1. Introduction

Since the first demonstration of giga-bit-per-second (Gbps) physical random bit generation (RBG) using semiconductor lasers by Uchida et al. in 2008 [1], chaotic lasers have attracted renewed interest as an entropy source for physical RBG. A semiconductor laser with delayed optical feedback can generate large-amplitude, chaotic intensity fluctuations in the GHz regime [2]. A chaotic laser can be viewed as an “amplifier” of microscopic noises [3, 4], which uses nonlinear dynamical instability as the amplification mechanism. Although dynamical instability itself is deterministic, the non-deterministic randomness involved in microscopic noises results in unpredictable output behavior after the Lyapunov time. The practical unpredictability of a chaotic laser is demonstrated experimentally in [4].

In the field of information and communication technology (ICT), there is a great demand for physical (truly) random bit generators, because true randomness plays a crucial role as regards achieving secure communication and storage systems. A high generation rate for physical random bits is useful for applications based on information-theoretic security [5] such as secret sharing [6,7] and secure multi-party computation [8,9]. These applications consume very many random numbers because their perfect security (in terms of information theory) is guaranteed by as much true randomness (or full entropy) as original information that one wants to encrypt. RBG using a chaotic laser has the potential to meet the need for high-generation-rate physical random bit generators.

With RBG using a chaotic laser, an AD converter (ADC) that resolves the state of the laser is as important as the entropy source. For example, digitization resolution of an ADC is directly related to the RBG rate. Many studies have demonstrated the enhancement of the RBG rate by multi-bit sampling [10–18], although in these cases bit manipulation is needed to reduce the biases of the generated bits. Thus far, such bit manipulation has only been performed offline. Moreover, real-time AD conversion has only been examined in a few studies [1,19–21], and all of these studies used one-bit ADCs.

The high generation rate proves its worth when it is used in a real-time physical random bit streaming (RBS) system, which can both perform bit manipulation for bias reduction in real time and continuously supply random bits to the memory of a server or a personal computer (PC). As a step towards application in the ICT field, it is important to examine the feasibility of such a real-time streaming system by using currently available electronic devices. We addressed this new challenge by integrating a chaotic laser with a commercially available ADC board that had a data interface with a PC, paying special attention to the end-to-end entropy source model, that is, how the entropy from physical sources is converted into bit entropy. We developed software for real-time bit manipulation for bias reduction and streaming to a PC user’s memory space, and demonstrated a physical RBS rate of up to 4 Gbps. We emphasize that this rate was measured in terms of the throughput of physical random bits supplied to a PC user’s memory space, in contrast to previous theoretical estimates based on offline post processing.

Our RBS system allows us to easily store and access physical random bits in a PC. We used this advantage to carry out a comprehensive assessment of physical random bits. In particular, we evaluated the pass rate of the NIST test suite for random number generators [22]. For various parameter values of the bit manipulation algorithm, we found that the pass rates were from 65 % to 75 %, which are comparable to the pass rates previously evaluated for commonly-used reliable pseudorandom bit generators [23–25].

2. Random bit streaming system

2.1. Chaotic laser chip

A schematic diagram of our RBS system is shown in Fig. 1(a). The physical entropy source is a monolithically integrated chaotic laser chip, whose structure is sketched in Fig. 1(b). It consists of a single frequency distributed feedback (DFB) laser emitting at a wavelength of 1550 nm, two semiconductor optical amplifiers (SOA₁ and SOA₂), and a passive waveguide one of whose edges is coated with high reflectivity film. The passive waveguide works as an external cavity for delayed optical feedback to the DFB laser, and the two SOAs are used to tune the strength and phase of the feedback. Our chaotic laser chip is similar to those studied in [4,17,26], except that our chip has no integrated photodiode. The light output intensity of the chip exhibits large-amplitude, chaotic oscillations when the external cavity is sufficiently long and the feedback is sufficiently strong. We set the length of the external cavity at 1.03 cm to ensure that there were broadband chaotic oscillations in the GHz regime [17].

 

Fig. 1 (a) Schematic diagram of random bit streaming system. (b) Structure of chaotic laser chip.

Download Full Size | PDF

The injection currents for the DFB laser (denoted by I_DFB) and two SOAs (denoted by I_SOA1 and I_SOA2), and the temperature of the chip were adjusted with a current-temperature controller (ILX Lightwave LDC-3900). For the experiments reported in this paper, we fixed the injection currents at I_DFB = 20.02 ± 0.01 mA (the lasing threshold was around 12 mA), I_SOA1 = 3.08 ± 0.01 mA, and I_SOA2 = 2.45 ± 0.01 mA. The temperature was fixed at 20.0 ± 0.1 °C. The output from the chaotic laser chip was converted to an electronic signal with a high-speed AC-coupled photodetector (New Focus, 1544-B, 12 GHz bandwidth). We used an optical fiber isolator to avoid unwanted feedback to the laser as shown in Fig. 1(a).

2.2. AD conversion and data streaming

The electronic signal from the photodetector was transferred to an ADC board (SP-Devices, ADQ-412-4G, 2-GHz analog bandwidth, 12-bit digitization resolution) through a coaxial cable. The ADC board can sample signals at a rate of up to 2 giga-samples-per-second (GSps), and sampled data are transferred to a PC via a PCI express (Gen2×8) interface. Figure 2(a) shows radio-frequency spectra with the chaotic laser turned on and turned off (i.e., noise level). The spectral data were acquired with software called ADCaptureLab (SP-Devices) in the 2-GHz bandwidth mode and with full 12-bit resolution. In Fig. 2(a), we can see that the intensity increased by 35 dB compared with the noise level, and it exhibits a flat dependence on frequency as with white noise. We will show that these characteristics are suitable for the physical entropy source of RBG.

 

Fig. 2 (a) Radio-frequency spectrum and (b) time series of the chaotic laser output measured using the ADC board. In (a), the noise level is given for comparison. In (b), the sampling rate is set at 1 GSps.

Download Full Size | PDF

The 12-bit range of the ADC corresponds to a fixed peak-to-peak voltage of 800 mV. We customized the Field-Programmable-Gate-Array (FPGA) on the ADC board so that only 8-bit data were transferred to the PC, where any eight contiguous bits can be selected by setting an FPGA parameter from the PC, and this defines the signal range of the ADC. For the experimental data reported in this paper, we arranged it so that the eight bits from the lowest 4th to 11th bits were transferred to the PC (namely, we discarded the most significant bit and the lowest three bits of the full twelve bits), so that the signal range of the ADC board fitted the dynamic range of the input signal. Moreover, by programming the FPGA, we set the sampling rate of the ADC at 1 GSps (i.e., 1-ns sampling interval). This is because the timescale needed for amplifying microscopic noises to a macro-scale has been measured to be around 1 ns for a similar chaotic laser chip [4]. That is, the statistical distribution of intensity values after 1 ns converges close to the asymptotic distribution. In this way, the unpredictability of a sampled data sequence is guaranteed by the physical mechanism of the microscopic noise amplification by nonlinear dynamical instability [4]. With the above settings for the FPGA, the 8-bit data were transferred to the PC at 1 GSps, yielding a data transfer rate of 8 Gbps. The data bandwidth of the PCI express Gen2 ×8 (≲ 25.6 Gbps) is sufficient for this data transfer.

2.3. Real-time bit manipulation at PC

We developed random bit server software for transferring sampled raw data to the memory of the PC, and converting them to random bits with reduced biases in real time. We developed the software on a PC (2 CPUs, 8-core, 2.6 GHz, 20M cache) with a Linux OS (Ubuntu 14.04), and for data acquisition, we used API commands for the ADC board (SP-Devices, ADQAPI). Figure 3 shows a diagram of the data flow managed by random bit server software. The ADC board stores sampled raw data in the local memory, and those data are continuously copied to the buffer memory space of the PC at a data streaming rate of 8 Gbps (note that the sampling rate and digitization resolution of the ADC were fixed at 1 GSps and 8 bits, respectively). Figure 2(b) shows a time-series plot of sampled raw data for the chaotic laser’s output (acquired at 1 GSps). Then, the software converts the raw data to random bits with the bit manipulation algorithm described in Sect. 4, and stores the generated random bits in the shared memory space. These random bits are ready to use, in the sense that their bias is well reduced by the bit manipulation algorithm. The random bits are continuously supplied to the shared memory space. As shown in Sect. 4, we confirmed an average streaming throughput of up to 4 Gbps. These constantly supplied random bits can be delivered to a client program on demand.

 

Fig. 3 Diagram of data flow managed with random bit server software.

Download Full Size | PDF

3. Physical entropy sources: chaotic laser vs. electronic noise

When constructing a physical RBS system, it is important to clarify the origin of the randomness, or entropy. This point is emphasized in NIST SP800-90B [27], for example, which requires a description of how the noise source works and rationale about why the noise source provides acceptable entropy output. The randomness and unpredictability of the chaotic laser outputs have been extensively studied through physical modeling and related numerical and real experiments [3, 4, 26, 28]. On the other hand, electronic noise is always unavoidable when a chaotic laser is integrated with electronic components. Thus, we first report the extent to which the electronic noise contributes as an additional physical entropy source.

Figures 4(a) and 4(b) respectively show typical finite-time probability distributions for the intensity of the chaotic laser and for the electronic noise (for the latter, the chaotic laser is turned off). From the probability distribution in Fig. 4(b) together with direct observation of the corresponding time series, we found that the intensity largely remained at a value of −1, but sporadic fluctuation occured (in a truly noise-free case, we would expect the intensity to remain only in a single quantization bin). We consider this fluctuation to be mainly caused by electronic noise intrinsic to the photodetector and the ADC board. Figure 4(b) shows that the intensity probability distribution mainly spread over two bins (i.e., −1 and −2). In Fig. 4(c), we show a semi-log plot of the probability distribution, where we find that the fluctuation has distribution tails that spread over six quantization bins (this variation corresponds to ln(6)/ ln(2) = 2.58 bits). This means that the number of bits that are not affected by the electronic noise is estimated to be 5.42. We need to keep this in mind when we use a chaotic laser’s signals for RBG. For applications that do not allow use of an unknown physical entropy source, we need to exclude those bits that are suspected of being affected by electronic noise.

 

Fig. 4 Typical finite-time probability distributions. (a) Normalized probability distribution for the intensity of the chaotic laser. (b) Normalized probability distribution for the intensity of the electronic noise. (c) Same as (b) but the vertical axis is in log scale to enhance tiny probabilities. When calculating these probability distributions, the intensity was sampled at 1 GSps as shown in Fig. 2(b), and 1024³ samples were used.

Download Full Size | PDF

In previous studies, less attention has been paid to the treatment of the electronic noise, and they might have constituted an additional physical entropy source. As far as passing the statistical tests for randomness is concerned, no significant anomalies have been reported when some lowest bits are included in RBG. In Sect. 5, we assess the quality of the generated random bits when the electronic noise is included and when it is excluded, for comparison.

4. Bit manipulation for bias reduction

Before discussing the biases of generated bits and bit manipulation for bias reduction, we first fix our notations. We denote the decimal expression of the 8-bit sampled data at time t = nT (n ∈ Z) by X(nT) ∈ [−128, 127], where X(nT) takes an integer value, and the sampling interval T is fixed at T = 1 ns. We denote the binary expression of X(nT) by ${\left\{A_j^{(n)}\right\}}_{j=0}^7$ with $A_j^{(n)}\in \{0,1\}$ (j = 0, · · · , 7), that is, $X(nT)={\sum }_{j=0}^7{A}_j^{(n)}{2}^j-128$, where j = 0 and j = 7 correspond to the lowest significant bit (LSB) and the most significant bit (MSB), respectively. We assume that for a given j (= 0,· · ·,7), $A_j^{(n)}$ is an independent identically distributed random variable (as a function of n). This assumption can be approximately satisfied when the input signal is strongly chaotic and the sampling interval T is sufficiently large.

Because the probability distribution of sampled data is far from uniform as shown in Fig. 4(a), we expect the probability of each A_j (here we suppress the sample number index n) taking the value 0 (or 1) to be biased. We define the bias of the j-th bit as the deviation from 1/2 of the probability that A_j takes the value 0, i.e.,

 

Fig. 5 The bias of each bit for the chaotic laser’s signal, where 1-Gbit samples were used for calculating the bias (see Eq. (1) for the definition of the j-th bit’s bias). The filled circles (•) are for the raw binary data ${\left\{A_j\right\}}_{j=0}^7$, while the filled squares (▪) are for the binary data, ${\left\{C_1^{(s)}\right\}}_{s=0}^7$, whose biases are reduced by bit manipulation (see text for details).

Download Full Size | PDF

Various bit manipulation methods for reducing the bias have been examined in previous studies [10,11,14,15,17,18], which consist mainly of exclusive-OR (XOR) operation, bit order reversing, and use of a delayed signal. XOR operation plays a key role in the bias reduction. As is well known, when the random variables X and Y have biases ∊_X and ∊_Y, respectively, their XORed value Z := X ⊕ Y has a reduced bias of 2∊_X∊_Y.

In the work we report in this paper, we employed bit manipulation essentially similar to the ones used in [15, 17, 18]. In contrast to the previous studies, we perform the bit manipulation in real time. In our RBS system, the bit manipulation can be carried out either on the FPGA of the ADC board or on a PC. We adopted the latter, because it provides easier coding and more tuning flexibility, although the former is more efficient in terms of data transfer (namely, fewer data are transferred through the PCI express bus when bit extraction is performed at the FPGA).

Recently, Uchida et al. [29] implemented a more complicated bit manipulation algorithm in an FPGA and achieved real-time physical RBG at up to 21.1 Gbps with ADC sampling rate of 3.6 GSps and bit manipulation extracting 8-bits per sample. However, in this case, the theoretical peak RBG rate exceeds the actual RBG rate. In the system reported in this paper, we prioritize the full description of the end-to-end entropy source model describing how the entropy from physical sources is converted into bit entropy, so we limit the streaming rate to ensure continuous streaming.

For the input for the bit manipulation, we use two 8-bit data sets, X(nT) and X((n − n_d)T), where an integer n_d is a delay parameter that should be chosen so that the correlation between X(nT) and X((n − n_d)T) is negligible. We fixed n_d = 32, and the delayed data set was obtained by software using the PC’s memory. We denote the binary expression of X((n−n_d)T) as ${\left\{B_j\right\}}_{j=0}^7$ (we suppress the n dependence). The output of the bit manipulation is an m-bit sequence (m ≤ 8) obtained as follows: In the first step, we extract two sets of m-bit sequences, ${\left\{A_{s+k}\right\}}_{k=0}^{m-1}$ and ${\left\{B_{s+k}\right\}}_{k=0}^{m-1}$, from ${\left\{A_j\right\}}_{j=0}^7$ and ${\left\{B_j\right\}}_{j=0}^7$, where we introduced the offset parameter s ∈ [0, 7] defining the lowest bit to be used for RBG. In the second step, we reverse the order of ${\left\{B_{s+k}\right\}}_{k=0}^{m-1}$ to obtain ${\left\{B_{s+k}^{\prime }\right\}}_{k=0}^{m-1}$, where B′_s+k = B_s+m−1−k (k = 0, · · ·, m − 1). Finally, in the third stage, we perform a bitwise XOR operation for ${\left\{A_{s+k}\right\}}_{k=0}^{m-1}$ and ${\left\{B_{s+k}^{\prime }\right\}}_{k=0}^{m-1}$ to obtain $C_k^{(s)}=A_{s+k}\oplus B_{s+k}^{\prime }$ (k = 0, · · ·, m − 1).

When we consider the empirical fact that a bit of less significance has a smaller bias (c.f., Fig. 5), it is efficient to perform the bit order reversal operation in the second step to obtain as many less biased bits as possible, with minimal computational cost to maintain the high throughput. In Fig. 5 (black squares (▪)), the effect of the bit operation is illustrated for one-bit extraction (i.e., m = 1) with s = 0, · · ·, 7, where we can confirm that the biases of the lowest five bits can be made very small (≲ 10⁻⁵) by the XOR operation.

The bit manipulation algorithm was implemented in the random bit server software on the PC (see Fig. 1(a)). For an efficient implementation of the bit manipulation described above, we used commands supported by SSE4.2 (Streaming SIMD Extensions 4.2), AMI (advanced bit manipulation), and BMI2 (Bit Manipulation Instructions Sets 2). By efficiently performing bit operations using these commands, we were able to achieve a sustained streaming throughput up to 4 Gbps.

Figure 6(a) shows a real-time monitoring result for the average throughput of random bits used by a user application, where the average was obtained with 1/30th of a second time intervals. We can confirm that the throughput seen by the user application is sustained at the theoretical RBG rate of 4 Gbps. This means that there is no bit loss during transfer to the PC’s shared memory space, and even to the user application. Further, this means that there is no unknown factors in the bit processing and transfer, allowing us to have a full description of the process converting physical entropy to bit entropy.

 

Fig. 6 Real-time monitoring of the average throughput and bias of the generated random bits, where the parameters for the bit manipulation were set at m = 4 (four-bit extraction) and s = 0, yielding a generation rate of 4 Gbps. In (a), the throughput was measured in terms of the number of random bits supplied to the PC’s user memory space per time. In (b), the bias was calculated for 8-Mbit samples. The two lines at $\pm 1.29/\sqrt{8\times {1024}^2}\approx \pm 4.5\times {10}^{-4}$ correspond to the significance level α = 0.01 for the null hypothesis that the generated bits are random.

Download Full Size | PDF

Figure 6(b) shows the corresponding time series of the bias, where 8-Mbit samples were used for the calculation of the bias. The two lines at $\pm 1.29/\sqrt{8\times {1024}^2}\approx \pm 4.5\times {10}^{-4}$ correspond to the significance level α = 0.01 for the null hypothesis that the generated bits are random. For this demonstration, we used a bit manipulation algorithm with m = 4 and s = 0 (yielding a generation rate of 4 Gbps). From this result, we can confirm a reasonable fluctuation of the bias for the generated random bits. In Sect. 5, we present detailed information on the quality of the generated random bits.

5. Quality assessment of generated physical random bits

The statistical quality of physical random bits has been assessed by using statistical test suites for random and pseudorandom number generators, a representative of which is the NIST statistical test suite known as NIST SP800-22 [22]. In previous studies, passing all the included tests has been adopted as a criterion for generated bits to have acceptable statistical quality. Such a test suite has usually been applied to a limited number of generated bit sequences. For example, for NIST SP800-22, 1000 binary sequences with lengths of 10⁶ bits (the total data amount is about 1 Gbits) are often used, and the significance level α for p-values is set at 0.01, following the recommendation in NIST SP800-22 [22]. Most previous studies provided information only for a single trial of the NIST test suite. However, considering the statistical nature of the NIST test suite and the fact that the stationarity of the physical RBG system itself is not trivial, the pass rate of the test suite would provide more detailed information on the capability of the physical random bit generator. Such a pass rate has been evaluated for various representative pseudorandom bit generators [23–25]. For example, [24] reported a pass rate of 41 % to 56 %, while [25] reported a pass rate of 61 % to 69 %. In the former, the NIST test suite was applied to 100 different sample data sets to evaluate the pass rate. By taking account of the correlations of the sub-tests included in the NIST test suite, [25] estimated the upper bound of the pass rate to be 80.99 %.

However, such a pass rate has not been systematically evaluated for physical random bits. In Sect. 5.1, we evaluate the pass rate of the NIST test suite by applying it to 100 different sample data sets obtained with our RBS system, and reveal how this rate depends on the parameters of the bit manipulation. In addition, in Sect. 5.2, we report the results of long-term (60-minute) bias monitoring.

5.1. Pass rate of NIST test suite

As described in Sect. 4, the bit manipulation algorithm has two parameters m and s, where m is the number of extracted bits and s the offset bit. For various sets of m and s, we applied the NIST test suite to 100 different sample data sets (each consisting of 1000 binary sequences with lengths of 10⁶ bits), and evaluated the pass rate. The NIST test suite consists of fifteen kinds of statistical tests, and each tests a null hypothesis that the binary sequence is random [22]. The fifteen kinds of the test and the number of sub-tests are listed in the second column of Table 1. There are a total of 188 sub-tests. The criterion for passing each sub-test is determined by the significance level and the sequence length. We set the significance level α for the p-values at 0.01. For 1000 binary sequences, the proportion of the binary sequence that produces a p-value larger than α is expected to be in the 0.99 ± 0.0094392 range for ideal random bits. For a given sub-test, if the proportion is in this expected range and the P-value (uniformity of p-values) is larger than 0.0001, we conclude that the sample data set passes this sub-test, and for a given test from the fifteen kinds listed in Table 1, if a sample data set passes all the included sub-tests, we say that the sample data set passes the test. Moreover, if a sample data set passes all the 188 sub-tests (or equivalently passes all the fifteen kinds of the tests), we conclude that it passes the NIST test suite. In Table 1, we show the results of a single trial of the NIST test suite for a data set obtained when the bit manipulation parameters were set at m = 2 and s = 3, where we can confirm that all the fifteen tests were passed.

Table 1. The results of a single trial of the NIST test suite [22] for a data set obtained when the bit manipulation parameters were set at m = 2 and s = 3. For 1000 binary sequences with length 10⁶ and significance level α = 0.01, each test is passed if the P-value (uniformity of p-values) is larger than 0.0001, and the proportion is in the 0.99 ± 0.0094392 range. For the tests with multiple sub-tests, the worst P-values and proportions are shown.

View Table | View all tables in this article

By using 100 sample data sets obtained by our RBS system, we evaluated the pass rate for the NIST test suite as well as that for each of the included fifteen kinds of the tests. In Table 2, the counts of passing each of the fifteen tests are summarized for various parameter values of the bit manipulation algorithm, m and s. Since we have observed in Fig. 5 that the bias is large for j = 5, 6, and 7, we limited the values of m and s, so that these bits were not used for the RBG. As given in the bottom row of Table 2, the pass rates for the NIST test suite were in the 65 % to 75 % range, which are comparable to the pass rates for commonly-used reliable pseudorandom bit generators [24, 25]. Therefore, we conclude that the physical random bits generated by our RBS system have sufficient statistical quality.

Table 2. The counts for passing each test in the NIST test suite for 100 sample data sets, each consisting of 1000 binary sequences with lengths of 10⁶ bits. Each column corresponds to a different bit manipulation condition designated by m and s, which respectively represent the number of extracted bits and the offset bit. The bottom row shows the pass rates for the NIST test suite. A pass rate with * indicates that those bits suspected of being affected by electronic noise were not used in the RBG.

View Table | View all tables in this article

In Sect. 3, we found that the estimated number of bits unaffected by the electronic noise is 5.42. This means that the results for s = 0, 1, and 2 are suspected of being more or less affected by the electronic noise. In Table 2, we used superscript (*) for the pass rates when the lowest three bits were not used in the RBG. As far as the pass rate is concerned, we observed no significant change caused by the inclusion of the electronic noise. However, when simply characterizing the entropy production capability of a chaotic laser, or for applications that demand high reliability in an entropy source, one must exclude those bits that might be contaminated by electronic noise whose characteristics are unknown.

5.2. Long-term bias monitoring

To confirm the operational stability of our RBS system, we monitored the bias of generated random bits for a long time interval of 60 minutes. For the bit manipulation, we set m = 1 (one-bit extraction) and s = 3, which yields a 1 Gbps generation rate. The bias monitor computed the bias in 8 Mbit blocks acquired from the PC’s shared memory space.

For a generated bit sequence of length N = 8 × 1024², ${\left\{z_j\right\}}_{j=1}^N$, we calculated the following (signed) bias:

 

Fig. 7 (a) Time dependence of the bias S_N for generated random bits. The bias S_N is calculated from N (= 8 × 1024²) consecutive bits. (b) Normalized probability distribution of the scaled bias S̃_N for the data in (a) (see text for definitions of S_N and S̃_N), where the solid curve is the normalized Gaussian distribution (Eq. (3)) predicted by the central limit theorem.

Download Full Size | PDF

6. Conclusion

We demonstrated a physical random bit streaming (RBS) system with a chaotic laser as its physical entropy source. The RBS system is designed to allow a full description of how the entropy from physical sources is converted to bit entropy. The system can both perform bit manipulation for bias reduction in real time and continuously supply random bits to the shared memory space of the PC. We confirmed a throughput of up to 4 Gbps for the supply of the physical random bits. These physical random bits are ready to use in the sense that their bias is made negligible. The statistical quality of the generated random bits was systematically assessed by using the NIST test suite. Using a large number of generated physical random bits, we evaluated the pass rate of the NIST test suite to be 65 % to 75 %, which is comparable to the pass rates previously evaluated for commonly-used reliable peudorandom bit generators [23–25]. We also confirmed the long-term operational stability of our RBS system, by monitoring the bias for 60 minutes. This long-term continuous monitoring result proved that the chaotic laser chip can stably generate sufficiently random signals, even under unavoidable temperature and current fluctuations. This point has not been verified in previous studies [4,17,26], but is important for confirming the reliability of the chaotic laser chip as an entropy source.

Appendix: Bias dependence on bit number

In Fig. 5 (filled circles (•)), we can observe a tendency for a bit of less significance to have a smaller bias. In this Appendix, we explain the reason for this tendency. Let us use X₀ to denote a (decimal) variable describing sampled data. For simplicity and without loss of generality, we assume that X₀ ∈ [0, 1), and that X₀ obeys the probability distribution ρ₀(x). The decimal value of X₀ can be expressed by the binary form .A₀ A₁ A₂ · · ·, where A_j ∈ {0, 1} (j = 0, 1, 2, · · ·) are determined so as to satisfy $X_0={\sum }_{j=0}^{\infty }{A}_j{2}^{-(j+1)}$. In dynamical systems theory [30], it is well known that the binary shift operation .A₀ A₁ A₂ · · · ↦ .A₁ A₂ A₃ · · · is equivalent to the mapping of the point X₀ by the Bernoulli map B : [0, 1) ↦ [0, 1) defined by

(4)$$B(x)=2x\text{mod}1=\{\begin{array}{ll}2x\hfill & \text{for}\hspace{0.17em}\hspace{0.17em}x\in \left[0,\frac{1}{2}\right)\hfill \\ 2x-1\hfill & \text{for}\hspace{0.17em}\hspace{0.17em}x\in \left[\frac{1}{2},1\right),\hfill \end{array}$$

where the mapped point X₁ = B(X₀) has the binary expression .A₁ A₂ A₃ · · ·. Using this fact, we can write the probability of the j-th bit A_j taking the value 0 as

(5)$$\begin{array}{ll}\text{Prob}\{A_j=0\}\hfill & =\text{Prob}\left\{B^j(x_0)<1/2\right\}\hfill \\ \hfill & ={\int }_0^{1/2}dx{\rho }_j(x),\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}(j=0,1,\cdots )\hfill \end{array}$$

where ρ_j (x) is the evolution of ρ₀(x) obtained by the j-time iteration of the Bernoulli map, and it can be written as ρ_j (x) = ℱ ρ_j−1(x) by using the Frobenius-Perron operator ℱ defined by

(6)$$ℱ{\rho }_{j-1}(x):=\frac{1}{2}\left[{\rho }_{j-1}\left(\frac{x}{2}\right)+{\rho }_{j-1}\left(\frac{x+1}{2}\right)\right].$$

From Eq. (6), we have

(7)$${\rho }_j(x)=\frac{1}{2^j}\sum _{m=0}^{2^j-1}{\rho }_0\left(\frac{x+m}{2^j}\right).$$

Equation (7) with j → ∞ is nothing but a Riemann integral of ρ₀(x), and the R.H.S. of Eq. (7) converges to ${\int }_0^{1}dx{\rho }_0(x)=1$ for j → ∞ when ρ₀(x) is integrable [31]. In other words, ρ_j (x) approaches a uniform distribution (natural invariant measure) ρ_∞(x) ≡ 1 as j goes to infinity. From Eq. (5), it directly follows that Prob{A_j = 0} goes to 1/2 as j goes to infinity. Thus, the bias of the j-th bit defined in Eq. (1) goes to zero as j goes to infinity.

In Fig. 8(a), we numerically illustrate the convergence of ρ_j (x) to a uniform distribution, when the initial distribution ρ₀(x) is given by a skewed unimodal distribution. In Fig. 8(a), we observe that ρ_j (x) approaches ρ_∞(x) ≡ 1 as j increases. In Fig. 8(b), we plot the bias dependence on the bit number j, where the biases were calculated from ρ_j (x) using Eqs. (1) and (5). The biases exhibit exponential decay as a function of j, which is due to the smoothness of the probability distribution ρ₀(x). For real experimental data, the probability distribution ρ₀(x) often contains an ever finer fluctuation that remains at the level of the LSB, which may lead to non-exponential decay or decay saturation.

 

Fig. 8 (a) Evolution of ρ₀(x) under the Bernoulli map, Eq. (4). As j increases, ρ_j (x) converges to a uniform distribution ρ_∞(x) ≡ 1. (b) Bias dependence on bit number j, where j = 0 corresponds to the LSB.

Download Full Size | PDF

Acknowledgments

We thank Tomohiro Miyasaka and Fumihiro Matsui for coding the programs for the bit manipulation and random bit streaming. S.S and K.A. thank Atsushi Uchida for sending them a preprint on an FPGA implementation of real-time physical RBG [29], Dai Ikarashi, Koji Chida and Hitoshi Ito for discussions regarding secret sharing, Hiroyuki Noto for discussions concerning signal processing, and Tomohiro Nakatani for his support and encouragement.

References and links

1. A. Uchida, K. Amano, M. Inoue, K. Hirano, S. Naito, H. Someya, I. Oowada, T. Kurashige, M. Shiki, S. Yoshimori, K. Yoshimura, and P. Davis, “Fast physical random bit generation with chaotic semiconductor lasers,” Nat. Photonics 2(12), 728–732 (2008). [CrossRef]  

2. J. Ohtsubo, Semiconductor Lasers, Stability, Instability and Chaos, 3 Edition (Springer-Verlag, 2013).

3. T. Harayama, S. Sunada, K. Yoshimura, J. Muramatsu, K. Arai, A. Uchida, and P. Davis, “Theory of fast nondeterministic physical random-bit generation with chaotic lasers,” Phys. Rev. E 85(4), 046215 (2012). [CrossRef]  

4. S. Sunada, T. Harayama, P. Davis, K. Tsuzuki, K. Arai, K. Yoshimura, and A. Uchida, “Noise amplification by chaotic dynamics in a delayed feedback laser system and its application to nondeterministic random bit generation,” Chaos 22(4), 047513 (2012). [CrossRef]  

5. C. E. Shannon, “Communication theory of secrecy systems,” Bell Syst. Tech. J. 28, 656–715 (1949). [CrossRef]  

6. A. Shamir, “How to share a secret,” Commun. ACM 22612–613 (1979). [CrossRef]  

7. G. R. Blakley, “Safeguarding cryptographic keys,” Proc. AFIPS Nat. Computer Conf., 313–317 (1979).

8. A. C. Yao, “Protocols for secure computations (extended abstract),” Proc. 23rd Annual Symposium on Foundations of Computer Science, 160–164 (1982).

9. O. Goldreich, S. Micali, and A. Wigderson, “How to play any mental game,” Proc. 19th Annual ACM Conference on Theory of Computing, 218–222 (1987).

10. I. Reidler, Y. Aviad, M. Rosenbluh, and I. Kanter, “Ultrahigh-speed random number generation based on a chaotic semiconductor laser,” Phys. Rev. Lett. 103(2), 024102 (2009). [CrossRef]   [PubMed]  

11. K. Hirano, K. Amano, A. Uchida, S. Naito, M. Inoue, S. Yoshimori, K. Yoshimura, and P. Davis, “Characteristics of fast physical random bit generation using chaotic semiconductor lasers,” IEEE J. Quantum Electron. 45(11), 1367–1379 (2009). [CrossRef]  

12. K. Hirano, T. Yamazaki, S. Morikatsu, H. Okumura, H. Aida, A. Uchida, S. Yoshimori, K. Yoshimura, T. Harayama, and P. Davis, “Fast random bit generation with bandwidth-enhanced chaos in semiconductor lasers,” Opt. Express 18(6), 5512–5524 (2010). [CrossRef]   [PubMed]  

13. I. Kanter, Y. Aviad, I. Reidler, E. Cohen, and M. Rosenbluh, “An optical ultrafast random bit generator,” Nat. Photonics 4(1), 58–61 (2010). [CrossRef]  

14. A. Argyris, S. Deligiannidis, E. Pikasis, A. Bogris, and D. Syvridis, “Implementation of 140 Gb/s true random bit generator based on a chaotic photonic integrated circuit,” Opt. Express 18(18), 18763–18768 (2010). [CrossRef]   [PubMed]  

15. Y. Akizawa, T. Yamazaki, A. Uchida, T. Harayama, S. Sunada, K. Arai, K. Yoshimura, and P. Davis, “Fast random number generation with bandwidth-enhanced chaotic semiconductor lasers at 8 × 50 Gb/s,” IEEE Photon. Tech. Lett. 24(12), 1042–1044 (2012). [CrossRef]  

16. N. Oliver, M. C. Soriano, D. W. Sukow, and I. Fischer, “Fast random bit generation using a chaotic laser: Approaching the information theoretic limit,” IEEE J. Quantum Electron. 49(11), 910–918 (2013). [CrossRef]  

17. R. Takahashi, Y. Akizawa, A. Uchida, T. Harayama, K. Tsuzuki, S. Sunada, K. Arai, K. Yoshimura, and P. Davis, “Fast physical random bit generation with photonic integrated circuits with different external cavity lengths for chaos generation,” Opt. Express 22(10), 11727–11740 (2014). [CrossRef]   [PubMed]  

18. R. Sakuraba, K. Iwakawa, K. Kanno, and A. Uchida, “Tb/s physical random bit generation with bandwidth-enhanced chaos in three-cascaded semiconductor lasers,” Opt. Express 23(2), 1470–1490 (2015). [CrossRef]   [PubMed]  

19. T. Honjo, A. Uchida, K. Amano, K. Hirano, H. Someya, H. Okumura, K. Yoshimura, P. Davis, and Y. Tokura, “Differential-phase-shift quantum key distribution experiment using fast physical random bit generator with chaotic semiconductor lasers,” Opt. Express 17(11), 9053–9061 (2009). [CrossRef]  

20. J. Zhang, Y. Wang, M. Liu, L. Xue, P. Li, A. Wang, and M. Zhang, “A robust random number generator based on differential comparison of chaotic laser signals,” Opt. Express 20(7), 7496–7506 (2012). [CrossRef]   [PubMed]  

21. A. Wang, P. Li, J. Zhang, J. Zhang, L. Li, and Y. Wang, “4.5 Gbps high-speed real-time physical random bit generator,” Opt. Express 21(17), 20452–20462 (2013). [CrossRef]   [PubMed]  

22. A. Rukhin, J. Soto, J. Nechvatal, M. Smid, E. Barker, S. Leigh, M. Levenson, M. Vangel, D. Banks, A. Heckert, J. Dray, and S. Vo, “A statistical test suite for random and pseudorandom number generators for cryptographic applications,” NIST Special Publication 800-22, Revision 1a (2010).

23. H. Okutomi and K. Nakamura, “A study on rational judgment method of randomness property using NIST randomness test (NIST SP. 800-22)),” (in Japanese) IEICE Trans. A J93-A(1), 11–22 (2010).

24. A. Yamaguchi, T. Seo, and K. Yoshikawa, “On the pass rate of NIST statistical test suite for randomness,” JSIAM Lett. 2, 123–126 (2010). [CrossRef]  

25. D. Lihua, Z. Yong, J. Ligang, and H. Xucang, “Study on the pass rate of NIST SP800-22 statistical test suite,” Proc. 10th International Conference on Computational Intelligence and Security, 402–404 (2015).

26. T. Harayama, S. Sunada, K. Yoshimura, P. Davis, K. Tsuzuki, and A. Uchida, “Fast nondeterministic random-bit generation using on-chip chaos lasers,” Phys. Rev. A 83(3), 031803 (2011). [CrossRef]  

27. M. S. Turan, E. Barker, J. Kelsey, K. A. McKay, M. L. Baish, and M. Boyle, “Recommendation for the entropy sources used for random bit generation,” NIST Special Publication 800-90B, Second draft (2016).

28. M. Inubushi, K. Yoshimura, and P. Davis, “Noise robustness of unpredictability in a chaotic laser system: Toward reliable physical random bit generation,” Phys. Rev. E 91(2), 022918 (2015). [CrossRef]  

29. K. Ugajin, Y. Terashima, K. Iwakawa, A. Uchida, T. Harayama, K. Yoshimura, and M. Inubushi, “Real-time fast physical random number generator with a photonic integrated circuit” (preprint).

30. C. Beck and F. Schlögl, Thermodynamics of chaotic systems (Cambridge University, 1993). [CrossRef]  

31. D.J. Driebe, Fully chaotic maps and broken time symmetry (Kluwer Academic Publishers, 1999). [CrossRef]