Quantum randomness protected against detection loophole attacks

Abstract

Device and semi-device-independent private quantum randomness generators are crucial for applications requiring private randomness. However, they are vulnerable to detection inefficiency attacks and this limits severely their usage for practical purposes. Here, we present a method for protecting semi-device-independent private quantum randomness generators in prepare-and-measure scenarios against detection inefficiency attacks. The key idea is the introduction of a blocking device that adds failures in the communication between the preparation and measurement devices. We prove that, for any detection efficiency, there is a blocking rate that provides protection against these attacks. We experimentally demonstrate the generation of private randomness using weak coherent states and standard avalanche photo-detectors.

Appendices

Appendix A: Guessing probability, min-entropy and randomness certification

The distribution of lengths of series of systems sent and not blocked by the blocking mechanism at a rate R is given by

$$\begin{aligned} P(R, k) = (1 - R)^{k-1} R, \end{aligned}$$

(12)

where $k \ge 1$ is the number of systems in a series.

Let us denote by $\alpha$ the ratio between the number of systems containing synchronization signal sent by P and the total number of systems sent by P, cf. the assumption III.

In a given series of transmitted systems of length k, the average number of photons before the first synchronizing system within that series is

$$\begin{aligned} \begin{aligned} F_\text {asyn}(\alpha , k)&= \left[ \sum _{i=0}^{k} i (1 - \alpha )^i \alpha \right] + k (1 - \alpha )^k \\&= \frac{1 - \alpha }{\alpha } \left( 1 - (1 - \alpha )^k\right) . \end{aligned} \end{aligned}$$

(13)

Using (13), we get that the probability that a particular photon received by M is not synchronized is

$$\begin{aligned} \begin{aligned} P_\text {asyn}(R, \alpha )&= \sum _{k=1}^{\infty } P(R, k) \frac{F_\text {asyn}(\alpha , k)}{k} \\&= \frac{1 - \alpha }{\alpha } \frac{R}{1 - R} \ln \left( \frac{\alpha + R - \alpha R}{R} \right) , \end{aligned} \end{aligned}$$

(14)

for $\alpha > 0$ and $P_\text {asyn}(R, 0) = 1$. Directly from the definition of $\alpha$, the probability that the received system is a synchronization signal is

$$\begin{aligned} P_\text {sig}(R,\alpha ) = \alpha . \end{aligned}$$

(15)

The probability that a received system is synchronized and not carrying a synchronization signal is

$$\begin{aligned} P_\text {syn}(R, \alpha ) = 1 - P_\text {asyn}(R, \alpha ) - P_\text {sig}(R,\alpha ), \end{aligned}$$

(16)

for $\alpha > 0$ and $P_\text {syn}(R, 0) = 0$. One can easily calculate that . Let us define $F_\text {syn}(R) \equiv \max _{\alpha \in [0,1]} P_\text {syn}(R, \alpha )$. Then,

$$\begin{aligned} \lim _{R \rightarrow 1^{-}} F_\text {syn}(R) = 0. \end{aligned}$$

(17)

If ${\mathbb {P}}$ is a mixture of distributions ${\mathbb {P}}_i$ with frequencies $\{\omega _i\}$, $\sum _i \omega _i = 1$, and an eavesdropper is aware which distribution i occurs, we have $P_{guess}[{\mathbb {P}}] \equiv \sum _i \omega _i P_{guess}[{\mathbb {P}}_i]$.

Let us consider separately runs of the protocol without synchronization (abbreviated as “asyn”), runs containing synchronization signal (abbreviated as “sig”) and synchronized runs without the signal (abbreviated as “syn”).

Let $P_{guess}^\text {asyn}(p,\eta ),P_{guess}^\text {sig}(p,\eta ),P_{guess}^\text {syn}(p,\eta )$ be functions providing upper bounds on the maximal average guessing probabilities, $p_\text {asyn},p_\text {sig},p_\text {syn}$ be the average values of the certificate (3), and $\eta _\text {asyn},\eta _\text {sig},\eta _\text {syn}$ be the detection efficiencies (2), in the respective runs. These values cannot be observed individually by a user, but each of them has impact on the observed values of (3) and (2).

Let $\mathbf {p} \equiv (p_\text {asyn},p_\text {sig},p_\text {syn})$ and $\mathbf {\eta } \equiv (\eta _\text {asyn},\eta _\text {sig},\eta _\text {syn})$. Note that $p_\text {asyn} \le c_Q$, $p_\text {sig} \le c_R$ and $p_\text {syn} \le c_S(\eta _\text {syn})$. Let ${\mathscr {M}} \equiv \{\text {asyn}, \text {sig}, \text {syn}\}$, ${\bar{\eta }} \equiv \sum _{i \in {\mathscr {M}}} \eta _i P_i(R,\alpha )$, and $\omega _i \equiv \frac{\eta _i P_i(R,\alpha )}{{\bar{\eta }}}$ for $i \in {\mathscr {M}}$, thus $\sum _{i \in {\mathscr {M}}} \omega _i = 1$.

Let us also define

$$\begin{aligned} P_{guess}^\text {fun} \left( R,\alpha ,\mathbf {p},\mathbf {\eta } \right)\equiv & {} \sum _{i \in {\mathscr {M}}} \omega _i P_{guess}^i(p_i, \eta _i), \end{aligned}$$

(18a)

$$\begin{aligned} p^\text {fun} \left( R,\alpha ,\mathbf {p},\mathbf {\eta } \right)\equiv & {} \sum _{i \in {\mathscr {M}}} \omega _i p_i, \end{aligned}$$

(18b)

$$\begin{aligned} \eta ^\text {fun} \left( R,\alpha ,\mathbf {\eta }\right)\equiv & {} {\bar{\eta }}. \end{aligned}$$

(18c)

Using the above expression, we can give the following upper bounds on the maximal average guessing probability for the blocking parameter R, the observed value p of the certificate (3) and the observed value $\eta$ of the detection efficiency (2):

$$\begin{aligned} \begin{aligned} P_{guess}(R,\eta ,p) \equiv&\underset{\begin{array}{c} \alpha \in [0,1] \\ \eta _\text {asyn},\eta _\text {sig},\eta _\text {syn} \in [0,1] \\ p_\text {asyn} \in [0,c_Q] \\ p_\text {sig} \in [0,c_R] \\ p_\text {syn} \in [0,c_S(\eta _\text {syn})] \end{array}}{\text {maximize}}&P_{guess}^\text {fun} \left( R,\alpha ,\mathbf {p},\mathbf {\eta } \right) \\&\quad \text {subject to } \quad&p^\text {fun} \left( R,\alpha ,\mathbf {p},\mathbf {\eta } \right) = p, \\&\eta ^\text {fun} \left( R,\alpha ,\mathbf {\eta }\right) = \eta . \end{aligned} \end{aligned}$$

(19)

Note that the constraints can be equivalently rewritten as $\sum _{i \in {\mathscr {M}}} \eta _i P_{guess}(R,\alpha ) = \eta p$ and ${\bar{\eta }} = \eta$, and these forms are used in “Appendix B”.

Since (19) involves (18a) to perform maximization, we need explicit formulae for $P_{guess}^i(p_i,\eta _i)$, $i \in {\mathscr {M}}$. Since “sig” runs are deterministic, we have $P_{guess}^\text {sig}(p_\text {sig},\eta _\text {sig}) \equiv 1$. $P_{guess}^\text {asyn}(p_\text {asyn},\eta _\text {asyn})$ is a guessing probability of an eavesdropper not exploiting the detection loophole, thus it doesn’t depend on $\eta _\text {asyn}$. We provide analysis for this function in this section below. The function $P_{guess}^\text {syn}(p_\text {syn},\eta _\text {syn})$ has to be developed independently for different formulae for the certificate (3), as this depends on a particular form of detection loophole attack.

Let us now consider a private SDI-QRNG protocol given by some certificate of a form (3) in some fixed dimension. For some $p \in (c_L, c_Q]$, we have the following formula for $P_{guess}^\text {asyn}(p,\eta )$:

$$\begin{aligned} \begin{aligned} \underset{ \{ \rho _x \}, \{ M^b_z \}, \{ N^e_{x,z} \}, {\varvec{g}} }{\text {maximize}} \quad&P_{guess}[{\mathbb {P}}_{B|XZE}] \\ \text {subject to } \quad&W[{\mathbb {P}}_{B|XZ}] = p. \end{aligned} \end{aligned}$$

(20)

Without restricting the power of an eavesdropper, we may assume that

$$\begin{aligned} {\mathbb {P}}_{E|XZ}(e|x,z) = {\mathbb {P}}_E(e), \end{aligned}$$

(21)

i.e., the probability of the result e does not depend on x and z. This can be obtained using proper extension of ${\mathscr {H}}_E$, or providing some additional “idle” information to an extended set E.

From (6), it follows that when $\left\{ \rho _x \right\}$, $\{M^b_z\}$ and $\left\{ N^e_{x,z} \right\}$ are fixed, then for an eavesdropper having access to ${\mathscr {H}}_E$ the optimal guessing function ${\varvec{g}}: X \times Z \times E \rightarrow B$ is

$$\begin{aligned} {\varvec{g}}(x,z,e) = \text {argmax}_b {\mathbb {P}}(b|x,z,e), \end{aligned}$$

(22)

i.e., a function returning a most probable result b for each x, z and e.

Using no-signaling ${\mathbb {P}}_{B|XZ}(b|x,z) = \sum _{e \in E} {\mathbb {P}}_{BE|XZ}(b,e|x,z)$ and (21), we get

$$\begin{aligned} {\mathbb {P}}_{B|XZ}(b|x,z) = \sum _e {\mathbb {P}}_{BE|XZ}(b,e|x,z) = \sum _e {\mathbb {P}}_E(e) {\mathbb {P}}_{B|XZE}(b|x,z,e). \end{aligned}$$

(23)

Thus, we can rewrite (20) as

$$\begin{aligned} \begin{aligned} \underset{ \{ \rho _x \}, \{ M^b_z \}, \{ N^e_{x,z} \}, {\varvec{g}} }{\text {maximize}} \quad&\sum _e {\mathbb {P}}_E(e) \sum _{x,z} {\mathbb {P}}_{XZ}(x,z) {\mathbb {P}}_{B|XZE}({\varvec{g}}(x,z,e)|x,z,e)\\ \text {subject to } \quad&\sum _e {\mathbb {P}}_E(e) \sum _{b,x,z} \beta _{b,x,z} {\mathbb {P}}_{B|XZE}(b|x,z,e) = p. \end{aligned} \end{aligned}$$

(24)

Obviously, $\sum _e {\mathbb {P}}_E(e) = 1$ and the probability distribution is obtained by quantum measurements, see (9b). We can relax the latter constraint and replace ${\mathbb {P}}_E(e)$ with nonnegative coefficients $c_e$, with $\sum _e c_e = 1$. Then (20) can be relaxed as

$$\begin{aligned} \begin{aligned} G(p)\equiv & {} \underset{ \{c_e\}, \{p_e\}}{\text {maximize}} \quad&c_e g(p_e, e) \\&\text {subject to } \quad&c_e \ge 0, \sum _e c_e = 1, \\&&p_e \in [c_L, c_Q], \sum _e c_e p_e = p, \end{aligned} \end{aligned}$$

(25)

where cf. (8),

$$\begin{aligned} \begin{aligned} g(p_e, e)\equiv & {} \underset{\begin{array}{c} \{ \rho _{x|e} \}, \{ M^b_{z|e} \}, \\ {\varvec{g}}(\cdot ,\cdot ,e): X \times Z \rightarrow B \end{array}}{\text {maximize}} \quad&\sum _{x,z} {\mathbb {P}}_{XZ}(x,z) {\mathbb {P}}_{B|XZe}({\varvec{g}}(x,z,e)|x,z) \\&\text {subject to } \quad&{\mathbb {P}}_{B|XZe}(b|x,z) \equiv {{\,\mathrm{Tr}\,}}\left[ \rho _{x|e} M^b_{z|e} \right] \\&&\sum _{b,x,z} \beta _{b,x,z} {\mathbb {P}}_{B|XZe}(b|x,z) = p_e. \end{aligned} \end{aligned}$$

(26)

Appendix B: Proof of the blocking protocol theorem

From (19), it follows that to have $P_{guess}(R,\eta ,p) = 1$ we need

$$\begin{aligned} P_{guess}^\text {asyn}(p_\text {asyn},\eta _\text {asyn}) = 1, \text { or} \end{aligned}$$

(27a)

$$\begin{aligned} \omega _\text {asyn} = 0. \end{aligned}$$

(27b)

For (27a) to hold, we need $p_\text {asyn} \le c_L$.

Now, assuming $p_\text {asyn} \le c_L$, and using $p_\text {sig} \le c_L$, we relax the constraints in the optimization problem (19):

$$\begin{aligned}&c_L \times (\omega _\text {asyn} + \omega _\text {sig}) + P_\text {syn}(R,\alpha ) \ge \eta p, \end{aligned}$$

(28a)

$$\begin{aligned}&\omega _\text {asyn} + \omega _\text {sig} \le \eta . \end{aligned}$$

(28b)

Using (28) and the theorem’s assumption $p > c_L$, we get

$$\begin{aligned} P_\text {syn}(R,\alpha ) \ge \eta \times (p - c_L) \equiv \epsilon > 0. \end{aligned}$$

(29)

From (17), we know there exists $R < 1$ such that $P_\text {syn}(R,\alpha ) < \epsilon$. The contradiction with $p_\text {asyn} \le c_L$ shows that (27a) cannot be satisfied for all R.

What remains for the proof is to show that also (27b) is not true. To show this considers the following relaxation of constraints in (19):

$$\begin{aligned} c_Q \omega _\text {asyn} + c_R \omega _\text {sig} + F_\text {syn}(R) \ge \eta p, \end{aligned}$$

(30)

and (28b). Substituting the latter into (30), we get

$$\begin{aligned} \omega _\text {asyn} \ge \frac{\eta \times (p - c_R) - F_\text {syn}(R)}{c_Q - c_R}. \end{aligned}$$

(31)

Since, for some blocking rate $R < 1$, the value of $F_\text {syn}(R)$ is arbitrary small and $p - c_R > 0$, we see that also (27b) is not satisfied. Therefore, there exists a blocking rate R such that $P_{guess}(R,\eta ,p) < 1$.

Appendix C: Randomness of $2 \rightarrow 1$ quantum random access code

A common example [6, 35, 36] of a certificate (3) is based on the so-called $2 \rightarrow 1$ quantum random access code [37, 38] in dimension 2:

$$\begin{aligned} W^{2 \rightarrow 1}\left[ {\mathbb {P}}_{B|XZ}\right] \equiv \frac{1}{8} \sum _{x \in X } \sum _{z \in Z } {\mathbb {P}}_{B|XZ}(b=x_z|x,z), \end{aligned}$$

(32)

with $X = \{00,01,10,11\}$, $Z = \{0,1\}$, $B = \{0,1\}$. Results of our experimental implementation of this QRAC are shown in Table 1.

Table 1 Observed experimental probabilities ${\mathbb {P}}(b|x,z)$ with error bars

To calculate the maximal average guessing probability and min-entropy in the proposed protocol, we performed optimization over the set of all probability distributions allowed by quantum mechanics using the see-saw technique [39, 40] of semi-definite programming [41] and computed $g(p_e, e)$ from (26) with:

$$\begin{aligned} \begin{aligned}&\underset{ \{ \rho _x \}, \{ M^b_z \}, {\varvec{{\tilde{g}}}}:X \times Z \rightarrow B}{\text {maximize}} \quad \frac{1}{8} \sum _{x,z} P({\varvec{{\tilde{g}}}}(x,z) | x, z) \\&\text {subject to } \quad \frac{1}{8} \sum _{x,z} P(x_z | x, z) = p_e, \\&P(b|x,z) = {{\,\mathrm{Tr}\,}}\left( \rho _x M^z_b \right) , \end{aligned} \end{aligned}$$

(33)

where $\{ \rho _x \} = \{ \rho _{00},\rho _{01},\rho _{10},\rho _{11} \}$ are states, $\{ M^b_z \} = \{ \{M^0_0,M^0_1\},\{M^1_0,M^1_1\} \}$ are measurements on a Hilbert space of dimension 2, and ${\varvec{{\tilde{g}}}}$ is a possible guessing strategy when x and z are known. We took ${\mathbb {P}}_{XZ}(x,z) = \frac{1}{ \left| X \, \right| \left| Z \, \right| } = \frac{1}{8}$. In this case, $c_L = \frac{3}{4}$ and $c_Q = \frac{1}{2}+\frac{\sqrt{2}}{4} \approx 0.8536$. The result of the optimization as a function of $p_e$ is shown in Fig. 3. From (25), we conclude the following formula for G(p):

$$\begin{aligned} G(p) = \frac{\frac{1}{2} + \frac{\sqrt{2}}{4} - 1}{\frac{1}{2} + \frac{\sqrt{2}}{4} - \frac{3}{4}} \times \left( p - \frac{3}{4}\right) + 1 = -\sqrt{2} \times \left( p - \frac{3}{4}\right) + 1. \end{aligned}$$

(34)

Fig. 3

(Color online) Maximal average guessing probability for a certificate (32) based on $2 \rightarrow 1$ quantum random access code obtained using see-saw technique with the formula (33). The function is not differentiable at points relating to changes of the optimal guessing function ${\varvec{g}}: X \times Z \rightarrow B$, which are ${\varvec{g}}_1(x_0,x_1,z) = x_0$, ${\varvec{g}}_2(x_0,x_1,z) = x_0 \cdot x_1 \vee x_1 \cdot z$ and ${\varvec{g}}_3(x_0,x_1,z) = x_z$ (reading from the left of the plot)

Now, we give the explicit formula for $P_{guess}^\text {syn}(p_\text {syn},\eta _\text {syn})$ for the considered protocol. M is allowed not to click in $1-\eta$ part of rounds, and using detection efficiency loophole it can mimic a higher value of the certificate (32). The method is the following.

If $\eta \le \frac{1}{2}$, then the malevolent vendor can use the following strategy for all inputs. P is encoding one bit from the input, $x_0$ or $x_1$ with equal ratio. The choice which bit to encode is guided by shared randomness. If the input z matches the encoded bit, M measures the qubit and satisfies the certificate (32) with probability 1. Otherwise M outputs $\emptyset$. An upper bound on the maximal average guessing probability is given by:

$$\begin{aligned} \begin{aligned}&P_{guess}^{2 \rightarrow 1}\left( R, \eta , \alpha , p_\text {asyn}, q, \eta _\text {asyn}, \eta _\text {syn}\right) \equiv _{[\eta _\text {syn} \le \frac{1}{2}]} \omega _\text {asyn} G(p_\text {asyn}) + \omega _\text {sig} + \omega _\text {syn} \\&= 1 - \omega _\text {asyn} \sqrt{2} \left( p_\text {asyn} - \frac{3}{4} \right) = 1 - \frac{\sqrt{2} }{\eta } \eta _\text {asyn} P_\text {asyn}(R,\alpha ) \times \left( p_\text {asyn} - \frac{3}{4} \right) . \end{aligned}\nonumber \\ \end{aligned}$$

(35)

If $\eta > \frac{1}{2}$ then in $2(1-\eta )$ part of rounds P uses the above encoding strategy and the device attains $W^{2 \rightarrow 1}\left[ {\mathbb {P}}\right] = 1$. In the remaining $2\eta -1$ part of rounds, P and M use the states and measurements referring to the value of the certificate (32) equal to some $q \in [c_L, c_Q]$. The observed average value of the certificate in such a strategy is

$$\begin{aligned} p_\text {syn} = \frac{1}{\eta _\text {syn}} \left[ (2\eta _\text {syn}-1) q + (1-\eta _\text {syn}) \right] = 2 q - 1 + \frac{1-q}{\eta _\text {syn}}. \end{aligned}$$

(36)

The detection loophole allows to achieve the value of (36) up to $\frac{2\eta + \sqrt{2} - 1}{2 \sqrt{2} \eta } \le 1$ with $q = c_Q$. Thus,

$$\begin{aligned} c_S(\eta ) = \min \left( \frac{2\eta + \sqrt{2} - 1}{2 \sqrt{2} \eta } , 1 \right) . \end{aligned}$$

(37)

The value of (36) equals $p_\text {syn} \le c_S({\eta _\text {syn}})$ if and only if $q = \frac{\eta _\text {syn} (1+p_\text {syn}) - 1}{2\eta _\text {syn} -1}$. The maximal average guessing probability is then upper bounded by

$$\begin{aligned} \begin{aligned} {\tilde{G}}(p_\text {syn},\eta _\text {syn})&\equiv \frac{2\eta _\text {syn} - 1}{\eta _\text {syn}} \times G\left( \frac{\eta _\text {syn} (1+p_\text {syn}) - 1}{2\eta _\text {syn} -1}\right) + \frac{1-\eta _\text {syn}}{\eta _\text {syn}} \\&= -\sqrt{2} p_\text {syn} + 1 + \frac{\sqrt{2}}{2} + \frac{\sqrt{2}}{4\eta _\text {syn}}, \end{aligned} \end{aligned}$$

(38)

or, equivalently,

$$\begin{aligned} \begin{aligned} {\bar{G}}(q,\eta _\text {syn})&\equiv \frac{2\eta _\text {syn} - 1}{\eta _\text {syn}} \times G(q) + \frac{1-\eta _\text {syn}}{\eta _\text {syn}} \\&= \frac{1}{\eta _\text {syn}} \times \left[ -\sqrt{2} q \times (2 \eta _\text {syn} - 1) - \frac{3 \sqrt{2}}{4} \right] + \frac{3 \sqrt{2}}{2} + 1, \end{aligned} \end{aligned}$$

(39)

and is lower than 1 if and only if $p_\text {syn} > \frac{1}{2} + \frac{1}{4 \eta _\text {syn}}$ or, equivalently, $q > \frac{3}{4}$. Using this, we get that an upper bound on the maximal average guessing probability is in this case given by

$$\begin{aligned} \begin{aligned}&P_{guess}^{2 \rightarrow 1}\left( R, \eta , \alpha , p_\text {asyn}, q, \eta _\text {asyn}, \eta _\text {syn}\right) \equiv _{[\eta _\text {syn} > \frac{1}{2}]} \omega _\text {asyn} G(p_\text {asyn}) + \omega _\text {sig}\\&\qquad + \omega _\text {syn} {\bar{G}}(q,\eta _\text {syn}) \\&\quad = 1 - \sqrt{2} \times \left[ \omega _\text {asyn} \times \left( p_\text {asyn} - \frac{3}{4}\right) + \frac{2 \eta _\text {syn} - 1}{\eta _\text {syn}} \times \omega _\text {syn} \times \left( q - \frac{3}{4} \right) \right] \\&\quad = 1 - \frac{\sqrt{2}}{\eta } \times \left[ \eta _\text {asyn} P_\text {asyn}(R,\alpha ) \left( p_\text {asyn} - \frac{3}{4} \right) + (2 \eta _\text {syn} - 1) P_\text {syn}(R,\alpha ) \left( q - \frac{3}{4} \right) \right] . \end{aligned} \end{aligned}$$

(40)

Let us now give an explicit formula for an upper bound on the maximal average guessing probability, see (19), in this scenario. Let us define, cf. (36),

$$\begin{aligned} (36), p_\text {syn}^\text {fun}(q, \eta _\text {syn}) \equiv {\left\{ \begin{array}{ll} 2 q - 1 + \frac{1-q}{\eta _\text {syn}} &{} \text {for } \eta _\text {syn} > \frac{1}{2}, \\ 1 &{} \text {for } \eta _\text {syn} \le \frac{1}{2}. \end{array}\right. } \end{aligned}$$

(41)

We have

$$\begin{aligned} \begin{aligned} P_{guess}(R,\eta ,p) \le&\underset{\begin{array}{c} \alpha \in [0,1] \\ \eta _\text {asyn},\eta _\text {sig},\eta _\text {syn} \in [0,1] \\ p_\text {asyn},q \in [\frac{3}{4},c_Q] \\ \end{array}}{\text {maximize}} P_{guess}^{2 \rightarrow 1} \left( R, \eta , \alpha , p_\text {asyn}, q, \eta _\text {asyn}, \eta _\text {syn}\right) \\&\quad \text {subject to } \quad q^\text {fun} \left( R,\alpha ,p_\text {asyn},q,\mathbf {\eta } \right) \ge p, \\&\quad \quad \quad \quad \quad \quad \quad \eta ^\text {fun} \left( R,\alpha ,\mathbf {\eta }\right) = \eta , \end{aligned} \end{aligned}$$

(42)

where $q^\text {fun}$, cf. (18b) is given by

$$\begin{aligned} \begin{aligned} q^\text {fun}&\left( R,\alpha ,p_\text {asyn},q,\mathbf {\eta } \right) \equiv p_\text {asyn} \omega _\text {asyn} + \frac{1}{2} \omega _\text {sig} + p_\text {syn}^\text {fun}(q, \eta _\text {syn}) \omega _\text {syn} \\&= p_\text {asyn} \eta _\text {asyn} \frac{ P_\text {asyn}(R,\alpha )}{\eta } + \frac{1}{2} \eta _\text {sig} \frac{ P_\text {sig}(R,\alpha )}{\eta } + \eta _\text {syn} p_\text {syn}^\text {fun}(q, \eta _\text {syn}) \frac{ P_\text {syn}(R,\alpha )}{\eta } \end{aligned}\nonumber \\ \end{aligned}$$

(43)

Let us denote

$$\begin{aligned} \begin{aligned}&x \equiv \eta \omega _\text {asyn} = \eta _\text {asyn} P_\text {asyn}(R,\alpha ), \\&y \equiv \eta \omega _\text {syn} = \eta _\text {syn} P_\text {syn}(R,\alpha ). \end{aligned} \end{aligned}$$

(44)

Now, use the constraint $\eta ^\text {fun} \left( R,\alpha ,\mathbf {\eta }\right) = \eta$, or, equivalently, $\eta _\text {sig} P_\text {sig}(R,\alpha ) = \eta - x - y$, to eliminate $\eta _\text {sig}$. We separate further analysis in two cases.

In the case with $\eta _\text {syn} \in [0, \frac{1}{2}]$, we have $y \le \frac{1}{2 \eta } P_\text {syn}(R,\alpha )$. Let us denote for this case $z^{-} \equiv x \times \left( p_\text {asyn} - \frac{3}{4}\right)$. Then, (42) transforms to

$$\begin{aligned} P_{guess}^{-}(R,\eta ,p) \le \underset{\begin{array}{c} \alpha \in [0,1] \\ (x,y,z^{-}) \in A^{-}(R,\eta ,p,\alpha ) \end{array}}{\text {maximize}} 1 - \frac{\sqrt{2}}{\eta } z^{-}, \end{aligned}$$

(45)

where $A^{-}(R,\eta ,p,\alpha ) \subseteq {\mathscr {R}}^3$ is defined by the following linear constraints:

$$\begin{aligned} \begin{aligned}&0 \le x \le P_\text {asyn}(R,\alpha ), \\&0 \le y \le \frac{1}{2} P_\text {syn}(R,\alpha ), \\&0 \le z^{-} \le \left( c_q - \frac{3}{4}\right) \times x, \\&\eta - P_\text {sig}(R,\alpha ) \le x + y \le \eta , \\&\eta \times \left( p - \frac{1}{2}\right) - \frac{1}{4} x - \frac{1}{2} y \le z^{-}. \end{aligned} \end{aligned}$$

(46)

In the case with $\eta > \frac{1}{2}$, we have $y \ge \frac{1}{2} P_\text {syn}(R,\alpha )$. Let us now denote

$$\begin{aligned} z^{+} \equiv x \times \left( p_\text {asyn} - \frac{3}{4}\right) + (2 y - P_\text {syn}(R,\alpha )) \times \left( q - \frac{3}{4}\right) . \end{aligned}$$

(47)

As in the previous case, (42) transforms to

$$\begin{aligned} P_{guess}^{+}(R,\eta ,p) \le \underset{\begin{array}{c} \alpha \in [0,1] \\ (x,y,z^{+}) \in A^{+}(R,\eta ,p,\alpha ) \end{array}}{\text {maximize}} 1 - \frac{\sqrt{2}}{\eta } z^{+}, \end{aligned}$$

(48)

where $A^{+}(R,\eta ,p,\alpha ) \subseteq {\mathscr {R}}^3$ is defined by the following linear constraints:

$$\begin{aligned} \begin{aligned}&0 \le x \le P_\text {asyn}(R,\alpha ), \\&\frac{1}{2} P_\text {syn}(R,\alpha ) \le y \le P_\text {syn}(R,\alpha ), \\&0 \le z^{+} \le \left( c_Q - \frac{3}{4}\right) \times \left[ x + 2 y - P_\text {syn}(R,\alpha )\right] , \\&\eta - P_\text {sig}(R,\alpha ) \le x + y \le \eta , \\&\eta \times \left( p - \frac{1}{2}\right) - \frac{1}{4} x - \frac{1}{4} P_\text {syn}(R,\alpha ) \le z^{+}. \end{aligned} \end{aligned}$$

(49)

It is easy to see that, for fixed $\alpha \in [0,1]$, the internal optimization in (45) and (48) is a linear program. Thus, we derive the following formula for $P_{guess}(R,\eta ,p)$ for this scenario:

$$\begin{aligned} P_{guess}(R,\eta ,p) \le \max \left( P_{guess}^{-}(R,\eta ,p), P_{guess}^{+}(R,\eta ,p) \right) , \end{aligned}$$

(50)

with $P_{guess}^{\pm }(R,\eta ,p) \equiv 0$ if $A^{\pm } = \emptyset$.

Appendix D: Direct calculations of the experimental randomness

We take the experimental value $p = 0.8425$ and $\eta = 0.06$ for $R = 0.99$, as used in the setup. From our calculations of (45) and (48), it follows that the maximal average guessing probability is obtained for $\alpha = 0.499$. In that case, $\eta _\text {asyn} = 0.11880$, $\eta _\text {sig} = 0$ and $\eta _\text {syn} = 0.5$. We have $\omega _\text {asyn} = 0.98951$, $\omega _\text {sig} = 0$ and $\omega _\text {syn} = 0.01049$ with $p_\text {asyn} = 0.84083$ and $p_\text {syn} = 1$. This gives $G(0.84083) = 0.87155$. Direct calculation of (35) gives

$$\begin{aligned} 0.98951 \times 0.87155 + 0 + 0.01049 \approx 0.87289, \end{aligned}$$

(51)

and thus $-\log _2(0.87289) \approx 0.19612$. Since only $(1-R) \times \eta = 0.0006$ emitted photons are detected, the generation ratio of min-entropy is

$$\begin{aligned} H_\infty (0.99,0.06,0.8425) \approx 0.00012. \end{aligned}$$

(52)

Analogous calculations for $R = 0.3$, $\eta = 0.78$, and optimal $\alpha = 0.157$. This gives $P_\text {asyn}(R,\alpha ) = 0.71827$, $P_\text {sig}(R,\alpha ) = 0.157$, $P_\text {syn} = 0.12473$ with $\eta _\text {asyn} = 0.99912$, $\eta _\text {sig} = 0$, $\eta _\text {syn} = 0.5$. Here $p_\text {asyn} = 0.82881$ and $p_\text {syn} = 1$, giving $G(0.82881) = 0.88854$. From this, it follows that $\omega _\text {asyn} = 0.92004$, $\omega _\text {sig} = 0$, and $\omega _\text {syn} = 0.07996$. Direct calculation gives

$$\begin{aligned} 0.92004 \times 0.88854 + 0 + 0.07996 = 0.89745, \end{aligned}$$

(53)

and

$$\begin{aligned} H_\infty (0.3,0.78,0.8425) \approx -0.7 \times 0.78 \times \log _2 (0.89745) \approx 0.08523. \end{aligned}$$

(54)