Quantum Random Number Generation Based on Phase Reconstruction

Quantum random number generator (QRNG) utilizes the intrinsic randomness of quantum systems to generate completely unpredictable and genuine random numbers, finding wide applications across many fields. QRNGs relying on the phase noise of a laser have attracted considerable attention due to their straightforward system architecture and high random number generation rates. However, traditional phase noise QRNGs suffer from a 50\% loss of quantum entropy during the randomness extraction process. In this paper, we propose a phase-reconstruction quantum random number generation scheme, in which the phase noise of a laser is reconstructed by simultaneously measuring the orthogonal quadratures of the light field using balanced detectors. This enables direct discretization of uniform phase noise, and the min-entropy can achieve a value of 1. Furthermore, our approach exhibits inherent robustness against the classical phase fluctuations of the unbalanced interferometer, eliminating the need for active compensation. Finally, we conducted experimental validation using commercial optical hybrid and balanced detectors, achieving a random number generation rate of 1.96 Gbps at a sampling rate of 200 MSa/s.


Introduction
Random numbers play a crucial role in various applications, particularly in cryptography [1][2][3][4][5].Currently, two primary methods are employed for generating random numbers.The first method utilizes pseudo-random number generators based on computer algorithms, such as linear congruential generators and Mersenne Twister generators [6,7], to generate longer random number sequences from shorter seed numbers through deterministic algorithms.Pseudo-random number generators are simple to implement and can generate random number sequences of any length with minimal computational cost.However, these sequences are completely predictable for a given seed number and expansion algorithm, making them inappropriate for secure applications like cryptography.The second method involves random number generators based on classical physical noise, which generate random numbers by measuring real physical quantities of complex systems, such as random number generators based on chaotic events and mouse movement [8,9].In comparison to pseudo-random numbers, random numbers derived from classical physical noise offer improved unpredictability and security.However, classical physics is founded on deterministic principles in theory, achieving randomness through incomplete parameter descriptions.In principle, an adept eavesdropper may predict random numbers through device defects and other side-channel attacks.
Ideal QRNGs can generate genuine random numbers with full entropy in theory.However, practical QRNGs face challenges due to two constraints associated with their randomness.First, they are naturally affected by classical noise in measurement systems, such as electrical noise from quantum measuring devices.Although careful entropy assessment and subsequent data post-processing can eliminate this classical noise, ensuring the randomness of generated data originates solely from quantum noise.Challenges persist in developing real-time, costeffective post-processing hardware, particularly for high-speed QRNGs.Second, QRNGs can be influenced by parameters hidden from eavesdroppers, allowing them to predict the sequence.Researchers proposed device-independent QRNGs [32][33][34] to mitigate this issue, where security is ensured by violating Bell inequalities in quantum systems.The disadvantages of low random number generation rate and increased system complexity limit the practical application of this method.Besides, many alternative approaches have been developed, such as source-independent QRNGs [29,35] and measurement-device-independent QRNGs [36,37], to strike a balance between security and random number generation rate.
Due to simple implementation and high rate of random number generation, QRNG based on phase noise has garnered significant attention and research interest [20,38,39].The phase in the output field of the laser is influenced by the randomness of spontaneous emission photons and conforms to a Gaussian distribution [20,40], with a variance represented by where   represents the coherence time of the laser, inversely proportional to its linewidth   ≈ 1/(Δ  ).The time delay is  delay = Δ/, where  is the refractive index of the optical fiber,  is the speed of light in a vacuum, and Δ is the length of the delay line.
The phase Δ 0 () is a variable that maps Δ () to the range [−, ), following a folded Gaussian distribution [41,42].The distribution of Δ 0 () can be expressed as Random number extraction can be achieved through an unbalanced interferometer that measures the phase of the laser.Some conditions need to be satisfied to attain the phase noise correctly: a)   <   , ensuring the detector can effectively capture the phase noise; b)   ≫   , guaranteeing a uniform distribution of the phase noise, where   is the response time,   is the coherence time of the laser,   is the delay introduced by the arm length difference of the interferometer, and   is the sampling period.
Although QRNG based on the unbalanced interferometer and direct measurement using photodiode (PD) has the advantage of simple structure, it still faces two shortcomings in practical systems.One primary concern arises from environmental factors, such as vibration and temperature, where unbalanced interferometer systems experience phase drift, introducing additional classical phase fluctuations.Many studies have been presented to alleviate this problem.Qi et al. proposed to stabilize the unbalanced interferometer with active controllers [20].Xu et al. implemented an internally temperature-controlled compact planar lightwave circuit (PLC) unbalanced interferometer, achieving phase stabilization through temperature control [24].Nie et al. by using a polarization-insensitive Michelson interferometer and active PID algorithms, improved the stability of the interferometer [43].In addition, one method utilizes two independent lasers for interference that occurs within a multimode interference (MMI) device to avoid the influence of an unbalanced interferometer, while ensuring that the phase noise follows a uniform distribution [26,[44][45][46].However, two lasers with the same center frequency and spectral characteristics, as well as additional temperature control modules, are required to ensure the stability of the laser wavelength.
The second concern pertains to the quantum entropy loss in the post-processing of sampled data.The quantum min-entropy quantifies the maximum randomness extracted from a single sample, which is very low in traditional phase noise QRNGs [21,44,47].The quantum min-entropy is about 0.5 for the phase noise measured with an unbalanced interferometer and PD, which implies that a lot of the original bits will be lost, severely limiting the quantum random number generation rate.
In this paper, a QRNG based on phase reconstruction is proposed, which achieves the recovery of the phase information by simultaneously measuring the orthogonal quadratures of the optical field using balanced detectors, enabling direct discretization of phase noise.In contrast to traditional phase measurement methods, our proposed approach offers several advantages: quantum entropy close to 1 is achieved by employing post-processing techniques on the sampled data, leading to a higher rate of random number generation under identical conditions.Our approach is insensitive to the phase fluctuations of an unbalanced interferometer, exhibiting robustness against environmental factors and eliminating the need for intricate phase stabilization measures.Furthermore, a comprehensive model is established to analyze the imperfection of practical devices and the influence of classical noise.Finally, we validated our approach through experiments using commercially available components.The proposed achieves a high output rate of 1.96 Gbps at a sampling rate of 200 MSa/s, successfully passing the rigorous NIST random tests.The phase reconstruction QRNG scheme is depicted in Fig. 1.A continuous wave emitted by the laser is divided into two beams, one beam serves as the local oscillator light (LO), while the other functions as the signal light after a delay line.The local oscillator light passes through a quarter-wave plate oriented at 45 degrees relative to the LO polarization direction, converting into circularly polarized light and generating two polarization components with a relative 90 degrees phase delay orthogonal to each other.The signal light traverses through a half-wave plate set at 22.5 degrees relative to the signal polarization direction, producing two polarization components orthogonal to each other.In the LO and signal light components, those with matching polarization orientations interfere at the beam splitter (BS), and the resulting interference signals under different polarizations are split via polarization beam splitters (PBSs).Then, the two components of the optical field,  and , are measured by two balanced homodyne detectors (BHDs) to recover the phase information [48].

Theory
The field of a laser output can be described as [20,49,50] where  0 represents the optical power output,  0 represents the laser angular frequency, and  0 () represents the instantaneous phase of the laser.
The output interference signal   and   of two BHDs are expressed as where  1 ,  2 ,  1 and  2 represent the transimpedance gain and responsivity of two BHDs. S and  LO are the power of signal light and local oscillator light. 0  delay is the inherent phase difference caused by the delay  delay , and Δ 0 () is the instantaneous phase difference between the signal light and the local oscillator light.According to the complex expression of the optical , the phase information of the optical field can be obtained as Figure 2 shows the distribution of Δ() under various phase noise variances.As the variance of phase noise steadily increases from 0, the statistical distribution of the reconstructed phase transitions successively from a Gaussian distribution to a truncated Gaussian distribution and ultimately to a uniform distribution.Two distinct critical variances, 0.6 and 10, play pivotal roles as thresholds delineating pivotal stages in the evolution of the statistical characteristics of the reconstructed phase.Specifically, the critical variance of 0.6 signifies the transition from a Gaussian to a truncated Gaussian distribution, while the critical variance of 10 demarcates the shift from a truncated Gaussian distribution to a uniform distribution.
The following conclusions can be drawn: (a) When the variance  2 < 0.6, Δ() follows the same Gaussian distribution as Δ ().Interference signal   is mainly distributed around the maximum value of 1, and the distribution of   is concentrated on the value of 0, and the distribution is symmetric.(b) When the variance 0.6 ≤  2 < 10, Δ() exhibits a truncated Gaussian distribution.The distributions of   and   both take on a U-shaped form, with different probabilities around the maximum value of 1 and the minimum value of -1, resulting in an asymmetric distribution.(c) When the variance  2 ≥ 10, Δ() approaches a uniform distribution.Both   and   exhibit arcsine distributions with the same parameters, symmetrically centered around the value of 0. From the above analysis, it can be seen that there exists a critical variance  2 0 = 10.

The imperfections of practical devices
In ideal situations (see Fig. 4(a)), the complex information of the interference wave can be accurately reconstructed.However, in practical experiments, device imperfections and classical noise inevitably influence the randomness of the generated bits.Hence, we give a detailed analysis to take the main imperfections into account and evaluate the performance of our method.Splitting ratio of BS-By considering the transmittance  of BS and the delay line loss coefficient  as shown in Fig. 1,  S =   0 and  LO = (1 − ) 0 .The amplitudes of the output signals from the BHDs are rewritten as Eq. ( 6) reveals that the output signals from BHDs reach maximum amplitude when BS has a 50:50 splitting ratio ( = 1/2).Yet, the transmittance  is not equal to 1/2, thus the outputs   and   from the BHD are proportionally reduced, leading to a reduction in the amplitude of the complex information   while the phase remains unchanged.However, a significant difference in splitting ratio leads to a rapid decline in the amplitudes of the output orthogonal quadratures, thereby reducing interference visibility.This situation is unfavorable for observing and acquiring signals.Unmatched BHDs-In the discussion in the previous section, a basic assumption is that  1 =  2 and  1 =  2 , therefore, the reconstructed phase  is the true phase of the complex information (see Eq. ( 5)).But the scenario where  0 ≠  0 is a common occurrence in practical settings due to inconsistency of the gain or responsivity, in which both the amplitude and phase of the complex information   will change and an additional phase will be introduced.The greater the difference between  0 and  0 , the larger the additional phase (see Fig. 3).
Nevertheless, the difference between  0 and  0 remains consistent across both detection channels.Therefore, by measuring the disparity between  0 and  0 , the system can realize the extraction of the true phase from the measured values.Assuming measured values is  ′  =  ′ 0 cos  ′ and  ′  =  ′ 0 sin  ′ , the additional phase can be expressed as Fig. 3. Variation of the additional phase with the amplitude of the orthogonal quadratures. ′ 0 and  ′ 0 are the practical normalized amplitudes of the two BHDs.The black line represents the case when the additional phase is zero.It can be observed that when  ′ 0 >  ′ 0 , the additional phase is positive; when  ′ 0 <  ′ 0 , the additional phase is negative.
Intensity fluctuations of light-In practical systems, the laser's actual output power fluctuates over time, denoted as the mean  0 combined with intensity fluctuations  ().Therefore, both the local oscillator light and the signal light should be expressed as where we assume that the intensity fluctuations  S,LO () follow a zero-mean Gaussian white noise with variances  2  S,LO , and  S (),  LO () are mutually independent.Figure 4(b) shows the probability distribution when only the intensity fluctuations are considered.It shows that the intensity fluctuations result in a sharp decrease in the right-side peak of the distribution, with a slight decrease in the left-side peak.Generally, the effect of intensity fluctuations primarily manifests as the smoothing of the positive voltage peak, which disrupts the original symmetry of the output distribution.
Electrical noise of the detectors-Classical electrical noise within the detection apparatus primarily comes from the photodetector and oscilloscope.It is generally assumed that both of these noise sources are independent Gaussian white noises.Thus, the cumulative electrical noise contributes Gaussian white noise to the signal.This can be expressed as Figure 4(c) shows the affection of the electrical noise, which has a smoothing effect on the voltage distribution.However, in contrast to intensity noise, electrical noise affects both positive and negative peak values in the same manner.Consequently, the distribution of output voltage remains symmetric.The larger the variance of the electrical noise, the more pronounced the smoothing effect, leading to a more rapid decrease in peak values in the output distribution.Stability of unbalanced interferometer-An unbalanced interferometer should be introduced to measure the phase noise of a laser, but the interferometer is inevitably affected by environments (such as temperature), which will introduce classical phase fluctuations to the interferometer [28].Generally speaking, the variation of classical phase fluctuations is significantly slower than the sampling period.It can be regarded as a random variable because its value varies over different sampling periods but remains constant within one sampling period.The output voltage can be expressed as  () =  0 cos(Δ +  0 ).In instances where the variance of Δ exceeds the critical value  2 0 , with intensity fluctuations having a variance of   S,LO = 0.01 S,LO , and electrical noise exhibiting a variance of   = 0.1 max , the outcomes are depicted in Fig. 5.Under these conditions, the output distribution remains unaffected by phase fluctuations.The amplitudes on both sides of the distribution exhibit near-identity, suggesting minimal influence from intensity fluctuations, with electrical noise assuming a dominant role.In the event of an increase in the variance of intensity fluctuations or electrical noise, both peaks of the distribution undergo a uniform smoothing effect, maintaining the symmetry of the distribution.In instances where the phase noise variance is less than the critical value  2 0 , significant alterations occur in the voltage distribution owing to the presence of phase fluctuations.Under these circumstances, the stability of the output distribution is affected, requiring additional measures to maintain stability.
The presence of classical noise, particularly phase fluctuations in the interferometer, renders the output of QRNG unstable.Hence, our QRNG scheme exhibits robustness against classical phase fluctuations in the unbalanced interferometer and the system demonstrates sustained and stable output over extended periods.

Experimental setup and results
The experimental setup is illustrated in Fig. 6.A continuous-wave optical signal is sent by a distributed feedback (DFB) laser with a wavelength of 1550 nm.The optical signal is split into two beams by a BS, one beam serves as the local oscillator light, and the other serves as the signal light after a 6m polarization maintaining (PM) fiber.The local oscillator light and the signal light are directed into a 90-degree optical hybrid (Optoplex HB-C0AFAC057), thereby creating four orthogonal states within the complex field space.These output optical signals are input into two BHDs (Thorlabs PDB480C-AC) for photoelectric conversion.Subsequently, the two output signals ( and ) are acquired and quantified by using a high-speed oscilloscope (Keysight Infiniium DSOS104A) with a bandwidth of 1 GHz and a sampling rate of 20 GSa/s.The linewidth of the laser is about 50 MHz (coherence time of 6 ns).And the laser diode is driven by a compact laser diode controller (Thorlabs CLD1015) to stabilize its power and wavelength in real time.The controller settings are optimized to maintain the laser diode temperature at 25°C and the drive current at 14.5 mA.This configuration yields an output power of 0.140 mW with a standard deviation of power fluctuations at 7.855 × 10 −7 W. The practical output powers of BS are about 67.5 W and 64.5 W at two beams respectively.The balanced detectors have a bandwidth of 1.6 GHz, a response time of 625 ps, a responsivity of =1 A/W, and a transimpedance gain of  = 16 × 10 3 V/A.The output voltages amplitude of the BHDs are both approximately 600 mV.
According to the analysis in Section 2.1, the orthogonal quadratures  and  from the detectors follow an arcsine distribution.Thus, the probability density function can be expressed as here  =  or ,  is the maximum amplitude of .The actual statistical distributions of  and  are shown in Fig. 7(a) and Fig. 7(b).In this experiment, the power of the local oscillator  LO is 0.068 mW with a standard deviation of 4.505 × 10 −7 W, while the power of the signal light  S is 0.041 mW with a standard deviation of 2.823 × 10 −7 W. The standard deviations of the electronic noise for the  and  channels are 7.666 × 10 −3 V and 7.356 × 10 −3 V respectively.Submitting all the parameters into Eq.( 9), we could evaluate the performance of our QRNG system.Figures 7(a) and (b) illustrate both the simulated and experimental results for both  and .In the measured data, the amplitudes of the bias-removed  and  are 595.5 mV and 567.5 mV respectively, which are much larger than the electrical noise of two BHDs with 41.1 mV and 40.3 mV.To reduce the affection of the unmatched gains between two BHDs, the output voltage of  and  have been normalized.The results show that the experimental data are matched with that of the simulation, validating that our model can predict the output of the practical QRNG system.With the measured  and , we could reconstruct the phase of light, which can be written as here arg denotes the phase of a complex number.The phase Φ exhibits a uniform distribution within the range [−, ), with its probability density function expressed as Following the acquisition of orthogonal quadratures, the phase undergoes quantization into 2  bins, each with a width of Δ =  2 −1 .The probability in each bin is the same, with the probability of the first bin calculated as To evaluate the randomness of the samples, the min-entropy ( min ) is commonly employed [51].For a random variable , the quantum min-entropy is defined as where   signifies an element of , and   (  ) denotes the probability of   .In our experiment,  = 10, thus, the probability of each bin is about    = 9.77 × 10 −4 .The probability distribution of the phase is illustrated in Fig. 7(c).Submitting the experimental results into Eq.( 16), the quantum min-entropy could be estimated for , , and Φ, which are listed in Table 1.For the original method based on  and , the quantum min-entropy is about 5.65 bits per sample, but for our phase reconstructed method, the quantum min-entropy with 9.81 bits is achieved.Due to the imperfection of practical devices, the practical quantum min-entropy of our method is slightly lower than the maximal value of 10 bits.Furthermore, to verify the relationship between the distribution of the reconstructed phase and the delay line length of the interferometer, Kullback-Leibler divergence (KLD) is calculated for both Gaussian and uniform distribution under different delay line lengths, which are shown in Fig. 8.For the delay line with length 1m, 2m, 3m, 4m, 5m, and 6m, the phase variances ⟨Δ ()⟩ 2 are about 1.66, 3.32, 5, 6.64, 8.30, and 10, respectively (see Eq. ( 1)). Figure 8 clearly shows that the KLD rises from 0 to 0.96 when the delay line increases from 1m to 6m.This indicates that the phase gradually deviates from the Gaussian distribution.At the same time, for our reconstructed phase method, the KLD decreases from 0.59 to 0.0039.This implies that, under a 6m delay line, the statistical distribution of the phase can be well approximated by a uniform distribution.
In order to validate the system's robustness against environmental factors, we conducted separate tests to examine the distributions of , , and Φ after 30 minutes, 1 hour, and 2 hours of system operation (see Fig. 9).Our findings indicate the system's capability for stable performance over extended durations.In general, an elevated data sampling rate results in reduced temporal intervals between adjacent samples, consequently causing stronger correlations.To evaluate the sampling rate in the experiment, the autocorrelation coefficients between adjacent phases are calculated at different sampling rates.The autocorrelation coefficient () of the phase Φ is defined as where  represents the expectation operator,  is the sample delay,  and  2 is the mean and the variance of the phase Φ.In Fig. 10(a), autocorrelation coefficients () for 1 × 10 7 phase samples at different sampling rates are shown.The values indicate the level of correlation between the phases as a function of the time lag .When  = 1, the autocorrelation coefficients are 0.92, 0.85, 0.63, and 0.26 for sampling rates of 10 GSa/s, 5 GSa/s, 1 GSa/s, and 200 MSa/s, respectively.Based on the trade-off between rate and correlation requirements, a sampling rate of 200 MSa/s is suitable for the experiment, which corresponds to a sampling period of   = 5 ns.
Finally, a Toeplitz-hashing randomness extractor is used to compress the original bit sequence and extract pure quantum randomness.The Toeplitz-hashing randomness extractor operates by multiplying the original sequence  by a Toeplitz matrix to generate a random bit sequence .In this experiment, based on the assessment of min-entropy, the size of the Toeplitz matrix was set to  = 4000 and  = 3920, which resulted in the generation of approximately 9.8 bits (with a 10-bit ADC) of random bits for each As a result, a rate of 1.96 Gbps (200 MSa/s×9.8 bits) is achieved.
To evaluate the randomness of the bit sequence from our QRNG, we have examined the autocorrelation coefficients of 10 × 10 7 bits and subject the sequence to the National Institute of Standards and Technology (NIST) statistical testing suite.The autocorrelation coefficients are below 1 × 10 −3 , and the random bit sequence successfully passes all testing criteria of the NIST statistical testing suite, as depicted in Fig. 10(b) and Fig. 11.This indicates that the generated random bits have good statistical characteristics.

Conclusions
Random numbers serve as essential components with extensive and vital applications in fields like information security.QRNGs rely on the fundamental principles of quantum physics to generate inherently unpredictable random numbers, significantly enhancing the security of information systems.The QRNGs based on the phase of optical fields have attracted widespread attention due to their simple structure and high generation rates.
A QRNG scheme based on phase reconstruction is proposed in this paper, which provides a way to directly measure the orthogonal quadratures of the optical field from a laser.The proposed scheme offers significant advantages compared to previous QRNGs that rely on phase measurement in unbalanced interferometers, which include achieving a quantum min-entropy approaching 1, improving the efficiency of random number generation, and obtaining a higher random number generation rate under similar conditions.Additionally, the scheme demonstrates robustness against classical phase fluctuations in unbalanced interferometers.The designed QRNG incorporates comprehensive modeling of device imperfections and classical noise, enabling the development of a min-entropy evaluation model that examines the influence of noise on quantum random number performance.The experimental verification successfully achieved a random number generation rate of 1.96 Gbps.
The proposed QRNG can be further improved by increasing the linewidth of the light source to enhance the random number generation rate.However, it's essential to note that this increased rate comes at the cost of other considerations.In order to prevent the averaging out of random phase within the response time of the detectors, it is crucial to use detectors with higher bandwidth and shorter response time.Therefore, the generation rate of random numbers can be effectively improved by selecting a laser source with higher linewidth [52] and balanced detectors with higher bandwidth [43].Disclosures.The authors declare that there are no conflicts of interest related to this article.

Fig. 2 .
Fig. 2. The impact of noise variance on the output distribution.The changes in the output distribution under three different noise variances 0.1, 0.6, 10 are analyzed.(a) Distribution of the real phase noise of the laser.(b) Distribution of the phase mapped to [−, ).(c) Distribution of the  component.(d) Distribution of the  component.

Fig. 4 .
Fig. 4. Impact of classical noise on the distribution of output voltage.The distribution of output voltage under four scenarios is described (a) in the absence of classical noise, (b) with only intensity fluctuations, (c) with only electrical noise, and (d) with only classical phase fluctuations.

Figure 4 ( 11 )Fig. 5 .
Figure 4(d) shows the distribution of output voltage with different phase fluctuations  0 , which are systematically chosen within the interval [0, ].When the variance of Δ is greater than the

Fig. 6 .
Fig.6.Experimental setup of the phase-reconstruction QRNG.A stable continuous wave is emitted by a laser driven by a temperature controller (TC), divided into two paths by a BS and a delay line, and input into an optical hybrid (OH) to generate four orthogonal states.These states are then detected by two BHDs and signal acquisition and 10-bit quantization is performed using an oscilloscope (OSC).

Fig. 7 .
Fig. 7. Distribution of simulation and experimental data.The red dashed line in the figure represents simulation data, the black dash-dot line represents electrical noise, and the blue solid line represents experimental data.(a) Distribution of the  component.(b) Distribution of the  component.(c) Distribution of the reconstructed phase.

Fig. 8 .
Fig. 8. Kullback-Leibler Divergence of different delay line lengths.The red rhombus dot-dash line represents the KLD of the reconstructed phase and the standard Gaussian distribution, and the blue triangle dashed line represents the KLD of the reconstructed phase and the standard uniform distribution.

Fig. 10 .Fig. 11 .
Fig. 10.Autocorrelation coefficient of the phase.(a) Autocorrelation coefficient of the phase at different sampling rates.The blue circle dashed line represents 10 GSa/s samples; the red square dot-dash line represents 5 GSa/s samples; the orange triangle dotted line represents 1 GSa/s samples; the purple pentagram solid line represents 200 MSa/s samples.(b) The blue triangle dashed line represents the autocorrelation coefficient of the original reconstructed phase samples, and the red circle solid line represents the autocorrelation coefficient of the final random bits after randomness extraction.The autocorrelation coefficient of the final random bits is all less than 1 × 10 −3 .

Funding.
Shenzhen Science and Technology Program (JCYJ20220818102014029); National Natural Science Foundation of China (62171458); China Electronics Core Research Fund.

Table 1 .
The min-entropy for different data