Secure uniform random number extraction via incoherent strategies

TL;DR

This paper investigates secure extraction of uniform random numbers from quantum states using incoherent strategies, establishing the maximum extraction rate and analyzing the security under different constraints and measures.

Contribution

It introduces the maximum secure extraction rate as the relative entropy of coherence and compares it with the coherence of formation under specific constraints.

Findings

Maximum secure extraction rate equals the relative entropy of coherence.

The coherence of formation determines the rate under certain eavesdropper constraints.

The exponential decay of leaked information is characterized by Rényi relative entropies of coherence.

Abstract

To guarantee the security of uniform random numbers generated by a quantum random number generator, we study secure extraction of uniform random numbers when the environment of a given quantum state is controlled by the third party, the eavesdropper. Here we restrict our operations to incoherent strategies that are composed of the measurement on the computational basis and incoherent operations (or incoherence-preserving operations). We show that the maximum secure extraction rate is equal to the relative entropy of coherence. By contrast, the coherence of formation gives the extraction rate when a certain constraint is imposed on eavesdropper's operations. The condition under which the two extraction rates coincide is then determined. Furthermore, we find that the exponential decreasing rate of the leaked information is characterized by R\'{e}nyi relative entropies of coherence. These results clarify the power of incoherent strategies in random number generation, and can be applied to guarantee the quality of random numbers generated by a quantum random number generator.

Figures

Equations

$$C_{\mathrm{r}}(\rho ):=\underset{\sigma \in \mathcal{I}}{\min }S(\rho \Vert \sigma )=S({\rho }^{\mathrm{diag}})-S(\rho ),$$

$$C_{\mathrm{F}}(\rho ):=\underset{\{p_j,|{\psi }_j⟩\}}{\min }\sum _j{p}_j{C}_{\mathrm{r}}(|{\psi }_j⟩⟨|{\psi }_j|),$$

$$d_1({\rho }_{AE}):=\Vert {\rho }_{AE}-{\tau }_{|\mathcal{A}|}\otimes {\rho }_E{\Vert }_1,$$

$$\displaystyle R(\tilde{\rho}_{A}):=\max_{\{\mathsf{M}_{F_{n}}\}}\Big{\{}\liminf_{n\to\infty}\frac{\log|\mathsf{M}_{F_{n}}|}{n}\Big{|}d_{1}(\mathsf{M}_{F_{n}}|F_{n})\to 0\Big{\}},$$

$$U_{\mathrm{CNOT}}:=\sum _{x;y<d_A}|x,x+y⟩⟨x,y|+\sum _{x;y\ge d_A}|x,y⟩⟨x,y|,$$

$$\frac{1}{n}\underset{U_{\mathrm{i}}}{\max }H(A|E{)}_{{\tilde{\rho }}^{\otimes n}[U_{\mathrm{i}}]}=$$

$$=$$

$$H(A|E{)}_{\tilde{\rho }[U_{\mathrm{i}}]}$$

$$\le C_{\mathrm{r}}(\tilde{\rho }[U_{\mathrm{i}}{]}_{AB})\le C_{\mathrm{r}}({\tilde{\rho }}_A).$$

$$H(A|E{)}_{{\mathsf{M}}_{\mathrm{c}}(\tilde{\rho })}=H(A|E{)}_{\tilde{\rho }[U_{\mathrm{CNOT}}]}=C_{\mathrm{r}}({\tilde{\rho }}_A).$$

$$R({\tilde{\rho }}_A)\ge \underset{U_{\mathrm{i}}}{\max }H(A|E{)}_{\tilde{\rho }[U_{\mathrm{i}}]}.$$

$$R({\tilde{\rho }}_A)\le \underset{n\to \infty }{\mathrm{liminf}}\frac{1}{n}\underset{U_{\mathrm{i}}}{\max }H(A|E{)}_{{\tilde{\rho }}^{\otimes n}[U_{\mathrm{i}}]}$$

$$R({\tilde{\rho }}_A)=\underset{U_{\mathrm{i}}}{\max }H(A|E{)}_{\tilde{\rho }[U_{\mathrm{i}}]}=C_{\mathrm{r}}({\tilde{\rho }}_A),$$

$$H(A|E{)}_{\tilde{\rho }[{\Lambda }_{\mathrm{i}}]}\le E_{\mathrm{r}}(\tilde{\rho }[{\Lambda }_{\mathrm{i}}{]}_{AB})\le C_{\mathrm{r}}({\tilde{\rho }}_A).$$

$$\displaystyle\underline{d}_{1}(\mathsf{M}_{F_{n}}|F_{n}):=\max_{\mathsf{M}_{E}}\mathbb{E}_{F_{n}}d_{1}\bigl{(}\mathsf{M}_{F_{n}}(\mathsf{M}_{E}(\tilde{\rho})^{\otimes n})\bigr{)}$$

$$=$$

$$\overline{R}({\tilde{\rho }}_A):=\underset{\{{\mathsf{M}}_{F_n}\}}{\max }\left\{\underset{n\to \infty }{\mathrm{liminf}}\frac{\log |{\mathsf{M}}_{F_n}|}{n}|{\underline{d}}_1({\mathsf{M}}_{F_n}|F_n)\to 0\right\},$$

$$\overline{R}({\tilde{\rho }}_A)=C_{\mathrm{F}}({\tilde{\rho }}_A).$$

$$\displaystyle\liminf_{n\to\infty}\frac{-1}{n}\log d_{1}(\mathsf{M}_{F_{n}}^{*}|F_{n})\geq\max_{s\in[0,1]}\frac{s}{2}\bigl{(}\underline{C}_{\mathrm{r},\frac{1+s}{1+2s}}(\tilde{\rho}_{A})-R\bigr{)}.$$

$${\rho }_{AE}=\sum _a{P}_A(a)|a⟩⟨a|\otimes {\rho }_{E|a}.$$

$${\rho }_{f(A)E}:=\sum _a{P}_A(a)|f(a)⟩⟨f(a)|\otimes {\rho }_{E|a}.$$

$${\overline{H}}_{\alpha }^{\uparrow }(A|E{)}_{\rho }$$

$${\overline{H}}_{\alpha }^{\downarrow }(A|E{)}_{\rho }$$

$$H_{\alpha }^{\uparrow }(A|E{)}_{\rho }$$

$$S_{\alpha }(\rho \Vert \sigma )$$

$${\underline{S}}_{\alpha }(\rho \Vert \sigma )$$

$$\mathbb{P}\{F(a)=F(a^{\prime })\}\le \frac{1}{|\mathcal{Z}|}$$

$${\mathbb{E}}_F{d}_1({\rho }_{F(A)E})\le |\mathcal{Z}{|}^{\frac{1}{2}}{2}^{-\frac{1}{2}{\overline{H}}_2^{\uparrow }(A|E{)}_{{\rho }_{AE}}}.$$

$$K({\rho }_{AE}):=$$

$$\displaystyle\sup_{F_{n}}\Big{\{}\liminf_{n\to\infty}\frac{\log|F_{n}|}{n}\Big{|}\mathbb{E}_{F_{n}}d_{1}\bigl{(}(\rho^{\otimes n})_{F_{n}(A)E}\bigr{)}\to 0\Big{\}},$$

$$\displaystyle\liminf_{n\to\infty}-\frac{1}{n}\log\mathbb{E}_{F_{n}}d_{1}\bigl{(}(\rho^{\otimes n})_{F_{n}(A)E}\bigr{)}$$

$$\ge$$

$${\Delta }_{d,2}(M|{\rho }_{AE})$$

$$\displaystyle:=\min_{\sigma_{E}}\min_{\rho_{AE}^{\prime}}\Bigl{[}2\|\rho_{AE}-\rho_{AE}^{\prime}\|_{1}+M^{\frac{1}{2}}2^{\frac{1}{2}\underline{S}_{2}(\rho_{AE}^{\prime}\|I_{A}\otimes\sigma_{E})}\Bigr{]},$$

$$\displaystyle\mathbb{E}_{F_{n}}d_{1}\bigl{(}(\rho^{\otimes n})_{F_{n}(A)E}\bigr{)}\leq\Delta_{d,2}(2^{nR}|\rho_{AE}^{\otimes n}).$$

Full text

Recently, quantum random number generation attracts much attention because of many practical applications, such as cryptography, scientific simulation, and foundational studies Ma16 ; HG17 . A quantum random number generator is a device for extracting secure uniform random numbers from quantum states. Its experimental demonstration has been done with quantum optics Jennewein ; Furst ; Ren ; Wei . Ideally, the random numbers generated should be independent of the third party, the eavesdropper (Eve). In practice, however, the relevant states or random numbers are often correlated to Eve. For this reason, it is crucial to extract secure uniform random numbers from random numbers whose side information is leaked to Eve. This task is called secure uniform random number extraction, which has been studied in the framework of information security, and has been considered as a basic tool for quantum key distribution Renner ; marco ; RW . Here the goal of the legitimate user, Alice, is to generate random numbers that are almost independent of Eve. Usually, the initial state is taken to be a classical-quantum (C-Q) state $\rho_{AE}$, in which, Alice’s information is given as a classical random number, while Eve’s information is given as a quantum state that is correlated to Alice’s random variable. When the $n$-tensor product state $\rho_{AE}^{\otimes n}$ is given, it is known that the asymptotic secure extraction rate is equal to the conditional entropy $H(A|E)_{\rho_{AE}}:=S(\rho_{AE})-S(\rho_{E})$.

To guarantee the quality of the random numbers generated in a quantum random number generator, it is usually assumed that the environment of Alice’s system is controlled by Eve. This convention covers the most powerful Eve and is typical in similar research areas. For example, in the study of quantum key distribution SP ; marco ; HQKD and private capacity LAZG , all of the environment is assumed to be under Eve’s control. Further, since Alice generates the quantum state on her system, which is under her control, it is natural to treat Alice’s initial information as a quantum state in the same way as Eve’s state. In fact, there are several formulations of secure uniform random number extraction with quantum-quantum states (Berta, , Section 4.3)Berta2 ; BFW13 ; Faw12 . However, little is known about the optimal extraction rate. This is because it is not easy to clarify the reasonable range of allowed operations.

To extract random numbers from a quantum state, Alice can apply a projective measurement. However, not all quantum states can produce secure random numbers in this way given that the environment is controlled by Eve. Quantum coherence with respect to the measurement basis is crucial to realizing the independence from the environment and the randomness of the outcome simultaneously Ma16 ; HG17 . In addition, in many practical scenarios, it is not easy to create or increase coherence in quantum systems MarvS16 ; StreAP16 . Understanding the limit of random number generation in such practical scenarios is thus of paramount interest not only to theoretical study, but also to real applications. Although coherence is indispensable in many applications, such as laser and quantum metrology, the resource theory of coherence was not established until recently Aber06 ; BCP ; WintY16 ; StreAP16 ; Chitambar16PRL ; HuHPZ17 . Under this framework, Yuan et al. YZCM ; YZCM2 showed that the amount of randomness upon measurement on the computational basis is closely related to several important coherence measures, such as the relative entropy of coherence and coherence of formation. The relation between our paper and YZCM is explained in more detail in Appendix I. However, the extraction of uniform random numbers under general incoherent operations has not been discussed.

Motivated by the problem mentioned above, in this paper we study the secure extraction of uniform random numbers under incoherent strategies, which include the measurement on the computational basis and general incoherent operations (or incoherence-preserving operations) Aber06 ; BCP ; WintY16 ; StreAP16 . To guarantee the security of the random numbers generated, we assume that the environment of the relevant quantum state is controlled by Eve; see Fig. 1. We show that the maximum secure extraction rate is equal to the relative entropy of coherence. By contrast, the extraction rate coincides with the coherence of formation if Eve’s operations are constrained in a special way. The condition under which the extraction rates in the two scenarios coincide has a simple description. Furthermore, we show that the exponential decreasing rate of the leaked information is characterized by Rényi relative entropies of coherence. These results not only clarify the power of incoherent strategies in extracting random numbers, but also endow operational meanings to a number of important coherence measures.

The resource theory of coherence is characterized by the set of incoherent states, denoted by $\mathcal{I}$, and the set of incoherent operations Aber06 ; BCP ; WintY16 ; StreAP16 . Recall that a state is incoherent if it is diagonal with respect to the reference computational basis. A quantum operation, represented by a completely positive trace preserving (CPTP) map, is incoherence-preserving (also called maximally incoherent) if it maps incoherent states to incoherent states Aber06 . It is incoherent if, in addition, each Kraus operator in its Kraus representation maps incoherent states to incoherent states up to normalization BCP . An incoherent operation is physically incoherent if it admits an incoherent Stinespring dilation Chitambar16PRL . For unitary transformations, the three types of operations coincide. A unitary operator is incoherent if and only if (iff) each row and each column has only one nonzero entry.

The relative entropy of coherence $C_{\mathrm{r}}(\rho)$ of a quantum state $\rho$ is the minimum relative entropy between the state and any incoherent state BCP ; Aber06 ,

[TABLE]

where $S(\rho\|\sigma):=\operatorname{tr}\rho(\log\rho-\log\sigma)$ is the relative entropy between $\rho$ and $\sigma$, $S(\rho)$ is the von Neumann entropy of $\rho$, and $\rho^{\operatorname{diag}}$ is the diagonal part of $\rho$. In this paper “log” has base 2. The coherence of formation $C_{\mathrm{F}}(\rho)$ is the convex roof of $C_{\mathrm{r}}(\rho)$ Aber06 ; YZCM ,

[TABLE]

where $\{p_{j},|\psi_{j}\rangle\}$ satisfies $\rho=\sum_{j}p_{j}|\psi_{j}\rangle\langle\psi_{j}|$. It is known that the relative entropy of coherence $C_{\mathrm{r}}(\rho)$ is equal to the distillable coherence, and the coherence of formation $C_{\mathrm{F}}(\rho)$ is equal to the coherence cost WintY16 .

In practice, Alice repeatedly generates many copies of identical and independent quantum states. This assumption allows us to write the state of the whole system as a tensor product, so our problem can be formulated as follows. Suppose Alice holds $n$ copies of the quantum state $\tilde{\rho}_{A}$ on system $\mathcal{H}_{A}$ whose environment is controlled by Eve. All the information of Eve about Alice’s systems is encoded in a purification, say $\tilde{\rho}^{\otimes n}$, of $\tilde{\rho}_{A}^{\otimes n}$. Alice is allowed to perform only incoherent strategies, which can be divided into three steps without loss of generality. First, she applies an incoherent unitary operation $U_{\mathrm{i},n}$ on the system and an ancilla system $\mathcal{H}_{B}$, whose initial state is $|0\rangle$. Second, she performs the measurement $\mathsf{M}_{\mathrm{c},n}$ on the computational basis, whose set of outcomes is denoted by ${\cal A}^{n}$. Finally, as post-measurement processing, she applies a random hash function $F_{n}$ from ${\cal A}^{n}$ to a suitable set ${\cal L}_{n}$. The cardinality (number of elements) of ${\cal L}_{n}$ is denoted by $|{\cal L}_{n}|$, which also expresses the dimension of the output system. In this paper, a random variable is denoted by an italic capital letter, and its probability space by the same letter in mathcal font. The incoherent strategy of Alice is characterized by the triple $(U_{\mathrm{i},n},\mathsf{M}_{\mathrm{c},n},F_{n})$ and is denoted by $\mathsf{M}_{F_{n}}$ for simplicity. The cardinality $|{\cal L}_{n}|$ is also denoted by $|\mathsf{M}_{F_{n}}|$.

To determine the maximum extraction rate of secure uniform random numbers, we need a security measure. When the whole system is characterized by a C-Q state ${\rho}_{AE}$, a widely accepted measure on secure random numbers is the trace norm (also known as the Schatten 1-norm) between the real state and the ideal state,

[TABLE]

where $\tau_{V}$ is the completely mixed state on the $V$-dimensional system. So, $\tau_{|{\cal A}|}$ expresses the completely mixed state on $\mathcal{H}_{A}$. The significance of this measure lies in the fact that it is universally composable Renner ; RW .

Here the security measure of concern is the value $d_{1}(\mathsf{M}_{F_{n}}|F_{n}):=\mathbb{E}_{F_{n}}d_{1}(\mathsf{M}_{F_{n}}(\tilde{\rho}^{\otimes n}))$, where $\mathbb{E}_{F_{n}}$ expresses the expectation with respect to the choice of the random hash function. The maximum asymptotic extraction rate of secure uniform random numbers $R(\tilde{\rho}_{A})$ from the $n$-tensor product $\tilde{\rho}_{A}^{\otimes n}$ is defined as

[TABLE]

where the maximum is taken over sequences of incoherent strategies $\mathsf{M}_{F_{n}}$ which satisfy the given condition.

To compute the rate $R(\tilde{\rho}_{A})$, we need to study the uncertainty of Alice’s system from Eve’s viewpoint when the initial state on $\mathcal{H}_{A}\otimes\mathcal{H}_{E}$ is a pure state. This uncertainty can be measured by the conditional entropy $H(A|E)_{\tilde{\rho}}=S(\tilde{\rho})-S(\tilde{\rho}_{E})$. To maximize Eve’s uncertainty, Alice can introduce an ancilla system $\mathcal{H}_{B}$ prepared in the incoherent state $|0\rangle\langle 0|$, so that the initial state is $\tilde{\rho}\otimes|0\rangle\langle 0|$. Then she applies an incoherent unitary $U_{\mathrm{i}}$ on $\mathcal{H}_{A}\otimes\mathcal{H}_{B}$, which leads to the output state $\tilde{\rho}[U_{\mathrm{i}}]:=U_{\mathrm{i}}(\tilde{\rho}\otimes|0\rangle\langle 0|)U_{\mathrm{i}}^{\dagger}$. When $d_{B}:=\dim(\mathcal{H}_{B})\geq d_{A}:=\dim(\mathcal{H}_{A})$, a particularly interesting incoherent unitary is the the generalized CNOT gate defined as

[TABLE]

where the addition $x+y$ is modulo $d_{A}$.

where $U_{\mathrm{i}}$ is an incoherent unitary.

[TABLE]

Here the equality follows from the duality relation $H(A|E)_{\rho}+H(A|B)_{\rho}=0$, which holds whenever $\rho$ is pure; the first inequality follows from PlenVP00 (ZHC, , Lemma 4), the second inequality from the fact that incoherent states for a bipartite system are separable, and the third inequality from the fact that the relative entropy of coherence is monotonic under incoherence-preserving operations.

According to the duality relation and StreSDB15 (ZHC, , Theorem 1), $H(A|E)_{\tilde{\rho}[U_{\mathrm{CNOT}}]}=-H(A|B)_{\tilde{\rho}[U_{\mathrm{CNOT}}]}={C}_{\mathrm{r}}(\tilde{\rho}_{A})$, note that $\tilde{\rho}[U_{\mathrm{CNOT}}]_{AB}$ is a maximally correlated state Rain99 ; ZhuMCF17 ; ZhuHC17 . Therefore, $\max_{U_{\mathrm{i}}}H(A|E)_{\tilde{\rho}[U_{\mathrm{i}}]}=C_{\mathrm{r}}(\tilde{\rho}_{A})$. Now the proof of (6) is completed by the additivity relation $C_{\mathrm{r}}(\tilde{\rho}_{A}^{\otimes n})=nC_{\mathrm{r}}(\tilde{\rho}_{A})$ WintY16 ; ZHC . ∎

Theorem 1 is helpful for computing the extraction rate $R(\tilde{\rho}_{A})$ as follows. If Alice performs the measurement $\mathsf{M}_{\mathrm{c}}$ in the computational basis, then $\tilde{\rho}$ is turned into the state $\mathsf{M}_{\mathrm{c}}(\tilde{\rho}):=\sum_{x}|x\rangle\langle x|\otimes\langle x|\tilde{\rho}|x\rangle$, which satisfies

[TABLE]

After repeating this procedure and generating the state $\mathsf{M}_{\mathrm{c}}(\tilde{\rho})^{\otimes n}$, Alice applies a random hash function $F_{n}$ to the $n$ measurement outcomes with the extraction rate of uniform random numbers chosen to be $R$. Here the random hash function $F_{n}$ is assumed to satisfy the universal 2 condition as discussed in Appendix A Carter ; WC81 , which is conventional in generating secure random numbers from random numbers that might be partially leaked to the eavesdropper. The efficient construction of such hash functions was discussed in HT2 . In the independent and identical situation, Proposition 3 in Appendix A shows that the extracted random numbers are secure when the extraction rate $R$ is smaller than the conditional entropy $H(A|E)_{\mathsf{M}_{\mathrm{c}}(\tilde{\rho})}$. Therefore, we have $R(\tilde{\rho}_{A})\geq H(A|E)_{\mathsf{M}_{\mathrm{c}}(\tilde{\rho})}$. Since Alice can optimize the incoherent unitary before the measurement $\mathsf{M}_{\mathrm{c}}$, it follows that

[TABLE]

Conversely, as shown in Appendix B, the opposite inequality

[TABLE]

holds. Combining (6) of Theorem 1 with (9) and (10), we obtain the following theorem.

[TABLE]

where $U_{\mathrm{i}}$ is an incoherent unitary.

According to (8), (9), and (10), the maximum extraction rate $C_{\mathrm{r}}(\tilde{\rho}_{A})$ stated in Theorem 2 can be achieved by the measurement $\mathsf{M}_{\mathrm{c}}$ on the computational basis (without other incoherent operations) followed by classical data processing characterized by $F_{n}$. This strategy is denoted by $\mathsf{M}_{F_{n}}^{*}$ henceforth.

Now, we extend Alice’s incoherent unitaries to general incoherence-preserving CPTP maps acting on the system $\mathcal{H}_{A}\otimes\mathcal{H}_{B}$. If she uses a CPTP map whose final state is always the specific incoherent state $\sum_{i=0}^{d-1}\frac{1}{d}|i\rangle\langle i|$, the resulting conditional entropy equals $\log d$, which increases unlimitedly as $d$ increases. To avoid such a trivial advantage for Alice, similar to the study of quantum key distribution SP ; marco ; HQKD and private capacity LAZG , we assume that the environment $\mathcal{H}_{E^{\prime}}$ of the incoherence-preserving CPTP map $\Lambda_{\mathrm{i}}$ is also controlled by Eve, so that Eve has the two systems $\mathcal{H}_{E}$ and $\mathcal{H}_{E^{\prime}}$ in total. This is because it is not easy to exclude the possibility that Eve accesses a system that interacts with Alice’s operation. To cover such a worst scenario, we take this convention and consider the Stinespring representation $\rho_{E^{\prime}}[\Lambda_{\mathrm{i}}],U[\Lambda_{\mathrm{i}}]$ of $\Lambda_{\mathrm{i}}$, where $\rho_{E^{\prime}}[\Lambda_{\mathrm{i}}]$ is the initial pure state on the environment and $U[\Lambda_{\mathrm{i}}]$ is the unitary on the whole system. Note that $U[\Lambda_{\mathrm{i}}]$ may not be incoherent if $\Lambda_{\mathrm{i}}$ is not physically incoherent Chitambar16PRL , but this fact does not affect the following argument. Now the total output state is $\tilde{\rho}[\Lambda_{\mathrm{i}}]:=U[\Lambda_{\mathrm{i}}](\tilde{\rho}\otimes|0\rangle\langle 0|\otimes\rho_{E^{\prime}}[\Lambda_{\mathrm{i}}])U[\Lambda_{\mathrm{i}}]^{\dagger}$. Since $\tilde{\rho}[\Lambda_{\mathrm{i}}]$ is a pure state, we can still use the duality relation on conditional entropies. So, similar to (7), we have

[TABLE]

Again, the two inequalities are saturated when $\Lambda_{\mathrm{i}}$ is the generalized CNOT gate. Therefore, Theorems 1 and 2 still hold if incoherent unitaries are replaced by general incoherence-preserving operations.

Here, we need to discuss the relation with the distillable coherence $C_{\mathrm{D}}(\tilde{\rho}_{A})$ under incoherent operations, which is equal to $C_{\mathrm{r}}(\tilde{\rho}_{A})$ WintY16 . Note that coherence distillation may require incoherent operations across many copies, and these operations may not be physically incoherent. By contrast, to implement our optimal protocol, it suffices to perform the measurement $\mathsf{M}_{\mathrm{c}}$ followed by classical data processing, i.e., application of universal 2 hash functions, which is much easier.

Now, we remember that the criterion $d_{1}$ universally covers the distinguishability by Eve’s local measurement $\mathsf{M}_{E}$. Since the criterion $d_{1}$ is universally composable, the above discussion covers the case in which Eve chooses her local measurement $\mathsf{M}_{E}$ according to the choice of the hash function $f_{n}$. Now, we consider the scenario in which Eve cannot choose her local measurement $\mathsf{M}_{E}$ according to the random choice of the hash function $F_{n}$, although she knows which hash function $F_{n}$ is applied after her measurement $\mathsf{M}_{E}$. Here $f_{n}$ denotes a specific hash function, while $F_{n}$ denotes a random hash function. Given the $n$ tensor product state $\tilde{\rho}^{\otimes n}$, we introduce a new security criterion $\underline{d}_{1}(\mathsf{M}_{F_{n}}|F_{n})$ as

[TABLE]

where $\mathsf{M}_{E}$ is Eve’s POVM on the system $\mathcal{H}_{E}$. Then, instead of $R(\tilde{\rho}_{A})$, we define

[TABLE]

where the maximum is taken over sequences of incoherent strategies $\mathsf{M}_{F_{n}}$ which satisfy the given condition. The relation (13) implies the inequality $\overline{R}(\tilde{\rho}_{A})\geq{R}(\tilde{\rho}_{A})$. Instead of Theorem 2, we have the following theorem:

This theorem offers an operational meaning of the coherence of formation $C_{\mathrm{F}}(\tilde{\rho}_{A})$. Since the relation $C_{\mathrm{F}}(\tilde{\rho}_{A})\geq C_{\mathrm{r}}(\tilde{\rho}_{A})$ holds in general and the inequality is generically strict, Theorems 2 and 3 show that Alice can usually extract secure uniform random numbers with a higher rate if Eve chooses her measurement independently of the incoherent strategies of Alice. In conjunction with Theorem 10 in WintY16 , we can deduce the condition under which the rates in the two scenarios coincide.

The following corollary is an easy consequence of Theorem 4; a direct proof is presented in the appendix.

In many topics of quantum information, the Rényi entropies characterize the exponential decreasing rate of the error probability, which determines the speed of convergence c-expo ; s-expo . Concerning secure uniform random number generation, it is known that the exponential decreasing rate of the leaked information is characterized by Rényi conditional entropies, as explained in Appendix A. To determine the speed of convergence $d_{1}(\mathsf{M}_{F_{n}}|F_{n})\to 0$, we introduce the Rényi relative entropy of coherence $\underline{C}_{\mathrm{r},\alpha}(\rho):=\min_{\sigma\in\mathcal{I}}\underline{S}_{\alpha}(\rho\|\sigma)$ Chitambar ; ZHC based on the Rényi relative entropy \underline{S}_{\alpha}(\rho\|\sigma):=\frac{1}{\alpha-1}\log\operatorname{tr}\bigl{(}\sigma^{\frac{1-\alpha}{2\alpha}}\rho\sigma^{\frac{1-\alpha}{2\alpha}}\bigr{)}^{\alpha} with $\alpha\geq 0$ MullDSF14 ; WildWY14 Ha3 (Haya17book, , Theorem 5.13). Combining Proposition 2 in Appendix A with a generalization of Theorem 1 in Appendix D, we can derive the following theorem, whose proof is relegated to Appendix E.

[TABLE]

Theorem 5 shows that the exponential decreasing rate of the leaked information of the strategy $\mathsf{M}_{F_{n}}^{*}$ is characterized by Rényi relative entropies of coherence. In other words, the quality of the random numbers extracted in this way is controlled by these coherence measures. In information theory, another useful security measure is the relative entropy between the true state and the ideal state CN , which is known to be the unique measure under several natural assumptions (epsilon, , Theorem 8). In Appendix F we show that an analog of Theorem 5 holds for this alternative measure.

*Conclusion: * We studied the extraction of secure uniform random numbers in the quantum-quantum setting under incoherent strategies, assuming that Eve can access all of the environment of the given system. This problem properly reflects the situation of a quantum random number generator. We showed that the maximum rate of extraction is equal to the relative entropy of coherence. In contrast, the extraction rate with a constrained eavesdropper is equal to the coherence of formation. Furthermore, the exponential decreasing rate of the leaked information is characterized by Rényi relative entropies of coherence. These results not only clarify the capability of incoherent strategies in extracting secure uniform random numbers, but also endow coherence measures mentioned above with operational meanings.

To apply our results to the security evaluation of a quantum random number generator, we need to estimate the quantum state $\tilde{\rho}_{A}$ on Alice’s system priorly. Fortunately, as explained in Appendix H, this task can be achieved by quantum state tomography, which has been well established Hol ; Gill ; HayaB (Haya17book, , Chapter 6). Even when Alice’s quantum system cannot be trusted, we can estimate the quantum state $\tilde{\rho}_{A}$ of Alice’s system by combining the method of self testing MY2 ; McKague1 ; HH . Therefore, our study is helpful to the design of a quantum random number generator; see Appendix H for more details.

Appendix A Secure uniform random number extraction from a C-Q state

Here, we summarize known results on secure uniform random number extraction when the state is a C-Q state on the composite system $\mathcal{H}_{A}\otimes\mathcal{H}_{E}$, which has the form

[TABLE]

Given a function $f$, we define the state

[TABLE]

To study secure uniform random number extraction from a C-Q state, we need to consider the uncertainty quantified by three types of Rényi conditional entropies,

[TABLE]

Here the two types of Rényi relative entropies are defined as MullDSF14 ; WildWY14 (Haya17book, , Section 3.1)

[TABLE]

which satisfy the inequality $S_{\alpha}(\rho\|\sigma)\geq\underline{S}_{\alpha}(\rho\|\sigma)$. Both $S_{\alpha}(\rho\|\sigma)$ and $\underline{S}_{\alpha}(\rho\|\sigma)$ increase monotonically with $\alpha$.

To extract secure uniform random numbers, we can employ a universal 2 hash function. A random function $F$ from ${\cal A}$ to ${\cal Z}$ is called universal 2 hash if

[TABLE]

for $a\neq a^{\prime}\in{\cal A}$. This type of hash functions satisfy the following leftover hashing lemma.

Proposition 1* (Renner ).*

Let $F$ be a universal 2 hash function from ${\cal A}$ to ${\cal Z}$. Then, we have

[TABLE]

To characterize the ultimate amount of extracted secure uniform random numbers, we define the rate

[TABLE]

where $|F_{n}|$ denotes the cardinality of the image of $F_{n}$ and the supremum is taken over sequences of random hash functions which satisfy the given condition. The quantity $K(\rho_{AE})$ expresses the maximum extraction rate of secure uniform random numbers.

In this setting, the simple application of Proposition 1 cannot guarantee the exponential decrease of the leaked information even when the extraction rate $R$ of uniform random numbers is smaller than the conditional entropy $H(A|E)_{\rho_{AE}}$. To resolve this problem, we employ another proposition based on the discussions in Ha1 , which in turn rely on Proposition 1.

Proposition 2*.*

If a sequence of hash functions $F_{n}$ from ${\cal A}^{n}$ to $\{1,\ldots,2^{nR}\}$ is universal 2 hash, then

[TABLE]

Proof.

First, we introduce the quantity (Ha1, , Section IV)

[TABLE]

where $\min_{\rho_{AE}^{\prime}}$ denotes the minimum under the condition $\operatorname{tr}\rho_{AE}^{\prime}\leq 1$ and $\rho_{AE}^{\prime}\geq 0$, while $\min_{\sigma_{E}}$ denotes the minimum over normalized states $\sigma_{E}$. Here, the quantity $\underline{S}_{2}(\rho^{\prime}\|\sigma)$ is defined in the same way as in (23), that is, \underline{S}_{2}(\rho^{\prime}\|\sigma)=\frac{1}{\alpha-1}\log\operatorname{tr}\bigl{(}\sigma^{\frac{1-\alpha}{2\alpha}}\rho^{\prime}\sigma^{\frac{1-\alpha}{2\alpha}}\bigr{)}^{\alpha}, even when $\rho^{\prime}$ is not normalized. Then, as shown in (Ha1, , (73)), Proposition 1 implies that

[TABLE]

Let $v_{n}$ be the number of distinct eigenvalues of $\sigma_{E}^{\otimes n}$. Then the inequality (Ha1, , the next inequality of (83)) yields that

[TABLE]

for $s\in[0,1]$, where the CPTP map ${\mathsf{E}}_{\sigma}$ is defined as

[TABLE]

assuming that $\sigma$ has the spectral decomposition $\sigma=\sum_{x}\lambda_{x}E_{x}$.

Since $v_{n}$ is a polynomial in $n$, we have

[TABLE]

In addition,

[TABLE]

according to MO (Haya17book, , (3.17)). Combining the four equations (28), (29), (31), and (32) yields

[TABLE]

Taking the maximum of the right hand side (RHS) of (33) over $\sigma_{E}$, we obtain (27). ∎

When $R<H(A|E)$, according to Proposition 2, the amount of leaked information \mathbb{E}_{F_{n}}d_{1}\bigl{(}(\rho^{\otimes n})_{F_{n}(A)E}\bigr{)} goes to zero. Hence, we have

[TABLE]

Since the opposite inequality also holds Renner (Ha1, , (93)), we deduce the following proposition.

Proposition 3*.*

Renner (Ha1, , (94))

[TABLE]

In the current context, we often consider another security criterion $I^{\prime}(\rho_{AE})$ defined as the relative entropy between the true state and the ideal state (Ha1, , (29))(Ha2, , (9)),

[TABLE]

where $\tau_{|{\cal A}|}$ denotes the completely mixed state on $\mathcal{H}_{A}$. Under this security criterion, we have the following analog of Proposition 2.

Proposition 4*.*

(Ha2, , (33)) If a sequence of hash functions $F_{n}$ from ${\cal A}^{n}$ to $\{1,\ldots,2^{nR}\}$ is universal 2 hash, then

[TABLE]

Appendix B Proofs of (10) and Theorem 3

*Proof of (10):  * Let $\mathsf{M}_{F_{n}}=(U_{\mathrm{i},n},\mathsf{M}_{\mathrm{c},n},F_{n})$ be a sequence of incoherent strategies that satisfy $d_{1}(\mathsf{M}_{F_{n}}|F_{n})\to 0$, that is,

[TABLE]

Then

[TABLE]

according to Fannes inequality for the conditional entropy (Haya17book, , Exercise 5.38)Alicki . Since $\tau_{|\mathsf{M}_{F_{n}}|}$ is the completely mixed state on the $|\mathsf{M}_{F_{n}}|$-dimensional system, we have $H(A|E)_{\tau_{|\mathsf{M}_{F_{n}}|}\otimes\mathsf{M}_{F_{n}}(\tilde{\rho}^{\otimes n})_{E}}=\log|\mathsf{M}_{F_{n}}|$, which implies that

[TABLE]

Now (10) is a consequence of the following equation

[TABLE]

$\Box$

*Proof of Theorem 3:  * If $R<\min_{\mathsf{M}_{E}}H(A|E)_{\mathsf{M}_{\mathrm{c}}(\mathsf{M}_{E}(\tilde{\rho}))}$, then Alice can extract uniform random numbers using the method described in Appendix A, and Proposition 2 there guarantees that the extracted random numbers are secure. Therefore,

[TABLE]

where $(a)$ follows from the fact that any decomposition of $\tilde{\rho}_{A}$ can be induced by a suitable POVM on $\mathcal{H}_{E}$.

Let $\mathsf{M}_{F_{n}}=(U_{\mathrm{i},n},\mathsf{M}_{\mathrm{c},n},F_{n})$ be a sequence of incoherent strategies whose extraction rate is $R$ and which satisfies $\underline{d}_{1}(\mathsf{M}_{F_{n}}|F_{n})\to 0$. Since $\mathbb{E}_{F_{n}}d_{1}(\mathsf{M}_{F_{n}}(\mathsf{M}_{E}(\tilde{\rho})^{\otimes n}))\to 0$ for any local measurement $\mathsf{M}_{E}$ of Eve, using the same argument that leads to (41), we can show the inequality

[TABLE]

Taking the minimum over $\mathsf{M}_{E}$, we have

[TABLE]

which yields the opposite inequality to (42). $\Box$

Appendix C Possibility of extension of Theorem 3

Since the coherence of formation is additive, that is, $C_{\mathrm{F}}(\rho^{\otimes n})=nC_{\mathrm{F}}(\rho)$ WintY16 , one might expect a further extension of Theorem 3. That is, one might speculate that the relation $\overline{R}(\tilde{\rho}_{A})=C_{\mathrm{F}}(\tilde{\rho}_{A})$ holds even when the condition $\underline{d}_{1}(\mathsf{M}_{F_{n}}|F_{n})\to 0$ is replaced by the stronger condition $\max_{\mathsf{M}_{E,n}}\mathbb{E}_{F_{n}}d_{1}(\mathsf{M}_{F_{n}}(\mathsf{M}_{E,n}(\tilde{\rho}^{\otimes n})))\to 0$. Here, note that $\mathsf{M}_{E,n}$ is a POVM on the $n$-tensor product system; by contrast, in the definition of $\underline{d}_{1}(\mathsf{M}_{F_{n}}|F_{n})$, Eve’s POVMs are restricted to tensor powers of POVMs on individual systems. However, the additivity of $C_{\mathrm{F}}$ alone does not imply this stronger statement.

This stronger statement would follow from a stronger condition as described as follows. Given $\alpha>0$, define the Rényi coherence of formation as

[TABLE]

where $\{p_{j},|\psi_{j}\rangle\}$ satisfies $\rho=\sum_{j}p_{j}|\psi_{j}\rangle\langle\psi_{j}|$. As shown later,

[TABLE]

In addition, if the classical Rényi conditional entropy satisfied the chain rule, i.e.,

[TABLE]

then the Rényi coherence of formation would be additive,

[TABLE]

for any pair of density matrices $\rho_{1}$ and $\rho_{2}$ on $A_{1}$ and $A_{2}$. Assuming this additivity relation, we can show the inequality

[TABLE]

for $s\in[0,1/2]$, where $\mathsf{M}_{F_{n}}^{*}$ denotes the optimal incoherent strategy composed of the computational-basis measurement and the application of the universal 2 hash function $F_{n}$. In this way, the combination of (46) and (49) implies that $\max_{\mathsf{M}_{E,n}}\mathbb{E}_{F_{n}}d_{1}(\mathsf{M}_{F_{n}}^{*}(\mathsf{M}_{E,n}(\tilde{\rho}^{\otimes n})))\to 0$ if $R<C_{\mathrm{F}}(\tilde{\rho}_{A})$.

However, it is known that the Rényi conditional entropy does not satisfy the chain rule satisfied by the usual conditional entropy even in the classical case Dupuis ; FB . This quantity satisfies only a weaker version of the chain rule (Dupuis, , Theorem 1)(Ha4, , Corollary 87) (FB, , Theorem 3). Hence, it is not easy to show the relation $\overline{R}(\tilde{\rho}_{A})=C_{\mathrm{F}}(\tilde{\rho}_{A})$ with the above replacement.

*Proof of (46):  * For a given $\{p_{j},|\psi_{j}\rangle\}$, the value $\sum_{j}p_{j}2^{(1-\alpha)C_{\mathrm{r},1/\alpha}(|\psi_{j}\rangle\langle|\psi_{j}|)}$ equals $1$ when $\alpha=1$. So, the formula of the logarithmic derivative $\frac{d}{dx}\log f(x)=\frac{1}{\ln 2}\frac{df}{dx}(x)/f(x)$ yields that

[TABLE]

which implies (46). $\Box$

*Derivation of (48) assuming the chain rule (47): *When $\rho$ is pure, according to Chitambar ; ZHC , we have

[TABLE]

where

[TABLE]

is the Rényi $\alpha$-entropy. So the Rényi coherence of formation can be expressed as

[TABLE]

where $\{p_{j},\bar{\rho}_{j}\}$ satisfies $\rho=\sum_{j}p_{j}\bar{\rho}_{j}$, and $J$ denotes the classical system of the register. The expression (52) follows from the fact that the minimum is attained when all $\bar{\rho}_{j}$ are pure.

To prove (48), suppose $\rho_{1}\otimes\rho_{2}$ has an optimal pure-state decomposition $\rho_{1}\otimes\rho_{2}=\sum_{j}p_{j}\bar{\rho}_{j}$ such that

[TABLE]

Let $\sigma:=\sum_{j}p_{j}\bar{\rho}_{j}\otimes|j\rangle\langle j|$; then

[TABLE]

where $\mathsf{M}_{\mathrm{c},1}$ and $\mathsf{M}_{\mathrm{c},2}$ express the computational-basis measurements on $A_{1}$ and $A_{2}$, respectively. Now, the chain rule (47) implies that

[TABLE]

Since the opposite inequality

[TABLE]

is an easy consequence of the definition, we deduce (48), assuming that the chain rule (47) holds.

*Derivation of (49) assuming the additivity relation (48): * When $\rho$ is a diagonal density matrix, the paper (epsilon, , Proposition 21) showed that

[TABLE]

for $s\in[0,1/2]$. Therefore,

[TABLE]

if $s\in[0,1/2]$ and $F_{n}$ is universal 2 hash. Here $(a)$ follows from the combination of (28), (52), and (57), while $(b)$ follows from the additivity of the Rényi coherence of formation.

Appendix D Generalization of Theorem 1

Before proving Theorem 5, which characterizes the exponential decreasing rate of the leaked information, we need to generalize Theorem 1 in terms of Rényi conditional entropies and Rényi relative entropies of coherence.

The two types of Rényi relative entropies defined in (22) and (23) can be used to define two types of coherence measures Chitambar ; ZHC ,

[TABLE]

both of which increase monotonically with $\alpha$. The following theorem generalizes Theorem 1 and thereby demonstrates the significance of these Rényi relative entropies of coherence.

Theorem 6*.*

[TABLE]

where $U_{\mathrm{i}}$ is an incoherent unitary, $\Lambda_{\mathrm{i}}$ is an incoherence-preserving operation, (59) holds for $\alpha,\beta\in[\frac{1}{2},\infty]$ with $\frac{1}{\alpha}+\frac{1}{\beta}=2$, while (60) holds for $\alpha\in[\frac{1}{2},\infty]$ and $\beta\in[0,2]$ with $\alpha\beta=1$.

The proof of Theorem 6 relies on the duality relations between Rényi conditional entropies. When $\rho$ is a pure state across the three systems $\mathcal{H}_{A},\mathcal{H}_{B}$, and $\mathcal{H}_{E}$, these conditional entropies obey the following duality relations MullDSF14 Ha3 (Haya17book, , Theorem 5.13)C6 :

[TABLE]

where (61) holds for $\alpha,\beta\in[\frac{1}{2},\infty]$ with $\frac{1}{\alpha}+\frac{1}{\beta}=2$ and (62) holds for $\alpha,\beta\in[0,\infty]$ with $\alpha\beta=1$.

*Proof of Theorem 6:  * Let $\beta=\alpha/(2\alpha-1)$, then $\frac{1}{\alpha}+\frac{1}{\beta}=2$. Let $U_{\mathrm{i}}$ be any incoherent unitary acting on $\mathcal{H}_{A}\otimes\mathcal{H}_{B}$; then

[TABLE]

Here the equality follows from (61), the first inequality follows from (ZHC, , Lemma 4), and the other two inequalities are trivial. According to (ZHC, , Theorem 1), the upper bound in the RHS of (63) is attained when $U_{\mathrm{i}}$ is the generalized CNOT gate, in which case $\tilde{\rho}[U_{\mathrm{i}}]_{AB}$ is maximally correlated.

By the same reasoning as above, we deduce the equality $\max_{\Lambda_{\mathrm{i}}}\overline{H}_{\alpha}^{\uparrow}(A|E)_{\tilde{\rho}[\Lambda_{\mathrm{i}}]}=\underline{C}_{\mathrm{r},\beta}(\tilde{\rho}_{A})$, which in turn implies that $\max_{\Lambda_{\mathrm{i}}}\overline{H}_{\alpha}^{\uparrow}(A|E)_{\tilde{\rho}^{\otimes n}[\Lambda_{\mathrm{i}}]}=\underline{C}_{\mathrm{r},\beta}(\tilde{\rho}_{A}^{\otimes n})$. Now the proof of (59) is completed by the additivity relation $\underline{C}_{\mathrm{r},\beta}(\tilde{\rho}_{A}^{\otimes n})=n\underline{C}_{\mathrm{r},\beta}(\tilde{\rho}_{A})$, which is shown in (ZHC, , Theorem 3).

Finally, (60) can be proved in a similar way. $\Box$

Appendix E Proof of Theorem 5

Proof of Theorem 5.

Applying Proposition 2 in Appendix A, we deduce that

[TABLE]

Now Theorem 5 is a corollary of the following equation

[TABLE]

where the second equality follows from (59) in Theorem 6. ∎

Appendix F Security analysis based on an alternative criterion

Here we analyze the exponential decreasing rate of the alternative security measure $I^{\prime}({\rho}_{AE})$ defined in (36), which denotes the relative entropy between the true state and the ideal state CN . Similar to Theorem 5, we have

[TABLE]

Again, the exponential decreasing rate of the leaked information is controlled by Rényi relative entropies of coherence. To prove (66), note that

[TABLE]

according to Proposition 4 in Appendix A. Now (66) is a corollary of the following equation

[TABLE]

where the second equality follows from (60) in Theorem 6.

Appendix G Proof of Corollary 1

In view of Theorems 2 and 3, Corollary 1 is an immediate consequence of the following lemma.

Lemma 1*.*

A qubit state $\rho$ saturates the inequality $C_{\mathrm{F}}(\rho)\geq C_{\mathrm{r}}(\rho)$ iff $\rho$ is pure or incoherent.

Proof.

The inequality $C_{\mathrm{F}}\geq C_{\mathrm{r}}$ holds in general because $C_{\mathrm{F}}$ is the convex roof of $C_{\mathrm{r}}$.

Any qubit state can be written as follows,

[TABLE]

Let $r=\sqrt{x^{2}+y^{2}+z^{2}}$, then

[TABLE]

where $H(p)=-p\log p-(1-p)\log(1-p)$, and the formula for $C_{\mathrm{F}}(\rho)$ was derived in Ref. YZCM . The relation between $C_{\mathrm{r}}$ and $C_{\mathrm{F}}$ was illustrated in Fig. 3 of YZCM2 .

If $\rho$ is pure, then $x^{2}+y^{2}+z^{2}=1$, so that C_{\mathrm{F}}(\rho)=C_{\mathrm{r}}(\rho)=H\bigl{(}\frac{1+z}{2}\bigr{)}. If $\rho$ is incoherent, then $x=y=0$, so that $C_{\mathrm{F}}=C_{\mathrm{r}}=0$.

To determine the condition for saturating the inequality $C_{\mathrm{F}}\geq C_{\mathrm{r}}$, first consider the case $y=z=0$, so that C_{\mathrm{r}}(\rho)=1-H\bigl{(}\frac{1+x}{2}\bigr{)} and C_{\mathrm{F}}(\rho)=H\bigl{(}\frac{1+\sqrt{1-x^{2}}}{2}\bigr{)}. By computing the first and second derivatives of $C_{\mathrm{F}}(\rho)-C_{\mathrm{r}}(\rho)$ with $x$, it is not difficult to prove that $C_{\mathrm{F}}(\rho)=C_{\mathrm{r}}(\rho)$ iff $x=0$ or $x=\pm 1$.

Next, consider the case $0<x<1$, $y=0$, $z\geq 0$, and $x^{2}+z^{2}<1$. Let $\rho_{1},\rho_{2}$ be two qubit states with Bloch vectors $(x,0,0)$ and $(x,0,\sqrt{1-x^{2}})$, respectively. Then $\rho$ is a convex combination of $\rho_{1}$ and $\rho_{2}$, that is, $\rho=p_{1}\rho_{1}+p_{2}\rho_{2}$ with $p_{1}>0$. In addition,

[TABLE]

Given that $C_{\mathrm{r}}$ is convex, we conclude that

[TABLE]

By symmetry $C_{\mathrm{r}}(\rho)<C_{\mathrm{F}}(\rho)$ whenever $x^{2}+y^{2}+z^{2}<1$ and $x^{2}+y^{2}>0$. Therefore, the inequality $C_{\mathrm{F}}(\rho)\geq C_{\mathrm{r}}(\rho)$ is saturated iff the qubit state $\rho$ is pure or incoherent. ∎

Appendix H Application to quantum random number generators

In this appendix, we explain the application of our study to the design of a quantum random number generator. Remember that our optimal incoherent strategy can be realized by the measurement $\mathsf{M}_{\mathrm{c}}$ in the computational basis followed by classical data processing. A quantum random number generator consists of the following ingredients: an internal quantum system, the device that performs the computational-basis measurement, and the data processor that extracts secure uniform random numbers. To make a quantum random number generator as an industrial product, the supplier needs to specify the method for preparing the state of the internal system, which can be identified by quantum state tomography Hol ; Gill ; HayaB (Haya17book, , Chapter 6).

To implement quantum state tomography, the supplier can apply suitable measurements to the quantum system and reconstruct the quantum state based on the measurement statistics. Since quantum measurements are destructive, to achieve sufficient precision in this procedure, usually many identically-prepared quantum states are needed to gather enough information. In addition, quantum state tomography may require operations that are not incoherent, but this is not a problem. Note that in the design stage of the random number generator, it is reasonable to assume that the supplier can access certain advanced equipments and are not restricted to incoherent operations, in contrast with the user stage of the device.

Once the internal state $\tilde{\rho}_{A}$ of the random number generator is determined, the supplier can choose the parameter $n$ and the extraction rate $R$ based on the upper bound determined by (28) and (29), so that the amount of leaked information $d_{1}(\mathsf{M}_{F_{n}}^{*}|F_{n})$ is less than a given threshold. Note that the combination of (28) and (29) allows to perform a finite-length analysis. Since $d_{1}(\mathsf{M}_{F_{n}}^{*}|F_{n})$ decreases exponentially with $n$, this task can be achieved with a suitable choice of the parameters as long as $\tilde{\rho}_{A}$ is sufficiently coherent. In addition, the supplier needs to design universal 2 hash functions so as to perform randomness extraction. Although random numbers are needed to apply random hash functions, the security is not compromised even if Eve knows which specific hash function is applied each time. Therefore, the supplier needs to design universal 2 hash functions only once, which can then be reused repeatedly. The user does not have to invest random numbers to operate the random number generator.

So far we have assumed that the measurement device for estimating the quantum state of the internal system is trustworthy. This assumption is not absolutely necessary. Even when the measurement device cannot be trusted, the supplier can identify the measurement device by applying the method of self testing MY2 ; McKague1 ; HH . The self testing was originally proposed using the CHSH test, which requires the preparation of a Bell state MY2 ; McKague1 . Recently, the paper HH improved it by proposing a hybrid method of the CHSH test and the Bell state test, i.e., the stabilizer test. Applying this method before quantum state tomography, the supplier can identify the measurement device so that the quantum state of the internal system can be guaranteed. Similarly, the measurement device for generating random numbers may not be trustworthy. In that case, the supplier can apply the self testing to this measurement device. In this way, the supplier can guarantee the security of the random numbers generated by the random number generator.

Appendix I Relation with YZCM

Here, we need to discuss the relation with the paper YZCM , which studied a related but different problem. The focus of the current paper is the extraction of uniform random numbers by incoherent strategies, which include the measurement on the computational basis and general incoherent operations (or incoherence-preserving operations). The focus of YZCM is the connection between intrinsic randomness and coherence measures. In information theory, the term “intrinsic randomness” usually means the extraction of uniform random numbers Ha5 ; Han . In YZCM , the term has a related but different meaning, that is, the randomness of measurement outcomes conditioned on Eve’s prediction. With this latter interpretation, YZCM showed that the intrinsic randomness of measurement outcomes with respect to the computational basis is equal to the coherence of formation, without discussing general protocols for extracting uniform random numbers.