Quantum random number generator
M. Stipčević1, ∗ and B. Medved Rogina1
1

Rudjer Bošković Institute, Bijenička 54, P.O.B. 180, HR-10002 Zagreb, Croatia

We report upon a novel realization of a fast nondeterministic random number generator whose randomness relies on intrinsic randomness of the quantum physical processesof photonic emission in semiconductors and subsequent detection by the photoelectriceffect. Timing information of detected photons is used to generate binary random
digits-bits. The bit extraction method based on the restartable clock method theoretically eliminates both bias and autocorrelation while reaching efficiency of almost 0.5
bits per random event. A prototype has been built and statistically tested.

arXiv:quant-ph/0609043v2 1 Jan 2007

PACS numbers: 05.40.-a, 02.50.Ng, 03.67.Dd

Introduction

True random numbers, or more precisely nondeterministic random number generators, seem to be of an everincreasing importance. Random numbers are essential
in cryptography (both classical and quantum), Monte
Carlo numerical simulations and calculations, statisticalresearch, randomized algorithms, lottery etc.
Historically, there are two approaches to random
number generation: algorithmic (pseudorandom) and by
hardware (nondeterministic). Pseudorandom number
generators are well known in the art [1]. A pseudorandom generator is nothing more than a mathematicalformula which produces deterministic, periodic sequenceof numbers which is completely determined by the initialstate called seed. By definition such generators are
not provably random. In contrast to that, hardware
generators extract randomness form physical processes
believed to behave in nondeterministic way whichmakes them better candidates for true random number
generation.
In applications where provability is essential, randomness sources (if involved) must also be provably random.
For example the famous BB84 quantum key distribution
protocol described in [2] would be completely insecure if
only an eavesdropper could calculate (or predict) either
Alice’s random numbers or Bob’s random numbers orboth. From analysis of the secret key rate presented
therein it is obvious that any guessability of random
numbers by the eavesdropper would leak relevant information to him, thus diminishing the effective key rate.
It is intriguing (and obvious) that in the case that theeavesdropper could calculate the numbers exactly, thecryptographic potential of the BB84 protocol would be
zero. This example shows that the local random number
generators assumed in BB84 are essential for its security
and should not be taken for granted.

∗ Electronic address: Mario.Stipcevic@irb.hr

It has also been noticed that a random bit generator
combined with an ordinary classical digital channel(this combination being referred to as ”symmetricbinary channel with noise”) gives raise to cryptographic
potential of such a channel [3, 4, 5].
At present state of the art probably the best way torealize scientifically provable random number generator
is to rely on intrinsic randomness of certain simple quantum systems. One such system, frequently exploitedfor random number generation, is based upon a photon
passing through a beam splitter, as schematically shownin Fig. 1.

Beamsplitter
D1

"1"

LED,
laser, ...

D2

"0"

FIG. 1: Beam splitter is a frequently used component for
random number generators. The two photon detectors D1 andD2 are used to detect two possible outcomes corresponding
to one of the two possible paths that photon can take. Thus
each photon entering the beam splitter generates one randombinary digit - bit.

A light source emits photons which pass through abeam splitter. Whenever a photon is emitted it takes
one of the two possible paths (with a small probability to
get reflected or absorbed). If it ends up in the detector
D1 then we generate binary value ”1”, whereas if it ends
up in D2 we generate binary value ”0”. Because nonpolarized light can be understood as an equal mixtureof two orthogonal polarizations, there is a theoretical2reason why zeros and ones would appear with the sameprobability in an idealized apparatus, that is why thebias (defined as b = p(1) − 1/2 where p(1) is probabilityof ones) would be zero. Other realizations of opticalrandom quantum systems include: photons incident on
a semi-transparent mirror [6], polarized photons incident
on a rotateable polarizing beamsplitter which offers apossibility to tune the bias [7] and an apparatus using
polarization entangled photons to suppress false photon
detections [8]. Practical realizations of quantum random
number generators, of course, necessarily suffer fromimperfections. Primary imperfection of such systems
is that the probability of ones is not exactly equal tothe probability of zeros. In the systems mentioned
above this is firstly because photons which produce
zeros and ones traverse different physical paths (whichmight have different transmission probabilities), andsecondly because photons are detected with two (ormore) detectors. Detection efficiency of single a photon
detector can vary significantly form one physical device
to another and is typically very sensitive to temperaturedrift, supply voltage fluctuations, component tolerances
and aging. In order to achieve a low bias one needs
to cope with two problems: first how to achieve thatthe detectors have exactly the same efficiencies (i.e.
precisely such efficiencies as to compensate for different
photon paths) and second how to keep the detectors
efficiencies extremely constant. To minimize the bias,
quantum random number generators described so far
must be fine tuned for a low bias prior to use. This is
not convenient because this fine tuning is a very time
consuming procedure due to the statistical nature ofmeasurement of bias. Furthermore, due to stability
problems one cannot expect that the bias once adjusted
would stay constant for a long time.

a generator. It will be shown that the method produces
perfect random numbers (bits) if fed by perfectly random
events. One practical realization will be presented andstatitically tested.

Theory of operation: the restartable clock method

For the purpose of this paper we define a random bit
generator as a device which produces bits independentlyof each other and with equal probability of the twooutcomes, i.e. p(0) = p(1) = 0.5. We assume existenceof a physical setup which produces Poissonian random
events, typically in form of digital pulses. By definition,
Poisonian events are occuring independently of eachother and in such a manner that time intervals between
subsequent events follow the exponential probability
distribution function (pdf).
Basic idea of the method for extracting random bits
is to consider a pair of non overlapping random timeintervals (t1 , t2 ) which are defined with subsequent
random events, as shown in Fig. 2a, and generate either
binary value ”0” if t1 < t2 , or ”1” if t1 > t2 . Next two
intervals will be considered to generate the next random
bit. Since the events which determine time intervals
are by definition independent of each other it is notpossible that t1 < t2 would appear with any different
probability than t1 > t2 , consequently the probability
to generate ”0” is exactly equal to the probability
to generate ”1”. In other words, the distribution of
t2i − t2i−1 , i = 1, 2, 3, . . . is symmetric. Furthermore,
the bits are mutually independent (i.e. uncorrelated)since independent pairs of events are used to generate
different bits.

The source of problems with previous art is that it
uses spatial information of photons randomly ariving
at different places as a source of randomness. This
necessarily requires two (or more) photon detectors. In
our approach we use temporal information of photons
emmited at random times by a light emitting diode ora laser. All photons traverse the same optical path andarrive always at the same single detector. Because now
both zeros and ones are detected by the same detector,
our random number generating method (described
below) does not require any fine tuning of the bias.
Furthermore the method is highly immune to stability
problems because any slow change in the detector’s
performance influences by the same amount both zeros
and ones and thus precisely cancels out. The price for
improved randomness quality is paid in a somewhat
more complex bit extraction method, but still easily
manageable by logic electronics circuits.

First modification deals with the fact that measurement of time intervals usually results with an integer
number which is produced, for example, by counting of ahigh frequency periodic signal (eg. quartz clock) or digizing a time to amplitude converter (TAC) output voltage.
The time intervals t1 , t2 are then represented by integer
numbers n1 , n2 . With this effect of ”time discretization”
it is still true that p(n1 < n2 ) = p(n1 > n2 ) but now it
can happen that n1 = n2 . In that case, in order to preserve equalness of probabilities of zeros and ones, the twointervals (t1 and t2 ) are discarded and no bit is generated.

The random number generator presented here consistsof two principal parts: a physical random pulse generator(RPG) and a method of extracting random bits from such

Next modification is crucial and deals with the factthat the time discretization leads to appearance of correlations among bits. The serial autocorrelation coefficientThis ”basic algorithm” readily (and obviously) yields
perfect random bits if fed by perfectly random events.
However, it needs to be modified in order to cope with
common limitations of physical realizations, notably
detectors and electronics, and still give good random
numbers.

3

t2
a

t1

a)

0.05
0.04

n1=3

0.03

n2=3

0.02

b)

0.01

n’2=4

n’2=2

0

0

1

2

3

4

5

T/τ

c)

with lag k ≥ 1 of the sequence of bits Y1 ...YN is definedaccording to [14] as:
ak =

PN −k
i=1

(Yi − Y )(Yi+k − Y ).
PN2
i=1 (Yi − Y )(1)

Since different bits correspond to different random
events we do not expect long-range correlations amongbits. Therefore, we are mostly concerned with the lowest
lag coefficient, a1 , which for simplicity we henceforthdenote with a.
A technologically appealing way to measure (approximately) the time interval between subsequent random
pulses is by counting periodic pulses from a continuous(i.e. non-restartable) quartz-controlled clock, as shownin Fig. 2b. The time intervals t1 , t2 are then represented
by integer numbers n1 , n2 . Due to the symmetry between
generating zeros and ones the method ensures zero bias.
However since time intervals are only measured approximately it is not anymore obvious that bits obtained fromsuch measurements will be random, as it was for the basic algorithm. Indeed, simulations show that a sequenceof bits will have a non-negative autocorrelation (Fig. 3)
which vanishes in the limits of a very fast clock or a very
slow clock. This behavior can be understood as follows.
In the fast clock limit the time interval measurement
becomes ”exact” and this brings us back to the basic
algorithm which provides unbiased and uncorrelated bits.
In the slow clock limit the probability of having morethan one count during a random period becomes negligible. Therefore bit ”0” becomes mainly represented by
n1 = 0, n2 = 1 whereas ”1” becomes mainly represented
by n1 = 1, n0 = 1. In other words, in the limit, one
bit is generated with every clock count and if the clock
count occurs during an even random interval then ”0”
is produced, whereas if the clock count occurs during
an odd random interval then ”1” is produced. During

FIG. 3: Serial autocorrelation coeficient a for non-restartableclock method (dead time = 0). T is the clock period, τ is themean time interval between random pulses.

a clock period of length T , there are on average T /τrandom intervals, where τ is the mean time interval
between random pulses. According to the central limit
theorem, the number of intervals becomes normally
distributed as T /τ goes to infinity and since the normal
distribution is symmetric even and odd periods (and thus
0’s and 1’s) appear with equal probability and at random.
Apart from the correlation which characterizes thequality of randomness, another technologically important
issue is the ”bit efficiency” which we define as the number of bits generated per random event. It reaches its
maximum of 1/2 in the fast clock limit and continuously
goes to zero at the slow clock limit (Fig. 4). Since goodquality random events from the RPG are ”technologicallyexpensive”, fast clock limit is preferred for practical realizations of random number generators.

bit efficiency

FIG. 2: Time interval measurement methods (a) with continuous (b) and restartable (c) clock. The time counter advanceswith every positive going edge of the clock pulse.

0.5
0.45
0.4
0.35
0.3
0.25
0.2
0

1

2

3

4

5

T/τ

FIG. 4: Bit efficiency, defined as the number of bits generated per random event, for non-restartable clock method as
a function of T /τ where T is the clock period and τ is themean time interval between random pulses.

Since the fast clock limit could never be reached inpractice, it is interesting to understand what happens in
its vicinity. If we look at a pair of subsequently gener-

4
ated bits (for some T /τ > 0), a process which involves
measurements of 4 subsequent random time intervals, itturns out that this process slightly prefers pair values”11” and ”00” (symmetrically) over the other two possibilities. This has a direct impact on autocorrelation sinceEq. (1) for k = 1 is equivalent to:a = p11 − p10 + p00 − p01 .

(2)

where p11 is probability of ”11” etc. By simulationand symmetry arguments we have found that following
relations hold for probabilities of pairs: p11 =p00 ; p10 =p01
and p11 > p10 for finite T /τ . Acording to Eq. (2) thisgives rise to a positive correlation. Understanding of
this autocorrelation effect from combinatorics and basic
laws of probability is involved, but for our purpose it
suffices to understand that the correlation appears as aconsequence of the way in which random time intervals
ti are measured. Figure 2b illustrates this problem. Iftime interval t1 ends up close to the beginning of a clock
period it is more likely that n2 will be smaller then in
the case when t1 ends up close to the end of a clock
period. It means that measurement of the time interval
t2 depends on the length of t1 , that is n1 and n2 aresomehow correlated.
By help of extensive simulations we have derived anempirical asymptotic expansion for autocorrelation in thefast clock limit:a(x) =

4 2
x
5

(3)

where x = T /τ .
This formula describes autocorrelation very well for x ≤ 0.2. For example, an
autocorrelation of 10−4 is achieved if the ratio of theclock frequency and mean frequency of random events isabout 90 (x ≈ 1/90). For a very modest bit production
speed of 2MHz this already requires clock frequencyof 360MHz (bit efficiency ≈ 0.5) which corresponds
to fastest available logic circuits family. The required
minimum clock frequency scales linearly with the bit
production speed and inverse of the square root of
the desired autocorrelation which leaves no room for
substantial improvement, either in the bit production
rate or in correlation, with the present technology.
However autocorrelation can be completely removed bya different approach that we call ”restartable clock”.
Namely, it is our finding that in order to avoid thecorrelations completely it suffices to synchronize clock
pulses with beginning of each random interval, as
shown in Fig. 2c. In this case, result of measurementof each time interval is only a function of its lengthand obviously it is not dependent on any previous
measurements, which completely eliminates correlations.
Because all time intervals are measured in the same way,
it is again true that p(n1 < n2 ) = p(n1 > n2 ), meaning
there is no bias either. The quality of radomness is now
completely independent of ratio T /τ . This ”restartableclock method” theoretically yields perfectly random bits
if fed by perfectly random events.
The efficiency is again approximately described withthe graph Fig. 6b. But now the departure from the
maximum efficiency does not indicate any problem with
the quality of randomness. It simply means that there
are too few clocks within an average interval and that
because of that we often have n1 = n2 in which case
we must drop the whole pair of events. Good news isthat with restartable clock method we can use clock ofany speed: the only penalty for using a slow clock isefficiency lower than the maximum.
It is important to understand here that the dead timecaused by the photon counting system does not introduce correlations (nor bias) provided that the dead time
following each detected photon is constant in length i.e.
independent of any previously detected photons. Thiscan be understood as follows. In the basic algorithm,
the bit generating process makes use only of the difference of two time interval lengths. Since each random
time interval contains exactly one dead time (namely the
one following the first event) the two dead times cancelout completely. As a result, the distribution of time interval differences t2i − t2i−1 is independent of the deadtime. The same cancellation argument works also forrestartable clock because the dead time is always measured in exactly the same way and produces always thesame number of counts in the counter. However the cancelation does not work for the non-restartable clock andindeed in that case (as we have checked by simulation) a
non-zero dead time introduces additional correlation.
Practical realization of the random pulse generator

The random pulse generator is made of a photon source
followed by a single photon detector. As a source of photons we have used a standard low-efficiency red lightemitting diode (LED). LE diodes are direct bandgap
devices which produce incoherent light by spontaneousemission [10] which is essentially a random process. If
operated at sufficiently low power, LED emits photons
which are virtually independent of each other, that isthe photon emission is then a Poissonian proces [10]. The
important parameter here is the coherence time τcohr , atime scale at which photons are becoming to be correlated. The coherence time can be estimated by help of
the Heisenberg uncertainty relation, assuming Gaussian
emission spectrum:τcohr =

λ2
4πcσ

(4)

The type of LED we used has an exceptionally broad
spectrum, approximately Gaussian centered at λ =688nm and width σ ≈ 35nm. If the mean frequency

5of photon emissions is kept well below the coherence
frequency of fcohr = 2π/τcohr ≈ 2 × 1015 Hz, photons
are practically mutually independent and consequently
time intervals between subsequent photon emissions
are exponentially distributed. Namely, the exponential
distribution of time intervals between photon emissions
and mutual independence of photons are two equivalentcharacterizations.
Alternatively, instead of a LED diode one could aswell use appropriately attenuated laser (diode). Namely,
for a continuous, constant-power source of coherent
light, a random distribution of photon emissions in timeyields a Poissonian photon-counting distribution [12].
Photons from the LED are directed toward photocathode of a photomultiplier tube. Each time a photon
hits the photocathode, there is a probability that anelectron is emitted via the photoelectric effect. Creationof this so called ”photoelectron” is a process governed by
the binomial statistics. Therefore, the statistics of timeintervals between emission of subsequent photoelectrons
is governed by convolution of exponential and differential
binomial distributions. However, the convolution of any
distribution and exponential distribution gives again
the exponential distribution. This is easy to understandqualitatively: if we have a source of random events andchoose randomly only some of these events, then thechosen events are again random. Even more favorably,
the convolution of an approximately exponential distribution and any other distribution yields an improved
exponential distribution, meaning that randomnessof the photoelectric effect can only enhance overallrandomness of produced photoelectrons. Therefore, creation of a photoelectron is virtually truly random event.
Creation of useable electric signal comprises: electron
collection, electron multiplication, signal amplification,level detection and pulse shaping. The effect of thissignal processing is that following a photon detection
the detector becomes insensitive to further incoming
photons during a certain period of time called the ”deadtime”. For good quality detectors the dead time has awell defined, fixed length (which is important for our
method). But even if this is not the case, that is if fora certain detector dead time varies from event to event,
it is easy to modify such detector to achieve a constantdead time. This can be done, for example, by pasing
its output through a non-retriggerable one-shot pulse
shaping circuit which produces pulses of a constantlength and which itself has the dead time slightly above
the longest dead time observed in the detector. Suchpulse shaping circuits, whose dead time can be set at adesired length, are well known in the art, see for example[11].
In our experiments we have used Hamamatsu photomultiplier with bialkali photocathode R5611, highvoltage source C3830, and the photon counting unit

C3866 (amplifier + discriminator + pulse shaper). Deadtime of this photon counting system is about 25 ns,very stable and independent of brightness of the LED.
The low quantum efficiency of only about 0.05 percentof the bialkali photocathode at the wavelength of the
LED presents no problem in our application. We haveintentionally used low efficiency red LED because its
widest wavelength spectrum in comparison to otherLEDs indicates highest randomness of emited photons.

+5V
C3086 HV Supply
P1
OutputLED

PM module
R5611
Ampl. discr.
H8134

FIG. 5: Schematic diagram of the random pulse generator(RPG) composed of: light emitting diode (LED) and single
photon detector setup. Mean frequency of output pulses canbe set by potentiometer P1.

The probability density function (pdf) of measured
time intervals between subsequent pulses from the RPG
operated at 2 MHz as measured by the fast digital osciloscope LeCroy WaveRunner 6100A, is shown in Fig.
6a. An almost perfect fit of measured data to the exponential distribution extends over nearly five decades of
the random variable. The effect of dead time is visibleat the left end of the distribution as a sharp fall of the
distribution at 25 ns. A zoom of this region is shown in
Fig. 6b. Small wrinkles wisible at left end are caused by
the binning effect due to the finite time resoution of theoscilloscope.
Good agreement of the measured pdf with exponential distribution confirms that the photon emission of
the LED is indeed random and that afterpulsing in
the photon detector is negligible at the mean output
frequency of 2 MHz. If, in some case, randomness of asingle LED source would be suspected, one could use
several independently driven LED sources to enhance
the randomness of the light source. However, havingin mind very small coherence time τcohr this is unlikely
to be an issue in practice. On the other hand, theafterpulsing in photomultipliers could be a potential
problem at high bit extraction rates. Afterpulsing in
PMT’s creates correlations in the distribution of random
intervals which dies off tipically with a time constantof the order of τcorr ≈ 1000 ns [13]. At large photon
incidence frequencies this effect becomes negligible
in comparison with abundant signal caused by real
photons. Nevertheles, in principle, afterpulsing could
cause serial correlations among random bits when bit
extraction rate exceeds 1/τcorr no matter what the6Entries
Mean
RMS

10 4
10

3

500000
522.7
498.4

10 2

Data clock

Counter0Sign +1
discriminator

Up/Dn
Clock
Qi

Data

Clock pulse
generatora)10

Dividebytwo

To the PC

10 5

Restart

1
0

1000

2000

3000

4000

5000

t/ns

Y
Entries
Mean
RMS

10 3

447675
157.4
84.26

10 2
10

b)

1
0

50

100

150

Quantum
random pulse
generator (RPG)

6000

200

250

300

t/ns

FIG. 6: (a) Measured probability density function (pdf) oftime intervals between subsequent events from our setup; (b)zoom of the dead-time region which is characterized by a
sharp transition from complete insensitivity of the detector
following a photon detection to fully restored sensitivity some
25 ns later.

extraction method. This effect should be studied in
more detail preferably by simulations which greatly overemphasize the level of afterpulsing. In any case, bits
produced by our prototype at 1 Mbit/sec do not show
any measurable correlations, as will be presented later.
The non-zero dead time, as will be shown, does notcreate bias nor correlations among random bits in our
method.

FIG. 7: Diagram of the quantum random number generator
consistsing of random pulse generator and curcitry for implementation of the restartable clock method.

intervals as explained earlier, the counter state is set
to 0. During each first random time interval its control
input is held at high logic state so it counts forward,
and during the second random interval the control input
is set low, so it continues counting backward until theend of the second random time interval. The required
difference n1 − n2 is thus effectively obtained without aneed to actually perform any subtraction. If the counter
state represents negative number we generate ”0”, if
positive we generate ”1” and if zero we generate nothing.
Implementing the extraction algorithm in the discrete
74HC logic family and operating the random event generator at a mean frequency f0 = 2MHz, we were able
to extract random bits at almost 1 million bits per second. With a 48MHz restartable clock we have measured
bit efficiency of 0.487 ± 0.02, which is quite close to thetheoretical limit of 0.5, and in a good agreement withtheoretical prediction of 0.490. Namely it can be shownthat the bit efficiency of our method ηbit , defined as thenumber of bits produced on average per 1 random event
asymptotically behaves like:ηbit =The random number generator prototype

Using the above RPG and logic circuitry embedding
our bit extraction method we have built and tested alaboratory prototype of a quantum random number generator which operates upon the above described method.
Big advantage of this method is that it requires only one
photon detector and is insensitive to slow variations in
the detector’s gain and quantum efficiency, in contrast
to some other methods which crucially depend on extreme stability of these parameters over a full lifetime ofthe detector. Simplified schematic diagram of the setup
is shown in Fig. 7. It contains a quantum random pulse
generator described in the previous section (Fig. 5).
For the construction of the prototype we have useda controlable bi-directional (up/down) counter which
operates in the following way. At the beginning of any
first time interval, in a pair of subsequent random time1
1 1
− x + x2 ± O(x3 )
2 4
8

(5)

where x = T /τ . The error of this asymptotic expansion is less than 0.25 percent for x ≤ 0.5. Since in ourcase x=2/48 this above formula gives ηbit ≈ 0.490.
Although theoretically eliminated, the main problem
with the practical realization of this prototype was a
non-vanishing bias. This seems to be a general problem with physical random number generators. In ourcase the bias was probably mainly due to the fact thatswitchings of the bi-directional counter to ”up” direction
and to ”down” direction are not equally fast. Even theslightest systematic difference in the length of ”up” and”down” counting time intervals has a measurable effecton bias. It can be shown that in the case of zero deadtime the bias is given by:b=

1 T ∆t
2τ τ

(6)

7
where ∆t is the difference between transition times for”up” and ”down” counting directions. However this biasing effect has no bearing on correlations which wereindeed consistent with zero.
The bias of this setup was measured to be very small,of the order of 10−4 . This is readily by far the smallest
bias reported for the raw bits from a quantum random bit
generator [7, 15]. However, bias quickly raised with random events freqency arriving to 10−3 at f0 ≈ 6MHz, thescaling with 1/τ 2 being quite in accordance with Eq. (6).
In order to lower the bias even further or make possible operation at higher random events frequencies one
could add a small tuneable delay to the clock input of
the up/down counter and adjust it for a minimum bias.
Alternative approaches include use of faster electronics
which has smaller internal circuit delays and software
debiasing procedures.
Statistical quality of random numbers

Quality of randomness of long sequences of bits produced by our prototype was evaluated by three batteriesof statistical tests: ENT [20], DIEHARD [18] and STS
version 1.5 for Linux [19].
ENT is a collection of ”standard” basic statisticaltests, including autocorrelation test. We have modified
this program in order to be able to check correlation
coefficients with lags higher than 1. Notably, we havechecked serial correlation coefficients (Eq. 1) with lags
from 1 up to 32 to be consistent with zero within
statistical error bars which were of the order of 10−4 .
Below is a result for a typical sequence of 1E9 bits.
For sake of brevity only the first 8 serial correlation
coefficients are shown in Table I.
Entropy = 1.000000 bits per bit.
Chi square distribution for 1E9 samples is 2.89,
and randomly would exceed this value
25.00 percent of the times.
Arithmetic mean value of bits is 0.500086 +/- 0.000050
Monte Carlo value for Pi is 3.140953 (error 0.02 percent).
Serial correlation coef. a0 1 = -0.000027 +/- 0.000100
Serial correlation coef. a0 2 = 0.000092 +/- 0.000100
Serial correlation coef. a0 3 = 0.000101 +/- 0.000100
Serial correlation coef. a0 4 = 0.000131 +/- 0.000100
Serial correlation coef. a0 5 = -0.000116 +/- 0.000100
Serial correlation coef. a0 6 = 0.000121 +/- 0.000100
Serial correlation coef. a0 7 = 0.000082 +/- 0.000100
Serial correlation coef. a0 8 = -0.000025 +/- 0.000100
TABLE I: Results of ENT tests suite for a typical sequenceof 1E9 bits.

We can see a slight tendency toward positive bias, also
indicated by larger Chi square. Running this test over
several sequences we have concluded that the bias of ourgenerator is of the order of 1E-4. However, correlations

were always consistent with zero.
DIEHARD is a renown battery of tests which is mostsensitive to various problems likely to appear in pseudorandom generators. It is widely considered as a moststringent series of statistical tests. It consists of 15 tests
whose outcome is a p-value. According to the acompanying documentation, a test is considered failed if the corresponding p-value is less than 0.00001 or greater than
0.99999. Some tests have variants so all in all there are
20 p-values. Results of testing of the sequence of 1E9
bits shown in the Table II indicate that all the tests werepassed.
Birthday Spacings
0.465507
Overlapping Permutations
0.12892
Ranks of 31x31 Matrices
0.57825
Ranks of 32x32 Matrices
0.795461
Ranks of 6x8 Matrices
0.862294
Monkey Tests on 20-bit Words 0.72331
Monkey Test OPSO
0.9383
Monkey Test OQSO
0.6845
Monkey Test DNA
0.1439Count 1’s in Stream of Bytes 0.146824
Count 1’s in Specific Bytes
0.290347
Parking Lot Test
0.554244
Minimum Distance Test
0.386845
Random Spheres Test
0.375526
The Sqeeze Test
0.667035
Overlapping Sums Test
0.859314
Runs Test (up)0.173183
Runs Test (down)
0.137973
The Craps Test no. of wins
0.176271
The Craps Test throws/game 0.523654
TABLE II: Results of DIEHARD tests suite for a typical sequence of 1E9 bits.

NIST has recently put forward ”A statistical test suitefor random and pseudorandom number generators forcryptographic applications” (STS) which aims to become
first industry standard for testing of random number
generators. STS tests consist of total of 38 individual
statistical tests, such as entropy, chisquare, long runs,
DNA tests, birthday spacing tests, Lempel-Ziv complexity, Maurer’s test etc. The written output from STS islengthy and therefore not suitable for presenting here. It
suffices to say that we have repeatedly tested sequences
as long as 1 × 109 bits, which passed all of the tests.

Conclusion

We have presented the concept and the developmentof a new type of a fast nondeterministic random number
generator whose randomness relies on intrinsic randomness of the quantum physical process of photonic
emission in semiconductors and subsequent detection by
the photoelectric effect. Timing information of detected
photons, or more precisely the time interval between

8detected random events, is used to generate binary
random digits-bits.
Presented prototype consist of a light source, one
single-photon detector and fast electronics for timing
analysis of the detected photons providing random
output numbers (bits) at 1Mbit/sec. By using only
one photodetector there is no need to perform any finetuning of the generator, moreover method is immune todetector instability problems, which are improved characteristics compared to most of the systems based on thespatial photon detection used today. Another originality
is that for the purpose of eliminating correlations timeinterval measurement principle has been modified to arestartable clock method. The collection of statisticaltests applied to random numbers produced with ourquantum random number generator present results
which demonstrate the high quality of randomness
resulting in bias less than 10−4 and autocorrelationconsistent with zero, with efficiency of 0.487 ± 0.02 bits

per detected random event.
With appearance of fast quantum random generatorsin the market ?? and obvious declining of speed ofcomputer processors, the speed gap between softwareand hardware generators has become much smaller
especially if one takes into account that hardware
generators do not put such a load on the processor
as software generators do. We predict that quantum
random number generators will find their applications
in basic scientific research, sensitive data protectionand encryption, as well as in simulations in science andtechnology.
We are grateful to prof. B. Basrak form the Mathematical faculty of the University of Zagreb for enlightenig
discussions. Parts of this work are subject of the patentapplication WO2005106645. Building of the prototype
was supported by World Bank Technical Assistance Program 2004 for Croatia (TAL-2).

1. FIGURE CAPTIONS[1] T. Ritter, Cryptologia. 15, 81 (1991).
[2] C.H. Bennett et. al., J. Cryptology, 5 3, (1992).
[3] A. D. Wyner, Bell Syst. Tech. J. 54, 1355 (1975).
Fig. 1. Beam splitter is a frequently used compo[4] I. Csiszar, J. Koerner, IEEE T. Inform. Theory 24, 339
nent for random number generators. The two photon(1978).
detectors D1 and D2 are used to detect two possible[5] U. Maurer, IEEE T. Inform. Theory 39, 733 (1993).
outcomes corresponding to one of the two possible[6] A. Stefanov, N. Gisin, O. Guinnard, L. Guinnard and H.
paths that photon can take. Thus each photon entering
Zbinden quant-ph/9907006, 1999
[7] T. Jennewein et. al., Rev. Sci. Instrum. 71, 1675 (2000).
the beam splitter generates one random binary digit - bit.
[8] Ma Hai-Qiang et al, Chinese Phys. Lett. 21, 1961 (2004).
[9] C. E. Shannon, Bell System Technical Journal, 28, 656
Fig. 2. Time interval measurement methods (a)(1949).
with continuous (b) and restartable (c) clock. The time[10] S. Nakamura, et al., Japan J. Appl. Phys., 34 L1332
counter advances with every positive going edge of the(1995).
clock pulse.
[11] 74HC221 Dual non-retriggerable monostable multivibrtor with reset - Product specification, Philips SemiconFig. 3. Serial autocorrelation coeficient a for nonductor, December 1990.
[12] E. Gulari, B. Chu, Rev. Sci. Instrum.48, 1560 (1977).
restartable clock method (dead time = 0). T is the clock[13] P. B. Coates, The origins of afterpulses in photomultipliperiod, τ is the mean time interval between random
ers, J. Phys. D: Appl. Phys., 6 1159 (1995).
pulses.
[14] D. E. Knuth, The art of computer programming, Vol. 2,
Third edition, (Addison-Wesley, Reading, 1997)
Fig. 4. Bit efficiency, defined as the number of bits
[15] Web URL http://www.idquantique.com/products/quantis.htm
generated
per random event, for non-restartable clock[16] Web URL http://qrbg.irb.hr
methodasa function of T /τ where T is the clock period[17] M. Stipčević, Rev. Sci. Instrum. 75, 4442 (2004).
and τ is the mean time interval between random pulses.
[18] G. Marsaglia, Diehard Battery of Tests of Randomness,internet URL: http://stat.fsu.edu/pub/diehard/
G. Marsaglia, Statistics & Probability Letters, 9, 345
Fig. 5. Schematic diagram of the random pulse gen(1990).
erator (RPG) composed of: light emitting diode (LED)[19] A. Rukhin et. al., A Statistical Test Suite forand single photon detector setup. Mean frequency ofRandom and Pseudorandom Number Generators for
output pulses can be set by potentiometer P1.
Cryptographic Applications, NIST Special Publication, (NIST, Gaithersburg, 2001), internet URL:
Fig. 6. (a) Measured probability density function
http://csrc.nist.gov/rng/(pdf) of time intervals between subsequent events from[20] J. Walker, Hotbits, http://www.fourmilab.ch/hotbits/how.html

our setup; (b) zoom of the dead-time region which
is characterized by a sharp transition from complete
insensitivity of the detector following a photon detection

9
to fully restored sensitivity some 25 ns later.
Fig. 7. Diagram of the quantum random number gen-erator consistsing of random pulse generator and curcitry
for implementation of the restartable clock method.