Certified finite randomness expansion

Randomness expansion is a protocol for Quantum Random Number Generator which takes as input a private, uniformly random string and outputs a longer string which is (close to) private and uniformly random. The protocol of Pironio et. al. enables randomness expansion of such an input using only two identical untrusted (i.e. provided by an adversary) measurement devices. Privacy of the output string is guaranteed to a given confidence level and its length depends on the stochastic outcome of a CHSH game, the confidence level desired and the randomness extractor used in post-processing.

Such a protocol is useful in the case where one already has access to a private source for true randomness, but whose use is prohibitively expensive or whose access is limited. By applying randomness expansion, it is possible to make this resource go further using potentially much cheaper or more simple methods.

Tags: Building Blocks, Quantum Functionality, Specific Task

Assumptions

• Quantum theory is correct.
• The measurement devices do not interact during measurements.
• The measurement devices are not correlated with the input string.
• The adversary does not have access to a quantum memory.

Outline

In this protocol, Alice has an initial private random string (the seed) and has been provided with two identical measurement devices by Eve. Each of the devices has two settings and can produce two outputs. Prior to beginning the protocol, Alice has to decide with which confidence she would like her output string to be private from Eve, and which strong randomness extractor she would like to perform post-processing with. She then splits her seed into two portions - the sizes of which are determined by the chosen randomness extractor.

Alice then takes two bits from the start of the first portion of her initial string and uses these to choose the settings of her measurement devices (i.e. if the pair is $(0,1)$ then she sets the first device to setting $0$ and the second device to setting $1$). She prepares an EPR state and shares it across the two measurement devices, then performs measurements using each device with the chosen settings and records the output. She repeats this process until this portion of her input string has been exhausted, resulting in a binary string of recorded outputs of equal length to the input.

Using the input and output strings, Alice estimates the violation of the CHSH inequality her experiment has produced. This allows her to place a bound on the conditional min-entropy of the output string with respect to both the input string and any information Eve may have.

Finally, Alice passes her output string, the second portion of her initial seed and the determined min-entropy bound to a strong randomness extractor to generate a processed string which is (close to) uniform and private from Eve with the confidence specified at the beginning of the protocol. As Alice has kept her seed private throughout and the randomness extractor used is a strong one, she can then simply append her entire seed to the output of the randomness extractor to produce a final expanded string, which is guaranteed to be longer than the seed so long as a super-classical CHSH game has occurred.

Notation

• $n$: number of measurement iterations
• $x_{i}$: measurement setting for device A on iteration $i$
• $y_{i}$: measurement setting for device B on iteration $i$
• $A_{bases}$: tuple of measurement bases for device A; $A_{bases}=\{X,Z\}$
• $B_{bases}$: tuple of measurement bases for device B; $B_{bases}=\{1/{\sqrt {2}}(X+Z),1/{\sqrt {2}}(X-Z)\}$
• $a_{i}$: measurement result for device A on iteration $i$ (0 or 1)
• $b_{i}$: measurement result for device B on iteration $i$ (0 or 1)
• $s$: string of measurement basis pairs; $s=(x_{1},y_{1};\ldots ;x_{n},y_{n})$
• $r$: string of measurement result pairs; $r=(a_{1},b_{1};\ldots ;a_{n},b_{n})$
• ${\overline {r}}$: output string from classical randomness extraction of $r$
• $t$: initial private random seed
• $u$: final randomness expanded string
• ${\hat {I}}$: experimental estimate of CHSH correlation
• $k$: lower bound on conditional min-entropy of measurement results $r$ with respect to measurement settings $s$ and any information held by an adversary
• $f$: function which takes as input a(n estimated) CHSH correlation and returns a per-use lower bound on the conditional min-entropy of the measurement results with respect to measurement settings and any information held by an adversary in the limit of a large number of uses (determined using semi-definite programming in Pironio et. al.)
• $\epsilon$: term to account for finite statistics effects
• $\alpha$: the chosen confidence with which the returned entropy lower bound is correct
• ${\textrm {Ext}}$: strong seeded (classical) randomness extractor

Requirements

• Network stage: Entanglement Distribution
• Random number generator
• Authenticated quantum channel
• Authenticated classical channel
• Hardware:
  • Multi qubit non-separable state preparation
  • Single qubit measurement
  • Single qubit gates

Properties

• Output string is of length $\theta (n^{2})$
• Requires only two measurement devices.
• Devices can be untrusted.
• Imposes no constraints on input states or measurements (i.e. Bell inequality tested can be changed from what is specified here).
• Allows for devices to have an internal quantum memory.
• Length of expanded string dependent on magnitude of CHSH correlation (as this tells us how much min-entropy can be contained in the results string) and the choice of randomness extractor (as different constructions have varying degrees of performance).

Pseudocode

Input: $t$, $\alpha$, ${\textrm {Ext}}v'''Output''':<math>u$

• split $t$ into $t=(t^{(1)},t^{(2)})$ where $|t^{(1)}|$ and $|t^{(2)}|$ are determined by ${\textrm {Ext}}$
• $n\leftarrow {\big \lfloor }{\frac {|t^{(1)}|}{2}}{\big \rfloor }$
• initialize arrays $r$, $s$ of length $n$
• For $i\leftarrow 1$ to $n$:
  • prepare state $|\Psi ^{+}\rangle$ and share across devices A and B
  • $x_{i}\leftarrow t_{i}^{(1)}$
  • $y_{i}\leftarrow t_{i+1}^{(1)}$
  • $a_{i}\leftarrow$ measurement result from device A in basis $A_{bases}[x_{i}]$
  • $b_{i}\leftarrow$ measurement result from device B in basis $B_{bases}[y_{i}]$
  • $s[i]\leftarrow (x_{i},y_{i})$
  • $r[i]\leftarrow (a_{i},b_{i})$
• ${\hat {I}}\leftarrow 0$
• $i\leftarrow 1$ to $n$:
  • $x_{i},y_{i}\leftarrow s[i]$
  • $a_{i},b_{i}\leftarrow r[i]$
  • ${\hat {I}}\leftarrow {\hat {I}}+{\frac {4}{n}}(-1)^{x_{i}\wedge y_{i}}(-1)^{a_{i}\oplus b_{i}}$
• $\epsilon \leftarrow 4{\sqrt {-{\frac {2{\sqrt {2}}}{n}}\ln {(1-\alpha )}}}$
• $k\leftarrow nf{\big (}{\hat {I}}-\epsilon {\big )}$
• flatten $r$ into an array of bits
• ${\overline {r}}\leftarrow {\textrm {Ext}}(r,t^{(2)},k)$
• $u\leftarrow (t,{\overline {r}})$

Further Information

• Pironio et. al. implement the protocol using two ionic Yttrium qubits, separated by a distance of $1$, and a uniform probability distribution (i.e. $P(x,y)={\frac {1}{4}}$). Over the course of one month, they were able to produce $n=3016$ entanglements and recorded a correlation of ${\hat {I}}=2.414$; implying at least 42 new random qubits had been produced with a confidence of 99%. The seed used in the experiment was generated from a combination of sources: radioactive decay, atmospheric noise and network activity on a remote computer.
• The protocol presented here implements the simplest design choices throughout. It is possible to use arbitrary Bell inequalities (rather than the CHSH inequality), to use the seed to generate $x_{i}$ and $y_{i}$ from some joint probability distribution $P(x,y)$, and to contsruct the protocol with more than two devices.

contributed by Neil Mcblane