Key generation device and method

Abstract

An apparatus for generating certified random numbers usable as data keys, e.g., post-quantum cryptographic keys, is provided, the apparatus being a self-contained hardware unit configured to operate at room temperature. The apparatus includes a quantum random number generator including a certified light source for generating a quantum random bit sequence using a preparation and measurement technique. The apparatus further includes an extractor for verifying the entropy of the quantum random bit sequence using a proof of entropy and, after verification, generating certified random numbers using the quantum random bit sequence. The apparatus further includes a control and processing unit configured to control and monitor operation of the apparatus and to process the certified random numbers to generate data keys.

Description

[Technical field]

[0001] INCORPORATION BY REFERENCE TO PRIORITY APPLICATIONS This application claims the benefit of priority to U.S. Provisional Application No. 63 / 319,172, entitled "KEY GENERATION APPARATUS AND METHOD," filed March 11, 2022, the entire disclosure of which is incorporated herein by reference.

[0002] The present disclosure relates to methods and apparatus for generating quantum random numbers for generating data keys, more optionally for generating cryptographic keys, and even more optionally for generating post-quantum cryptographic keys. [Background technology]

[0003] Pseudorandom number generation algorithms are executable on classical computing devices (e.g., classical binary computing devices), such algorithms can generate a sequence of random numbers from a seed number, and a data key can be generated from the sequence of random numbers. However, such algorithms are in principle deterministic, and thus the sequence of random numbers is potentially predictable to a third party given sufficiently powerful computational resources, and thus the data key generated from the sequence of random numbers is correspondingly predictable. To address such vulnerabilities, it has been proposed to use classical stochastic processes to generate the sequence of random numbers, and a data key can be generated from the sequence of random numbers. However, quantum phenomena can generate sequences of random numbers with sufficient entropy that the data key generated therefrom cannot be predicted, assuming that substantially unlimited computational resources are available to a third party hacker, and similar considerations apply to keys used in various cryptographic systems. It is therefore desirable to have a data key generation system that uses quantum phenomena to generate such keys. Summary of the Invention [Means for solving the problem]

[0004] The present disclosure seeks to provide a hardware apparatus for generating certified random numbers using a prepare-and-measure method, where the certified random numbers are generated based on events whose quantum nature is associated with an energy-type constraint satisfied by a light source. The certified random numbers may be used to generate post-quantum cryptographic keys.

[0005] According to one aspect, an apparatus for generating certified random numbers based at least in part on quantum events includes a quantum device configured to generate quantum events, a classical computing device in communication with the quantum device, the classical computing device including a control and processing system, the control and processing system including a memory configured to store certain computer-executable instructions, and a hardware processor in communication with the memory and configured to execute the certain computer-executable instructions to at least generate a quantum random bit string using the quantum device, determine an entropy level of the quantum random bit string using a plurality of entropy witnesses, and generate a certified random number using the quantum random bit string in response to determining that the entropy level of the quantum random bit string is higher than an entropy level associated with an entropy witness of the plurality of entropy witnesses.

[0006] According to another aspect, a method for generating certified random numbers based at least in part on quantum events includes using, by a hardware processor of a control and processing system, a quantum device configured to generate a quantum random bit string; determining an entropy level of the random bit string using a plurality of entropy proofs; and, in response to determining that the entropy level of the quantum random bit string is higher than an entropy level associated with an entropy proof of the plurality of entropy proofs, generating a certified random number using the quantum random bit string.

[0007] According to another aspect, a method of calibrating and qualifying a light source for use in a quantum device for generating a quantum random bit sequence, the light source including a photon source and an optical link, the optical link transmitting at least a portion of the light generated by the photon source to a photodetector, the method including measuring, using the photodetector, a portion of the light received by the photodetector while controlling the photon source with a first trigger signal to determine a quantum state of the portion of the light received by the photodetector with respect to an energy-type constraint, the method further including adjusting the optical link to attenuate the portion of the light received by the photodetector while controlling the photon source with a second trigger signal, using the photodetector to measure the attenuated portion of the light received by the photodetector while controlling the photon source with a second trigger signal to determine a quantum state of the attenuated portion of the light received by the photodetector with respect to the energy-type constraint, and qualifying the light source for use in the quantum device in response to determining that the portion of the light received by the photodetector or the attenuated portion satisfies the energy-type constraint.

[0008] According to another aspect, an apparatus for generating certified quantum random numbers in an operational mode and generating seed random numbers in a kick-off mode includes a quantum device configured to generate quantum events, a classical computing device in communication with the quantum device, and a control and processing system configured to: generate a first quantum random bit sequence and a second quantum random bit sequence using the quantum device, generate a seed random number using the first quantum random bit sequence and the second quantum random bit sequence, generate a third quantum random bit sequence using the quantum device, and generate the certified random number using the third quantum random bit sequence and the seed random number.

[0009] According to another aspect, a method for generating certified quantum random numbers in an operational mode and generating a seed random number in a kick-off mode includes generating, by a control and processing system, a first quantum random bit sequence and a second quantum random bit sequence using a quantum device, generating a seed random number using the first quantum random bit sequence and the second quantum random bit sequence, generating a third quantum random bit sequence using a quantum device, and generating a certified random number using the third quantum random bit sequence and the seed random number.

[0010] According to another aspect, a non-transitory computer-readable storage medium comprising specific computer-readable instructions executable in data processing hardware, the specific computer-readable instructions, when executed in the data processing hardware, perform any of the methods described in the above aspect.

[0011] According to another aspect, there is provided an apparatus for generating certified random numbers (data keys), the apparatus being a self-contained hardware unit configured to operate substantially at room temperature, the apparatus including a quantum random number generator including a quantum device for generating a quantum random bit stream, a randomness extractor (e.g., a seeded extractor) for generating random numbers using the quantum random bit stream.

[0012] Particular embodiments may provide advantages in that the device may be implemented as a self-contained, compact item of hardware and, when in use, is capable of delivering large amounts of data keys of extremely high entropy.

[0013] Optionally, the data key comprises a cryptographic key. More optionally, the data key comprises a post-quantum cryptographic key.

[0014] Optionally, in the device, the quantum random number generator is implemented using a laser that generates photons, an optical mechanism for coupling at least a portion of the photons from the laser to a detector mechanism, and a processing mechanism for processing a signal from the detector mechanism, the optical mechanism being configured with the detector mechanism to create conditions for a single-photon quantum event in a spatial or temporal regime, the detector mechanism being configured to detect the event, and the processing mechanism being configured to apply a statistical test to verify that the event is truly a quantum event. More optionally, in the device, the statistical test includes determining an entropy level or a minimum entropy level of the quantum random bit stream using one or more entropy proofs, although other types of statistical tests can be used alternatively or additionally.

[0015] Optionally, in the apparatus the laser is implemented as a mode-locked self-pulsing laser.

[0016] Optionally, in the apparatus, the laser is a solid state laser, a fiber laser, or a semiconductor laser.

[0017] Optionally, in the apparatus, the laser is configured to operate in a pulsed mode.

[0018] Optionally, in the apparatus, the laser is configured to operate in a self-triggering mode.

[0019] Optionally, in the device, the laser may be externally triggered to generate the pulse train.

[0020] Optionally, in the apparatus, the extractor is implemented as a Dodis extractor.

[0021] Optionally, the apparatus includes a monitoring mechanism within the data interface and control unit configured to monitor operating conditions of the apparatus to determine whether evidence of entropy can be used to ensure that the entropy level of a quantum random bit string (QRBS) generated using a quantum device of the apparatus exceeds a required degree of entropy for the QRBS to be used (e.g., to generate a data key).

[0022] Optionally, the apparatus is configured to switch from an operational phase when generating random numbers to a "quick-off" phase in which the quantum device is used to generate seeds for use in an extractor that is seeded during another operational phase.

[0023] Optionally, in the device, the data processing required for the device to function when in use is implemented using at least one FPGA.

[0024] Optionally, the apparatus is 3 The invention is implemented using hardware that can be housed in a volume less than 100 MHz.

[0025] Optionally, the device is configured to consume less than 10 watts when in operation.

[0026] According to another aspect, there is provided a method for (i.e., a method of using) an apparatus for generating a data key, the apparatus (10) being a self-contained hardware unit configured to operate at substantially room temperature, the method comprising: (a) configuring an apparatus to include a quantum random number generator including a quantum device for generating a quantum random bit stream; (b) using an extractor (e.g., a seeded extractor) to generate a random number using the quantum random bit sequence received from the quantum device; (c) using a control and processing system to control and monitor operation of the apparatus and process the output of the extractor to generate the random number.

[0027] Optionally, the device generates a data key using the random number. The data key may be a cryptographic key. More optionally, the data key is a post-quantum cryptographic key.

[0028] Optionally, the method further comprises: (i) implementing a quantum random number generator that uses a laser to generate photons; (ii) coupling photons from the laser to a detector mechanism using an optical mechanism; (iii) processing signals from the detector mechanism using a processing mechanism, the optical mechanism being configured with the detector mechanism to create conditions for measuring single photon detection quantum events in a spatial or temporal form; (iv) detecting the event using a detector mechanism; (v) generating a sequence of quantum random bits using the events; (vi) using a processing mechanism to apply a statistical test based on the evidence of entropy to verify that the entropy of the quantum random bit string is greater than a minimum entropy associated with the evidence of entropy.

[0029] According to another aspect, there is provided a software product recorded on a machine-readable data storage medium, the software product being executable on data processing hardware to perform the method of the second aspect.

[0030] Additional aspects, advantages, features, and objects of the present disclosure will become apparent from the drawings and detailed description of illustrative embodiments taken in conjunction with the accompanying claims below.

[0031] It will be understood that features of the present disclosure are capable of being combined in various combinations without departing from the scope of the present disclosure as defined by the appended claims.

[0032] Embodiments of the present disclosure will now be described, by way of example only, with reference to figures of the present disclosure. [Brief description of the drawings]

[0033] [Figure 1] FIG. 1 is a diagram of an embodiment of a random number generator according to the present disclosure. [Figure 2A] FIG. 2 is a schematic diagram of an optical setup that can be used to implement a quantum random number generator of the device of FIG. 1. [Figure 2B] FIG. 2 is a schematic diagram of an optical setup that can be used to implement a quantum random number generator of the device of FIG. 1. [Diagram 3] FIG. 2 is a schematic diagram of an active damping mechanism for the quantum device of the apparatus of FIG. 1. [Figure 4] FIG. 1 is a block diagram illustrating a system that may be used to generate certified random numbers related to quantum events using the prepare-and-measure or OOK method. [Figure 5A]FIG. 5 is a block diagram of an apparatus for generating certified quantum random numbers using the method described above with respect to FIG. 4. [Figure 5B] 5B is a flow diagram illustrating an exemplary process that may be used by the device shown in FIG. 5A during a normal mode of operation to generate certified random numbers. [Figure 6] FIG. 1 is a block diagram illustrating an example optoelectronic system for generating certified random numbers. [Figure 7] 5B is a flow diagram illustrating an example process that may be used by the apparatus shown in FIG. 5A in a quick-off phase or mode to generate a seed random number. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0034] In the accompanying figures, underlined numbers are used to represent the item in which the underlined number is located or to which it is adjacent. When a number is not underlined and has an associated arrow attached, the non-underlined number is used to identify the general item to which the arrow is pointing.

[0035] The present disclosure relates to methods and apparatus for generating data keys, more optionally for generating cryptographic keys, and even more optionally for generating post-quantum cryptographic keys. Furthermore, the present disclosure relates to a method for using (i.e. a method of using) said apparatus for generating said keys. Furthermore, the present disclosure relates to a software product, for example stored on a data carrier, which is executable on computing hardware to perform said method.

[0036] Pseudorandom number generation algorithms are executable on classical binary computing devices, and such algorithms can generate sequences of random numbers from a seed number, which can be used to generate a data key. However, such algorithms are deterministic, and therefore the sequence of random numbers is potentially predictable to a third party given sufficiently powerful computational resources, and thus the data key generated from the sequence of random numbers is also predictable. To address such vulnerabilities, classical stochastic processes such as electronic noise, Zener diode noise, and thermal noise have been proposed as a method with higher entropy to generate sequences of random numbers with higher entropy, and a data key with higher entropy can be generated from a sequence of random numbers with higher entropy. However, assuming an adversary has sufficiently powerful computational resources, such classical stochastic processes cannot be used to generate an unbreakable encryption key extracted from a sequence with higher entropy (e.g., using a Dodis extractor). In contrast, quantum phenomena may be exploited to generate sequences of random numbers with sufficiently large entropy that the data keys generated therefrom resist prediction, even assuming an adversary with virtually unlimited computational resources; similar ideas apply mutatis mutandis to RSA cryptographic keys. A technical problem encountered is that a user would like to have a data key generation device that is spatially local to them, for example located in the user's high security enclave or entirely local to the system, for a cryptographic key generation device.

[0037] Compact quantum random number generators are known. For example, the scientific paper "Compact quantum random number generator based on superluminescent lightemitting diodes", Shihai Wei et al., Rev Sci Instrum 2017 Dec; 88(12):123115 doi: 10.1063 / 1.5005506, describes a method for implementing a compact quantum random number generator (QRNG), which is configured to work by measuring the amplified spontaneous emission (ASE) noise of a superluminescent light emitting diode. In the QRNG, after detecting and amplifying the ASE noise, data acquisition and randomness extraction are both performed in real time, and the final random bit sequence generated by the extraction is delivered to a host computer at a real-time generation rate of 1.2 Gbps, and the data acquisition and randomness extraction are integrated in a field programmable gate array (FPGA). In addition, to achieve compactness, all components of the QRNG are integrated onto three independent printed circuit boards in a compact design, and the QRNG is housed in a small enclosure with a size of 140mm x 120mm x 25mm. The final random bit sequence can pass all NISTSTS tests and DIEHARD tests.

[0038] According to a first aspect, there is provided an apparatus for generating data keys (e.g. encryption keys, post-quantum encryption keys), the apparatus being a self-contained hardware unit configured to operate at room temperature, the apparatus comprising: a quantum random number generator including a quantum device for generating a quantum random bit stream; an extractor for generating certified random numbers using a quantum random bit sequence received from the quantum device; and a data control and processing unit configured to control and monitor operation of the apparatus.

[0039] With reference to FIG. 1, an embodiment of a data key generating device is shown, the device being generally indicated by 10. The data key generated by the device 10 when in operation is optionally a cryptographic key, for example a post-quantum cryptographic key. Furthermore, the device 10 includes an optical system (quantum device) 22 that provides random quantum events, an extractor 30, a pseudorandom number generator 40, and a control system 60 that functions in use to perform statistical tests based on the entropy evidence, for example the entropy evidence related to the generator 20, as a data processor and interface 50. In some cases, the control and processing system 60 can be a self-contained electronic system. Advantageously, it is difficult for a malicious third party to monitor signals in such an electronic system and thereby eavesdrop on the data flows and data processing operations occurring therein, and therefore difficult for a malicious third party to capture any information that may reduce the security of the system or the randomness of the certified random numbers generated by the system. In various implementations, the control and processing system 60 may include a field programmable gate array (FPGA), a development board (e.g., a board including a central processing unit (CPU) and / or an FPGA), a microcontroller, a microprocessor, an application specific integrated circuit (ASIC), or other system. In some cases, the pseudorandom number generator 40 and the data processor and interface 50. In some cases, the control and processing system 60 may include an analog-to-digital converter or a digital-to-analog converter.

[0040] Optionally, parts of the data interface and control unit 50 are implemented using a microprocessor and / or microcontroller configured to execute one or more software products for performing the functions of the device 10, as described above.

[0041] In some cases, in the device 10, at least a portion of the quantum random number generator 20 is carefully electromagnetically shielded from electronic switching devices, such as a control system, to reduce any signaling occurring between the device and the electronic switching devices. Such shielding is beneficially achieved using a ferromagnetic conductive sheet, e.g., a mu alloy sheet, although other conductive shielding materials are alternatively used. In some cases, as shown in FIG. 3, at least a portion of the quantum random number generator 20 can be attached to an actuator mechanism 220 and is also provided with a solid-state vibration sensor 200, and a vibration signal from the vibration sensor 200 is provided via a negative feedback loop amplifier 210 to drive the actuator mechanism 220 to counteract vibrations experienced in critical parts of the quantum random number generator 20, such an implementation allows the device 10 to be mounted in a high vibration environment, e.g., an equipment rack where cooling fans cause significant environmental vibrations and acoustic noise. Optionally, the actuator mechanism 220 includes at least one of a piezoelectric actuator 230A, an electromagnetic actuator 230B. Optionally, such active damping is activated on demand when device 10 is needed to distribute a data key, but is otherwise deactivated to reduce power dissipation within device 10.

[0042] The quantum devices of generator 20 are configured to use at least the quantum phenomenon of quantum superposition to generate data streams having a minimum level of entropy, and these high entropy data streams are statistically processed within control and processing system 60 and subjected to entropy level tests using entropy evidence, e.g., when the data streams pass the entropy evidence test, they are thereby determined to have an entropy level greater than the minimum entropy associated with the corresponding entropy evidence.

[0043] The device 10 may be physically compact, for example, 1000 cm 3 Less than, or more arbitrarily, 500 cm 3 Less than, more arbitrarily, 300cm 3 It is understood that the device 10 is intended to be housed within a volume of less than 100 nm and to function at approximately (substantially) room temperature, i.e., in the room temperature range of about +0° C. to +40° C., but the device 10 can be configured to function outside this range if necessary. By using photonics components, it is feasible to implement the quantum devices so that they do not require cooling or refrigeration, thereby allowing a compact mechanism to be realized. When in use, the quantum devices of the generator 20 detect the presence or absence of individual photons by either temporal or spatial discrimination, or both. Preferably, the quantum devices are temperature stabilized, e.g., heated to function at a steady temperature of +45° C. when in operation.

[0044] 2A is a block diagram showing an exemplary experimental setup that may be used to characterize an output light beam (photon stream) generated by a light source 25 (e.g., a laser), which is optionally attenuated before being split by a beam splitter 100. A given photon passing through the splitter 100 may either follow a first optical path A 110A and be received at a first detector A 120A, or follow a second optical path B 110B and be received at a second detector B 120B, but not both at a given moment. In some cases, for example, when the light source 25 is a single-photon source, if signals are generated at both detectors 120A, 120B at a given moment of propagation of a given photon, the corresponding signals SIG.A and SIG.B are likely to output stochastic classical noise. In some cases, if a signal is generated in only one of the detectors 120A, 120B at a given moment, the corresponding signal SIG.A or SIG.B can be associated with a quantum event. The detectors 120A, 120B may have high sensitivity and low noise. In some cases, the detectors 120A, 120B may include single photon detectors.

[0045] In some embodiments, light source 25 comprises a solid-state laser or an erbium-doped fiber optic laser. Optionally, light source 25 is operated as a pulsed light source or comprises a pulsed laser. Optionally, light source 25 is operated as a free-pulsating laser. In some cases, such pulsed operation may reduce power dissipation and lower cooling requirements for light source 25.

[0046] In some embodiments, the light source 25 is temperature controlled when in operation, e.g., the laser 25 beneficially has an associated built-in temperature sensor and associated temperature feedback control loop to maintain heat dissipation within the laser 25 to operate at a substantially constant operating temperature. In some embodiments, the light source 25 is electromagnetically shielded against stray electrostatic radiation or electromagnetic ambient radiation. In some cases, the output light beam generated by the light source 25 is attenuated as described above before being allowed to propagate along the first optical path A 110A and be received at the first detector A 120A or the second optical path B 110B and be received at the second detector B 120B, such attenuation being required to allow a relatively low photon flux and to satisfy the energy type constraints on the quantum states of the photons received by the first and second photodetectors 120A, 120B.

[0047] 2B shows an exemplary optical system 22 used in the apparatus 10. In some cases, temporal discrimination may be used to detect individual photons within the optical beam of photons that propagate during operation from the laser 25 to detector A 120A. Again, detector 120A needs to be highly sensitive and low noise to be able to detect individual photons. Using temporal discrimination of individual photons potentially results in the apparatus 10 being simpler in design and more compact than when the mechanism of FIG. 2A is used.

[0048] In FIG. 2B, the light source 25 is optionally a solid-state laser or an erbium-doped fiber-optic laser as described above. Optionally, the laser 25 is a mode-locked laser 25. Optionally, the laser 25 is operated as a pulsed laser. Optionally, the laser 25 is operated as a self-oscillating laser. Optionally, the laser 25 is temperature controlled when in operation. Optionally, the laser 25 is electromagnetically shielded from all stray electrostatic or electromagnetic ambient radiation, thereby operating in a nearly non-signalling manner, more optionally substantially non-signalling manner (i.e., completely shielded from all forms of crosstalk from other components of the device 10). The output beam from the laser 25 is attenuated before being allowed to propagate to the detector A 120A. Such attenuation is required to provide a photon flux having a quantum state that satisfies the energy-type constraint.

[0049] In some embodiments, the output parameters of the laser 25 of the optical system 22 may be monitored for changes over time that may affect the performance of the device 10. If the changes are greater than a threshold amount, the device 10 is configured to send a warning message to a user of the device 10. Optionally, a feedback loop is included in the device 10 to control the laser 25 so that the pulse power or the number of photons in the light pulse remains substantially constant, and in some cases the changes may be monitored to determine ageing in the device 10, for example, by comparison to a mathematical model of the device 10. If the changes indicate that the device 10 is potentially becoming unreliable, a warning is sent to a user of the device 10 via a user interface. In some implementations, the optical output from the laser 25, i.e., the spectral composition of the beam, is monitored, for example, using an optical Bragg grating with an associated array light sensor to identify individual spectral components of the optical output.

[0050] Because it is technically extremely difficult to detect individual photons given the small signals involved, the output from a quantum device contains components of classical stochastic noise (e.g., thermal noise in the photon detectors and associated amplifiers) and also quantum noise. A test for a quantum phenomenon can be verification that the output from the quantum device represents a quantum event and is suitable for use in generating random numbers (e.g., data keys) in the apparatus 10, e.g., post-quantum cryptographic keys.

[0051] In operation, the quantum random number generator 20 provides a string of 0's and 1's as logic states referred to as a "QRNG" to the extractor 30, and during operation of the device 10, the QRNG is statistically verified as having a sufficient level of entropy by a statistical test 24. In some cases, the statistical test 24 may include testing the QRNG using an entropy evidence designed to determine whether the entropy level of the QRNG exceeds a threshold entropy level associated with the entropy evidence. Preferably, the extractor 30 is configured to function as a Dodis extractor, although other implementations of extractors are feasible for use in the device 10. The pseudorandom number generator 40 generates pseudorandom numbers that are used to trigger the optical device 22 to generate quantum events that can be used to generate QRBSs that are provided to the extractor 30 to generate post-quantum cryptographic keys for output from the device 10. In some examples, the device 10 may generate more than 50 million post-quantum cryptographic data keys per second. As is known from Claude Shannon's theory, for optimal data security, a cryptographic key may only be used once (i.e., a "nonce") and should ideally have a bit length comparable to the length of the data being encrypted. Thus, when device 10 is used in highly secure cybersecurity systems that are required to provide high data throughput, many post-quantum cryptographic keys may be used per second, e.g., millions of such keys may be used per second, and device 10, when in operation, may be capable of distributing such a large amount of data keys.

[0052] The random number generators described herein (e.g., device 10) can be semi-device-independent (SDI) random number generators that generate certified random numbers based at least in part on quantum events. These random number generators may be designed to provide an optimal tradeoff between ease of practical implementation in a self-contained, compact hardware mechanism and providing extremely high data security. Furthermore, these random number generators are advantageous in that they can be operated with modest energy consumption, i.e., consuming power on the order of a few watts when in operation, optionally less than 1 watt. In some embodiments, these random number generators implement QRNG protocols, including those described in the publication entitled “Semi-device-independent framework based on natural physical assumptions” by TV Himbeeck, E. Woodhead, NJ Cerf, R. Garcia-Patron, and S. Pironio, Quantum 1 (2017), https: / / doi.org / 10.22331 / q-2017-11-18-33, herein referred to as “Himbeeck / Pironio”, and the publication entitled “Correlation and randomness generation based on energy constraints” by TV Himbeeck and S. Pironio, arXiv:1905.09117v1 [quant-ph], the entire contents of which are incorporated herein by reference and made a part hereof. In an embodiment, the quantum random number generator may utilize the "On-Off-Keying" (OOK) method as described in Himbeeck / Pironio.

[0053] When trying to build a device that implements a semi-device independent QRNG protocol such as that described by Himbeeck / Pironio, one encounters two objective problems. Problem 1: Himbeeck / Pironio does not teach how to build a quantum random number generator, but only provides theoretical justification and mathematical proof. Thus, inventive effort is required to put the theoretical ideas of Himbeeck / Pironio into practice. The embodiments of the present disclosure are distinguished from the teachings of Himbeeck / Pironio because Himbeeck / Pironio does not teach how to design a suitable randomness certificate for use in the control and processing system 60 of the device 10 to ensure that at least a minimum threshold of entropy of the generated QRNG data is achieved, and furthermore, Himbeeck / Pironio does not teach how to build a practical low-power device that can be used in challenging environments where, for example, environmental temperature changes and mechanical vibrations are likely to be encountered. Issue 2: Implementing device 10 and experimentally verifying assumptions used when designing device 10 to ensure that the data key has sufficient entropy, e.g., manufacturing device 10 includes experimental verification that the light generated by the light source of optical system 22 satisfies the energy-type assumptions (e.g., the energy-type assumptions described in Himbeeck / Pironio).

[0054] FIG. 4A is a block diagram illustrating a system 400 that may be used to generate certified random numbers associated with quantum events using a preparation and measurement or OOK method. In some embodiments, the system 400 may include a quantum device (e.g., a photonic quantum device) 402 in communication with and controlled by a classical computing device 404. The quantum device 402 generates a quantum random bit string (QRBS) that includes quantum random bits associated with a quantum event (e.g., detection of a photon). The quantum device 402 may generate the quantum random bits using a two-step process that includes preparation of a quantum state using a preparation process 406 triggered by the classical computing device 404, and a measurement process 408 that includes measuring the quantum state. The classical computing system may trigger the preparation process 406 by generating a trigger signal and sending a first portion 411a of the trigger signal to the quantum device 402. In some cases, the trigger signal may include a pseudorandom number (PRN) generated by a seeded pseudorandom number generator (PRNG) 410. In some cases, the preparation process 406 may be constrained by an energy type constraint, resulting in a constrained quantum state 407. In some cases, such a constrained quantum state 407 may generate a quantum random event when measured. A plurality of measured random quantum events may be transmitted to the classical computing device 404 as a quantum random bit string (QRBS) 409. The classical computing device 404 may then use an evidence verification process 412 to verify that the entropy level of the QRBS 409 is greater than a minimum entropy associated with the entropy evidence. In some examples, the verification process 412 may include evaluating the QRBS 409 using the second portion 411b of the triggered signal received from the seeded PRNG 410 and at least the entropy evidence. In some cases, the verification process 412 may evaluate the QRBS 409 using the second portion 411b of the triggered signal and a sorted group of the entropy evidence sorted based on the corresponding entropy levels.In some such examples, the verification process 412 includes sequentially evaluating (QRBS) 409 using individual entropy evidences of the sorted group, starting with the entropy evidence having the highest entropy level, until (QRBS) 409 satisfies the entropy condition associated with the entropy evidence. In some cases, the different entropy evidences of the sorted group may be associated with different physical states of the quantum device 402. For example, the different entropy evidences of the sorted group may be associated with different temperatures of the quantum device 402, with the first witness function having the highest entropy level being associated with the lowest temperature. Such a witness verification process may result in a lower rate of rejection of the QRBS, since a QRBS having a lower level of entropy due to the physical state of the quantum device 402 can still be verified by an entropy evidence having a lower entropy level (lower in the sorted group).

[0055] Once the one or more QRBSs are verified using the evidence verification process 412, the verified QRBS 413 may be sent to a seeded randomness extractor 416. The seeded randomness extractor uses a seed random number (e.g., a cryptographic seed) 414 and the verified QRBS 413 to generate one or more certified random numbers 418. In some cases, the cryptographic seed 414 may be hard-coded into the classical computing device 404.

[0056] In an embodiment, the quantum device 402 may include a light source that provides photons having a constrained quantum state, and a photodetector that detects the photons and generates a detection signal. In these cases, the constrained quantum state may have a constrained number of photons, or a constrained overlap with a vacuum state. For example, the overlap between the constrained quantum state of the photons and the vacuum state may be greater than a threshold. The detection signals may be transmitted to the classical computing device 404 as a QRBS 409.

[0057] Advantageously, the measurement process 408 has greater than a minimum entropy and may not be constrained by specific physical constraints for generating the QRBS associated with the quantum event.

[0058] 5A is a block diagram of an apparatus 500 for generating qualified quantum random numbers using the methods described above with respect to system 400. In some cases, apparatus 502 may include a photonic quantum device 502 acting as quantum device 402. Photonic quantum device 502 includes a photonic system including a light source 506 configured to generate light (photons) and a photodetector 508 configured to detect photons received from light source 506 and generate a detection signal indicative of the received and detected photon or photons.

[0059] The wavelength (e.g., center wavelength) of the light generated by light source 506 can be 400-700 nm, 700-1700 nm, 1700-2500 nm, or any value within a range formed by any of these values, or a smaller or larger value.

[0060] The light source 506 may include a photon source (507a) such as a laser, e.g., a solid-state laser, a fiber laser, a semiconductor laser, or other light source (e.g., a light-emitting diode). In some cases, the laser may have a pulse width (t P ) . In some cases, the laser may be a pulsed laser configured to generate pulses of light having a Pcan be from 1 ns to 10 ns, 10 ns to 20 ns, 20 ns to 30 ns, 30 ns to 50 ns, or any range formed by these values, or can be larger or smaller. In some cases, the photodetector 508 is a single photon detector (e.g., a single photon avalanche diode or SPAD). In some implementations, the photonic system may include an optical link 507b configured to receive light from the photon source 507a, attenuate the received light, and transmit the attenuated light to the photodetector 508. In some cases, the attenuated light may satisfy an energy type constraint. In some examples, the light generated by the photon source 507a may not satisfy the energy type constraint, while the attenuated light satisfies the energy type constraint. The energy type constraint may include a finite expected value of an observable (or measurable) physical parameter of the light (photon stream), such as energy, photon number, or quantum state overlap with the vacuum state. For example, the overlap between the quantum state of the attenuated light transmitted from optical link 507b to photodetector 508 and the vacuum state may be greater than a threshold. In some cases, the energy type constraint may include a max-peak assumption that imposes an upper limit on the average energy observable by a user of apparatus 500 and an adversary who has access to classical information related to photonic quantum device 502. In some examples, the characterization process may include using a "trusted detector" to measure characteristics of the resulting or attenuated light (e.g., photon statistics). The trusted detector may be a photodetector that is thoroughly characterized and placed in a protected environment. Further details about the max-peak assumption are described below.

[0061] The detection signal generated by the photodetector 508 may be transmitted to measurement circuitry 519 configured to process and store the detection signal to generate a quantum random bit sequence (QRBS).

[0062] In some implementations, the photonic quantum device 502 may generate multiple detection signals using multiple preparation and measurement cycles (which may operate according to the OOK process). Each preparation and measurement cycle may include, for example, triggering the light source 506 to generate light (e.g., a light pulse) using a trigger signal, measuring (detecting) the resulting light, and storing the resulting detection signal. The trigger signal may cause the light source 506 to send a light pulse to the photodetector 508.

[0063] The trigger signal may be generated by a preparation circuit 518 receiving a pseudorandom number (PRN) generated by the pseudorandom number generator 510. The trigger signal may thus comprise a random series of ON / OFF signals (corresponding to logical 1 and logical 0) configured to cause the photon source 507a to generate a series of pulses randomly distributed in the time domain. The photon source 507a may be configured to generate light pulses upon receiving an ON signal and to generate no light upon receiving an OFF signal. The preparation and measurement cycle may include receiving a signal, which may be a random ON or OFF signal, by the light source 506, and measuring a corresponding detection signal that may indicate the detection of one or more photons or the non-detection of a photon.

[0064] The apparatus 500 may use an evidence verification circuit or process 512 to determine and confirm the entropy level of the QRBS generated by the measurement circuit 519 using a signal (e.g., a part of the trigger signal) generated by the preparation circuit 518 and at least one entropy evidence associated with a particular level of entropy. In some cases, the evidence verification process 512 may include a comparison between the QRBS and the entropy evidence to determine whether the entropy level of the QRBS is equal to or greater than the particular level of entropy. If the entropy level of the QRBS is determined to be equal to or greater than the particular level of entropy (associated with the entropy evidence), the QRBS is verified and the evidence verification process 512 provides a verified QRBS (V-QRBS) to an extractor circuit or randomness extraction process 516. In some cases, the extractor 516 may include a seeded extractor that uses the seed random number 514 and the V-QRBS to generate a certified random number 530. The seed random number 514 may be, for example, a cryptographic random number hard-coded into the device 500 as part of the extractor circuit or extraction process 516 .

[0065] The apparatus 500 may include an electronic device 504 in communication with the photonic system of the photonic quantum device 502. In some implementations, the circuits or processes described above with respect to the apparatus 500 may be implemented in the electronic device 504 as processes executed by one or more electronic processors of the electronic device 504 using machine-readable instructions stored in a memory of the electronic device 504. In some cases, one or more of the circuits or processes described above with respect to the apparatus 500 may include individual circuits of the electronic device 504. The electronic device 504 may include a control and processing system 520 that controls the operation of the circuits and execution of the processes in the electronic device 504, as well as the operation of the optical system of the photonic quantum device 502. The photonic quantum device 502 may include a photonic system (e.g., a light source 506 and a light detector 508) and preparation 518 and measurement 519 circuits / processes implemented in the electronic device 504. In various implementations, the electronic device 504 may include a field programmable gate array (FPGA), a development board (e.g., a board including a central processing unit (CPU) and / or an FPGA), a microcontroller, a microprocessor, an application specific integrated circuit (ASIC), or other types of electronic devices. In some cases, the electronic device 504 may be connected to an external computing system (e.g., a classical computing system) and use a processor of the external computing system for at least some of the processing tasks performed to generate the certified quantum random numbers 530.

[0066] In some embodiments, the device 500 may be used in more than one mode, with each mode corresponding to a configuration of the device 500 to perform a computational task. For example, in a normal mode (also called an operational mode), the device 500 may be configured to generate certified random numbers 530, and in a kick-off mode, the device 500 may be configured to generate seed random numbers. In some cases, the device 500 may be operated in the kick-off mode during the manufacturing process to generate seed random numbers for use during the operational mode. In some cases, the device 500 may be operated in the kick-off mode after a period of operation in the normal mode.

[0067] 5B is a flow diagram illustrating an exemplary process 500 that may be used by a control and processing system 520 (also referred to as a controlled system 520) of the apparatus 500 during a normal mode (operational mode) to generate one or more certified random numbers. The control system 520 executes the process 500 using various circuits, processors, non-transitory memory elements of the electronic device 504 and information / instructions stored therein.

[0068] In block 502, a control system 520 triggers a light source 506 using a pseudorandom number generator 510 and a preparation process (or circuit) 518 to generate a photon stream and provide the photon stream to a photodetector 508. In some cases, providing the photon stream may include reducing the number of photons in the photon stream (e.g., using an optical attenuator 507). In some cases, the quantum state of the photon stream delivered to the detector may meet a maximum peak assumption (e.g., the quantum state may have a minimal overlap with the vacuum state).

[0069] In block 504 , the control system 520 detects and measures the photon stream generated in block 502 using a photodetector 508 and a measurement process (or circuit) 519 .

[0070] In block 506, the control system 520 stores the results of the measurement process of block 504 (e.g., the detected signal) in a non-transitory memory of the electronic device 504. The measurement results may include random bits associated with the quantum event.

[0071] At decision block 508, the control system 520 determines the total number of stored measurements (random bits). If the total number of stored measurements is greater than or equal to the threshold, the process proceeds to block 510. If the total number of stored measurements is less than the threshold, the process returns to block 502. In some cases, the threshold is a predefined value stored in the memory of the electronic device 504.

[0072] In block 510, the control system 520 generates a QRBS using the stored random bits.

[0073] At decision block 512, the control system 520 determines the entropy of the QRBS using the one or more entropy evidences. If the determined entropy of the QRBS is higher than the entropy level associated with the entropy evidence, the process proceeds to block 514. If the determined entropy of the QRBS is less than the entropy level associated with the one or more entropy evidences, the process returns to block 502.

[0074] 6 is a block diagram illustrating an example optoelectronic system 600 for generating certified random numbers. The optoelectronic system 600 can be an implementation of the apparatus 500 shown in FIG. The optoelectronic system 600 may include an electronic substrate 602 (e.g., serving as the electronic device 504), an optical system 603 (serving as the optical system for the photonic quantum device 502), and a power source 604 configured to provide power to the electronic substrate 602 and the optical system 603.

[0075] The optical system may include a photon source 507a (e.g., a laser), an optical link 507b, and a photodetector 508. The electronic board 602 is connected to the laser 506 and the photodetector 508 via a wired or wireless link, for example, to send control signals and receive data signals. In some implementations, the photon source 507a is optically connected to the photodetector 508 via an optical link 507b including an optical connector assembly 608 and an optical fiber 610. The optical link 507b may act as the optical attenuator 507 of the device 500. In some cases, the optical link 507b may include an absorptive optical attenuator. In some cases, the optical connector assembly 608 may include an absorptive optical layer configured to attenuate the light generated by the photon source 507a. In some cases, the total optical attenuation of the light transmitted through the optical link 507b may be configured to reduce the power of the light generated by the photon source 507b to satisfy the energy type constraint.

[0076] In some cases, during a manufacturing or recalibration process, detector 508 may be replaced by a reliable photodetector to adjust parameters of photon source 507a and total optical attenuation of link 507b such that one or more characteristics of the light detected by the reliable detector satisfy the energy type constraint. In some cases, satisfying the energy type constraint may include a maximum peak assumption. In some examples, the one or more characteristics of the light may include an average photon number or an overlap of the quantum state of the light with the vacuum state.

[0077] In some embodiments, the system 600 may include an environmental sensor 612 configured to measure an environmental parameter (e.g., temperature). In these embodiments, the control system of the electronic board 602 may use the sensor signal received from the environmental sensor 612 to determine that an environmental condition during the quantum random number generation process has changed beyond a threshold level. In response to such a determination, the control system of the electronic board 602 may abort the quantum random number generation and / or the evidence verification process. Alternatively or additionally, in response to such a determination, the control system of the electronic board 602 may alert a user of the device 600 that the device 600 has malfunctioned and that the certified quantum random numbers are likely unreliable.

[0078] In some embodiments, a control system of the electronic board 602 may adjust or select values ​​for parameters of the electronic board 602 based at least in part on the sensor signal.

[0079] In some implementations, the output of the photon source 507a may include a sequence of periodically generated optical pulses having pulse widths between 1 ns and 100 ns, for example, when electronically triggered. In some cases, the repetition rate of the optical pulses can be 1 to 100 MHz. The optical link between the photon source 507a and the photodetector 508 may include one or more absorbing neutral density (ND) filters in combination with intentionally decoupled optical fibers to achieve a desired average number of photons received by the photodetector 508 for a given optical output power generated by the light source 506. In some cases, the photodetector 508 may include a single photon avalanche diode (SPAD). The SPAD may generate a single TTL pulse when a photon (or multiple photons) triggers an avalanche in the SPAD. The detection efficiency of the SPAD may be 60 to 90% for wavelengths between 600 nm and 700 nm. The dead time of the photodetector 508 may be 20 ns to 60 ns. The dark count of the photodetector 506 can be less than 200 Cps, less than 300 Cps, or less than 600 Cps.

[0080] In some implementations, the extractor 30 or 516 may be beneficially implemented as an optionally seeded Dodis extractor. Parameters of the extractor 30 or 516 may be adjusted by the control and processing system 60 or the electronic device 504. In some implementations, the extractor 30 or 516 may be configured as a Markov model two-source extractor (e.g., when the device operates in kick-off mode). In some cases, the extractor 30 or 516 may include a randomness extraction algorithm that runs on a processor of the control and processing system 60 or the electronic device 504.

[0081] The device 10, system 400, or device 500 may include one or more of the following innovations.

[0082] Innovation 1: Use of multiple proofs of randomness within the data-key generator Ensuring that the device 10, 500, or system 400 is trustworthy in operation and provides certified random numbers or verifiable data keys, e.g., but not limited to, post-quantum cryptographic keys, are essential attributes that the device 10, 500, or system 400 must provide to satisfy its practical end uses, e.g., in banking systems, secure data communication systems, infrastructure safety-critical control systems, secure data storage systems, etc. Such verified operation of the device 10, 500, or system 400 may be provided by having the device 10, 500, or system 400 hard-code entropy evidence, e.g., in the control processing system 60, the classical computing device 404, or the electronic device 504. Additionally, the inclusion of such entropy evidence may be useful to ensure performance as the device 10, 500, or system 400 ages (e.g., as the corresponding quantum device ages).

[0083] The quantum device (e.g., optical system) of the apparatus 10, 500, or system 400 may generate a sequence of output bits whose entropy may be strictly lower bounded based on the validity of quantum theory. In some implementations, this entropy lower bound is obtained by solving an optimization problem whose inputs are the estimated probabilities of the individual outputs (e.g., detection signals) for a given choice of preparation. Due to the complexity of the optimization algorithm, it may be difficult to solve such an optimization problem using the control processing system 60, the classical computing device 404, or the electronic device 504. To address this limitation, in some implementations, an evidence of entropy may be used during the manufacturing process of the apparatus 10, 500, or system 400 to determine whether a QRBS of n output bits contains a certain minimum amount of entropy. Such an evidence of entropy may be expressed as a conditional probability P(x) that indicates the probability of obtaining a measurement a in response to a preparation x with respect to the measured behavior of the quantum device (e.g., optical system) or the operating conditions of the quantum device (e.g., typical or expected behavior of the quantum device).typ (a|x). Such conditional probabilities may be estimated by running the quantum device many times in expected environmental conditions. The resulting proof of entropy may be hard-coded into the control processing system 60, classical computing device 404, or electronic device 504 and used to determine if the QRBS of the n output bits is greater than a minimum entropy set to proceed to the extraction step.

[0084] The use of a single entropy proof is an effective alternative to solving the optimization on-board, assuming that the behavior of the quantum device (optical system) does not deviate significantly from the "expected" conditions for which the single entropy proof is prepared and optimized. In some cases, variations in environmental conditions may result in a high probability that the QRBS will be rejected by statistical tests 24 or the proof validation process 412, 512. In some cases, when the environmental conditions of the quantum device differ from the environmental conditions associated with the entropy proof, the entropy level of the QRBS generated by the quantum device may be less than the entropy level associated with the entropy proof.

[0085] In a real implementation, a quantum device may operate over the expected lifetime of the device in a range of different environmental conditions (e.g., in a range of temperatures between 10 and 40 C). Environmental conditions such as temperature can have a strong effect on the behavior of components (e.g., optical components) of the quantum device, which may be expressed as a conditional probability P typ(a|x) dependence. Similarly, aging of optical components may affect the expected behavior of the quantum device. To account for variability in the behavior of the quantum device (e.g., due to variable environmental conditions), inventive aspects of the systems disclosed herein include preparing or designing different entropy proofs suitable for different environmental conditions to which the quantum may be exposed and / or different behavior of the quantum device that may be expected during the lifetime or operation of the corresponding apparatus or system. As an example, when the quantum device of apparatus 10, 500, or system 400 is expected to function in a range of temperatures between 10C and 40C, three entropy proofs may be designed for operation from 10C to 20C, 20C to 30C, or 30C to 40C. Depending on the level of sensitivity of the behavior of the quantum device to temperature, additional entropy proofs may be designed to be used at smaller temperature intervals (e.g., every 5C instead of 10C).

[0086] Advantageously, using multiple entropy proofs can reduce the probability of aborting a cycle without adding assumptions to the random number generation protocol. In some embodiments, the individual entropy proofs provide a bound on the entropy that is valid even in different environmental conditions, but the results may not be optimal. In some cases, different entropy proofs of the multiple proofs may be associated with different entropy levels. The individual entropy proofs may be used to determine that the entropy of a bit string (e.g., a quantum bit string) is greater than the entropy level associated with the individual proof functions.

[0087] In some cases, the verification process 412 may evaluate the QRBS 409 using the second portion 411b of the triggered signal and multiple entropy evidences. In some such examples, the verification process 412 includes evaluating the (QRBS) 409 using each entropy evidence until the (QRBS) 409 satisfies an entropy condition associated with the entropy evidence. In some such examples, the at least two entropy evidences may be associated with substantially equal entropy levels. In some such examples, the at least two entropy evidences may be associated with different environmental conditions.

[0088] In some implementations, the multiple entropy evidences may be sorted based on corresponding entropy levels to form a sorted set of entropy evidence groups. Thus, in an operating mode of the apparatus 10, 500, or system 400, the statistical test 24 or evidence verification process 412, 512 may evaluate a QRBS received from a quantum device using a first entropy evidence of the sorted group, a second entropy evidence of the sorted group if the QRBS does not meet the entropy level of the first entropy evidence, and continuing the evaluation process using subsequent entropy evidences of the ordered groups until the QRBS meets the entropy level of the entropy evidence. In some examples, the entropy evidence associated with the highest level of entropy may be placed first in the sorted group, followed by the remainder of the entropy evidence in descending order.

[0089] Therefore, the rate of certified quantum random number generation may be determined by the initial proof that the entropy level is met by the QRBS, which means that the overall rate of certified random number generation may be improved.

[0090] In some cases, the aging of the quantum devices of the apparatus 10 may be monitored by monitoring the validation rate of received QRNs by statistical tests 24, for example, the validation rate may decrease as a function of the total operating time of the apparatus 10. In some such cases, such a decrease may indicate that classical stochastic phenomena become more prominent and dominant when the apparatus 10 is functioning, thereby potentially decreasing the rate at which post-quantum cryptographic keys can be generated from the apparatus 10. Other parameters may alternatively or additionally be used to monitor the apparatus 10, for example: (i) the laser output power used in the quantum device; (ii) photodetector noise when no photons are received within the quantum device (e.g., when the laser 25 or photon source 507a is turned off); and (iii) Changes in the spectral distribution of noise occurring in quantum devices, for example changes in the spectral distribution of noise in a laser output.

[0091] Thus, in an embodiment, multiple parameters may be monitored in device 10, each parameter affecting a different aspect of the certified random number or data key generation by device 10; for example, in some embodiments, some or all of the following parameters are monitored to verify correct operation of device 10: (i) aging of components used in device 10; (ii) the energy output of the laser 25 (or photon source 507a) decreasing as a function of time; (iii) The dark count of the detector, which increases as a function of time and is detected, for example, when the laser 25 (or photon source 507a) is turned off.

[0092] Optionally, the data interface and control unit 50 keeps a record of at least the measurements (i) to (iii) over time and performs statistical analysis of trends or compares to acceptable thresholds as it monitors the operation of the device 10 and generates a warning signal from the device 10 if the device 10 is potentially generating data keys with insufficient entropy.

[0093] In some embodiments, the control and processing system 60 or 520 may select an entropy evidence or a subset of entropy evidence from the sorted group of entropy evidence based at least in part on a monitoring signal related to one or more of the monitored parameters listed above. In some cases, the monitoring signal may include a sensor signal generated by a sensor (e.g., an environmental sensor).

[0094] Innovation 2: Seed generation for random sampling In some cases, the quantum random number generator may use a random “seed”, i.e., data corresponding to a small amount of initial near-perfect randomness, to generate a random number (RN) for random number extraction, for example, when random number extraction is performed in extractor 30 of device 10 (or extractor 516 of device 500).

[0095] This seed is used by extractor 30 (or extractor 516) during the randomness extraction step to randomize the process by randomly selecting a hash function to be applied to the output of the RNG. The hash function may be selected based on the value of the seed. The seed can be generated using an external high quality RNG and then hard-coded into the device, although in some applications it may be desirable to generate the seed internally within the device, mitigating the need for an external seed.

[0096] Aspects of the invention discussed herein include implementing a "quick-off mode" or "quick-off phase" in which the device generates a seed. In some cases, the device 10 or 500 may be operated in a quick-off mode during the manufacturing process to generate a seed random number that is hard-coded into the device 10 or 500. In some cases, operation of the device 10 or 500 may include a quick-off phase prior to the normal randomness generation phase in which the seeded random number generator uses the seed generated in the kick-off phase.

[0097] In some implementations, the seed is generated on apparatus 10 or 500 using a quantum device (optical system) of QRNG 20 or photonic quantum device 502, i.e., from the first few uses of the quantum device. To generate the seed, the quantum device is used multiple times initially, i.e., during a "quick-off" phase, i.e., a latency period after which the quantum device settles to generate quantum random data with large entropy.

[0098] During use of device 10 (or 500), the device is configured to perform a hard reset. After completing a "quick-off" phase, device 10 can generate a data key upon request from one or more users of device 10.

[0099] Optionally, the aforementioned "quick-off" phase is repeated to provide the extractor 30 (or extractor 516) with a new fresh seed, as opposed to having to input a pseudo-random seed from an external source to the device 10 (or 500), thereby making the device 10 (or 500) more robust in its operation against unauthorized third-party modification. Optionally, the extractor 30 (or extractor 516) is used to perform a seeded extractor function when generating the aforementioned data key using the seed generated during the aforementioned "quick-off" phase. However, it is understood that other types of extractors may be used in the device 10 (or 500) instead of or in addition to the Dodis extractor, e.g., as an alternative to using the Dodis extractor protocol, a Diffie-Hellman extractor protocol is optionally used in the extractor 30 (or 516). In some cases, the same type of extractor protocol may be used both when generating seed data during the "quick-off" phase and when generating certified random numbers, but with different parameters. In some cases, the device's control and processing system may change parameters of the extractor algorithm to change the extractor 516 (or extractor 30) from a seed extractor during the normal (operating) phase to a two-source extractor during the quick-off phase.

[0100] 7 is a flow diagram illustrating an example process 700 that may be used by the control system 520 of the random number generator device 500 during a quick-off phase or mode to generate one or more seed random numbers for use during an operational phase of the device 500 to generate, for example, certified random numbers 530. The control system 520 executes the process 700 using various circuits, processors, non-transitory memory elements, and information / instructions stored therein.

[0101] In block 702, the control system 520 generates a first bit sequence using the quantum device 502. In some examples, the first bit sequence may include the n bits output from the measurement device 519. The first bit sequence may have a minimum entropy k1.

[0102] At block 704, the control system 520 resets the quantum device 502 to remove memory effects. In some cases, resetting the quantum device 502 may include turning off the quantum device 502 for a waiting period, e.g., the quantum device 502 may be powered off and turned on again after the waiting period. The waiting period may be long enough to erase data from a previous operation period (e.g., data or information left by the generation of the first bit string in block 702) and prevent such data from leaking into a subsequent operation.

[0103] In block 706, the control system generates a second bit string using the quantum device 502 (e.g., after possibly being reset). In some examples, the second bit string may include m bits output from the measurement device 519. The second bit string may have a minimum entropy k2. In some examples, m may be equal to n. In some examples, n and m are predetermined values ​​stored in a memory of the electronic device 504.

[0104] In some embodiments, the control system 520 may skip block 704 and generate the second bit sequence after generating the first bit sequence without allowing the quantum device 502 to rest.

[0105] At decision block 708, the control system 520 uses the evidence verification process 512 (e.g., an evidence verification algorithm implemented in the electronic device 504) to determine whether the minimum entropy (k1+k2) of the sum of the first bit string and the second bit string is greater than or equal to a threshold (k th) to determine whether k1+k2 is greater than k th If k is greater than k, the control system sends the first and second bit strings to the extractor 516 and the process 700 proceeds to block 710. th is effectively equal to n+k, k>0. k1+k2 is equal to k th If so, the process 700 returns to block 702 .

[0106] In some embodiments, the evidence verification process 512 uses one or more entropy evidences hard-coded into the electronic device 504. As with the operational phase, the entropy evidence used during the quick-off phase (or quick-off mode) may be selected from a plurality of entropy evidences hard-coded into the electronic device 504 based on a set of operational and / or environmental conditions of the quantum device 502. In some cases, at least a portion of the entropy evidence used during the quick-off phase (or quick-off mode) can be the same as the entropy evidence used during the operational phase. In some cases, one or more entropy evidences may be dedicated to the quick-off phase operation. For example, the entropy evidence hard-coded into the device may include an entropy evidence used exclusively during the quick-off phase and an entropy evidence used exclusively during the normal phase. Advantageously, using a dedicated entropy evidence during the quick-off phase may improve the efficiency and / or reliability of the resulting random seed number.

[0107] In block 710, the control system 520 configures the extractor 516 as a two-source extractor. For example, the control system 520 may modify one or more parameters of the extractor algorithm or execute a dedicated two-source extractor algorithm using the computational resources of the electronic device 504. The two-source extractor is configured to generate (extract) a random number using two input random numbers. The two-source extractor 516 then generates a third bit string using the first bit string and the second bit string received from the evidence verification 512. In some examples, the third bit string may be a near-perfect random bit string with a minimum entropy that exceeds the minimum entropy of the first bit string and the second bit string. The control system 520 stores the third bit string in a non-transitory memory (e.g., a memory associated with the evidence verification) and the process proceeds to block 712.

[0108] At decision block 712, the control system determines whether the number of near perfect random bit sequences generated by quantum device 502 and stored in electronic device 504 exceeds a threshold number (N th ) or more. The number of nearly perfect random bit sequences is determined based on the threshold number (N th ), the process 700 proceeds to block 714. If the number of near perfect random bit sequences is N th If so, the process returns to block 702. th may be determined based on a selected security parameter of the near perfect output bits. th may be limited by the computational power of the electronic device 504. In some cases, N th may be determined based on the time interval over which the number of random seeds generated by process 700 may be used in device 500. For example, a seed of size 4096 may be reliable for 50 days of operation, but if the device must operate for 10 years without receiving a new number of seeds, 73 seed random numbers of size 4096 may be required. th1000 to 5000, 5000 to 10 3 Up to 10 3 From 5×10 3 Up to 5×10 3 From 10 4 Up to 10 4 From 10 5 Up to 10 5 From 10 6 It can be up to or even greater.

[0109] In some implementations, the steps described above with respect to blocks 702 through 712 may be repeated M times before the process proceeds to block 714. In some examples, M may be greater than or equal to N th / k is possible.

[0110] In block 714[6], the control system 520 generates a seed random number 514 using at least a portion of the near-perfect random bit string and stores the seed random number 514 in non-transitory memory of the electronic device 504 for use during an operational phase or mode.

[0111] Advantageously, resetting the system at block 504 may enable the use of a Markov model extractor 30. In some examples, the extractor 516 (e.g., when configured as a two-source extractor) may be a "Dodis extractor." Examples of such extractors are discussed in "Practical randomness amplification and privatization with implementations on quantum computers," 2009, arXiv:2009.06551v2.

[0112] In some cases, if the third sequence is a nearly perfectly random bit sequence, n can be as large as 10. 4 Greater than or equal to 10 5 Greater than or equal to 10 6In some cases, n may be limited by the extractor 516. In some such cases, the extractor 516 may be executed by a processor of a computing system separate from the electronic device 504 of the apparatus 500, for example, to enable the extraction of the third random bit sequence from the large first and second bit sequences. Such a computing system may have higher computing power compared to the electronic device 504 (e.g., FPGA) of the apparatus 500. In some cases, the computing system may include a notebook, a personal computer, a notepad, or other computing system. In some cases, the computing system may be connected to the apparatus 500 via a wired or wireless data link.

[0113] In some implementations, to generate a large seed random number, e.g., a seed number large enough to enable the use of a Dodis extractor during the operational phase, the above-mentioned quick-off phase may be used during the manufacturing phase (or recalibration phase) of the device 500 to generate such a large seed random number, which is then hard-coded into the electronic device 504 of the device 500 for use during the life of the device 500.

[0114] In some implementations, the device 500 may be configured in a quick-off mode to generate one or more seed random numbers. 4 Bits or greater than 10 5 bits or greater than 10 6The random numbers may be connected to a computing system for generating seed random numbers larger than 1000 bits. These seed random numbers may be stored or hard-coded in one or more random generators similar to the device 500 so that they can be used to generate certified random numbers 530 in normal mode without the need for any quick-off phase. Such device operation may be referred to as randomness amplification or multi-source extraction. Thus, the random numbers generated using the device 500 in quick-off mode may replace the cryptographic seed 414 of the system 400 or device 500 to eliminate the need for a cryptographic seed generated by a classical computing system or the need to interrupt the operation of the device to switch to a quick-off phase.

[0115] Innovation 3: Light source manufacturing, calibration, and qualification During manufacture of the apparatus 10, 500, or optoelectronic system 600, the laser 25 (or photon source 507a) may be characterized using a number of methods to ensure that the laser 25 (or photon source 507a) is functioning in a manner that enables the QRNG 20 or photonic quantum device 502 to generate quantum random bit strings, where the randomness is associated with quantum events, using the preparation and measurement methods described above.

[0116] In some implementations, during the manufacturing process and / or recalibration of the apparatus 10, 500, or optoelectronic system 600, the light source may be calibrated and certified at the factory for use in the quantum device used to generate the quantum random bit sequence (e.g., to be used as the light source 506 of the photonic quantum device 502 or the light source of the optical system 22 of the QRNG 20). As described above, the light source may include a photon source and an optical link, which transmits at least a portion of the light generated by the photon source to a photodetector of the quantum device. For calibration and certification, the light source may be optically connected to a trusted photodetector. In some cases, the trusted photodetector (also referred to as a trusted detector) may be a detector dedicated to the calibration and certification of the light source of the quantum device used to generate the quantum random bit sequence. It will be understood that the trusted detector is meticulously calibrated. In some embodiments, the trusted photodetector may be mechanically, thermally, electromagnetically, electrically, or magnetically isolated from the surrounding environment. Alternatively or additionally, the trusted photodetector may be protected from tampering by an adversary. Thus, the detection signal (e.g., photocurrent) generated by the reliable photodetector may not be affected by any parameters other than the light received by the light source, or possibly changes or effects related to the internal circuitry of the photodetector. In some cases, the reliable photodetector may be battery powered to electrically isolate the reliable photodetector. In some cases, the use of such a reliable detector may be limited to the manufacturing process of the device 10, 500, or optoelectronic system 600, and the reliable photodetector may not form an integral part of the device 10, 500, or optoelectronic system 600.

[0117] In some embodiments, the trusted detector may be optically connected or coupled to laser 25 (or photon source 507a) of optical system 22 (or photonic quantum device 502) of QRNG 20 without the use of any lens disposed between the laser 25 (or photon source 507a) and the trusted detector. In some cases, the trusted detector may be optically connected to laser 25 (or photon source 507a) of optical system 22 (or photonic quantum device 502) of QRNG 20 via optical path 110A (or optical link 507b) that is also used to optically connect laser 25 (or photon source 507a) to detector 120A (or photodetector 508) after a calibration and qualification process. In various implementations, an optical link (e.g., optical path 110A or optical link 507b) used to transmit light generated by a photon source (e.g., laser 25 or photon source 507a) to a trusted detector may include optical connectors (e.g., fiber optic connectors), optical attenuators, and / or optical fibers (e.g., single mode fiber optic waveguides). Such optical links may be configured to attenuate the light (light beam) generated by the photon source such that the power of the light (light power) received by the trusted photodetector is 1 to 3 dB, 3 to 6 dB, 6 to 10 dB, 10 to 15 dB, 15 to 20 dB, 20 to 25 dB, 25 to 30 dB, or any range formed by these values, or a value greater or less than the power of the light generated by the photon source. In various implementations, the optical link (e.g., optical path 110A or optical link 507b) used to transmit light generated by a photon source (e.g., laser 25 or photon source 507a) to a reliable detector may include an optical connector (e.g., a fiber optic connector), an optical attenuator (e.g., a tunable attenuator), and / or an optical fiber (e.g., a single mode fiber optic waveguide). The attenuation of the optical link may be tunable or adjustable by a user.In some examples, the optical attenuation through the optical link may be associated with insufficient coupling of the laser 25 (or photon source 507a) to the optical fiber used when calibrating the light source during the manufacturing process and also used during operation of the apparatus 10, 500, or optoelectronic system 600. This type of optical attenuation may reduce the complexity of the light source and its susceptibility to misalignment and environmental disturbances. In some cases, the optical link between the photon source and the trusted detector (and between the photon source and the photodetector after calibration) may include an optical attenuator and an optically absorptive filter. In some such cases, the optical attenuation of the optical link may be adjusted by selecting a different fixed attenuator or by changing the attenuation of a tunable optical attenuator. After adjusting the attenuation of the optical link, the optical link may be carefully disconnected from the trusted photodetector and connected to the photodetector of the quantum device, while avoiding all changes in the optical link that may cause changes in the attenuation of the optical link, so that for a given setting of the photon source, the optical power received by the detector of the quantum device is substantially equal to the optical power received by the trusted photodetector at the factory.

[0118] As mentioned above, the level of attenuation of light from laser 25 (or light source 506) to a reliable detector may be designed or adjusted so that the quantum state of the light received by the photodetector satisfies energy type constraints, such as having a minimum overlap with the vacuum state.

[0119] In some implementations, the light source calibration and qualification process may include adjusting the power of light output by the light source (light power received by the trusted photodetector) using the trusted photodetector such that the light received by the trusted photodetector satisfies the energy type constraint. In some cases, measuring the detection signal generated by the trusted detector during a measurement period may be used to evaluate the quantum state of the light received by the trusted photodetector to determine whether the quantum state satisfies the energy type constraint. Advantageously, switching the trusted detector with a photodetector (e.g., photodetector 508) used in the apparatus 10, 500, or optoelectronic system 600 without changing components between the photon source and the photodetector can ensure that the light received by the photodetector in the quantum device (e.g., photonic quantum device 502, or QRNG 20) satisfies the energy type constraint.

[0120] Preferably, in the apparatus 10, 500, or optoelectronic system 600, the laser 25 (or photon source 507a) is temperature controlled by using a temperature sensing feedback loop as described above, for example the laser 25 (or light source 506) is attached to a Peltier thermoelectric element and has a temperature sensor coupled to a feedback loop which maintains the laser 25 (or light source 506) at a constant temperature when in operation, alternatively the laser 25 (or photon source 507a) is operated at a constant temperature slightly higher than the ambient temperature of the apparatus 10, 500, or optoelectronic system 600. Optionally, the laser 25 (or photon source 507a) may be operated in a triggered pulse mode in the device 10, 500, or optoelectronic system 600 rather than a continuous operation mode; such a method of operation may enable the device 10, 500, or optoelectronic system 600 to generate a QRBS based on a preparation and measurement protocol, for example, in situations where the device 10, 500, or optoelectronic system 600 is battery powered (such as a portable device), while reducing power consumption within the device 10, 500, or optoelectronic system 600.

[0121] In some cases, the current provided to the photon source 507a (e.g., a laser) to generate light may be substantially equal to a critical current of the photon source 507a. In some cases, the current provided to the source 507a may be adjusted such that a characteristic of the light output by the photon source 507a meets a threshold condition. In some examples, the characteristic may include a noise level (e.g., relative intensity noise) or a coherence level, and the threshold condition may include a threshold noise level or a threshold coherence level.

[0122] In some implementations, the calibration and qualification process may include using a photodetector to measure a portion of the light received by the trusted photodetector while controlling the photon source with a trigger signal. In some examples, the trigger signal may include a sequence (e.g., a random sequence) of on / off signals that cause the light source to generate multiple light pulses during a measurement period. In some cases, the photon source can be a pulsed light source configured to generate a light pulse upon receiving an on signal. In some cases, the trigger signal used during the measurement period can be a pseudorandom bit string, and each light pulse generated by the photon source may be triggered with a bit of the pseudorandom bit string. The trusted photodetector receives the multiple light pulses and generates multiple detection signals, each signal indicating the detection of at least one photon. Using the trigger signal (indicative of an expected temporal distribution of light pulses) and the multiple detection signals (indicative of photon detection events), a probability (e.g., average probability) of occurrence of a photon detection event with and without a light pulse may be determined. For example, the pseudorandom bit string used to generate the light pulses may be used to determine the average probability of photon detection for the resulting light pulses.

[0123] This probability may then be used to determine the overlap of the quantum state of the light pulse generated by the light source with the vacuum state (an example of testing an energy-type constraint). Advantageously, this approach does not require photon counting, as the number of photons detected in each photon detection event is not required for the probability calculation.

[0124] Other energy type constraints on the light source can also be tested using a reliable detector that receives light from the photon source via an optical link. For example, in some cases, a reliable detector may be used to measure the average photon number of multiple light pulses generated by the light source (triggered by a trigger signal) during a measurement period. In some cases, an upper limit on the measured average photon number may be used to determine that the quantum state of light (output by the light source) received by the photodetector satisfies the energy type constraint (in this case the number of photons).

[0125] In some cases, in response to determining that a portion of the light received by the trusted photodetector during a first measurement period does not satisfy a selected energy-type constraint, a user or an automated system may adjust the optical link to attenuate a portion of the light received by the trusted photodetector. Then, during a second measurement period, the measurement process described above (e.g., with respect to overlap with a vacuum state) may be repeated to determine whether the quantum state of the portion of the light received by the photodetector after increasing the attenuation satisfies the energy-type constraint. This process may be repeated until the light output by the light source satisfies the energy-type constraint, and accordingly the light source may be certified for use in a quantum device (assuming no changes were made to the optical link during installation in the quantum device).

[0126] As discussed above, adjusting the optical link may include adjusting a level of optical attenuation of a tunable optical attenuator included in the optical link, or adjusting a level of optical attenuation or reducing an optical coupling at an optical junction (e.g., a connection or coupling to an optical fiber waveguide). In some cases, the qualified light source optical link may attenuate the light generated by the photon source by 1 to 3 dB, 3 to 6 dB, 6 to 10 dB, 10 to 15 dB, 15 to 20 dB, 20 to 25 dB, 25 to 30 dB, or any range formed by these values, or by a greater or lesser value.

[0127] In some cases, during manufacture of the apparatus 10, 500, or optoelectronic system 600, various properties of the light generated by the laser 25 (or photon source 507a) may be characterized. In some cases, the characterization may include measuring the statistics of the photons of the light generated by these sources. In some cases, the characterization may include measuring the degree of coherence of the light generated by these sources. In some cases, the characterization may include measuring the degree of coherence of the light generated by these sources.

[0128] In some implementations, the light source calibration and qualification process includes isolating the light source from all external perturbations (e.g., mechanical, electrical, magnetic, thermal, and electromagnetic) and characterizing the stability of the photon source (e.g., laser) by measuring the light detected by a reliable photodetector during a time interval. The stability of the photon source may include, for example, the stability of the wavelength, power, coherence properties, or polarization of the light generated by the photon source.

[0129] For example, the power fluctuation statistics or photon statistics of the laser may be measured during a stability test period, which may be, for example, 1 to 5 seconds. The results of the stability measurement are used to evaluate the validity of the maximum peak assumption.

[0130] Following this, the light generated by the light source may be characterized to test the energy-type constraints (e.g., overlap of the quantum state of the light with the vacuum state) over a range of environmental conditions (e.g., temperature) expected during operation of the light source in the quantum device of the random number generation apparatus. Some of the worst-case results (e.g., insufficient overlap with the vacuum) may then be used to design the random number generation protocol. For example, the entropy proof may be designed taking into account the worst-case results to lower the probability of rejecting the random qubit string in the entropy verification step. Furthermore, other aspects such as the size of the random qubit string or the parameters of the seed extractor may be selected based on the worst-case results obtained for the light source. As a result, in addition to adjusting the output of the light source according to the energy-type constraints, the light source calibration and qualification process allows the random number generation protocol as well as the corresponding processes (e.g., verification and extraction of randomness) to be tailored according to the characteristics of the particular light source. This differs from existing QRNGs, where the preparation of a particular quantum state is required by the random number generation protocol independent of the light source, which may potentially result in a lower rate of quantum random number generation.

[0131] In some implementations, the photon statistics may be characterized using a method described in "Reconstruction of photon-number distribution using low-performance photon counters" by G. Zambra and M. GA Paris, published in Physical Review A, Vol. 74, 063830, Dec. 27, 2006, referred to herein as "Zambra", the entire contents of which are incorporated herein by reference and made a part of this specification. In the Zambra method, when a laser beam is directed at a photodetector, the output of the photodetector includes a current pulse whose charge has the statistical distribution of the actual photon number convolved with a Bernoulli distribution. In the Zambra method, the inverse of the Bernoulli convolution may be performed by a maximum likelihood method aided by measurements made on the quantum efficiency of different detectors. The method can be used to show that a detector that can distinguish between zero detected photons, one detected photon, and two or more detected photons is generally sufficient to provide a reliable reconstruction of the distribution of photon numbers for single-peaked distributions. Furthermore, Zambra's method can identify that for quasi-classical states of light, even an on / off detector is sufficient to provide a good reconstruction. Finally, Zambra's method can show that reliable reconstruction of multi-peaked distributions requires either higher quantum efficiency or higher resolution.

[0132] In embodiments of the present disclosure, a simple "click / noclick" detector is advantageously used. Optionally, in embodiments of the present disclosure, it is feasible to distinguish between 0 photons and >1 photons.

[0133] In some cases, in apparatus 10, laser 25 is implemented as a self-pulsating laser; such an approach allows laser 25 to limit its own pulse power, thereby giving laser 25 greater operational stability.

[0134] In various implementations described above, the photon sources used in the optics (photonic systems) of the apparatus 10, 500, system 400, and optoelectronic system 600 may include incoherent light sources, or light sources having optical coherence less than that of a laser beam. For example, the photon source 507a may include a light emitting diode (LED) or other light source that generates photons primarily by spontaneous emission.

[0135] Energy-like constraints on light sources Device-independent (DI) protocols provide cryptographically secure protocols for quantum random number generation. Besides a minimal set of assumptions about the physical implementation (e.g., that the device is shielded), these protocols may not require characterization of the quantum device (e.g., the quantum device used for quantum random number generation) since the security and privacy of the resulting quantum random numbers may not be affected by parameters other than those related to the statistics of the quantum device's output (e.g., the statistics of photons in the photon stream output by a quantum optical device). On the downside, device independence requires the use of entanglement-based protocols that are experimentally demanding and provide a very low rate of certified entropy, if any at all.

[0136] The random number generation system described above works based on a semi-device-independent (SDI) approach to quantum random number generation, and by imposing appropriately selected additional physical assumptions on the devices (e.g., quantum devices) of the system, most of the security benefits of the DI approach may be maintained without the use of quantum entanglement or certain other features that limit the practical use of the corresponding protocols due to challenges related to the physical implementation of those features. An exemplary SDI approach used in the apparatus 10, 500, the system 400, and the optoelectronic system 600 is a preparation and measurement approach in which a quantum state is prepared and then measured to generate a quantum event or random qubit. In the preparation and measurement approach, the preparation (e.g., preparation of a photon stream) includes limited energy-type constraints (e.g., energy, photon number, overlap with vacuum) on the quantum state prepared by the source (e.g., laser) of the quantum device. In contrast to the constraints considered in some other approaches, e.g., the assumption that the state belongs to a finite-dimensional Hilbert space, the energy-type constraints can be experimentally monitored, providing a high level of confidence in the validity of the assumptions. Advantageously, this approach leaves the component most susceptible to adversary attack, the measurement device (eg, photodetector), uncharacterized.

[0137] In particular, the above-mentioned apparatus 10, 500, system 400, and optoelectronic system 600 may implement an on-off modulation (OOK) protocol using a quantum device consisting of a light source (e.g., laser) with two preparation modes (vacuum or coherent state) and a single photon detector (SPD) that either detects a photon or not. This is one of the simplest quantum devices that allows to qualify randomness (e.g., quantum randomness) in a quasi-device-independent manner. The selection of the preparation is performed independently of the quantum device using the output of a biased pseudorandom number generator (PRNG), making this a randomness-enhanced protocol.

[0138] In some implementations, the preparation device, the “source” (e.g., a light source) and the measurement device, the “detector” (e.g., a photodetector), are connected via a quantum channel (optical link) but do not share any entanglement. The source and the detector are only allowed to communicate through the quantum channel. In some cases, the source takes an input x ∈ {0, 1} selected independently from the source and the detector and generates one of two possible quantum states ρ χ These systems are sent to a detector where a measurement M with two possible outcomes a∈{-1, 1} is performed.

[0139] The probability of getting outcome a by choosing preparation x over many uses of the device may be expressed as p(a|x). In correlation space (which is equivalent to probability space since a is binary), the expected (statistical) value of the outcome for each preparation x may have the following form: E x = p(1|x) - p(-1|x) (1)

[0140] Equation 1 quantifies the bias of the outcome towards one of the two outputs. In a completely device-agnostic scenario that does not make any assumptions about the internal functionality of the device, the correlation E x This means that if the source can send a selection of preparations x to the detector, any set of E can be obtained by a deterministic response function. x can be obtained, which depends on classical randomness shared by the detector and the adversary. Although seemingly random, the output from the detector is then perfectly predictable by the adversary.

[0141] Correlation E allowed for deterministic strategies xTo find a separation between the set of θ and the set of quantum strategies, an assumption can be added that the source prepares a state that has finite expectation with respect to a given observable O. The observable O satisfies the following two conditions: i. O has a non-degenerate ground state ii. O has a finite gap between the ground state and the next eigenstate

[0142] Without loss of generality, it may be assumed that the eigenvalues ​​associated with the ground state have value 0 and the gap is 1. Examples of such observables are energy, photon number, or overlap with the vacuum, which may be experimentally controlled and characterized. In some cases, the observable O may be called an energy observable. Appropriate bounds on the expectation value of O with respect to the prepared state may prevent the source from sending a choice of input x to the detector.

[0143] In some cases, users of quantum devices may ω x = Tr(ρ x O) (2) can be accessed.

[0144] An adversary with access to classical side information, denoted by a random variable Λ distributed on p(λ), can determine the average energy

number

number

[0145] The maximum peak assumption further imposes an upper bound on the average energy observed by the adversary.

number

[0146] The maximum average assumption represents a lighter physical assumption about the source, i.e., the user can check its validity by measuring the energy of preparation x over a sufficient number of rounds with a reliable detector. The maximum peak assumption requires having precise knowledge of the internal functioning of the source in order to impose an absolute limit on the energy of the states prepared by the source. It is possible to test and verify the validity of the maximum peak assumption for a given source (e.g., a light source such as a laser) by characterization of the source using a reliable detector.

[0147] Advantageously, the maximum peak assumption allows for the qualification of randomness in cases where it may not be possible to do so under the maximum average assumption. An example is the case of the on-off keying (OOK) scheme used in the random number generation system described above.

[0148] One of the challenges in implementing an OOK scheme can be to ensure that the maximum peak assumption holds. This condition states that for a given power input, source (laser) temperature, and other source parameters, the average energy of any state prepared by the source is

number

[0149] Exemplary embodiments Various additional exemplary embodiments of the present disclosure may be illustrated by the following examples.

[0150] Group 1 Example 1. An apparatus for generating certified random numbers, the apparatus being a self-contained hardware unit configured to operate substantially at room temperature, the apparatus including a quantum random number generator including a quantum device for generating a quantum random bit sequence, an extractor for generating certified random numbers using the quantum random bit sequence, and a control and processing unit configured to control and monitor the operation of the apparatus.

[0151] Example 2. 2. The apparatus of example 1 configured to generate data keys including post-quantum cryptographic keys.

[0152] Example 3. The apparatus of Examples 1 or 2, wherein the quantum random number generator is implemented using a laser that generates photons, an optical mechanism configured to couple a portion of the photons from the laser to a detector mechanism, and a processing mechanism for processing signals from the detector mechanism, wherein the optical mechanism is configured with the detector mechanism to create conditions for single-photon quantum events in a spatial or temporal form, the detector mechanism is configured to detect the events, and the processing mechanism is configured to apply a statistical test to verify a level of entropy of the detected events.

[0153] Example 4. The apparatus of Example 3, wherein the statistical testing includes assessing the level of entropy of the event using evidence of entropy hard-coded into the apparatus.

[0154] Example 5. The apparatus of example 3 or 4, wherein the laser is implemented as a pulsed laser.

[0155] Example 6. The apparatus of any one of Examples 1 to 5, wherein the extractor is implemented as a Dodis extractor.

[0156] Example 8. The apparatus of any one of the preceding examples, wherein the apparatus is configured to switch from an operational phase when it outputs a data key to a "quick-off" phase in which the quantum device is used to generate seeds for use in a seeded random number generator.

[0157] Example 9. The apparatus of any one of the preceding examples, wherein data processing required for the apparatus to function when in use is implemented using at least one FPGA.

[0158] Example 10. 1000cm 3

[0023] The apparatus of any one of the preceding examples implemented using hardware that can be contained in a volume of less than

[0159] Example 11. The device of any one of the preceding examples, wherein the device is configured to consume less than 10 watts when in operation.

[0160] Example 12. 1. A method of using an apparatus for generating certified random numbers, the apparatus being a self-contained hardware unit configured to operate at room temperature, the method comprising: (a) configuring an apparatus to include a quantum random number generator including a quantum device for generating a quantum random bit sequence; (b) using an extractor to generate certified random numbers using the quantum random bit sequence; (c) using the control and processing unit to control and monitor operation of the apparatus.

[0161] Example 13. 13. The method of example 12, comprising configuring an apparatus to generate a random number as the post-quantum cryptographic key.

[0162] Example 14. A method of using the device of example 12 or 13, comprising the steps of: Example 15. Implementing a quantum random number generator using a laser to generate photons; Example 16. coupling a portion of the photons from the laser (25) to a detector mechanism using an optical mechanism; Example 17. processing a signal from the detector mechanism using a processing mechanism, the optical mechanism being configured with the detector mechanism to create conditions for single photon quantum events in a spatial or temporal regime; Example 18. detecting the events using a detector mechanism and generating a sequence of quantum random bits using the events; and Example 19. using a processing mechanism to apply a statistical test to verify that the quantum random bit string satisfies a minimum entropy condition associated with a proof of entropy stored in the processing mechanism.

[0163] Example 20. A machine-readable data storage medium comprising specific instructions executable in data processing hardware, the instructions, when executed by the data processing hardware, performing the method of any one of Examples 13 to 15.

[0164] Group 2 Example 1. 1. An apparatus for generating certified random numbers based at least in part on quantum events, comprising: a quantum device configured to generate quantum events; A classical computing device in communication with a quantum device, the classical computing device including a control and processing system, the control and processing system being in communication with a memory configured to store specific computer-executable instructions, and the control and processing system being configured to execute the specific computer-executable instructions to perform at least: Using a quantum device to generate a quantum random bit sequence; determining an entropy level of the quantum random bit string using the multiple entropy proofs; and a classical computing device including a hardware processor configured to generate certified random numbers using the quantum random bit string in response to determining that an entropy level of the quantum random bit string is higher than an entropy level associated with an entropy evidence among the plurality of entropy evidences.

[0165] Example 2. The apparatus of Example 1, wherein the control and processing system uses a pseudorandom number generator implemented in a classical computing device to trigger a series of preparatory steps in a quantum device and a corresponding series of measurement steps to generate a quantum random bit string.

[0166] Example 3. The apparatus of Example 2, wherein the control and processing system determines an entropy level of the quantum random bit sequence based at least in part on a pseudorandom number generated by the pseudorandom number generator.

[0167] Example 4. The apparatus of any one of Examples 1 to 3, wherein the plurality of entropy proofs comprises a sorted set of entropy proofs sorted in descending order of entropy with respect to corresponding entropy levels.

[0168] Example 5. The apparatus of example 4, wherein the control and processing system determines an entropy level of the quantum random bit string by sequentially testing the quantum random bit string against the entropy proofs of the sorted set, starting with a first entropy proof associated with the highest entropy level in the sorted set.

[0169] Example 6. The apparatus of any one of Examples 1 to 5, wherein the plurality of entropy evidences includes at least two entropy evidences having substantially the same entropy level.

[0170] Example 7. The apparatus of any one of Examples 1 to 6, wherein the control and processing system tests the quantum random bit string against a plurality of entropy evidences and determines that an entropy level of the quantum random bit string is higher than an entropy level associated with an entropy evidence among the plurality of entropy evidences.

[0171] Example 8. The apparatus of any one of Examples 1 to 7, wherein individual entropy proofs of the multiple entropy proofs are associated with different states of the quantum apparatus.

[0172] Example 9. The apparatus of any one of Examples 1 to 8, wherein the quantum device comprises a photonic system including a light source configured to generate light and a photodetector configured to receive the light generated by the light source and generate a quantum event.

[0173] Example 10. The apparatus of example 9, wherein the light source includes an optical link configured such that light received by the light detector satisfies an energy type constraint.

[0174] Example 11. The apparatus of example 10, wherein the light source is qualified using a calibration and qualification process that includes adjusting the optical link such that the light received by the light detector satisfies an energy type constraint.

[0175] Example 12. 12. The apparatus of example 11, wherein the energy type constraint comprises a lower limit on the overlap between the quantum state of the light generated by the light source and a vacuum state.

[0176] Example 13. 13. The apparatus of any one of Examples 1 to 12, further comprising a sensor configured to generate a sensor signal indicative of a state of the quantum device, and wherein the control and processing system generates the certified random number based at least in part on the sensor signal.

[0177] Example 14. The apparatus of Example 13, wherein the control and processing system rejects the quantum random bit string in response to determining that the sensor signal indicates that the state of the quantum device deviates from a predefined state by a threshold amount.

[0178] Example 15. The apparatus of any one of Examples 13 or 14, wherein in response to determining that the sensor signal indicates that the state of the quantum device deviates from a predefined state by a threshold amount, the control and processing system generates a warning message via a user interface of the apparatus.

[0179] Example 16. 16. The apparatus of any one of examples 13 to 15, wherein the state of the quantum device includes an environmental condition of the quantum device.

[0180] Example 17. 17. The apparatus of any one of examples 13 to 16, wherein the state of the quantum device includes a temperature of the quantum device.

[0181] Example 18. The apparatus of any one of Examples 1 to 17, wherein the classical computing device includes a single electronic board including at least a field programmable gate array.

[0182] Example 19. The apparatus of any one of Examples 1 to 17, wherein the control and processing system uses a random number extractor implemented in a classical computing device to extract certified random numbers using quantum random bit strings.

[0183] Example 20. The apparatus of Example 19, wherein the random number extractor is a Dodis extractor.

[0184] Example 21. 21. The apparatus of any one of examples 19 or 20, wherein the random number extractor is a seeded extractor.

[0185] Example 22. 22. The apparatus of example 21, wherein the seed random number used by the random number extractor is a cryptographic random number hard-coded into the classical computing system.

[0186] Example 23. The apparatus of Example 19, wherein the control and processing system operates the apparatus in a kick-off mode to generate seed random numbers used by the random number extractor during a period after generation of the certified random quantum numbers.

[0187] Example 24. The apparatus of example 23, wherein in a kick-off mode, the control and processing system uses the quantum device to generate two quantum random bit strings and operates the random number extractor as a two-source random number extractor to generate a seed random number using the two quantum random bit strings.

[0188] Example 25. 25. The apparatus of any one of Examples 1 to 24, which is a self-contained hardware unit configured to operate at substantially room temperature.

[0189] Example 26. 1. A method of generating certified random numbers based at least in part on quantum events, comprising: using a quantum device configured to generate a quantum random bit sequence; determining an entropy level of the random bit string using the multiple entropy proofs; and generating certified random numbers using the quantum random bit string in response to determining that the entropy level of the quantum random bit string is higher than an entropy level associated with an entropy evidence among the plurality of entropy evidences.

[0190] Example 27. 27. The method of Example 26, wherein determining an entropy level of the quantum random bit string comprises testing the quantum random bit string against an entropy evidence of the plurality of entropy evidences and determining that the entropy level of the quantum random bit string is higher than an entropy level associated with the entropy evidence of the plurality of entropy evidences.

[0191] Example 28. 28. The method of any one of Examples 26 or 27, wherein the plurality of entropy proofs comprises a sorted set of entropy proofs sorted in descending order of entropy with respect to corresponding entropy levels.

[0192] Example 29. 29. The method of Example 28, wherein the step of determining an entropy level of the quantum random bit string comprises sequentially testing the quantum random bit string against the entropy proofs of the sorted set, starting with a first entropy proof associated with a highest entropy level in the sorted set.

[0193] Example 30. 30. The method of any one of Examples 26 to 29, wherein individual entropy proofs of the multiple entropy proofs are associated with different states of the quantum device.

[0194] Example 31. 30. The method of any one of Examples 26 to 29, wherein the quantum device comprises a photonic system including a light source configured to generate light and a photodetector configured to receive the light generated by the light source and generate a quantum event.

[0195] Example 32. The method of example 31, wherein the light source includes an optical link configured such that light received by the light detector satisfies an energy type constraint.

[0196] Example 33. The method of Example 32, wherein the light source is qualified using a calibration and qualification process that includes adjusting the optical link such that the light received by the light detector satisfies an energy type constraint.

[0197] Example 34. 34. The method of any one of examples 32 or 33, wherein the energy type constraint includes a lower limit on the overlap between the quantum state of the light generated by the light source and a vacuum state.

[0198] Example 35. 1. A method of calibrating and qualifying a light source for use in a quantum device for generating a quantum random bit sequence, the light source including a photon source and an optical link, the optical link transmitting at least a portion of the light generated by the photon source to a photodetector, the method comprising: measuring, using the photodetector, a portion of the light received by the photodetector while controlling the photon source with the first trigger signal to determine a quantum state of the portion of the light received by the photodetector with respect to an energy type constraint; adjusting the optical link to attenuate the portion of the light received by the optical detector in response to determining that the portion of the light received by the optical detector does not satisfy the energy type constraint; measuring, using the photodetector, the attenuated portion of the light received by the photodetector while controlling the photon source with the second trigger signal to determine a quantum state of the attenuated portion of the light received by the photodetector with respect to an energy type constraint; and certifying the light source for use in the quantum device in response to determining that the portion of the light received by the light detector or the attenuated portion satisfies the energy type constraint.

[0199] Example 36. 36. The method of example 35, wherein the optical link includes an optical attenuator, and adjusting the optical link includes adjusting a level of optical attenuation of the optical attenuator.

[0200] Example 37. 36. The method of any one of Examples 34 or 35, wherein the optical link includes a fiber optic waveguide, and adjusting the optical link includes adjusting a level of optical attenuation in an optical connection to the fiber optic waveguide.

[0201] Example 38. The method of any one of Examples 35 to 37, wherein the attenuated portion of the light received by the photodetector is attenuated by at least 10 dB relative to the light generated by the light source.

[0202] Example 39. The method of any one of Examples 35 to 38, wherein the light generated by the photon source comprises at least one pulse of light.

[0203] Example 40. 40. The method of any one of Examples 35 to 39, wherein the step of measuring the portion or attenuated portion of the light received by the photodetector includes determining an overlap between a measured quantum state of the portion or attenuated portion of the light and a vacuum state.

[0204] Example 41. 41. The method of any one of Examples 35 to 40, wherein determining that the portion of light received by the photodetector or the attenuated portion satisfies the energy type constraint includes determining that a determined overlap between a measured quantum state of the portion of light or the attenuated portion and a vacuum state is greater than a minimum overlap.

[0205] Example 42. The method of any one of Examples 35 to 41, wherein the portion of the light received by the photodetector or the attenuated portion of the light comprises a plurality of pulses of light.

[0206] Example 43. The method of example 42, wherein the first trigger signal and the second trigger signal include a pseudorandom bit sequence and each optical pulse is associated with a bit of the pseudorandom bit sequence.

[0207] Example 44. 44. The method of example 43, wherein the step of measuring the portion or the attenuated portion of the light received by the photodetector includes determining an average probability of detecting a photon based at least in part on the corresponding pseudorandom bit sequence.

[0208] Example 45. The method of any one of Examples 35 to 44, wherein the optical detector is a trusted optical detector protected from tampering by an adversary.

[0209] Example 46. 47. The method of any one of Examples 35 to 46, further comprising the steps of decoupling the light source from the photodetector and connecting the light source to the photodetector of the quantum random bit generator (QRBG) quantum device.

[0210] Example 47. The method of any one of Examples 35 to 46, wherein the photodetector is mechanically, thermally, or electromagnetically, electrically, or magnetically isolated from the surrounding environment.

[0211] Example 48. 1. An apparatus for generating certified quantum random numbers in an operational mode and for generating seed random numbers in a kick-off mode, comprising: a quantum device configured to generate quantum events; 1. A classical computing device in communication with a quantum device, comprising: using a quantum device to generate a first quantum random bit sequence and a second quantum random bit sequence; generating a seed random number using the first quantum random bit sequence and the second quantum random bit sequence; generating a third quantum random bit sequence using a quantum device; a classical computing device including a control and processing system configured to generate certified random numbers using a third quantum random bit sequence and a seed random number; 13. An apparatus comprising:

[0212] Example 49. 49. The apparatus of example 48, wherein the control and processing system is further configured to verify an entropy level of the first bit string and the second bit string based on the entropy evidence before generating the seed random number.

[0213] Example 50. 50. The apparatus of any one of examples 48 or 49, wherein the control and processing system selects an entropy evidence from a plurality of entropy evidences.

[0214] Example 51. The apparatus of any one of Examples 48 to 50, wherein the control and processing system is further configured to reset the quantum device after generating the first quantum random bit sequence and before generating the second random bit sequence.

[0215] Example 52. 52. The apparatus of any one of Examples 48 to 51, wherein the control and processing system configures the random number extractor implemented in the classical computing system as a two-source extractor and provides the first quantum random bit sequence and the second quantum random bit sequence to the two-source extractor to generate the seed random number.

[0216] Example 53. The apparatus of example 52, wherein after generating the seed random number, the control and processing system configures the random number extractor as a seeded extractor for generating certified random numbers.

[0217] Example 54. The apparatus of any one of Examples 48 to 53, wherein the quantum device includes a light source configured to generate a photon stream and a photodetector configured to receive at least a portion of the photon stream via the optical link.

[0218] Example 55. The apparatus of example 54, wherein the light source and the optical link are configured such that the expectation value of the energy observables for the quantum state of the photon stream is bounded.

[0219] Example 56. 56. The apparatus of example 55, wherein the energy observables include energy, number of photons, or overlap with a vacuum state.

[0220] Example 57. 57. The apparatus of any one of examples 54 to 56, wherein the light source and the optical link are configured such that the overlap between the quantum state of the photon stream and the vacuum state is greater than a threshold.

[0221] Example 58. 1. A method for generating certified quantum random numbers in an operational mode and generating seed random numbers in a kick-off mode, comprising: generating a first quantum random bit sequence and a second quantum random bit sequence using a quantum device; generating a seed random number using a first quantum random bit sequence and a second quantum random bit sequence; generating a third quantum random bit sequence using a quantum device; and generating a certified random number using a third quantum random bit sequence and a seed random number.

[0222] Example 59. 59. The method of example 58, further comprising verifying an entropy level of the first bit string and the second bit string based on the entropy evidence prior to generating the seed random number.

[0223] Example 60. 60. The method of example 59, wherein verifying an entropy level of the first bit string and the second bit string further comprises selecting an entropy evidence from a plurality of entropy evidences.

[0224] Example 61. 61. The method of any one of Examples 58 to 60, further comprising resetting the quantum device after generating the first sequence of quantum random bits and before generating the second sequence of random bits.

[0225] Example 62. 62. The method of any one of Examples 58-61, wherein the step of generating a seed random number includes configuring the random number extractor as a two-source extractor and providing the first quantum random bit sequence and the second quantum random bit sequence to the two-source extractor to generate the seed random number.

[0226] Example 63. 63. The method of Example 62, wherein the step of generating the certified random numbers includes, after generating the seed random numbers, configuring the random number extractor as a seeded extractor, and generating the certified random numbers using the seeded extractor.

[0227] Example 64. The method of any one of Examples 62 or 63, wherein the random number extractor comprises a Dodis extractor.

[0228] term Modifications to the embodiments of the present disclosure described above are possible without departing from the scope of the disclosure as defined by the appended claims. Words such as "including," "comprising," "incorporating," "consisting of," "have," "is," and the like, used to describe and claim the present disclosure, are intended to be interpreted in a non-exclusive manner, i.e., allowing for the presence of items, components, or elements not expressly recited. References to the singular should also be interpreted as relating to the plural, for example, "at least one of" indicates "one of" in one instance and "multiple of" in another instance, and further "two of" and similarly "one or more" should be interpreted in a similar manner. Numerals contained within parentheses in the appended claims are intended to aid in the understanding of the claims and should in no way be interpreted as limiting the subject matter claimed by those claims.

[0229] The phrases "in an embodiment," "according to an embodiment," and the like generally mean that the particular feature, structure, or characteristic that follows the phrase is included in at least one embodiment of the present disclosure, and may be included in more than one embodiment of the present disclosure. Importantly, such phrases do not necessarily refer to the same embodiment.

[0230] The term "computer" or "computing-based device" is used herein to refer to any device that has processing capabilities such that it executes instructions. Those skilled in the art will understand that such processing capabilities are incorporated in many different devices, and thus the terms "computer" and "computing-based device" each include personal computers (PCs), servers, mobile phones (including smartphones), tablet computers, set-top boxes, media players, game consoles, personal digital assistants, wearable computers, and many other devices.

[0231] The methods described herein are performed in some examples by software in machine-readable form in a tangible, non-transitory storage medium, e.g., in the form of a computer program including computer program code adapted to perform one or more operations of the methods described herein when the program is run on a computer and when the computer program may be embodied in a non-transitory computer readable medium. The software is suitable for execution on a parallel or sequential processor such that the operations of the method may be performed in any suitable order or simultaneously.

[0232] This recognizes that software is a valuable, separately tradable commodity. It is intended to encompass software that runs on or controls "dumb" or standard hardware to perform a desired function. It is also intended to encompass software that "describes" or defines the configuration of hardware, such as HDL (Hardware Description Language) software used to design silicon chips or configure universal programmable chips to perform a desired function.

[0233] Those skilled in the art will appreciate that storage devices utilized to store program instructions are optionally distributed across a network. For example, a remote computer may store an example of a process written as software. A local or terminal computer may access a remote computer and download some or all of the software to execute the program. Alternatively, a local computer may download software as needed, or execute some software instructions at a local terminal and some at a remote computer (or computer network). Those skilled in the art will also appreciate that, by utilizing techniques known to those skilled in the art, all or some of the software instructions may be executed by dedicated circuitry, such as digital signal processors (DSPs), programmable logic arrays, and the like.

[0234] As will be apparent to one skilled in the art, all ranges or device values ​​given herein may be expanded or modified without losing the effect sought.

[0235] Although the subject matter has been described in language specific to structural features and / or method acts, it is to be understood that the subject matter defined in the appended claims is not necessarily limited to the specific features or acts described above. Rather, the specific features and acts described above are disclosed as example forms of implementing the claims.

[0236] It will be understood that the benefits and advantages described above may relate to one embodiment or may relate to several embodiments. The embodiments are not limited to those that solve any or all of the stated problems or that have any or all of the stated benefits and advantages. No single feature or group of features is necessary or essential to every embodiment.

[0237] In particular, conditional language used herein, such as "can," "could," "might," "may," "for example," and the like, unless specifically stated otherwise or understood otherwise within the context in which it is used, is intended to generally convey that certain embodiments include certain features, elements, and / or steps, while other embodiments do not include certain features, elements, and / or steps. Thus, such conditional language is generally not intended to suggest that features, elements, and / or steps are in any way required for one or more embodiments, or that one or more embodiments necessarily include logic for determining, with or without author input or prompting, whether those features, elements, and / or steps are included in or should be performed in any particular embodiment. The terms "comprising," "including," "having," and the like, are synonymous and used inclusively in an open-ended manner and do not exclude additional elements, features, actions, operations, blocks, and the like. Also, the term "or" is used in its inclusive (rather than its exclusive) sense, so, for example, when used to join a list of elements, the term "or" means one, some, or all of the elements in the list. Furthermore, the articles "a," "an," and "the" as used in this application and the appended claims should be construed to mean "one or more" or "at least one," unless expressly stated otherwise.

[0238] As used herein, a phrase referring to "at least one of" a list of items refers to any combination of those items, including single members. By way of example, "at least one of A, B, or C" is intended to encompass A, B, C, A and B, A and C, B and C, and A, B, and C. Conjunctive language such as "at least one of X, Y, and Z" is understood differently depending on the context, as it is used broadly to convey that an item, item, etc. may be at least one of X, Y, or Z, unless otherwise noted. Thus, such conjunctive language is generally not intended to suggest that a particular embodiment requires that at least one of X, at least one of Y, and at least one of Z, respectively, be present.

[0239] The actions of the methods described herein may be performed in any suitable order, or simultaneously where appropriate. Additionally, individual blocks may be deleted from any of the methods, combined with other blocks, or rearranged without departing from the scope of the subject matter described herein. Aspects of any of the above examples may be combined with aspects of any of the other examples described to form further examples without losing the desired effect.

[0240] It will be understood that the above description is given by way of example only, and various modifications may be made by those skilled in the art. The above specification, examples, and data provide a complete description of the structure and use of the exemplary embodiments. Although various embodiments have been described above in some detail, or with reference to one or more individual embodiments, those skilled in the art may make numerous modifications to the disclosed embodiments without departing from the scope of the present specification. [Explanation of symbols]

[0241] 10 equipment 20 Quantum Random Number Generator 22 Optical Systems (Quantum Devices) 24 Statistical Tests 25 Light source, laser 30 extractor 40 Pseudorandom number generator 50 Data processors and interfaces, data interfaces and control units 60 Control Systems, Control and Processing Systems 100 Beam splitter 110A First optical path A 110B Second optical path B 120A First detector A 120B Second detector B 200 Solid-state vibration sensor 210 Negative feedback loop amplifier 220 Actuator Mechanism 230A Piezoelectric Actuator 230B Electromagnetic Actuator 400 Systems 402 Quantum Devices 404 Classical Computing Devices 406 Preparation Process 407 Constrained Quantum States 408 Measurement Process 409 Quantum Random Bit String (QRBS) 410 Seeded Pseudo-Random Number Generator (PRNG) 411a First part of the trigger signal 411b Second part of the triggered signal 412 Evidence Verification Process 413 Verified QRBS 414 Seed Random Number 416 Seeded Randomness Extractor 418 Certified Random Numbers 500 Equipment, Process 502 Photonic Quantum Devices 504 Electronic Devices 506 Light source 507 Optical Attenuator 507a Photon Source 507b Optical Link 508 Photodetector 510 Pseudorandom number generator 512 Evidence Verification Circuit or Process 514 Seed Random Number 516 Extractor circuit, Randomness extraction process, Extractor 518 Preparation circuit 519 Measuring Circuits, Measuring Processes 520 Control and Processing Systems, Controlled Systems 530 Certified Random Numbers 600 Optoelectronic System 602 Electronic Board 603 Optical System 604 Power supply 608 Optical Connector Assembly 610 Optical Fiber 612 Environmental Sensor 700 processes

Claims

1. 1. An apparatus for generating certified random numbers based at least in part on quantum events, comprising: a quantum device configured to generate the quantum events; A classical computing device in communication with the quantum device, the classical computing device including a control and processing system, the control and processing system communicating with the memory and executing the specific computer-executable instructions to perform at least: generating a quantum random bit sequence using the quantum device; determining an entropy level of the quantum random bit string using a plurality of entropy proofs; In response to determining that the entropy level of the quantum random bit sequence is higher than an entropy level associated with an entropy evidence in the plurality of entropy evidences, generating the certified random number using the quantum random bit sequence. a classical computing device, the classical computing device including a hardware processor configured to 13. An apparatus comprising:

2. 2. The apparatus of claim 1 , wherein the control and processing system uses a pseudorandom number generator implemented in the classical computing device to trigger a series of preparatory steps in the quantum device and a corresponding series of measurement steps to generate the quantum random bit sequence.

3. 3. The apparatus of claim 2, wherein the control and processing system determines the entropy level of the quantum random bit sequence based at least in part on a pseudorandom number generated by the pseudorandom number generator.

4. 4. The apparatus of claim 1, wherein the plurality of entropy evidences comprises a sorted set of entropy evidences sorted in descending order of entropy with respect to corresponding entropy levels.

5. 5. The apparatus of claim 4, wherein the control and processing system determines the entropy level of the quantum random bit string by sequentially testing the quantum random bit string against the entropy evidences of the sorted set, starting with a first entropy evidence associated with a highest entropy level in the sorted set.

6. 6. The apparatus of claim 1, wherein the plurality of entropy evidences comprises at least two entropy evidences having substantially the same entropy level.

7. 7. The apparatus of claim 1, wherein the control and processing system tests the quantum random bit string against the plurality of entropy proofs and determines that the entropy level of the quantum random bit string is higher than an entropy level associated with an entropy proof in the plurality of entropy proofs.

8. 8. The apparatus of claim 1 , wherein each entropy evidence of the plurality of entropy evidences is associated with a different state of the quantum device.

9. 9. The apparatus of claim 1 , wherein the quantum device comprises a photonic system including a light source configured to generate light and a photodetector configured to receive the light generated by the light source and generate the quantum event.

10. The apparatus of claim 9 , wherein the light source includes an optical link configured such that the light received by the light detector satisfies an energy type constraint.

11. The apparatus of claim 10 , wherein the light source is qualified using a calibration and qualification process that includes adjusting the optical link such that the light received by the light detector meets an energy type constraint.

12. The apparatus of claim 11 , wherein the energy type constraint comprises a lower limit of overlap between a quantum state of the light generated by the light source and a vacuum state.

13. 13. The apparatus of claim 1, further comprising a sensor configured to generate a sensor signal indicative of a state of the quantum device, and wherein the control and processing system generates the certified random number based at least in part on the sensor signal.

14. 14. The apparatus of claim 13, wherein in response to determining that the sensor signal indicates that the state of the quantum device deviates from a predefined state by a threshold amount, the control and processing system rejects the quantum random bit sequence.

15. 15. The apparatus of claim 13 or 14, wherein in response to determining that the sensor signal indicates that the state of the quantum device deviates from a predefined state by a threshold amount, the control and processing system generates a warning message via a user interface of the apparatus.

16. 16. The apparatus of claim 13, wherein the state of the quantum device comprises an environmental condition of the quantum device.

17. 17. The apparatus of claim 13, wherein the state of the quantum device comprises a temperature of the quantum device.

18. 18. The apparatus of claim 1 , wherein the classical computing device comprises a single electronic board including at least a field programmable gate array.

19. 18. The apparatus of claim 1, wherein the control and processing system uses a random number extractor implemented in the classical computing device to extract the certified random number using the quantum random bit sequence.

20. 20. The apparatus of claim 19, wherein the random number extractor is a Dodis extractor.

21. 21. Apparatus according to claim 19 or 20, wherein the random number extractor is a seeded extractor.

22. 22. The apparatus of claim 21, wherein a seed random number used by the random number extractor is a cryptographic random number hard-coded into the classical computing system.

23. 20. The apparatus of claim 19, wherein the control and processing system operates the apparatus in a kick-off mode to generate a seed random number used by the random number extractor during a period following generation of a certified random quantum number.

24. 24. The apparatus of claim 23, wherein in the kick-off mode, the control and processing system uses the quantum device to generate two quantum random bit sequences and operates the random number extractor as a two-source random number extractor to generate the seed random number using the two quantum random bit sequences.

25. 25. The apparatus of any one of claims 1 to 24, wherein the apparatus is a self-contained hardware unit configured to operate at substantially room temperature.

26. 1. A method of generating certified random numbers based at least in part on quantum events, comprising: using a quantum device configured to generate a quantum random bit sequence; determining an entropy level of the quantum random bit string using a plurality of entropy proofs; generating the certified random number using the quantum random bit sequence in response to determining that the entropy level of the quantum random bit sequence is higher than an entropy level associated with an entropy evidence in the plurality of entropy evidences; A method comprising:

27. 27. The method of claim 26, wherein determining the entropy level of the quantum random bit string comprises testing the quantum random bit string against the entropy evidence of the plurality of entropy evidences and determining that the entropy level of the quantum random bit string is higher than an entropy level associated with an entropy evidence of the plurality of entropy evidences.

28. 28. The method of claim 26 or 27, wherein the plurality of entropy evidences comprises a sorted set of entropy evidences sorted in descending order of entropy with respect to corresponding entropy levels.

29. 30. The method of claim 28, wherein determining the entropy level of the quantum random bit string comprises sequentially testing the quantum random bit string against the entropy proofs of the sorted set, starting with a first entropy proof associated with a highest entropy level in the sorted set.

30. 30. A method according to any one of claims 26 to 29, wherein each entropy evidence of the plurality of entropy evidences is associated with a different state of a quantum device.

31. 30. The method of any one of claims 26 to 29, wherein the quantum device comprises a photonic system including a light source configured to generate light and a photodetector configured to receive the light generated by the light source and generate the quantum event.

32. 32. The method of claim 31, wherein the light source includes an optical link configured such that the light received by the light detector satisfies an energy type constraint.

33. 33. The method of claim 32, wherein the light source is qualified using a calibration and qualification process that includes adjusting the optical link such that the light received by the light detector meets the energy type constraint.

34. 34. The method of claim 32 or 33, wherein the energy type constraint comprises a lower limit of overlap between a quantum state of the light generated by the light source and a vacuum state.

35. 1. A method of calibrating and qualifying a light source for use in a quantum device for generating a quantum random bit sequence, the light source including a photon source and an optical link, the optical link transmitting at least a portion of the light generated by the photon source to a photodetector, the method comprising: measuring, using the photodetector, the portion of the light received by the photodetector while controlling the photon source with a first trigger signal to determine a quantum state of the portion of the light received by the photodetector with respect to an energy type constraint; adjusting the optical link to attenuate the portion of light received by the optical detector in response to determining that the portion of light received by the optical detector does not satisfy the energy type constraint; measuring, using the photodetector, the attenuated portion of the light received by the photodetector while controlling the photon source with a second trigger signal to determine a quantum state of the attenuated portion of the light received by the photodetector with respect to the energy type constraint; Qualifying the light source for use in the quantum device in response to determining that the portion or the attenuated portion received by the light detector satisfies the energy type constraint; A method comprising:

36. 36. The method of claim 35, wherein the optical link includes an optical attenuator, and adjusting the optical link includes adjusting a level of optical attenuation of the optical attenuator.

37. 36. A method according to claim 34 or 35, wherein the optical link comprises an optical fibre waveguide, and adjusting the optical link comprises adjusting a level of optical attenuation in an optical connection to the optical fibre waveguide.

38. 38. The method of claim 35, wherein the attenuated portion of the light received by the photodetector is attenuated by at least 10 dB relative to the light generated by the light source.

39. 39. The method of any one of claims 35 to 38, wherein the light generated by the photon source comprises at least one pulse of light.

40. 40. The method of any one of claims 35 to 39, wherein measuring the portion or the attenuated portion of light received by the photodetector comprises determining an overlap between a measured quantum state of the portion or the attenuated portion of light and a vacuum state.

41. 41. The method of any one of claims 35 to 40, wherein the portion or the attenuated portion of light received by the light detector satisfies the energy type constraint comprises determining that a determined overlap between a measured quantum state of the portion or the attenuated portion of light and a vacuum state is greater than a minimum overlap.

42. 42. The method of any one of claims 35 to 41, wherein the portion of light or the attenuated portion of light received by the photodetector comprises a plurality of pulses of light.

43. 43. The method of claim 42, wherein the first trigger signal and the second trigger signal comprise pseudorandom bit sequences, and each light pulse is associated with a bit of the pseudorandom bit sequence.

44. 44. The method of claim 43, wherein measuring the portion or the attenuated portion of the light received by the photodetector comprises determining an average probability of detecting a photon based at least in part on a corresponding pseudorandom bit sequence.

45. 45. A method according to any one of claims 35 to 44, wherein the optical detector is a trusted optical detector protected against tampering by an adversary.

46. 46. ​​The method of any one of claims 35 to 45, further comprising the steps of: decoupling the light source from the photodetector and connecting the light source to a photodetector of a quantum random bit generator (QRBG) quantum device.

47. 47. The method of any one of claims 35 to 46, wherein the optical detector is mechanically, thermally, or electromagnetically, electrically, magnetically isolated from the surrounding environment.

48. 1. An apparatus for generating certified quantum random numbers in an operational mode and for generating seed random numbers in a kick-off mode, comprising: a quantum device configured to generate quantum events; a classical computing device in communication with the quantum device, using the quantum device to generate a first quantum random bit sequence and a second quantum random bit sequence; generating the seed random number using the first quantum random bit sequence and the second quantum random bit sequence; generating a third sequence of quantum random bits using the quantum device; a classical computing device including a control and processing system configured to generate the certified random numbers using the third quantum random bit sequence and the seed random number; 13. An apparatus comprising:

49. 49. The apparatus of claim 48, wherein the control and processing system is further configured to verify an entropy level of the first quantum random bit string and the second quantum random bit string based on a proof of entropy prior to generating the seed random number.

50. 50. The apparatus of claim 48 or 49, wherein the control and processing system selects an entropy evidence from a plurality of entropy evidences.

51. 51. The apparatus of any one of claims 48 to 50, wherein the control and processing system is further configured to reset the quantum device after generating the first sequence of quantum random bits and before generating the second sequence of quantum random bits.

52. 52. The apparatus of any one of claims 48 to 51, wherein the control and processing system configures a random number extractor implemented in the classical computing system as a two-source extractor and provides the first quantum random bit sequence and the second quantum random bit sequence to the two-source extractor to generate the seed random number.

53. 53. The apparatus of claim 52, wherein after generating the seed random number, the control and processing system configures the random number extractor as a seeded extractor to generate the certified random number.

54. 54. The apparatus of any one of claims 48 to 53, wherein the quantum device comprises a light source configured to generate a photon stream and a photodetector configured to receive at least a portion of the photon stream via an optical link.

55. 55. The apparatus of claim 54, wherein the light source and the optical link are configured such that expectation values ​​of energy observables for quantum states of the photon stream are bounded.

56. 56. The apparatus of claim 55, wherein the energy observable comprises energy, photon number, or overlap with a vacuum state.

57. 57. Apparatus according to any one of claims 54 to 56, wherein the light source and the optical link are configured such that an overlap between a quantum state of the photon stream and a vacuum state is greater than a threshold.

58. 1. A method for generating certified quantum random numbers in an operational mode and generating seed random numbers in a kick-off mode, comprising: generating a first quantum random bit sequence and a second quantum random bit sequence using a quantum device; generating the seed random number using the first quantum random bit sequence and the second quantum random bit sequence; generating a third quantum random bit sequence using the quantum device; generating the certified random number using the third quantum random bit sequence and the seed random number; A method comprising:

59. 60. The method of claim 58, further comprising verifying an entropy level of the first quantum random bit string and the second quantum random bit string based on an entropy proof prior to generating the seed random number.

60. 60. The method of claim 59, wherein verifying an entropy level of the first quantum random bit string and the second quantum random bit string further comprises selecting the entropy evidence from a plurality of entropy evidences.

61. 61. The method of any one of claims 58 to 60, further comprising resetting the quantum device after generating the first sequence of quantum random bits and before generating the second sequence of quantum random bits.

62. 62. The method of any one of claims 58 to 61, wherein the step of generating the seed random number comprises configuring a random number extractor as a two-source extractor and providing the first quantum random bit sequence and the second quantum random bit sequence to the two-source extractor to generate the seed random number.

63. 63. The method of claim 62, wherein the step of generating the certified random number comprises, after generating the seed random number, configuring the random number extractor as a seeded extractor, and generating the certified random number using the seeded extractor.

64. 64. The method of claim 62 or 63, wherein the random number extractor comprises a Dodis extractor.

Images