For a laser it is straight forward to find an analytical expression. For the single photon source, the calculation for is given in the supplementary material. The probability density, that the th photon will be emitted at time :

 Lm+1(τ)=∫τt=0Lm(τ−t)K(t) dtwithL1(τ)=K(τ) (6)

The probability to emit photons within a waiting time right after the emission of a photon is calculated as:

 P0(τ) = 1−∫τt=0K(t)dt (7) Pm(τ) = ∫τt=0Lm(t)P0(τ−t)dt . (8)

When the is calculated for laser light, it represents the Poisson distribution (Eqn. in Fig. 1f). The difference between and is rarely discussed in the study of single photon emitters, where often start-stop type experiments are performed when photon anti-bunching is recorded. Only few papers include the relevant math fleury_prl_2000 (); fleury_jol_2001 (). When a low collection and detection probability is assumed, the -function is approached with a start-stop measurement. Fig. 1e shows the waiting time distribution for the -th photon. The emission of the next laser photon is a Bernoulli trial and shows an exponential behavior. The emission probability of a subsequent photon does not depend on a prior photon emission. On the other hand, a true single photon emitter will have some waiting time until it will reach the same probability. After this, it exceeds the photon emission probability of a laser.

Fig. 1f shows the emission probability within a defined waiting time. By definition a single photon source has a higher probability to emit no second photon within a certain time. The dead-time of the photon detector is in the same order of magnitude (=50 ns). Therefore, it is likely that for a defined brightness, , a single photon source might produce more detection events.

The above only considers the photon emission properties (=1). We now introduce the technical details on the detection of the supplied photons. We introduce the transition , where denotes the quantum efficiency and the probability that the photon will go from the beam splitter to detector and assume a “fair” beam splitter with a 50:50 splitting ratio. With this correction, the number of incoming photons is transferred to the number of click-producing photons when the detector is not “dead”. The click-rate of detector has to be calculated. The average number of photons which will arrive within a dead-time on detector and would produce a click is

One click on detector leads to one dead-time. That means that from possibly seen incoming photons to detector , photons will produce a click and will enter while the detector is blind. The click-rate is

 λa=λaclick(1+ma)⇔λaclick=λa1+ma . (10)

The outcome of a click in detector at time =0 has two possible outcomes: it is the only click within the time interval , or detector clicks too and a coincidence event () is observed. The probability of detector to click within is well approximated with:

 Pbcoinc=λbclick∫τcw−τcwg(2)(τ)dτ . (11)

This leads to a coincidence rate of  222Please note, that this definition deviates by a factor of two from many references, where a coincidence rate of two random sources is given as . In our case a of 2 ns implies, that two subsequent events will be regarded as a coincidence, if their time distance is smaller than 2 ns. This makes the underlying calculation of the combinatoric conditional probabilities more intuitive. The observation of two subsequent clicks with a distance of e.g. 3 ns would not lead to a coincicence. Therefore, our defines a “observation window”, which is started with the successful detection of a photon. and a raw bit rate of detector defined as

 (12)

When discarding coincidences, the total raw bit rate is the sum over both detectors:

 λbit=λabit+λbbit=λaclick+λbclick−2λcoinc . (13)

Fig. 2a shows the bit rates on detector . Depending on the photon rate, the dead time influences the probability of detection. For high photon rates, the coincidence rate increases and levels off at the ratio of . For infinite operation of the QRNG, the resulting ratio of single events to coincidences will be a fixed ratio.

Fig. 2b shows the increased bit rate between a single photon source and a laser. At high photon flux, the detector spends more time in the “dead” state, and therefore the bit rate is higher for the single photon source. The flux density is reduced within the dead time of the detector and only later increased. This effect gets more relevant, when coincidence events are discarded to avoid a bit permutation.

For any randomness generation, the relevant information is the entropy content of the fundamental process of photon detection. In the case of a randomness generator the conditional Shannon entropy, accounting for the correlation of subsequent raw bits, is defined as:

 HSh(X|Y) = ∑yp(y)HSh(X|Y=y) (14) = −∑yp(y)∑xp(x|y)log2p(x|y) . (15)

With two outcomes, the maximal entropy is unity. This defines an optimistic upper bound for the entropy fraction of the generator. More genralized, the conditional Rényi entropy has to be considered. Its lower bound is the conditional min-entropy. This gives the conservative bound for the entropy fraction in the system. It is defined as

 Hmin(X|Y)=−log2[∑yp(y)maxx{p(x|y)}] . (16)

is the probability that an arbitrary outcome has the value . It is worthwhile noting that we changed the notation from and to and , since we allow for coincidences. Therefore . is the conditional probability that after the outcome the following outcome takes the value .

When coincidences are discarded, the event is assumed first, and then the subsequent outcome (Fig. 3a). At high photon rates the transition is more likely, due to the increased probability of receiving a subsequent photon within the dead time of detector . At very high incident photon flux, the detectors click alternately, since at each time a detector is ‘alive’ it receives the next photon. The resulting time-ordered outcome would be . With two possible outcomes, the resulting conditional probabilities are symmetric around 0.5.

The calculation of the conditional probabilities is a combinatoric problem. For example, the transition of to can occur, when clicked, and occurs not within the coincidence window. Then there are several options how can occur, such as within and also outside the dead-time of detector . Equivalently, for the case it is required that after , detector does not click before clicks again. A full derivation of all conditional probabilities is given in the supplementary material. In the following we extend these assumptions to the case including the coincidences.

Fig. 3b shows the calculation of the transition probabilities for the case, that coincidences are not discarded. When a click on is detected, a third outcome, namely to a coincidence (), is possible. For simplicity, we assume that the dead time after a coincidence event ends exactly at the same time. The coincidence probability becomes relevant at high photon rates. All three conditional probabilities add up to one, but are not symmetric anymore. For very high photon rates, the probability to result in a coincidence again is reduced, although the number of coincidences is still increasing as shown in Fig. 2a. This becomes clear, when we consider the conditions for a click : It implies, that the other detector is likely in its “dead time”, and will likely receive a next photon, when detector is still “dead”.

Additionally, the outcomes for starting the calculation with a coincidence () are depicted. The transition probabilities from a coincidence to one of the outcomes ( or ) is the same. This transition becomes less likely, supported with the same arguments as for the transition of an alternating sequence of . It is important to realize that although Fig. 2a shows a fixed ratio of coincidences to single clicks, the transition from one to the other state becomes less likely at high photon rates.

With all transition probabilities, we calculate the entropy per raw bit. When few photons are coming, their temporal spacing is large against the dead time or the influence of the photon statistics. Also, the number of coincidences is negligible. Therefore, at low photon rates, the entropy per incoming photon is close to unity, and the generator will pass all statistical randomness tests also without any post-processing Gräfe et al. (2014). At high photon rates, specific output patterns occur (alternating, or coincidences), and the transition probability from one fixed output sequence is small. Therefore, the entropy per bit goes to zero (Fig. 3c). When coincidences are included, a third option () gives rise to a (binary) Shannon entropy above unity. Some timing information is introduced into this case, due to the fixed coincidence window. The calculated min-entropy stays in all cases below the curve for the Shannon entropy and below unity.

Fig. 3d shows the total amount of produced entropy rate for the generator. As before, the calculated Shannon entropy exceeds all other curves, and including the coincidences allows for 25.1% more extractable bits than a laser. All curves display an optimal point at which incident brightness the generator should be operated.

The inset of Fig. 3d shows the optimum points of the min-entropy for the randomness generator. A single photon source peaks at a lower incident photon rate than the generator with a laser source. This is a global optimum and a laser, able to provide an “arbitrary” brightness, and no timing correlation, has lower usable entropy at all possible settings. One could imagine, that this point coincides with the count-rate advantage, presented in Fig. 2b. The entropy peaks at an incident photon rate, which is 12.7% higher than the peak in the rawbit rate – not only the rawbit rate, but also the transition probabilities are relevant for the entropy. The pumping rate onto the single emitter, , amounts to 1.110 s (shown in Fig. 1d).

The min-entropy is higher for a single photon source, but as for the laser source not all resulting rawbits can be used. When the min-entropy is known, this is the fraction of bits which can be extracted by a hashing procedure. This is ideally a two-universal hashing procedure Tomamichel et al. (2011). Other cryptographic hash functions, like SHA, are not designed or characterized for randomness extraction young_book_2004 (); gabriel_np_2010 ().

The described math underlines the advantages of bright single photon sources. The requirement is a collection efficiency close to unity, since the optimal point is around 50 million incident photons per second, whereas the maximum theoretical emission rate is photons per second. Such sources are experimentally realized lee_np_2011 (); gazzano_nc_2013 () and provide more than 45 10 photons per second. The presented results can be experimentally verified with such sources, assuming that the required speed of time-tagging electronics is available. Even if such sources present a background fraction, the extractable entropy remains comparable as to a “perfect” single photon source.

The described count-rate advantage is also relevant in microscopy applications of single emitters. Simply by the higher count-rates for a specific brightness, single photon emitters allow for a higher localization accuracy than a nanoscopic coherently emitting particle or when the radiative lifetime is very short. Very common, single emitters are researched with single photon detectors, but only by integrated detection. Since this characterizes the net brightness of the emitter, a relation to the real brightness is obscured when the count-rates are calculated equivalently to a laser source.

The given entropy enhancement is very robust in a wide range of input parameters. If the emitter lifetime is changed, the advantage stays in a range for of 1–18 ns. It is, though, optimal for an emitter lifetime of the given 10 ns. A crucial measure is the dead time of the detector which is assumed to be as measured in our case. A detector dead time of 30 ns shows still a small advantage for the detection of single photons. This is still better than the conservative bound of the present APD data-sheet (40 ns). The coincidence window also influences the outcome. With a shorter coincidence window, the advantage increases. The detector efficiency might be as low as 37% and the beam splitter ratio can deviate from the ideal 50:50 case up to 70:30 – still the described advantage holds.

It is evident that a true single photon source produces more usable entropy in an experimental configuration. A quantum random bit generator will benefit from bright single photon sources. Intrinsically, the non-classical nature of the source is measured, when the random bits are produced. This gives again some advantage against an external adversary, who might try to influence the generator’s outcome gerhardt_prl_2011 (); liu_rosi_2014 (). The described phenomena also show, that an anti-bunched emitter can be more efficiently localized with the present single photon detectors than a Poisson emitter with the same brightness. The entropic advantage might enhance precision sensing and microscopic applications in single emitter studies even further. How far this is possible is presently ongoing research.

## References

• [1] Arjen K. Lenstra, James P. Hughes, Maxime Augier, Joppe W. Bos, Thorsten Kleinjung, and Christophe Wachter. Ron was wrong, Whit is right. IACR, 2012.
• [2] Francis Galton. Dice for statistical experiments. Nature, 42:13–4, 1890.
• [3] William Feller. An Introduction to Probability Theory and Its Applications. Wiley, 3rd edition, 1968.
• [4] Pierre Simon Laplace. A Philosophical Essay on Probabilities. Forgotten Books, 1951.
• [5] Helmut Schmidt. Quantum-mechanical random-number generator. Journal of Applied Physics, 41(2):462–468, 1970.
• [6] T. Erber and S. Putterman. Randomness in quantum mechanics – nature’s ultimate cryptogram? Nature, 318:41–43, 1985.
• [7] AndrÃ© Stefanov, Nicolas Gisin, Olivier Guinnard, Laurent Guinnard, and Hugo Zbinden. Optical quantum random number generator. Journal of Modern Optics, 47(4):595–598, 2000.
• [8] Thomas Jennewein, Ulrich Achleitner, Gregor Weihs, Harald Weinfurter, and Anton Zeilinger. A fast and compact quantum random number generator. Review of Scientific Instruments, 71(4):1675–1680, 2000.
• [9] Christian Gabriel, Christoffer Wittmann, Denis Sych, Ruifang Dong, Wolfgang Mauerer, Ulrik L. Andersen, Christoph Marquardt, and Gerd Leuchs. A generator for unique quantum random numbers based on vacuum states. Nature Photonics, 4(10):711–715, October 2010.
• [10] C. Abellán, W. Amaya, M. Jofre, M. Curty, A. Acín, J. Capmany, V. Pruneri, and M. W. Mitchell. Ultra-fast quantum randomness generation by accelerated phase diffusion in a pulsed laser diode. Opt. Express, 22(2):1645–1654, Jan 2014.
• [11] Bruno Sanguinetti, Anthony Martin, Hugo Zbinden, and Nicolas Gisin. Quantum random number generation on a mobile phone. Phys. Rev. X, 4:031056, Sep 2014.
• [12] Daniela Frauchiger, Renato Renner, and Matthias Troyer. True randomness from realistic quantum devices. ArXiv, 2013.
• [13] Patrick Bronner, Andreas Strunz, Christine Silberhorn, and Jan-Peter Meyn. Demonstrating quantum random with single photons. European Journal of Physics, 30(5):1189, 2009.
• [14] David Branning and Matthew Bermudez. Testing quantum randomness in single-photon polarization measurements with the NIST test suite. J. Opt. Soc. Am. B, 27(8):1594–1602, Aug 2010.
• [15] Markus Gräfe, René Heilmann, Armando Perez-Leija, Robert Keil, Felix Dreisow, Matthias Heinrich, Hector Moya-Cessa, Stefan Nolte, Demetrios N. Christodoulides, and Alexander Szameit. On-chip generation of high-order single-photon w-states. Nature Photonics, 8(10):791–795, October 2014.
• [16] Andre Stefanov, Nicolas Gisin, Olivier Guinnard, Laurent Guinnard, and Hugo Zbinden. Optical quantum random number generator. ArXiv, 0:1–10, 1999.
• [17] ID Quantique. Random number generation using quantum physics. Whitepaper, 2010.
• [18] S. J. van Enk and Christopher A. Fuchs. Quantum state of an ideal propagating laser field. Phys. Rev. Lett., 88:027902, Dec 2001.
• [19] Perkin Elmer Optoelectronics. Single Photon Counting Module SPCM-AQR Series. Datasheet, 2001.
• [20] P. K. Tan, G. H. Yeo, H. S. Poh, A. H. Chan, and C. Kurtsiefer. Measuring temporal photon bunching in blackbody radiation. The Astrophysical Journal Letters, 789(1):L10, 2014.
• [21] S. Reynaud. Fluorescence de résonance. Ann.Phys. (Paris), 8:351, 1983.
• [22] is still defined as unity when only the emission properties are analyzed, but will become relevant later.
• [23] L. Fleury, J.-M. Segura, G. Zumofen, B. Hecht, and U. P. Wild. Nonclassical photon statistics in single-molecule fluorescence at room temperature. Phys. Rev. Lett., 84:1148–1151, Feb 2000.
• [24] L. Fleury, J.-M. Segura, G. Zumofen, B. Hecht, and U.P. Wild. Photon statistics in single-molecule fluorescence at room temperature. Journal of Luminescence, 94-95(0):805 – 809, 2001. International Conference on Dynamical Processes in Excited States of Solids.
• [25] Please note, that this definition deviates by a factor of two from many references, where a coincidence rate of two random sources is given as . In our case a of 2 ns implies, that two subsequent events will be regarded as a coincidence, if their time distance is smaller than 2 ns. This makes the underlying calculation of the combinatoric conditional probabilities more intuitive. The observation of two subsequent clicks with a distance of e.g. 3 ns would not lead to a coincicence. Therefore, our defines a “observation window”, which is started with the successful detection of a photon.
• [26] Marco Tomamichel, Christian Schaffner, Adam Smith, and Renato Renner. Leftover hashing against quantum side information. IEEE Transactions on Information Theory, 57(8):5524–5535, 2011.
• [27] Adam Young and Moti Yung. Malicious cryptography: exposing cryptovirology. Hoboken, NJ : Wiley, 2004.
• [28] K. G. Lee, X. W. W Chen, H. Eghlidi, P. Kukura, R. Lettow, A. Renn, V. Sandoghdar, and S. Götzinger. A planar dielectric antenna for directional single-photon emission and near-unity collection efficiency. Nature Photonics, 5(3):166–169, March 2011.
• [29] O. Gazzano, S. Michaelis de Vasconcellos, C. Arnold, A. Nowak, E. Galopin, I. Sagnes, L. Lanco, A. Lemaitre, and P. Senellart. Bright solid-state sources of indistinguishable single photons. Nat Commun, 4:1425–, February 2013.
• [30] Ilja Gerhardt, Qin Liu, Antía Lamas-Linares, Johannes Skaar, Valerio Scarani, Vadim Makarov, and Christian Kurtsiefer. Experimentally faking the violation of Bell’s inequalities. Phys. Rev. Lett., 107:170404, Oct 2011.
• [31] Qin Liu, Antía Lamas-Linares, Christian Kurtsiefer, Johannes Skaar, Vadim Makarov, and Ilja Gerhardt. A universal setup for active control of a single-photon detector. Review of Scientific Instruments, 85(1):013108, 2014.

## Acknowledgments

Axel Kuhn provided some inputs on the statistical description of single photon measurements. We acknowledge the critical questions and ideas provided by Daniela Frauchiger and Renato Renner. We thank Jörg Wrachtrup for continuous support.

Supplementary material to:

Better Randomness with Single Photons

## Appendix A Overview

In this supplement we introduce the steps to derive the entropy of the introduced QRNG.

We follow the following procedure to derive the final entropy of the generator.

1. describe the generator and the possible detector outcomes. This includes assumptions on the detection process, external adversaries, etc.. All detector outcomes can be described in this model.

2. define the raw generator outcomes. Here we define which outcomes of the generator are resulting in what outcomes. We call this entity the “raw-bit” rate, although we partially derive three outcomes.

3. describe all probabilities and conditional transition probabilities in the system. This is required to judge if there are correlations in the system.

4. calculate the conditional entropies in the system. Afterwards we know how much entropy can be extracted.

5. post process the raw-bits according to the entropy-fraction of the generator

This scheme can be generalized to many random number generators. We recommend the study of [37] to extend our approach presented below.

## Appendix B The single photon source and the g(2)-function

The single photon source, which is regarded in this paper, is based on a single emitter. The working scheme is given in the inset of Fig. S5. It is equivalent to many reports in the literature [39, 34, 32, 41], when the coherences are neglected [41, 42].

A pump rate brings the emitter from ground state to an excited state . The single photons originate from the transition to . The decay constant for the latter is . The mathematical description of the change in the population () of state () is given by Eqn. S1 (S2).

 ˙ρ11 = −kρ11+Γρ22 (S1) ˙ρ22 = +kρ11−Γρ22 , (S2)

This differential equations are solved for a single emitter, assuming the emission of a single photon at ( and ). The solution denotes

 ρ11(τ) = k⋅e−(k+Γ)τ+Γk+Γ (S3) ρ22(τ) = k(1−e−(k+Γ)τ)k+Γ . (S4)

It is evident in Eqn. S3 and S4, that the system goes for a constant value of into an equilibrium, as . In this state of equilibrium the emitted photon rate of the single photon source denotes

 λ(k)=Γ⋅limτ→∞ρ22(τ)=kΓk+Γ . (S5)

as a function of is shown in Fig. S5.

For the emitted photon rate goes to . The population of the excited state is (population inversion). The property, that the single photon source never emits more than one photon at the same time, can be observed by calculating the correlation function of the source.

It is defined as [36]

 g(2)(τ)=⟨I(t)I(t+τ)⟩⟨I(t)⟩⟨I(t+τ)⟩ (S6)

and in the denormalized form

 G(2)(τ)=⟨I(t)I(t+τ)⟩ , (S7)

where describes the intensity of the light source. If we treat light as quantized particles – photons – describes the emitted photon rate and the -function gives the statistics that the source emit a photon at time under the condition that the light source has emitted a photon at time . If the light source, attenuated by the parameter (with ), goes onto a perfect detector, the -function describes also the detection statistics of the detector. In the following the parameter is included into the intensity of the light source, that means is the attenuated intensity of the light source.
A simple setup to measure approximately the -function can be described by the same setup as our random number generator uses (see Fig. 1a). It has to be performed as a start-stop measurement. This measurement only results in the statistics about the waiting time to the detection of the next photon, but if the light source is attenuated strongly, this statistics is for short enough times a good approximation to the -function.

A helpful property of the correlation-function is the invariance under time inversion, that means . There is no difference between measuring the time from the start event to stop event or vice versa. The physics is the same.

A stable laser with a fixed intensity , attenuated by , has for each point in time the correlation-function

 g(2)laser(τ)=(ηI0)2(ηI0)2=1∀τ . (S8)

A chunk of radioactive material follows the same correlation-function. There are no correlations among different decay events. One decay does not influence the next (or coinciding) outcome. Equivalently, the emission of a photon has no effect on other photons. The denormalized correlation function of a laser which is attenuated by the factor denotes

 G(2)laser(τ)=(ηλ)2 , (S9)

where is the mean emitted photon rate of the laser.

To derive the correlation function of the single photon source the population of the excited state needs to be known. These population can be understood as the probability that the system is in the excited state at time , which is proportional to the photon emission probability at time . The normalized correlation function of the single photon source reads

 g(2)sps(τ)=ρ22(|τ|)limτ→∞ρ22(τ)=1−e−(k+Γ)|τ| . (S10)

The denormalized correlation function of the single photon source, attenuated by the factor , is

 G(2)sps(τ)=(ηλ(k)kΓk+Γ)2(1−e−(k+Γ)|τ|) . (S11)

Fig. 1d shows the correlation functions of the laser and the single photon source for two values of the pumping rate . The so-called “anti-bunching dip” gets more and more narrow with higher pumping rates.

The property of the single photon source, never to emit more than one photon at the same time, is fulfilled because of . Due to this property this light is called “anti-bunched”.

## Appendix C Jk-formalism

The -function tells only about the detection statistics of any photon at time , under the condition, that at time a photon has been detected. With the -formalism [44], the probability density of detecting exactly the next photon after the 0th photon at can be predicted. The function is the probability density of the next photon and the function describes the number density for the detection of any photon at time . The functions are defined as the probability density for the arrival of the th photon (with ), conditioned on the th photon at . It is

 ∞∑m=1Lm(τ)=J(τ) . (S12)

The probability density of the th photon can be predicted through the probability density of the th photon and the function :

 Lm+1(τ)=∫τ0Lm(τ−t)K(t) dt =(Lm∗K)(τ)withL1(τ)=K(τ) , (S13)

where denotes the convolution. If the function is known, all functions can be predicted in an iterative through Eqn. S13. can be derived by

 ∫τ0J(τ−t)K(t) dt =∞∑m=2Lm(τ) (S14a) ⇔(J∗K)(τ) =J(τ)−K(τ) (S14b) ⇔L[(J∗K)(τ)] =L[J(τ)]−L[K(τ)] (S14c) ⇔L[J(τ)]⋅L[K(τ)] =L[J(τ)]−L[K(τ)] (S14d) ⇔K(τ) =L−1[L[J(τ)]1+L[J(τ)]] , (S14e)

where where denotes the Laplace-transformation of the function . The term on the left in Eqn. S14c is simplified by the convolution theorem [33].

## Appendix D Arrival time of the mth photon

To study the emission behavior of the light sources in more detail than the -function tells us, the probability densities of the th photon after the th photon at will be estimated. With Eqn. S14e and the number densities

 Jlaser(τ) = ηλ (S15) Jsps(τ) = ηλ(1−e−(k+Γ)t) (S16)

the probability density of the next photon, i.e. the first (=1), is predicted for the laser and the single photon source. The resulting functions are

 Klaser(τ)=ηλ⋅e−ηλτ (S17) Ksps(τ)=2ηλ√k+Γ√k+Γ−4ηλ⋅e−12(k+Γ)τ⋅sinh(12√k+Γ√k+Γ−4ηλ) . (S18)

With Eqn. S13 the probability densities of the th photon can be calculated iteratively. For the laser an analytic expression is given by

 Lm,laser(τ)=(ηλ)mτm−1(m−1)!e−ηλτwith m∈N . (S19)

The functions in the case of the single photon source become very lengthy. The Mathematica source code of the calculation can be obtained in Appendix I.

The probability densities are shown in Fig. 1e for both light sources with the parameters , and .

The greatest difference between the two sources exists between the densities of the first photon. Exactly this functions give a strong hint, that the single photon source produces less coincidences than the laser, because for small waiting times ( ns) it is more unlikely that the single photon source emits the first photon.

## Appendix E Number of photons within time intervals

The described single photon source is a “real” single photon source, when it is operated with pulsed excitation, by e.g. a pulsed laser. If the laser has sufficient energy, the system is transferred to the excited state, and emits only a single photon. When the device is operated in continuous wave (cw) mode, the source emits only a single photon at a time – but for a finite observation window, more photons could arrive on a detector. Therefore, we first calculate the probability distribution for a certain number of photons within a waiting time . The function (with ) gives the probability that photons will occur within the time interval under the condition, that the 0th photon was at . Note, that the 0th photon is not included into the number . These functions can be predicted through

 P0(τ) = 1−∫τt=0K(t)dt (S20) Pm(τ) = ∫τt′=0⎡⎢ ⎢ ⎢ ⎢ ⎢ ⎢⎣Lm(t′)(1−∫τ−t′t=0K(t) dt)P0(τ−t′)⎤⎥ ⎥ ⎥ ⎥ ⎥ ⎥⎦dt′with m∈N . (S21)

The integral is the probability that the next photon occur in the interval . The probability is calculated by the probability, that the next photon will not come within . To calculate the probability has to be determined, that at , the th Photon has occurred () and within the remaining time , there will not come the following photon (). At a later date we need the probability that within a time interval (with ) no photon will be emitted, when at a photon was emitted. This probability is defined as:

 P0(t2)=P0(t1)⋅P0([t1,t2])⇔P0([t1,t2])=P0(t2)P0(t1) (S22)

In the case of the laser the functions denote

 Pm,laser(τ)=(ηλτ)mm!⋅e−ηλτ=:⟨m⟩mm!e−⟨m⟩=Poi% (m)with m∈N0 , (S23)

where denotes the expected value of number . Eqn. S23 can be identified with the Poisson distribution . Of course, this was known for a laser. But a very interesting point is, that the 0th photon at is not involved in this Poisson distribution. If at there would be no photon we would expect exactly the same distribution. The fact, that an detected photon, which is then not included in the distribution, does not change the photon emission distribution of the laser, was described before [40]. The proof can be outlined as follows:
The detection of a photon means a transition from the occupancy state to . The probability to be after a detection in the state is proportional to the probability , that the detected photon originate from the state :

 P(m−1)∝P(m)=(m1)Poi(m)=m⋅Poi(m) . (S24)

Eqn. S24 can be prepared by the substitution :

 P(m) ∝ (m+1)⋅Poi(m+1) (S25a) = (m+1)⟨m⟩m+1(m+1)!e−⟨m⟩ (S25b) = ⟨m⟩⋅⟨m⟩mm!e−⟨m⟩ (S25c) = ⟨m⟩⋅Poi(m) (S25d)

Now we got the expression , which has to be normalized by the norm :

 1N⟨m⟩∞∑m=0Poi(m)=1!=1⇒N=⟨m⟩

The new distribution after the detection of a photon is still the Poisson distribution: .
The calculated functions in the case of the single photon source become also very lengthy. The Mathematica source code of the calculation can be obtained in Appendix I.
For the same parameters as above (, and ), the probabilities are shown for some different values of in Fig. 1f for both light sources.

It is more probable that no further photons come within the waiting time for the single photon source: . In the case of the laser the probability distribution is given through the Poisson distribution with the parameter .

## Appendix F Click rate of the detectors

Now the focus goes to the random number generator. In this section the click rate of each detector, which is limited through the dead time , will be estimated.
But first it has to be explained, how to adapt all previous defined math to the specific problem. What has to be included is the beam splitter ratio and the quantum efficiency of the APDs. All these defined functions above can be transferred to the case of the detector by simply substitute the attenuation , where denotes the quantum efficiency and the probability that the photon will take on the beam splitter the path to detector . In principle, these defined attenuation can be interpreted as a grey-filter, which attenuates the emitted light, which then impinges onto a perfect detector with a quantum efficiency of unity (but still the influence of dead time has to be considered). The new function will be labeled by an upper index (for example is the number density of the photons which “decided” on the beam splitter the -path and are definitely not overseen by detector because of the quantum efficiency).

The click rate of detector has to be calculated. The limiting factor is the dead time of the detectors. First, we determine the average number of photons which occur within a dead time on detector

One click on detector leads to one dead time of length . That means that from these incoming photons to detector , which definitely produce a click, if the detector is not in dead time, photons will produce a “click” and of these photons will enter while the detector is blind. So the click rate is

 λa=λaclick(1+ma)⇔λaclick=λa1+ma . (S27)

The click rates of detector R or T (since ) are shown in Fig. S6 for the laser and the single photon source.

It can be seen, that the single photon source produces more detector clicks than the laser until to the maximal emission rate ( s) of the single photon source. But the laser can be driven at higher photon rates and as the intensity is increased, the click rate converges to the maximal achievable click rate per detector ().

## Appendix G Raw bit rate

Now the question arises, whether a click on detector at produces a bit or not, because beneath the dead time another technical influence is the coincidence window (with length  ns). When detector clicks, there are two different scenarios which could happen on detector (with ):

• detector clicks within the time interval
coincidence

• detector clicks not within the time interval
a bit is produced by detector .

In the following we calculate the bit rate of detector () and the coincidence rate (. To that end it has to be calculated the probability, that detector clicks within the time interval , conditioned on a click of detector at time . It is not sufficient to regard whether within the time interval a photon will enter detector , because the latter might be in dead time. Instead we make use of the above calculated click rate of detector . We know that the average number of clicks within a time interval of length reads

 (S28)

This quantity can also be interpreted as the probability for a click in the interval, because the interval length is shorter than one dead time an therefore the only possibilities are zero or one click. The problem changes (in the case of the single photon source) when we postulate a click at on detector and regard the time interval on detector . Due to the collapse of the -function at (in the case of the single photon source) the probability that detector clicks decrease. The click probability density of detector reads then

 ρclick(τ)=⟨λbclick⟩∣∣[−τcw,τcw]⋅g(2)(τ)2τcw=λbclickg(2)(τ) . (S29)

The probability , that detector clicks within the interval when there is a click at on detector , which means that a coincidence occurs, is

 (S30)

Note, that Eqn. S30 diverges for . But a probability should always be smaller than one. This equation is only an approximation for small coincidence windows (which is given in our considerations)!
Now we are able to estimate the coincidence rate ()

 λabbit:=λcoinc=λaclickPbcoinc=λbclickPacoinc (S31)

and the bit rate of the detector ()

 (S32)

The whole bit rate is the sum over both detectors:

 λbit=λabit+λbbit=λaclick+λbclick−2λcoinc . (S33)

Fig. 2a depicts the bit rate of detector R (or T, since ) for some different parameters and also the coincidence rate for the standard parameter  ns.

Note, that the bit rate for the parameter is exactly the click rate as shown in Fig. S6, since there exist no coincidences and every click automatically becomes a bit. As the parameter increases, the bit rate decreases (and thus the coincidence rate increase). But for each value of the single photon source produces more raw bits within its emission range. On the bottom can be seen, that the single photon source has less coincidences than the laser. The purple function shows the bit rate for  ns, i.e. the click rate, if the beam splitter is taken out of the setup and all light impinges onto only one detector. This has the effect, that for small incoming photon rates the click rate becomes double compared to the case with beam splitter, and for high photon rates the click rate converges faster against .

In Fig. 2b is shown the function , which gives the of enhancement of the raw bit rate when using the single photon source instead of the laser, for some parameters .

When discarding coincidences, the more the coincidence window is increased, the more is the single photon source superior against the laser. But even if the coincidence window is zero, the single photon source produces on the maximum point 4.7% more bits. With the standard parameter  ns the enhancement denotes on its maximum 7.5%. The enhancement of the single photon source in the setup without beam splitter, where all light impinges onto one detector is shown by the purple curve.

## Appendix H Entropy

The entropy of a random number is the amount of information, the number is containing. It is important to know these quantity of a raw bit string, to extract the maximal information of the string in a subsequent post-processing step.

The Rényi entropy [43] of order (with and ) is defined as

 Hα(X)=11−\mathboldαlog2[n∑x=1p(x)α] , (S34)

where is a random variable with the outcomes (with ). Please note that this definition of contradicts with the definition for the coherent state () in the main part of this paper. Therefore, we utilize a bold version at this point. The th outcome occurs with the probability , while . The limit case gives the Shannon entropy

 HShannon(X)=lim\mathboldα→1Hα(X)=−n∑x=1p(x)log2[p(x)] . (S35)

And the limit case gives the min-entropy

 Hmin(X) = lim\mathboldα→∞Hα(X)=−log2[Guess(X)],\leavevmode\nobreak with (S36) Guess(X) = maxx{p(x)}

The min-entropy is the smallest Rényi entropy. For our application it is the most important quantity, since it is an conservative bound on the entropy fraction in the raw bit stream.
But it might be, that the outcome of the random variable has an influence on the outcome of the random variable . To describe the entropy of such a coupled system, a conditional entropy is required [35]. The conditional Shannon entropy of the random variable conditioned on the random variable is

 HShannon(X|Y) = ∑yp(y)HShannon(X|Y=y) = −∑yp(y)∑xp(x|y)log2[p(x|y)]

and conditional min-entropy

 Hmin(X|Y) = −log2[Guess(X|Y)] = −log2[∑yp(y)Guess(X|Y=y)] = −log2[∑yp(y)maxx{p(x|y)}] ,

where describes as above the probability for the outcome of the random variable and describes the conditional probability for the outcome of the random variable , conditioned on the outcome of the random variable .

The entropy can be understood as the amount of information, the random number is containing. Our assumption is, that all events in the past can be known by an external adversary. We will calculate the conditional entropy of the next produced output . Only the knowledge about the previous produced output is relevant.

In the section H.1 all coincidences will be discarded. That means the only outputs are the bits and . An outcome produced by detector is labeled as . In section H.2 a coincidence will also be treated as an output of the generator. A coincidence as output is labeled as .

Before we start to calculate all the required probabilities in Eqn. H and H for the case of discarding and not discarding coincidences, one function has to be defined. Eqn. S30, which gives the the probability that detector clicks within the time interval , conditioned on a click at on detector , can be generalized to any time interval with :

 Pbclick([t1,t2]):=λbclick∫t2t1g(2)(τ) dτ . (S39)

The function is the probability that detector clicks within the interval when there is a click at on detector .

### h.1 Conditional probability of consecutive bits (discarding coincidences)

Now let us calculate the functions and if we discard coincidences, that means the only outcome of the random variables and are and .
The probabilities are very easy to calculate:

 p(a)=λabitλabit+λbbitwith a,b∈{R,T} ∧ a≠b . (S40)

The calculation of the conditional probabilities and is more complicated.
Before we do that we define , i.e. the probability if both detectors are outside dead time, the next output is . In principle the beam splitter “decides” where the next photon will occur, but it has to be considered, that the detectors have a quantum efficiency and that the next click might end in a coincidence:

 paoutτdead = (S41a) ⋅paηqePb0(τcw)+…(5) = (S41b) = (S41c) = (S41d)

in which