Setting the stage

A schematic of our QRNG is shown in Fig. 1. An arbitrary quadrature of the vacuum state is measured using a balanced homodyne detector comprising a bright reference beam, a nominal symmetric beam splitter, and two photo diodes²³. The measurement outcomes ideally are random with a Gaussian distribution associated with the Gaussian Wigner function of the vacuum state²⁴. The measured distribution, however, contains two additional independent noise sources: excess optical noise and electronic noise, thereby contributing two side channels. These must be accounted for in estimating the min-entropy of the source.

Fig. 1

Schematic of the quantum random number generator.

A 1.6 mW 1550 nm laser beam was split into two by a 3 dB fiber coupler and detected by a home-made homodyne detector based on an MAR-6 microwave amplifier from Minicircuits and two 120 μm indium–gallium–arsenide photo diodes (PD). The output of the detector was amplified with another microwave amplifier, low pass filtered at 400 MHz, and digitized with a 16 bit 1-GSample/s analog-to-digital converter (ADC). The ADC output was read by a Xilinx Kintex UltraScale field-programmable gate array (FPGA). The ADC and FPGA were hosted by a PCI Express card from 4DSP (Abaco). The FPGA was used for real-time randomness extraction based on Toeplitz hashing. Random access memory (RAM) was used to store the output.

The amount of quantum randomness that can be extracted from the homodyne measurement of vacuum fluctuations is given by the leftover hash lemma against quantum side information^25,26

Theoretical analysis

The theoretical analysis of the security of the QRNG is made under the following assumptions:

A0 The predictions of quantum mechanics are reliable.

A1 The measurement performs homodyne detection on a single-mode and the measurement outcome is linear in the quadratures.

A2 The quantum state that is measured is a single mode thermal state with stationary mean photon number.

The analysis of the QRNG follows a device-dependent approach, which assumes that the system (and therefore the min-entropy of the source) does not change after system characterization (A2). The quantum side information comprises all information that can be extracted from the environment of the QRNG, i.e., from the rest of the universe. Therefore, under assumptions A0–A2, the bits extracted by the QRNG are random with respect to all (quantum and classical) side channels. Following A2, homodyne detection is performed on a single optical mode in a thermal state, which at a given time is characterized by the field quadratures $$ \widehat{q}$$ and $$ \widehat{p}$$.

The physical model of our device is derived in “Methods.” There we show that our device performs the measurement

In the following, we first present a theoretical analysis of a source emitting i.i.d. (independent and identically distributed) quantum states, i.e., a source of infinite bandwidth, and an ideal analog-to-digital converter (ADC). We then extend the security analysis to imperfect ADCs. Finally, we extend to a source with finite bandwidth that emits correlated (non-i.i.d.) quantum states at different times.

Limit of identical and independent distribution

Under ideal conditions, homodyne detection would allow us to measure the quadrature of a target optical mode, which in our setting is in the vacuum state. However, as discussed in detail in “Methods,” because of experimental imperfections, this vacuum signal is mixed with noise. Therefore, the non-ideal homodyne detector measures the quadrature $$ \widehat{q}$$ of a mode, denoted in the following as S, that is not in the vacuum state. Following assumption A2, said state is a thermal state, which we denote as ρ_S. We recall that a thermal state is uniquely characterized by the mean photon number n.

We require the random numbers to be statistically independent of any quantum or classical side information. Therefore, we need to analyze the correlations between the measured system S and its environment E. Following A0, the joint state of S and E is necessarily a pure state, ψ_SE, as the combined system SE is by definition isolated²⁷. There exist infinitely many purifications ψ_SE of the thermal state ρ_S. However, these purifications are all equivalent up to local unitary transformations in the environment E, and thus they all have the same information content²⁷. To perform our theoretical analysis, it is therefore sufficient to consider any of these purifications. We choose the two-mode squeezed vacuum (TMSV), which is a two-mode Gaussian state that purifies the thermal state²⁴. The environment E is thus described by a single bosonic mode.

The outcome X of homodyne detection on a thermal state with mean photon number n is a continuous real-valued variable, whose probability density distribution is

In our QRNG, the continuous variable X is mapped into a discrete and bounded variable $$ \overline{X}$$ due to the use of an ADC with range R and bin size Δx. We therefore consider a model in which X is replaced by a discrete variable $$ \overline{X}$$ that assumes values j = 1, 2, …, d with probability mass distribution

The correlations between the discretized outcome $$ \overline{X}$$ and the environment E are described by the classical-quantum (CQ) state,

We will now quantify the rate of the QRNG in terms of the conditional min-entropy with quantum side information. Given the state $$ {\rho }_{\overline{X}E}$$ in Eq. (6), the min-entropy of $$ \overline{X}$$ conditioned on the environment mode reads²⁸

In “Methods,” we compute a lower bound on this quantity following a particular choice for γ_E. The final result (which includes an optimization over the gain g—see “Methods” for the unoptimized result) is

ADC digitization noise

The above result assumed an ADC without digitization errors and noise. However, those imperfections reduce the extractable min-entropy. Given the true digitization outcome j, the noise replaces it with a different, possibly random, output f. For any given f, we count up to M possible true values j that map into f. In “Methods,” we show that this reduces the min-entropy by at most $$ \log M$$ bits, i.e.,

Beyond i.i.d.: stationary Gaussian process

We now consider the more realistic scenario of finite bandwidth. In the experimental implementation, the finite detection bandwidth, described by the impulse response of the detector, defines the temporal mode of the measured quantum state. Correlations arise due to the temporal overlap of the different modes. The process is still stationary and Gaussian (A2), however, not i.i.d. Here we use theoretical tools from information theory²⁹ and signal processing³⁰ to analyze this stationary Gaussian process. We first obtain a virtual i.i.d. model for the non-i.i.d. process. Then we apply the results of the previous section to compute a lower bound on the min-entropy with quantum side information of said virtual i.i.d. model.

The analysis deals with two stochastic processes. One is the outcome X of the homodyne measurement. The second stochastic process, denoted as U, describes the excess noise, i.e., all fluctuations in the measurement that are not purely vacuum fluctuations, including electronic noise of the detector and intensity noise of the local oscillator laser. Both X and U are stationary and Gaussian processes (A2). When a measurement is performed at a given time t, the homodyne outcome is denoted as X_t. Similarly, we denote as U_t the excess noise at time t.

The homodyne measurement outcome X_t comprises several components. Part of it comes from pure vacuum fluctuations and part comes from the excess noise. However, because of the finite bandwidth, X_t also contains a component that is determined by past measurement outcomes, denoted as X_<t. The component from past measurement outcomes is considered as side information.

We write the variance of X_t as $$ {\sigma }^2={\sigma }_X^2+\zeta $$, where ζ accounts for the fluctuations of X_<t, and $$ {\sigma }_X^2$$ accounts for all fluctuations that are independent of the past, i.e., the variance of X_t conditioned on X_<t. The conditional variance $$ {\sigma }_X^2$$ accounts for both pure vacuum fluctuations and for the excess noise. The conditional variance of the excess noise is denoted as $$ {\sigma }_U^2$$, and the variance of pure vacuum fluctuations is thus obtained as $$ {\sigma }_X^2-{\sigma }_U^2$$. Below we develop a theory that allows us to determine the quantities $$ {\sigma }_X^2$$, ζ, and $$ {\sigma }_U^2$$.

Let us first consider the stochastic process X. Given the time series of measured values $$ x_{t_k}$$, $$ \widehat{x}\left(\lambda \right)={\sum }_k{x}_{t_k}{e}^{ik\lambda }$$ is the Fourier transform, for λ ∈ [0, 2π]. The power spectral density (PSD) is then defined as $$ f_X\left(\lambda \right)=\mid \widehat{x}\left(\lambda \right){\mid }^2$$. The variance σ² and the PSD can be both estimated experimentally. In turn, from the PSD we can estimate the entropy rate^29,30,

Because of the finite bandwidth of the measuring apparatus, both the homodyne outcome X_t and excess noise U_t, at a given time t, are correlated with their values at previous times. To filter out the effects of these correlations, we consider the probability density distribution of X_t, conditioned on all past homodyne measurement outcomes,

In summary, we have defined an effective i.i.d. model for the non-i.i.d. signal. The i.i.d. model is characterized by the parameters n and g in Eq. (18). To determine these parameters, we need a second equation in addition to Eq. (18). Such a second equation is obtained through the conditional variance of the excess noise.

For the excess noise U_t, we can similarly write the probability density distribution conditioned on past values, i.e.,

By inverting Eqs. (18) and (21), we obtain the parameters n and g of the i.i.d. model of the non-i.i.d. process,

In conclusion, we use this virtual i.i.d. model to compute a lower bound for the min-entropy of the non-i.i.d. process, where the values for g and n in Eq. (3) are given in Eq. (22) and (24), respectively. In turn, this allows us to estimate the min-entropy rate using Eq. (9) (see also Eqs. (62) and (67) in “Methods”). This is plotted in Fig. 2 for varying excess noise, ADC resolution, and temporal correlations. The x-axis of the plot is the ratio of the conditional variance of the vacuum fluctuations and the excess noise, i.e., the quantum noise to excess noise ratio of the virtual i.i.d. process. If, as assumed for the plot in Fig. 2, the homodyne measurement outcomes and the excess noise have similar temporal correlations, this ratio is independent of the amount of correlations. The amount of correlations present in the system is instead characterized by the ratio $$ {\sigma }_X^2/{\sigma }^2$$, which takes the value of 1 for an i.i.d. process and becomes smaller for increasing temporal correlations. For each ADC resolution, the upper traces in Fig. 2 show the extractable min-entropy when almost no correlations are present. Obviously, stronger correlations yield lower randomness.

Fig. 2

Min-entropy versus the conditional quantum signal-to-noise ratio.

Min-entropy for 8-, 12-, and 16-bit analog-to-digital converter (ADC) resolution versus the ratio of conditional variance of the vacuum fluctuations and the conditional variance of the excess noise, $$ \left({\sigma }_X^2-{\sigma }_U^2\right)/{\sigma }_U^2$$. Here $$ {\sigma }_X^2$$ and $$ {\sigma }_U^2$$ are the conditional variance of the measurement outcomes and of the excess noise, respectively. The shaded areas indicate the regions between low correlations ($$ {\sigma }_X^2/{\sigma }^2=0.99$$), upper trace and high correlations ($$ {\sigma }_X^2/{\sigma }^2=0.1$$), lower trace. Thereby σ² is the variance of the measurement outcomes, which has been optimized to obtain the highest min-entropy. The ADC is assumed to be ideal without digitization errors.

Similar to the result for classical side information⁸, we show that random numbers can in principle be generated for noise treated as quantum side information as well and even in the large excess noise regime. This is due to the fact that relatively small vacuum fluctuations can give a substantial contribution to the entropy if the ADC resolution is sufficiently high. This property is preserved even when a large amount of temporal correlations is present in the recorded data (lower traces in Fig. 2). However, as discussed below, increasing the precision may not necessarily lead to an increase in the min-entropy in the presence of digitization errors.

System characterization

To be able to apply the theoretical result obtained above to our experimental implementation, we need to provide evidence that our implementation indeed fulfills the assumptions. This is in fact a difficult task and a detailed discussion can be found in “Methods.”

We are now in a position to estimate the min-entropy through characterization of our set-up. According to the theoretical analysis, the min-entropy can be found by determining the variance σ² as well as the conditional variances of the homodyne measurement outcomes $$ {\sigma }_X^2$$ and the excess noise $$ {\sigma }_U^2$$. To obtain a conservative, and thus reliable, estimate of the min-entropy, it is important that the measurement of these parameters does not rely on any ideality assumptions of the homodyne detector.

The first two parameters σ² and $$ {\sigma }_X^2$$ can be directly established from the PSD f_X(λ) of the homodyne measurement outcomes. The excess noise parameter $$ {\sigma }_U^2$$ is, however, more involved as its amount is determined by several sources whose individual contributions is too cumbersome to determine. Our goal is thus to establish the PSD of the excess noise f_U(λ) by determining the contribution of the vacuum fluctuations to the total noise. $$ {\sigma }_U^2$$ can then be computed from f_U(λ) = f_X(λ) − f_vac(λ), where f_vac(λ) is the PSD of the vacuum fluctuations.

To establish a lower bound on f_vac(λ), we basically consider the homodyne detector as a box (see Fig. 3a) with a quantum state input and an input–output relation given by Eq. (2) with unknown parameters. Our strategy is thus to measure the TF of the box by probing it with known quantum states and to use this result to conservatively calibrate the PSD of the vacuum fluctuations. This method allows us to establish a lower bound on the vacuum fluctuations under all experimental conditions, in particular where other noise sources couple into the detector, e.g., intensity noise of the laser due to imperfect common-mode rejection or stray light coupling into the signal port—likely to be an issue with integrated photonic chips.

Fig. 3

Characterization of the transfer function of the detection system to obtain the vacuum fluctuation noise level.

a Experimental set-up for the characterization. VATT variable optical attenuator, PD photo diode, ADC analog-to-digital converter, FPGA field-programmable gate array, RAM random access memory. b Power spectrum from a typical measurement. The transfer function is determined by the amplitude of the beat note. c Transfer function of the homodyne detector and the electronics including the analog-to-digital converter. Inset: transfer function with linear frequency scale.

The TF of the box is measured by injecting a coherent state in the form of a second laser beam (independent of the local oscillator laser) with low power P_sig into the signal port of the beam splitter as displayed in Fig. 3a. A typical beat signal is shown in Fig. 3b obtained by computing an averaged periodogram from the sampled signal. We record the TF(ν) by scanning the frequency of the signal laser. At each difference frequency ν, we determine the power of the beat signal and normalize it to P_sig. At high signal-to-noise ratio, the root-mean-square power of the beat signal is purely a function of the coherent state amplitude (determined by the signal laser power). It is independent of the noise of the detector, since the second term in Eq. (2), the noise term, can be neglected. The first term depending on the quadrature operator $$ {\widehat{X}}_a$$ can be decomposed into a dominating term depending on the coherent state amplitude and a negligible term depending on the noise of the input state, rendering the root-mean-square power independent of the laser noise properties.

Since the vacuum noise was amplified to optimally fill the range of the ADC, we used a 20-dB electrical attenuator with flat attenuation over the frequency band of interest to avoid saturation, see Fig. 3a. The result of the TF characterization, normalized to a maximum gain of 1, is shown in Fig. 3c.

Given the linearity of the detector (A1), we obtain the PSD of the vacuum fluctuations by multiplying the TF(ν) with the shot noise energy $$ ħ{\omega }_L$$ contained in 1 Hz bandwidth, where $$ ħ$$ is Planck’s constant and ω_L is the angular frequency of the local oscillator laser. By modeling the inner workings of the box, we confirm in Supplementary Note 5 that with this procedure we indeed obtain a lower bound on the PSD of the vacuum fluctuations.

The conservatively estimated PSD of the vacuum fluctuations is shown in Fig. 4a together with the actually measured PSD of the signal. The spectra are clearly colored which indicates that the data samples are correlated and therefore non-i.i.d. This is further corroborated in Fig. 4b, where the autocorrelation of the homodyne measurement outcomes is plotted. It justifies the importance of using the min-entropy relation associated with non-i.i.d. samples.

Fig. 4

Experimental results.

a The figure shows the power spectral densities (PSDs) of the measurement outcomes, the calibrated vacuum fluctuations (obtained by the system characterization), and the excess noise (obtained by subtracting the PSD of the vacuum fluctuations from the PSD of the measurement outcomes). b Autocorrelation coefficients calculated from the measured samples and averaged 1000 times. The inset shows a zoom. c Relative frequency of the digitization error of the analog-to-digital converter (ADC) with respect to the digitization results. The non-linearity and digitization noise of the ADC leads to a large reduction of the min-entropy.

From the PSDs, we calculate the three parameters for obtaining the min-entropy, which are summarized in Table 1. By minimizing the min-entropy over the confidence set of the estimated parameters, we obtain 10.74 bit per 16-bit sample with a failure probability of ϵ_PE = 10⁻¹⁰ (i.e., the probability that the actual parameters are outside the confidence intervals) under the assumption of an ideal ADC.

Table 1

Summary of the parameters determined by system characterization.

Parameter	Value
σ2	3.96 × 107 ± 0.09 × 107
$$ {\sigma }_X^2$$	3.29 × 107 ± 0.07 × 107
$$ {\sigma }_U^2$$	2.49 × 107 ± 0.06 × 107
Conditional quantum to excess noise ratio	−4.9 dB
Temporal correlations $$ {\sigma }_X^2/{\sigma }^2$$	0.83
Min-entropy, ideal ADC	10.74 bit
Reduction due to ADC digitization error	7.23 bit
Min-entropy	3.51 bit
Calculated secure length	1027 bit
Extracted length	1024 bit

Finally, we characterized the digitization error of our ADC, which is shown in Fig. 4c. The measurement protocol is described in Supplementary Note 3. The reduction of the min-entropy due to the digitization error is 7.23 bit with a confidence of 2 × 10⁻⁶ as 500,000 measurements have been used to construct the histogram for each digitization result. Thus this yields a total min-entropy of 3.51 bit. This relatively large reduction is due to the fact that our ADC is four-way interleaved and has a large analog bandwidth.

Physical model

Here we will develop a physical model of the QRNG using a description of optical modes by annihilation and creation operators in the Heisenberg picture³⁵. A schematic of our detector depicting the involved modes and parameters is shown in Fig. 5. Mode operators $$ \widehat{a}$$ and $$ \widehat{b}$$ denote the signal and local oscillator, respectively. The signal and the local oscillator are mixed at the central beam splitter, which, under ideal conditions, has 50% splitting ratio. In our model, we consider that the splitting ratio of the central beam splitter may deviate from perfect balancing by Δ. The optical modes at the output of the central beam splitter are measured by a pair of photo diodes, with quantum efficiencies η₁ and η₂, respectively. The non-unit efficiencies are modeled by introducing the auxiliary modes $$ {\widehat{l}}_1$$ and $$ {\widehat{l}}_2$$. Opto-electrical conversion is described by the constant K.

Fig. 5

Physical model of the QRNG showing the involved modes.

The local oscillator described by the mode $$ \widehat{b}$$ interferes with the vacuum state described by mode $$ \widehat{a}$$ at a beam splitter with reflectivity $$ \frac{1}{2}+\mathrm{\Delta }$$. The photo diode efficiencies are modeled as beam splitters with transmittivities η₁ and η₂, where the output modes from the central beam splitter are interfered with vacuum modes $$ {\widehat{l}}_1$$ and $$ {\widehat{l}}_2$$. The difference of the two photo currents from photo diodes PD1 and PD2, each generated by the light described by conversion factor K, is amplified electronically by h_amp, during which electronic noise is added to the output of the detector.

The local oscillator laser mode $$ \widehat{b}$$ can be written as $$ \widehat{b}=⟨\widehat{b}⟩+\delta \widehat{b}\equiv \beta +\delta \widehat{b}$$, where $$ ⟨\widehat{b}⟩$$ is the expectation value and $$ \delta \widehat{b}$$ describes the fluctuations. We operate our homodyne detector in the strong local oscillator regime, so that products of operators describing fluctuations are negligible: $$ \delta \widehat{x}\delta \widehat{y}\approx 0$$. We note that with local oscillator photon flux in the range of 10¹⁵ the detector operates deep within the strong local oscillator regime.

The modes that are detected by photo detection are given by

After subtraction and amplification, we obtain

The homodyne detection circuit implements a high-pass filter that removes the first term, which is constant. For an ideal homodyne detector, with Δ = 0 and η₁ = η₂ = 1, the output current of the detector reduces to

The finite bandwidth of the detector can be modeled by its impulse response h_amp, which is the Fourier transform of its frequency response. The output voltage is then given by

In our calibration method, described in the main text, we replace the vacuum state in the signal mode $$ \widehat{a}$$ with a coherent state. This allows us to estimate the contribution of the vacuum fluctuations, $$ {\widehat{X}}_a$$, to the PSD of the detector output.

Theoretical analysis in the i.i.d. limit

Consider a single optical mode characterized by the quadrature operators $$ \widehat{q}$$ and $$ \widehat{p}$$. For a thermal state ρ_S with mean photon number n, the first moments of the field quadratures vanish, and the covariance matrix (CM) is

As discussed above, the measured state ρ_S is purified into a TMSV. Thereby the second optical mode of this TMSV state, characterized by the field quadratures $$ {\widehat{q}}_{\mathrm{e}}$$ and $$ {\widehat{p}}_{\mathrm{e}}$$, is associated with the environment, i.e., the rest of the universe. The TMSV state is a Gaussian state with zero mean and CM²⁴

The correlations between the outcome X of ideal homodyne detection and the quantum side information in its environment are described by the CQ state

The continuous variable X is mapped into a discrete and bounded variable $$ \overline{X}$$ due to the use of an ADC. The probability mass distribution of $$ \overline{X}$$ is

In terms of the discrete variable $$ \overline{X}$$, the correlations with the environment are thus described by the state

We are now ready to quantify the rate of the QRNG in terms of the conditional min-entropy. Given the state $$ {\rho }_{\overline{X}E}$$ in Eq. (52), the min-entropy of $$ \overline{X}$$ conditioned on the eavesdropper (denoted with the letter E) reads²⁸

Since a direct computation of the min-entropy is not feasible, as it requires an optimization over all density operators γ_E in an infinite-dimensional Hilbert space, we instead focus on finding a computable lower bound. A first lower bound on the min-entropy is obtained by computing $$ \parallel {\gamma }_E^{-1/2}{\rho }_{\overline{X}E}{\gamma }_E^{-1/2}{\parallel }_{\infty }$$ for a given choice of the state γ_E, so that we have

A second lower bound is obtained by applying the triangular inequality,

Since $$ {\rho }_E^x$$ and γ_E are both Gaussian states, the above lower bound can be computed using the Gibbs representation techniques developed in ref. ³⁶. Employing these techniques and additional tools, ref. ³⁷ derived a formula for the min-entropy. By applying this result, we obtain (see Supplementary Note 2 for details)

To simplify the notation, we define

We hence obtain

Let us define the function

In conclusion, the best lower bound on the conditional min-entropy is

ADC digitization noise

ADCs are not ideal devices and are subject to digitization error. We model the digitization error by introducing:

A classical noise variable N, with associated probability distribution p_N;

A function f that describes how the noise variable i combines with the noiseless output value j to produce the noisy output f = f(j, i).

Using this model, the quantum side information about the output of the noisy ADC is described by the CQ state

We want to ensure that the randomness extracted is also independent on the noise variable N, therefore, we compute the min-entropy conditioned on EN,

Putting $$ {\gamma }_{EN}={\gamma }_E\otimes {\sum }_i{p}_N\left(i\right)∣i⟩⟨i∣$$, we obtain

It is difficult to estimate S_f∣i without making further assumptions on the noise underlying the ADC. However, we can experimentally estimate the cardinality ∣J_f∣ of the set J_f. Note that J_f contains S_f∣i for all i. We can then write a computable bound in terms of ∣J_f∣:

In conclusion, when compared with an ideal noiseless ADC, the randomness is reduced by at most b bits, with $$ b=\log \left[{\sup }_f\mid J_f\mid \right]$$.

Verification of assumptions in the theoretical analysis

An integral part is the verification that our implementation indeed fulfills the assumptions made in the theoretical analysis of the QRNG.

A2

The excess noise in the thermal state stems from relative intensity noise of the laser and the electronic noise of the homodyne circuit. Both are independent of the phase between local oscillator and the measured quantum state and can therefore be modeled as phase invariant state.

Having established the phase invariance of the measured state, we verify the Gaussianity of the measured signal. This can only be shown approximately and is displayed in Fig. 6a where we show the probability quantiles of the measured samples and compared those to the theoretical quantiles of a Gaussian distribution. This completes the verification of the assumption in the security proof that a thermal state is measured.

Fig. 6

Verification of assumption A2.

a Quantile–quantile plot indicating the Gaussianity of the measured samples. The variance of the samples has been normalized to 1. The limited analog-to-digital converter range truncates the tails of the Gaussian distribution, which results in slight deviations from the theoretical quantiles toward the ends. b Overlapped Allan deviation of vacuum state measurements. The stationarity condition is fulfilled when the experimental points follow the theory curve, which is the case until about 1000 s where it starts to deviate.

We are left with that the mean photon number of the thermal state shall be stationary. Also this can only be proven approximately. We computed the overlapped Allan deviation of the measurement outcomes, which is shown in Fig. 6b. It is clearly visible that in the short term the noise processes are stationary. Over longer times, some fluctuations become evident, which could lead to a lower min-entropy at times than estimated. A power stabilization of the local oscillator laser could improve this figure of merit. We, however, leave this investigation for future work.

Real-time randomness extraction

Having calculated the min-entropy, the next step is to extract random numbers. This is done by using a strong extractor based on a Toeplitz matrix hashing algorithm in which the seed can be reused³⁸. We chose matrix dimensions of n = 5632 bits and m = 1024 bits, which corresponds to 352 input samples with a depth of 16 bit and an output length m < l, chosen such that Eq. (1) was fulfilled with $$ H_{\min }=3.51$$ bit and ϵ_hash < 10⁻³². The 16-bit samples provided by the ADC at a rate of 1 GHz are received by the FPGA in chunks of 64 bits at a rate of 250 MHz. For the algorithm implementing the Toeplitz hashing, we followed the approach of ref. ²⁰. Every clock cycle 64 bits were stored in a block until n-bits were accepted, after which the next block started receiving data. For each full block, we carried out the hashing multiplication with bit-wise AND and subsequent XOR operations on the Toeplitz matrix by first splitting up the matrix into submatrices of width 16 bit and then shifting the data through the operations. When the hashing was completed, the m-bit-wide output data was stored in a register, and the next block was processed. The achieved throughput was 2.9 Gbit/s.

Reporting summary

Further information on research design is available in the Nature Research Reporting Summary linked to this article.