METHOD FOR QUANTUM GENERATION OF RANDOM NUMBERS ESPECIALLY IN LOTTERIES AND GAMING AND DEVICE FOR QUANTUM GENERATION OF RANDOM NUMBERS

Abstract

The presented invention relates to a method and device for the quantum generation of random numbers. The invention can be implemented in generation of random numbers in lotteries and gaming. The device for a self-testing quantum number generator especially in lotteries and gaming comprising: interferometer, a control unit CU connected to the signal source S, the signal is with interference property, components A that modify the signal's properties, and detectors D for measuring the signal's intensity by electrical wires. Components A are controlled by the control unit CU via electrical wires with parameters x. Detectors D are configured to measure signal intensity and send the measurement results d, via electrical wires to the control unit CU. The control unit CU performs a self-test based on the measurement results d and returns its outcome Hmin. The control unit CU returns random numbers d, and the result of self-test Hmin.

Claims

1. Device for a self-testing quantum number generator especially in lotteries and gaming comprising: interferometer, comprising: signal source S, at least two paths through which the signal travels, components that can modify the signal's properties A, interference region I, detectors D, characterized that the device comprises a control unit CU, while the control unit CU is connected to the signal source S, the signal is with interference property, components A that modify the signal's properties, and detectors D for measuring the signal's intensity by electrical wires, detectors D are configured to measure signal intensity and send the measurement results {right arrow over (d)}, via electrical wires to the control unit CU, components A are controlled by the control unit CU via electrical wires with parameters {right arrow over (x)}, the source S is configured to produce a signal when requested by the control unit CU via electrical wires, the control unit CU performs a self-test based on the measurement results a and returns its outcome H.sub.min({right arrow over (d)}|{right arrow over (x)}) the control unit CU returns random numbers a, and the result of self-test H.sub.min {right arrow over (r)}, where: {right arrow over (x)} is a vector representing the parameters for all components A, {right arrow over (d)} is a vector representing the measurement results of the detectors D, H.sub.min({right arrow over (d)}|{right arrow over (x)}) is a lower bound on average min-entropy of the string of N.sub.0 values of d, given by formula $H_{\min }\left(\stackrel{.fwdarw.}{d}|\stackrel{.fwdarw.}{x}\right)={\log }_2\underset{\stackrel{.fwdarw.}{k}}{\max }p\left(\stackrel{.fwdarw.}{d}=\stackrel{.fwdarw.}{k}|\stackrel{.fwdarw.}{x}\right),$ N.sub.0 is a free parameter.

2. The generator according to claim 1, comprises an interferometer of any design modified by addition of additional components B

3. The generator according to claim 1, comprises an interferometer of any design modified by addition of additional components B and additional detectors D′

4. The generator, according to claim 1, comprises a Mach-Zehnder interferometer, modified by addition of additional components B.

5. The generator, according to claim 1, comprises a Mach-Zehnder interferometer, modified by addition of additional components B and detectors D′.

6. The generator, according to claim 1, wherein the inputs {right arrow over (x)} are generated by the control unit CU from the randomness generated previously or the control unit CU receives it as an input from external source.

7. A method for generating a string of random numbers especially in lotteries and gaming, comprising steps of: a) requesting from signal source S by control unit CU signal with interference property to be produced, b) sending parameters {right arrow over (x)} to components A by control unit CU c) transferring the signal from the source S, via component A, to interference region I and detector D, d) measuring the signal intensities by the detector D and sending the results of the measurement {right arrow over (d)} to the control unit CU, e) returning the measurement results {right arrow over (d)} as the output randomness, f) returning the min-entropy H.sub.min({right arrow over (d)}|{right arrow over (x)}) as the outcome of self-test, g) repeating the step a-f.

8. The method according to claim 7, wherein the method for self-testing comprises steps of: the control unit CU records the values of {right arrow over (d)} and {right arrow over (x)} from N.sub.0 steps, where N.sub.0 is a free parameter, the control unit CU estimates observed probability distribution using formula: $p\left(\stackrel{.fwdarw.}{d}|\stackrel{.fwdarw.}{x}\right)=\frac{{.Math.}_{i=1}^{N_0}\delta \left(\stackrel{.fwdarw.}{d},{\stackrel{.fwdarw.}{d}}_i\right)\delta \left(\stackrel{.fwdarw.}{x},{\stackrel{.fwdarw.}{x}}_i\right)}{{.Math.}_{i=1}^{N_0}\delta \left(\stackrel{.fwdarw.}{x},{\stackrel{.fwdarw.}{x}}_i\right)},$ the control unit CU uses well-known linear or semi-definite programming, algorithms is used to find the minimum value of min-entropy H.sub.min({right arrow over (d)}|{right arrow over (x)}), which is compatible with the observed value of p({right arrow over (d)}|{right arrow over (x)}), the control unit CU returns the value of H.sub.min({right arrow over (d)}|{right arrow over (x)}), where δ(a, b) is Kronecker's function equal to 1 if a=b and 0 otherwise.

9. The method according to claim 7, wherein the control unit CU using method for generating a string of random numbers while post-process it with well-known method of randomness extraction, which takes as an input {right arrow over (d)} and H.sub.min({right arrow over (d)}|{right arrow over (x)}), and produces a sting of random numbers with arbitrary quality {right arrow over (r)}, then it returns {right arrow over (r)} instead of {right arrow over (d)} as randomness.

Description

[0018] FIG. 1—a standard multipath interferometer;

[0019] FIG. 2a— device based on an interferometer modified by the addition of extra signal modification components and detectors;

[0020] FIG. 2b— device based on an interferometer modified by the addition of extra signal modification components;

[0021] FIG. 2c— device based on an unmodified interferometer;

[0022] FIG. 3—particular embodiment of the invention—application in lottery and gaming;

[0023] FIG. 4—schematic of the control unit CU present in FIGS. 2a, 2b and 2c.

GENERAL EXAMPLE

[0024] a) System—generator

INTRODUCTION

[0025] The device consists of two main parts: (a) interferometer; and (b) control unit CU. The interferometer is a well-known apparatus, which is described in the next paragraph. The interferometer constituting part of the device can be modified by placing additional components. The control unit governs the work of the interferometer and self-tests the quality of randomness produced by the interferometer. The self-test is performed by computing a lower bound on min-entropy of the output sting of numbers.

Interferometer

[0026] An interferometer is a device that is used to measure interference properties of waves in a form of signal. In FIG. 1), a schematic diagram of an interferometer is presented.

[0027] The interferometer has a signal that comes from a source (S) and consists of n paths. The signals can be modified according to the parameters(x.sub.1, . . . , x.sub.n) in the control components A.sub.1, . . . , A.sub.n. The interference takes part in the interference region (I) and then the signals are measured at the detection stations (D.sub.1, . . . , D.sub.m). The number of detectors m usually is but does not have to be equal to the number of paths.

[0028] The initial signal in the form of a wave is emitted from a source S and travels along two or more paths. The signal can be anything with interference properties, e.g. particles, electric current, light or acoustic waves. In each path, the signals can be modified independently, to change its properties in the components denoted by A.sub.1, . . . , A.sub.n, according to the configuration of their input parameters (x.sub.1, . . . , x.sub.n). Then the signals interfere in the interference region I-region indicated in FIG. 1). After leaving interference region I, the signals are measured at the stations denoted by (D.sub.1, . . . , D.sub.m), which represent the detectors. The number of stations m can but does not have to be equal to the number of paths n. The joint probability distribution of the measurement results at the detection stations p(D.sub.1, . . . , D.sub.m), is measured as a function of the input parameters (x.sub.1, . . . , x.sub.n), in order to establish the signal interference properties.

Underlying Idea

[0029] The described invention is based on the interferometer presented in the previous paragraph and control unit connected to it. The main idea of this invention is based on the fact that for some combination of input parameters (x.sub.1, . . . , x.sub.n) from a control unit CU, the outcomes of the detection stations should be deterministic and for other completely random, if the device works correctly. Checking for deviations and estimating their magnitude when we expect the determinism allows us to quantify the current quality of the device and randomness it produces. The outcomes of the device are random in a way which admits self-testing only if the behaviour of the device can be modelled by quantum theory (not any classical one).

Construction of the Device

[0030] The device comprises interferometer and control unit CU, which is presented in FIG. 2a-2c. The interferometer can be kept unchanged as in FIG. 1) or modified by addition of extra components on some or all of the paths. The additional components denoted by B.sub.1, . . . , B.sub.k, get their own inputs (y.sub.1, . . . , y.sub.k) from a control unit CU as in FIG. 2a) or can involve additional detection stations (D′.sub.1, . . . , D′.sub.k) as in FIG. 2b). The control unit CU can take a form of an FPGA or ASIC microprocessor, with auxiliary known electronics if necessary.

[0031] The source of the signal, basic components of the interferometer (x.sub.1, . . . , x.sub.n), optional ones (y.sub.1, . . . , y.sub.k), the detectors (D.sub.1, . . . , D.sub.m) and, additional detection stations (D′.sub.1, . . . , D′.sub.k) if they exist, are controlled by a control unit CU. {right arrow over (d)} stands for the messages from the detectors (D.sub.1, . . . , D.sub.m) and, if they exist, (D′.sub.1, . . . , D′.sub.k) to CU and {right arrow over (x)} for all the inputs—parameters (x.sub.1, . . . , x.sub.n) and, if additional parameters if they exist, (y.sub.r, . . . , y.sub.k). The control unit CU itself has four main components: timer T, hardware driver HD, memory M and computing processor CP, all communicating via electrical wires.

[0032] According to the FIG. 2a—in the device a signal comes from a source (S) and travels along n paths. The signals is modified according to the parameters (x.sub.1, . . . , x.sub.n) in the control CU components A.sub.1, . . . , A.sub.n. On some of the paths there are additional components B.sub.1, . . . , B.sub.k, with their own parameters (y.sub.1, y.sub.k). Based on the value of y.sub.i on i-th path the signal either continues on its path or is redirected to one of the additional detectors D′.sub.1, . . . , D′.sub.k. The signals that stayed on their paths interfere in the interference region (I) and are later measured at the stations D.sub.1, . . . , D.sub.m. A control unit CU in a form of FPGA or ASIC which controls the rest of the device has a timer which divides device's operation into steps. In each step CU causes the signal source (S) to send the signals, generates inputs (x.sub.1, . . . , x.sub.n) and (y.sub.r, . . . , y.sub.k), which are communicated by electrical wires to components A.sub.1, . . . , A.sub.n and B.sub.1, . . . , B.sub.k. In each step all the detectors D.sub.1, . . . , D.sub.m and D′.sub.1, . . . , D′.sub.k measure incoming signals and send via electrical wires the measurement results a to CU. In each step CU sends {right arrow over (d)} and min-entopy estimate H.sub.min for that step to the user.

[0033] As is presented in the FIG. 2b, in the device a signal comes from a source (S) and travels along n paths. The signals can be modified according to the parameters (x.sub.1, . . . , x.sub.n) in the control components A.sub.1, . . . , A.sub.n. On some of the paths there are additional components B.sub.1, . . . , B.sub.k, with their own parameters (y.sub.r, . . . , y.sub.k). The signals pass through both sets of components. The interference takes part in the interference region and then the signals are measured at the detection stations D.sub.1, . . . , D.sub.m. The control unit CU in a form of FPGA or ASIC which controls the rest of the device has a timer which divides device's operation into steps. In each step CU causes the signal source (S) to send the signals, generates inputs (x.sub.1, . . . , x.sub.n) and (y.sub.r, . . . , y.sub.k), which are communicated by electrical wires to components A.sub.1, . . . , A.sub.n and B.sub.1, . . . , B.sub.k. In each step all the detectors D.sub.1, . . . , D.sub.m measure incoming signals and send via electrical wires the measurement results a to CU. In each step CU sends a and min-entopy estimate H.sub.min for that step to the user.

[0034] As is presented in the FIG. 2c, in the device a signal comes from a source (S) and travels along n paths. The signals can be modified according to the parameters (x.sub.1, x.sub.n) in the control components A.sub.1, . . . , A.sub.n. The interference takes part in the interference region and then the signals are measured at the detection stations D.sub.1, . . . , D.sub.m. The control unit CU in a form of FPGA or ASIC which controls the rest of the device has a timer which divides device's operation into steps. In each step CU causes the signal source (S) to send the signals, generates inputs (x.sub.1, . . . , x.sub.n) which are communicated by electrical wires to components A.sub.1, . . . , A.sub.n. In each step all the detectors D.sub.1, . . . , D.sub.m measure incoming signals and send via electrical wires the measurement results {right arrow over (d)} to CU. In each step CU sends {right arrow over (d)} and min-entopy estimate H.sub.min for that step to the user.

Method

Generation of Randomness

[0035] The control unit's CU internal structure is shown in FIG. 4. CU works in steps. Each step begins by timer T sending a signal to the hardware driver HD notifying it that the new step has started. Then the hardware driver HD retrieves random variable x from memory M. Next the hardware driver HD transmits {right arrow over (x)} to components A.sub.1, . . . , A.sub.n and B.sub.1, . . . , B.sub.k and commands the source S to send the signal. After the signal has been measured by the detectors (D.sub.1, . . . , D.sub.m) and, if they exist, (D′.sub.1, . . . , D′.sub.k), they send a to the hardware driver HD, which passes it to memory M. Next the computing processor CP retrieves the set of {right arrow over (d)} and {right arrow over (x)} from memory M and from them the result of self-test, which is a lower bound on min-entropy H.sub.min({right arrow over (d)}|{right arrow over (x)}) of {right arrow over (d)} is computed. It is a standard measure of randomness quality in information theory. The method used by CP to compute H.sub.min({right arrow over (d)}|{right arrow over (x)}) is described in the next section. The step ends with CP transmitting {right arrow over (d)} and H.sub.min({right arrow over (d)}|{right arrow over (x)}) to the user. {right arrow over (d)} is a random number generated in this step and H.sub.min({right arrow over (d)}|{right arrow over (x)}) the result of self-test.

[0036] CP also uses randomness extractor (a well-known mathematical function) to obtain from {right arrow over (d)} the value of {right arrow over (x)} which is sent to memory M and will be used for the settings of components A.sub.1, . . . , A.sub.n and B.sub.1, . . . , B.sub.k in the next step.

Self-Testing. Part 1: Estimation of Probability Distribution p({right arrow over (d)}|{right arrow over (x)})

[0037] The method used to establish and update H.sub.min({right arrow over (d)}|{right arrow over (x)}) based on {right arrow over (d)} and {right arrow over (x)} works in the following way:

[0038] The control unit CU stores in its memory M values of {right arrow over (d)} and {right arrow over (x)} for the last N.sub.0 steps. N.sub.0 is a free parameter chosen by the user. In each step next pair of {right arrow over (d)} and {right arrow over (x)} is added and the one which is in memory for longest removed. The current content of the memory is a list of pairs ({right arrow over (d)}.sub.i, {right arrow over (x)}.sub.i)i=1, . . . , N.sub.0 and the value of {right arrow over (x)} for the next step. The value of H.sub.min({right arrow over (d)}|{right arrow over (x)}) returned in any given step is then a lower bound on the average min-entropy of {right arrow over (d)} for the block of last N.sub.0 steps.

[0039] First conditional probability distribution p({right arrow over (d)}|{right arrow over (x)}) of {right arrow over (d)} as a function of {right arrow over (x)} is estimated by the control unit CU. It is taken to be equal to the frequency of any given value of a for any particular {right arrow over (x)} in the block of the last N.sub.0 steps and given by the formula:

[00001]$p\left(\stackrel{.fwdarw.}{d}|\stackrel{.fwdarw.}{x}\right)=\frac{{.Math.}_{i=1}^{N_0}\delta \left(\stackrel{.fwdarw.}{d},{\stackrel{.fwdarw.}{d}}_i\right)\delta \left(\stackrel{.fwdarw.}{x},{\stackrel{.fwdarw.}{x}}_i\right)}{{.Math.}_{i=1}^{N_0}\delta \left(\stackrel{.fwdarw.}{x},{\stackrel{.fwdarw.}{x}}_i\right)},$

where δ(a, b) is Kronecker's function equal to 1 if a=b and 0 otherwise.
Self-Testing. Part 2: Estimation of Min-Entropy H.sub.min({right arrow over (d)}|{right arrow over (x)})

[0040] It will call p({right arrow over (d)}|{right arrow over (x)}) an observed probability distribution and assume it to arise from underlying probabilities p.sub.γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}). There are two kinds of parameters here to which we don't have a direct access: [0041] γ denotes properties of the interferometric setup such as losses in different paths or the characteristics of interference region I. While they can evolve in time they do so slowly enough for us to assume that γ is constant in the whole block of last N.sub.0 steps. [0042] {right arrow over (λ)} on the other hand, represents parameters that can change in every step of operation of the device. Such a quick change of parameters can only appear in electronic circuits controlling the behaviour of the signal source S and detectors (D.sub.1, . . . , D.sub.m) and, if they exist, (D′.sub.1, . . . , D′.sub.k). Therefore, we use notation {right arrow over (λ)}=(λ.sub.0, λ.sub.1, . . . , λ.sub.D), where D is the total number of detectors equal to m for the case in FIG. 2a) or m+k for the one in FIG. (2b). λ.sub.0 is a parameter related to the signal source and λ.sub.i is related to detector D.sub.i.

[0043] The control unit CU stores in its memory a finite set of pairs p.sub.γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}) and H.sub.γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}), which were calculated previously by modelling the behaviour of the device as a function of γ and {right arrow over (λ)}. The exact parametrization of the device by γ and A and their ranges depend on the choice of the security paradigm. For example in order to model the device we may assume that there are no rapid changes in the parameters of the device and A is constant, or that signal source produces always single photons. The device can store more than one set and the user can switch between different paradigms trading level of security for higher randomness generation rates. To make the set of pairs p.sub.γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}) and H.sub.γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}) finite the parameters γ and {right arrow over (λ)} may need to be coarse-grained. Then for every value of γ and {right arrow over (λ)} p.sub.γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}) is calculated. Then H.sub.γ ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (λ)}) is taken to be the minimal min-entropy of probabilities p.sub.Γ({right arrow over (d)}|{right arrow over (x)}, {right arrow over (Λ)}), where Γ and Λ denote sets of values which, when coarse-grained, yield γ and {right arrow over (λ)} respectively, i.e.:

[00002]$H_{\gamma }\left(\stackrel{.fwdarw.}{d}|\stackrel{.fwdarw.}{x},\stackrel{.fwdarw.}{\lambda }\right)=\underset{\Gamma ,\Lambda }{\min }\left(-\log \max p_{\Gamma }\left(\stackrel{.fwdarw.}{d}=\stackrel{.fwdarw.}{k}|\stackrel{.fwdarw.}{x},\stackrel{.fwdarw.}{\Lambda }\right)\right).$

[0044] Let us denote the probability distribution of {right arrow over (λ)} as p({right arrow over (λ)}) Then the min-entropy of potential adversary for a particular value of γ is lower bounded by

H.sub.γ({right arrow over (d)}|{right arrow over (x)})=Σ.sub.{right arrow over (λ)}p({right arrow over (λ)})H.sub.γ({right arrow over (d)}|{right arrow over (x)},{right arrow over (λ)})(*).

[0045] The observed probability distribution for a particular value of γ is then

p.sub.γ({right arrow over (d)}|{right arrow over (x)})=Σ.sub.{right arrow over (λ)}p({right arrow over (λ)})p.sub.γ({right arrow over (d)}|{right arrow over (x)},{right arrow over (λ)}).

[0046] Now the control unit CU can perform linear programming to find minimum of (*) under the constraint that |p.sub.γ({right arrow over (d)}|{right arrow over (x)})−p({right arrow over (d)}|{right arrow over (x)})|<ϵ, where ϵ is a constant implied by coarse-graining chosen. The meaning of this constraint is that the linear program is trying to find lowest min-entropy H.sub.γ({right arrow over (d)}|{right arrow over (x)}) compatible with the observed probability distribution. After solving the linear program for all values of γ the lower bound on H.sub.min({right arrow over (d)}|{right arrow over (x)}) is taken to be minimum over all values of γ, i.e.

[00003]$H_{\min }\left(\stackrel{.fwdarw.}{d}|\stackrel{.fwdarw.}{x}\right)=\underset{\gamma }{\min }{H}_{\gamma }\left(\stackrel{.fwdarw.}{d}|\stackrel{.fwdarw.}{x}\right).$

EXAMPLE 2

Description of the Preferred Embodiment of the Invention

[0047] The preferred embodiment of the invention (shown in FIG. 3)), is based on a four-arm Mach-Zehnder interferometer built with modern fiber optic technology.

[0048] The user of the device is a lottery, which needs random numbers of the results of a draw. It starts the procedure of obtaining them by giving a signal to the control unit CU of the device to produce the numbers.

[0049] The role of the control unit CU is played by a field-programmable gate array (FPGA) electronic unit. It contains all the necessary elements of the control unit CU: Memory M, Timer T, Hardware Driver HD and Computing Processor CP. The FPGA unit controls and synchronises the signal source S, signal modifying components A and B and detectors D.

[0050] After the light is emitted from the laser optical attenuators are then used to reduce initial signal intensity. The attenuators set the average number of photons per pulse to μ=0.2. In this case, the source can be seen as a good approximation of a nondeterministic source of single photons. We use standard ket notation of quantum information and describe the state of light after a single photon is generated by|x.sub.0=|0.

[0051] After the attenuators, the signal is split into four paths using 4×4 multi-port beam splitter unit (MBS.sub.0). This unit consists of a commercial demultiplexer (DEMUX) device, with 1 fiber as an input and 4 independent fibres as an output. It implements a 4-dimensional Hadamard gate operation:

[00004]$U_H=\frac{1}{2}\left[\begin{array}{cccc}1& 1& 1& 1\\ 1& 1& -1& -1\\ 1& -1& 1& -1\\ 1& -1& -1& 1\end{array}\right].$

[0052] The quantum state of light after it leaves the source is

[00005]$.Math.{\chi }_1.Math.=\frac{1}{2}(.Math.0.Math.+.Math.1.Math.+.Math.2.Math.+.Math.3.Math.),$

[0053] where |k> is the mode representing the photon in the k-th path.

[0054] The device follows the schematics from FIG. 2b. The role of components A.sub.1, . . . , A.sub.4 is played by phase modulators (PM) connected to each of—fibers—leaving MBS.sub.0. The role of parameters (x.sub.1, . . . , x.sub.4), is played by phases ϕ.sub.0.sup.A, ϕ.sub.1.sup.A, ϕ.sub.2.sup.A, ϕ.sub.3.sup.A. The FPGA controls ϕ.sub.0.sup.A, ϕ.sub.1.sup.A, ϕ.sub.2.sup.A, ϕ.sub.3.sup.A by applying different voltages to the drivers of PMs. After passing through components A.sub.1, . . . , A.sub.4 the state of light becomes

[00006]$.Math.{\chi }_2.Math.=\frac{1}{2}(e^{i{\varphi }_0^A}.Math.0.Math.+e^{i{\varphi }_1^A}.Math.1.Math.+e^{i{\varphi }_2^A}.Math.2.Math.+e^{i{\varphi }_3^A}.Math.3.Math.),$

[0055] The role of components B.sub.1, . . . , B.sub.4 is played by another set of—phase modulators (PM) connected to each of—fibers. The role of parameters (y.sub.1, . . . , y.sub.4), is played by phases ϕ.sub.0.sup.A, ϕ.sub.1.sup.A, ϕ.sub.2.sup.A, ϕ.sub.3.sup.A. The FPGA controls ϕ.sub.0.sup.A, ϕ.sub.1.sup.A, ϕ.sub.2.sup.A, ϕ.sub.3.sup.A by applying different voltages to the drivers of PMs. After passing through components B.sub.1, . . . , B.sub.4 the state of light becomes

[00007]$.Math.{\chi }_3.Math.=\frac{1}{2}(e^{i\left({\varphi }_0^A+{\varphi }_0^B\right)}.Math.0.Math.+e^{i\left({\varphi }_1^A+{\varphi }_1^B\right)}.Math.1.Math.+e^{i\left({\varphi }_2^A+{\varphi }_2^B\right)}.Math.2.Math.+e^{i\left({\varphi }_3^A+{\varphi }_3^B\right)}.Math.3.Math.),$

[0056] The role of the interference region I is played by another 4×4 multi-port beam splitter unit (MBS.sub.1) build in the same way as (MBS.sub.0) and performing the same transformation. After that, the state of light becomes

[00008]$.Math.{\chi }_4.Math.=\frac{1}{2}(\left[e^{i\left({\varphi }_0^A+{\varphi }_0^B\right)}+e^{i\left({\varphi }_1^A+{\varphi }_1^B\right)}+e^{i\left({\varphi }_2^A+{\varphi }_2^B\right)}+e^{i\left({\varphi }_3^A+{\varphi }_3^B\right)}\right].Math.0.Math.+\left[e^{i\left({\varphi }_0^A+{\varphi }_0^B\right)}+e^{i\left({\varphi }_1^A+{\varphi }_1^B\right)}-e^{i\left({\varphi }_2^A+{\varphi }_2^B\right)}-e^{i\left({\varphi }_3^A+{\varphi }_3^B\right)}\right].Math.1.Math.+\left[e^{i\left({\varphi }_0^A+{\varphi }_0^B\right)}-e^{i\left({\varphi }_1^A+{\varphi }_1^B\right)}+e^{i\left({\varphi }_2^A+{\varphi }_2^B\right)}-e^{i\left({\varphi }_3^A+{\varphi }_3^B\right)}\right].Math.2.Math.+\left[e^{i\left({\varphi }_0^A+{\varphi }_0^B\right)}-e^{i\left({\varphi }_1^A+{\varphi }_1^B\right)}-e^{i\left({\varphi }_2^A+{\varphi }_2^B\right)}+e^{i\left({\varphi }_3^A+{\varphi }_3^B\right)}\right].Math.3.Math.).$

[0057] Then the light is measured by the detectors. Photons in mode|0 are measured by the detector D.sub.1, those in |1 are measured by the detector D.sub.2, those in |2 are measured by the detector D.sub.3, and those in |3 are measured by the detector D.sub.4. The detectors are triggered commercial InGaAs single-photon avalanche detectors.

[0058] The detectors send the measurement outcomes to FPGA which estimates min-entropy H.sub.min({right arrow over (d)}|{right arrow over (x)}). The FPGA pots-process a with well-known method of randomness extraction, which takes as an input {right arrow over (d)} and H.sub.min({right arrow over (d)}|{right arrow over (x)}), and produces a sting of random numbers with arbitrary quality {right arrow over (r)}. Next FPGA returns {right arrow over (r)} to the user which can use the numbers in {right arrow over (r)} for the results of the lottery draw.

ACKNOWLEDGEMENTS

[0059] The inventors acknowledge the support of Foundation for Polish Science through grant First TEAM/2016-1/5.