QUANTUM RANDOM NUMBER GENERATOR

(1)

Q

UANTUM

RANDOM

NUMBER

GENERATOR

ON

A

MOBILE

PHONE

(2)

“T

HE

SECURITY

OF

A

CYPHER

MUST

RESIDE

ENTIRELY

IN

THE

KEY

”

AUGUSTE KERCKHOFFS [1]

(3)

C

OMPROMISING

THE

SECURITY

OF

THE

KEY

COMPROMISES

THE

SYSTEM

[1] L. Bello. openssl – predictable random number generator. Debian security advisory 1571-1, 2008. [2] Bushing, Marcan, Segher, and Sven. PS3 epic fail. 27th Chaos Communication Congress, 2010. [3] R. Chirgwin. Android bug batters bitcoin wallets. The Register, 2013.

[4] L. Dorrendorf, Z. Gutterman, and B. Pinkas. Cryptanalysis of the random number generator of the windows operating system. ACM Trans. Inf. Syst. Secur., 13(1):1–32, 2009.

[5] A. K. Lenstra, H. J. P., M. Augier, J. W. Bos, T. Kleinjung, and C. Wachter. Ron was wrong, Whit is right. Cryptology ePrint Archive, 2012.

(4)

C

OMPROMISING

THE

SECURITY

OF

THE

KEY

COMPROMISES

THE

SYSTEM

[1] L. Bello. openssl – predictable random number generator. Debian security advisory 1571-1, 2008. [2] Bushing, Marcan, Segher, and Sven. PS3 epic fail. 27th Chaos Communication Congress, 2010. [3] R. Chirgwin. Android bug batters bitcoin wallets. The Register, 2013.

[4] L. Dorrendorf, Z. Gutterman, and B. Pinkas. Cryptanalysis of the random number generator of the windows operating system. ACM Trans. Inf. Syst. Secur., 13(1):1–32, 2009.

[5] A. K. Lenstra, H. J. P., M. Augier, J. W. Bos, T. Kleinjung, and C. Wachter. Ron was wrong, Whit is right. Cryptology ePrint Archive, 2012.

(5)

C

URRENT

C

OMMERCIAL

RNG

IMPLEMENTATIONS

• Software (not random)

• Microphone (can be controlled)

• PLL (no one knows…)

• Shot noise in diode (slow)

(6)

(7)

S

IMPLIFIED

PRINCIPLE

OF

OPERATION

(8)

S

IMPLIFIED

PRINCIPLE

OF

OPERATION

(9)

C

ONCEPT

LED

Extractor

Random

_numbers

Camera

(10)

C

ONCEPT

LED

Extractor

Random

_numbers

Camera

(11)

C

ONCEPT

LED

Extractor

Random

_numbers

Camera

OR Fibre

0 4,5 9 0 1 2 3

(12)

F

UNDAMENTAL

RESEARCH

(13)

M

OBILE

PHONE

SENSORS

ARE

EXCELLENT

!

Low noise (< 1e-), linear,

small pixels, low capacitance before amp

Fast ( 1Gpixel/s ~10 GBits/s)

for video

Cheap (~1$); market for

billions

of sensors (I have 30 at home)

CMOS technology: source, detector and processing on a single chip.

(14)

T

ESTED

WITH

TWO

CAMERAS

Astronomy CCD

(ATIK

383L+)

Phone CMOS

(Nokia N9)

(15)

-Light source

loss

detector amp converter

e

V

ADC

d

digital

_output

(16)

Light source

loss

detector amp converter

e

V

ADC

d

digital

_output

detector model

!

ATIK

Nokia

(17)

Light source

loss

detector amp converter

e

V

ADC

d

digital

_output

detector model

4 0 20 40 60 0.00 0.02 0.04 0.06 0.08 Photon number n P(n ) Theory (Poisson dist.) Experiment

FIG. 5. Statistics of the number of photons detected by a single-photon detector (ID Quantique ID100) in 1 ms, which, as expected for most sources, follow a Poisson distribution.

ATIK 383L Nokia N9 Noise, t (e ) 10 3.3 Saturation (e ) 2 _⇥ 104 500 Illumination (e ) 1.5 _⇥ 104 410 Quantum uncertainty, q (e ) 122 20 O↵set (e ) 144 6 Output bits per pixel 16 10 Quantum entropy per pixel 8.3 bits 5.7 bits Quantum entropy per raw bit 0.52 0.57

TABLE I. Experimental parameters for the two cameras em-ployed in this experiment.

Random number generation

To generate random numbers we illuminate the cam-eras so that the mean number of absorbed photons ¯n is sufficient to give a quantum uncertainty _q = pn¯ as large as possible whilst not saturating the detectors. In prac-tice we illuminate the ATIK and Nokia cameras with an amount of light sufficient to generate 1.5 _⇥ 104 e and 410 e respectively. From equation 3, it is possible to calculate that the amount of entropy of quantum origin per pixel is 8.3 bits and 5.7 bits for each camera respec-tively, which are encoded over 16 and 10 bits, resulting in an average entropy per output bit of 0.52 for the CCD and 0.57 for the CMOS sensor. The raw data is sent to the extractor as a bitstring. When the illumination corresponds to approximately half the maximum value represented by the digitizer, the entropy is distributed over the output bits fairly homogenously. For di↵erent illuminations, the most significant bits start to carry less entropy. We rely on the extractor to ensure that the fi-nal output is perfectly random. Working parameters and results are summarised in table I.

From equation 5, we calculate that using the camera in the Nokia cell phone, and an extractor with a compres-sion factor of 4, for example with k = 500 and l = 2000,

!

FIG. 6. Measurement of the quantum and classical noise of our ATIK (a) and Nokia (b) detectors. At the operating con-ditions quantum noise strongly dominates.

it would take an impossible _⇠ 2 _⇥ 1096 trials to notice a deviation from a perfectly random bit string. If every-body on earth used such a device constantly at 1Gbps, it would take 1060 times the age of the universe for one to notice a deviation from a perfectly random bit string.

RESULTS AND TESTS

We collected 48 frames corresponding to approxi-mately 5 Gbits of raw random numbers and processed them on a computer through an extractor with a 2000 bit input vector and a 500 bit output vector to generate 1.25 Gbits of random numbers. Random number gener-ators are notoriously hard to test, however it is possible to check the generated bit string for specific weaknesses. The first step is to individuate potential problems of the system, and then test for them. First, we tested the generated random bit string before extraction. At this stage, the entropy per bit is still considerably less than unity; moreover, possible errors could arise from dead pixels and from correlations between pixels values given by electrical noise.

Besides increasing the mean entropy per bit, the ran-domness extractor also ensures that if some of the pix-els become damaged, covered by dust or su↵er from any other problem, the extremely good quality of the

(18)

ran-NON

-

IDEAL

CAMERA

:

STILL

OK

Even if Eve has full knowledge of the technical

noise, the best she can do is recover the quantum

noise.

Technical

noise

Quantum

noise

Alice

Eve

(19)

NON

-

IDEAL

CAMERA

:

STILL

OK

Even if Eve has full knowledge of the technical

noise, the best she can do is recover the quantum

noise.

Technical

noise

Quantum

noise

Alice

Eve

(20)

NON

-

IDEAL

CAMERA

:

STILL

OK

Even if Eve has full knowledge of the technical

noise, the best she can do is recover the quantum

noise.

Technical

noise

Quantum

noise

Alice

Eve

(21)

U

P

TO

10

RANDOM

BITS

PER

PIXEL

H_min(X_q) = log₂ [max (P_q(n))] (1) = log₂  max ✓ e n¯ n¯n n! ◆ = log₂  e n¯ n¯bn¯c bn¯_c! 1 10 100 1000 104 105 2 4 6 8 10

¯

n

H min (bits)

(22)

D

ETECTOR

LINEARITY

IS

IMPORTANT

3

LED

Extractor Random_numbers Camera

FIG. 3. Random number generator setup: a camera is fully and homogeneously illuminated by a LED. The raw binary representation of pixel values are concatenated and passed

through a randomness extractor. This extractor outputs

quantum random numbers.

the output of which are random numbers ready to be used.

First however, we check that the cameras comply with the manufacturer’s specification and that the operating conditions are appropriate for the generation of quan-tum random numbers. In particular, we are interested in verifying that the photon number distribution does not exceed the region where the camera is linear, and that there are enough digital codes to represent each possible

number of absorbed photons, i.e. ⇣ 1.

Camera characterization

To characterise the two cameras, we use a well con-trolled light source based on a light emitting diode (LED), as shown in Fig. 3.

As shown in Fig. 1, a number of photons n is absorbed

by the image sensor and converted into an equal number of electrons. This charge is in turn converted into a volt-age by an amplifier, and finally digitised. The amplifier gain (which in the sensors used corresponds to “ISO” setting) is set such that each additional input electron

will result in an output voltage increase sufficient to be

resolved by the ADC. This means that each electron

in-crease the digital output code c by at least 1. We check

that this is the case by illuminating the cameras with a

known amount of light. Using the nominal quantum effi

-ciency of the cameras we can infer ¯n, and observe ⇣ = c/e

to be 2.3 codes/electron for the ATIK camera, and 1.9 codes/electron for the Nokia camera, as expected from the devices’ specifications.

To evaluate the linearity of the camera sensors, we

measure the Fano factor given by F = Var(c)_⇣_c . In Fig. 4 we

plot the F for various illuminating intensities of our light

sensors. Both detectors have a large range of intensities where the Fano factor is constant with a value close to 1. In this range the statistics are dominated by the quantum uncertainty (shot noise). At strong illuminations, satu-ration occurs, for the Nokia N9 this happens at inten-sities corresponding to 450 absorbed photons per pixel. This is due to the high amplifier gain used (ISO 3200).

When saturation occurs, the Fano factor decreases, as the output is a constant. At low illumination intensities, we measure a Fano factor much greater than 1, due to detector technical noise.

0 100 200 300 400 500 Absorbed photons n 0 5000 10000 15000 0.0 0.5 1.0 1.5 2.0 Absorbed photons n V a ri a n ce /me a n ATIK 383L Nokia N9

FIG. 4. Fano factor (Variance/mean) of the devices employed in this experiment. We operate in the region where the Fano factor is 1 and the detector is most linear.

Image sensors such as CCD and CMOS have various sources of noise: thermal noise, leakage current and read-out noise. Thermal and leakage noise accumulate with integration time, so that it is possible to eliminate them using short exposure times (of the order of a millisec-ond). In this case, readout noise becomes the dominant technical noise, and is given by the readout circuit, the amplifier and the analog to digital converter (ADC). In image sensors, noise is usually counted in electrons (e ). The CCD camera and CMOS camera have a noise of

10 e and 3.3 e respectively.

Source characterization

Our light source is a standard LED. We check that it illuminates the detector homogenously, and measure the intensity of the emitted light with a powermeter, which allows us to calculate the mean number of photons ar-riving to each pixel within the exposure time, and thus

verify the camera’s efficiency. Using two single-photon

detectors (ID Quantique ID100) we measure the

second-order correlation function g(2), which we find to be 1, as

expected for a LED and acquisition times much longer

than the coherence time of the order of _⇠ 100 fs. We also

measure, using a single photon detector, that the num-ber of photons emitted within an exposure time follows a Poisson distribution, as shown in Fig. 5.

Saturation

(23)

R

ANDOMNESS

EXTRACTOR

0 0 0 0 0 0 0 1 0 0 1 1 1 1 1 1 1 0 0 0 1 1 1 1 1 1 0 1 0 0 1 0 0 1 1 1 1 1 0 1 0 0 0 1 0 1 0 0 0 0 0 0 1 1 1 1 1 0 0 0 0 0 0 0 0 0 1 1 1 1 0 0 0 0 0 1 0 0 1 0 H 1 1 1 0 L

✕

Ra

w

d

ata

in

_Extractor matrix (actually 2000x500)

Random bits out

[1] D. Frauchiger, R. Renner, and M. Troyer. True randomness from realistic

quantum devices. arXiv preprint arXiv:1311.4547, 2013.!

[2] M. Troyer and R. Renner. A randomness extractor for the quantis device. Id Quantique technical report, 2012.!

Light source loss detector amp converter

e V

ADC d digital_output

detector model

4

0 20 40 60 0.00 0.02 0.04 0.06 0.08 Photon number n P(n ) Theory (Poisson dist.) Experiment

ATIK 383L Nokia N9 Noise, t (e ) 10 3.3 Saturation (e ) 2 _⇥ 104 500 Illumination (e ) 1.5 _⇥ 104 410 Quantum uncertainty, q (e ) 122 20 O↵set (e ) 144 6

Output bits per pixel 16 10

Quantum entropy per pixel 8.3 bits 5.7 bits Quantum entropy per raw bit 0.52 0.57

To generate random numbers we illuminate the

cam-eras so that the mean number of absorbed photons ¯

n

is

su

ffi

cient to give a quantum uncertainty

_q

=

p

n

¯

as large

as possible whilst not saturating the detectors. In

prac-tice we illuminate the ATIK and Nokia cameras with an

amount of light su

ffi

cient to generate 1

.

5 _⇥

10

4

e

and

410 e

respectively. From equation 3, it is possible to

calculate that the amount of entropy of quantum origin

per pixel is 8.3 bits and 5.7 bits for each camera

respec-tively, which are encoded over 16 and 10 bits, resulting

in an average entropy per output bit of 0.52 for the CCD

and 0.57 for the CMOS sensor. The raw data is sent

to the extractor as a bitstring. When the illumination

corresponds to approximately half the maximum value

represented by the digitizer, the entropy is distributed

over the output bits fairly homogenously. For di

↵

erent

illuminations, the most significant bits start to carry less

entropy. We rely on the extractor to ensure that the

fi-nal output is perfectly random. Working parameters and

results are summarised in table I.

From equation 5, we calculate that using the camera in

the Nokia cell phone, and an extractor with a

compres-sion factor of 4, for example with

k

= 500 and

l

= 2000,

!

it would take an impossible

_⇠

2 _⇥

10

96

trials to notice

a deviation from a perfectly random bit string. If

every-body on earth used such a device constantly at 1Gbps,

it would take 10

60

times the age of the universe for one

to notice a deviation from a perfectly random bit string.

RESULTS AND TESTS

We collected 48 frames corresponding to

approxi-mately 5 Gbits of raw random numbers and processed

them on a computer through an extractor with a 2000

bit input vector and a 500 bit output vector to generate

1.25 Gbits of random numbers. Random number

gener-ators are notoriously hard to test, however it is possible

to check the generated bit string for specific weaknesses.

The first step is to individuate potential problems of the

system, and then test for them. First, we tested the

generated random bit string before extraction. At this

stage, the entropy per bit is still considerably less than

unity; moreover, possible errors could arise from dead

pixels and from correlations between pixels values given

by electrical noise.

Besides increasing the mean entropy per bit, the

ran-domness extractor also ensures that if some of the

pix-els become damaged, covered by dust or su

↵

er from any

T

ESTS

, “D

IE

H

ARDER

”

5 1e-08 1e-07 1e-06 1e-05 0.0001 0.001 0.01 0.1 1 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Aut oc or relation coefficient bits Atik Nokia

FIG. 7. Autocorrelation of the output bitstring, the value of the correlation is limited by the finite sample size.

domness is maintained.

A simplistic test to check that the generator does not su↵er from a problem is to check the autocorrelation of the output bitstring. We plot this in Fig. 7, showing no correlation.

Finally, we performed the “die harder” battery of ran-domness tests on both the extracted bit strings. This set of tests contains the NIST test, the diehard tests and some extra tests. The RNG passed all tests, the results of the most commonly used tests are shown in Fig. 8.

For many applications, such as the generation of cryp-tographic keys or gaming, speed is not as important as the a↵ordability and portability given by this sys-tem. Nevertheless, a quantum random number generator based on an image sensor can provide very reasonable performance in terms of speed. Consumer grade devices acquire data at rates between 100 Megapixels per second and 1 Gigapixel per second. After the necessary process-ing, each pixel will typically provide 3 random bits so that rates between 300 Mbps and 3 Gbps can be obtained. To sustain such high data rates, processing can be done either on an Field Programmable Gate Array (FPGA), or could be embedded directly on a CMOS sensor chip. Implementing the extractor fully in the software of a con-sumer device can sustain random bit rates greater than 1 Mbps, largely sufficient for most consumer applications.

CONCLUSION AND OUTLOOK

We demonstrate a generator of random numbers of quantum origin using technology compatible with con-sumer and portable electronics. We believe that the simplicity and performance of this device will make the widespread use of quantum random numbers a reality, with an important impact on information security. We

! " # $ % & ' $ % &( ' ) * ! + ! , , . $ /0//% /0/% /0% % ! " # $ % & ' $ % &( ' ) * ! + ! , , . $ /0//% /0/% /0% % #123 "

FIG. 8. Test results for some of the Diehard battery of tests for random number generators. The represented p-value is the result of a Kolmogorov-Smirnov test of 100 p-values. The suite also performs a large number of other tests, which our RNG passes, e.g. have a 0.01 < p-value <0.99.

find exciting that, with a few tricks, quantum experi-ments can now be done with consumer-grade hardware, and that this may lead to the widespread use of a quan-tum technology

ACKNOWLEDGEMENTS

We are very grateful to Charles Ci Wen Lim and Pavel Sekatski, Renato Renner, Daniela Frauchiger and Pierre Jobez for useful discussion. We are also very grateful to the team that developed the Nokia n9 mobile telephone and its open source operating system, as well as the team who developed the FCam camera driver. We aknowledge the Swiss NCCR QSIT for financial support.

⇤ _{[email protected]}

[1] David W Kravitz, “Digital signature algorithm,” US patent N. 5,231,668 A (1993).

[2] R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key cryptosys-tems,” Commun Acm 21, 120–126 (1978).

[3] L.M. Adleman, R.L. Rivest, and A. Shamir, “Crypto-graphic communications system and method,” US patent

5 1e-08 1e-07 1e-06 1e-05 0.0001 0.001 0.01 0.1 1 0 200 400 600 800 1000 1200 1400 1600 1800 2000 Aut oc or relation coefficient bits Atik Nokia

FIG. 7. Autocorrelation of the output bitstring, the value of the correlation is limited by the finite sample size.

domness is maintained.

A simplistic test to check that the generator does not su↵er from a problem is to check the autocorrelation of the output bitstring. We plot this in Fig. 7, showing no correlation.

Finally, we performed the “die harder” battery of ran-domness tests on both the extracted bit strings. This set of tests contains the NIST test, the diehard tests and some extra tests. The RNG passed all tests, the results of the most commonly used tests are shown in Fig. 8.

For many applications, such as the generation of cryp-tographic keys or gaming, speed is not as important as the a↵ordability and portability given by this sys-tem. Nevertheless, a quantum random number generator based on an image sensor can provide very reasonable performance in terms of speed. Consumer grade devices acquire data at rates between 100 Megapixels per second and 1 Gigapixel per second. After the necessary process-ing, each pixel will typically provide 3 random bits so that rates between 300 Mbps and 3 Gbps can be obtained. To sustain such high data rates, processing can be done either on an Field Programmable Gate Array (FPGA), or could be embedded directly on a CMOS sensor chip. Implementing the extractor fully in the software of a con-sumer device can sustain random bit rates greater than 1 Mbps, largely sufficient for most consumer applications.

CONCLUSION AND OUTLOOK

We demonstrate a generator of random numbers of quantum origin using technology compatible with con-sumer and portable electronics. We believe that the simplicity and performance of this device will make the widespread use of quantum random numbers a reality, with an important impact on information security. We

! " # $ % & ' $ % &( ' ) * ! + ! , , . $ /0//% /0/% /0% % ! " # $ % & ' $ % &( ' ) * ! + ! , , . $ /0//% /0/% /0% % #123 "

FIG. 8. Test results for some of the Diehard battery of tests for random number generators. The represented p-value is the result of a Kolmogorov-Smirnov test of 100 p-values. The suite also performs a large number of other tests, which our RNG passes, e.g. have a 0.01 < p-value < 0.99.

find exciting that, with a few tricks, quantum experi-ments can now be done with consumer-grade hardware, and that this may lead to the widespread use of a quan-tum technology

ACKNOWLEDGEMENTS

We are very grateful to Charles Ci Wen Lim and Pavel Sekatski, Renato Renner, Daniela Frauchiger and Pierre Jobez for useful discussion. We are also very grateful to the team that developed the Nokia n9 mobile telephone and its open source operating system, as well as the team who developed the FCam camera driver. We aknowledge the Swiss NCCR QSIT for financial support.

⇤ _{[email protected]}

[1] David W Kravitz, “Digital signature algorithm,” US patent N. 5,231,668 A (1993).

[2] R. L. Rivest, A. Shamir, and L. Adleman, “A method for obtaining digital signatures and public-key

cryptosys-tems,” Commun Acm 21, 120–126 (1978).

[3] L.M. Adleman, R.L. Rivest, and A. Shamir, “Crypto-graphic communications system and method,” US patent

(25)

S

PEED

Control

Clock

Data (10x)

300 MHz 1000 MHz

Image sensor CPU/DSP/FPGA

Sensor: 8 Megapixels x 30 frames/s x 3 bits = 720 Mbit/s

Extractor: software ~10 Mbps; PFGA ~ 1.25 Gbps

(26)

M

OST

“

CALIBRATED

”

SOURCES

ARE

USABLE

,

WITH

CERTAIN

ASSUMPTIONS

.

4 0 20 40 60 0.00 0.02 0.04 0.06 0.08 Photon number n P(n ) Theory (Poisson dist.) Experiment

ATIK 383L Nokia N9 Noise, t (e ) 10 3.3 Saturation (e ) 2_⇥ 104 500 Illumination (e ) 1.5 _⇥ 104 410 Quantum uncertainty, q (e ) 122 20 O↵set (e ) 144 6

Output bits per pixel 16 10 Quantum entropy per pixel 8.3 bits 5.7 bits Quantum entropy per raw bit 0.52 0.57

To generate random numbers we illuminate the cam-eras so that the mean number of absorbed photons ¯n is sufficient to give a quantum uncertainty q =

p

¯

n as large as possible whilst not saturating the detectors. In prac-tice we illuminate the ATIK and Nokia cameras with an amount of light sufficient to generate 1.5 _⇥104e and 410 e respectively. From equation 3, it is possible to calculate that the amount of entropy of quantum origin per pixel is 8.3 bits and 5.7 bits for each camera respec-tively, which are encoded over 16 and 10 bits, resulting in an average entropy per output bit of 0.52 for the CCD and 0.57 for the CMOS sensor. The raw data is sent to the extractor as a bitstring. When the illumination corresponds to approximately half the maximum value represented by the digitizer, the entropy is distributed over the output bits fairly homogenously. For di↵erent illuminations, the most significant bits start to carry less entropy. We rely on the extractor to ensure that the fi-nal output is perfectly random. Working parameters and results are summarised in table I.

From equation 5, we calculate that using the camera in the Nokia cell phone, and an extractor with a compres-sion factor of 4, for example with k = 500 and l = 2000,

!

it would take an impossible _⇠ 2 _⇥ 1096 trials to notice a deviation from a perfectly random bit string. If every-body on earth used such a device constantly at 1Gbps, it would take 1060 times the age of the universe for one to notice a deviation from a perfectly random bit string.

RESULTS AND TESTS

We collected 48 frames corresponding to approxi-mately 5 Gbits of raw random numbers and processed them on a computer through an extractor with a 2000 bit input vector and a 500 bit output vector to generate 1.25 Gbits of random numbers. Random number gener-ators are notoriously hard to test, however it is possible to check the generated bit string for specific weaknesses. The first step is to individuate potential problems of the system, and then test for them. First, we tested the generated random bit string before extraction. At this stage, the entropy per bit is still considerably less than unity; moreover, possible errors could arise from dead pixels and from correlations between pixels values given by electrical noise.

Besides increasing the mean entropy per bit, the ran-domness extractor also ensures that if some of the pix-els become damaged, covered by dust or su↵er from any other problem, the extremely good quality of the

ran-Price: ► € 3’480.- per participant (Early booking discount, see below)

The price includes:

- Board and accommodation (6 nights, single room in a *** hotel)

- Course participation

- Teaching materials

- Recreational activities (various winter sports)

Travel to and from Les Diablerets not included.

Certificate: ► Granted upon completion of the Winter School

Insurance: ► Health and accident insurance is the responsibility of the participant. Accompanying ► Possibility to come with an accompanying person.

Person: Price: € 1’200.- per person, which includes:

Accommodation in a double room, breakfast, lunch and dinner, and recreational activities. Travel to and from Les Diablerets not included.

Application: ► Before November 15th, 2014

(The number of participants is limited. Applications will be accepted on a first come first served basis.)

Early booking: ► For booking and payment before October 15th, 2014, special price of €

2’780.- per participant (€ 960.- per accompanying person).

Act quickly to take advantage of this 20% discount!

Optional visit: ► Possibility to visit the premises of ID Quantique on Friday morning and/or

the Group of Applied Physics of the University of Geneva on Friday afternoon,

January 23th, 2015.

Participants wishing to take advantage of this opportunity will leave Les Diablerets by train for Geneva at 8.00am.

The train ticket must be purchased by the participant, but the visit(s) is free of charge.

Registration and organizational issue for the visit(s) will be taken during the Winter School

Come join us in Les Diablerets next winter! This Winter School is a unique opportunity to learn about state-of-the-art practical quantum communications and to gain hands-on experience. The program will also allow participants to network and socialize, while discovering winter sports such as downhill skiing, sledding or snowshoe hiking in a beautiful Swiss Alps winter landscape.

Your faithfully,

Grégoire Ribordy

Test of LED photon

number distribution

with single photon

detector

Light source loss detector amp converter

e V

ADC digital

output d

(27)

C

AN

BE

COMPLETELY

INTEGRATED

ON

CHIP

LED

waveguide

Extractor

Sensor

Random

numbers

(28)

C

ONCLUSION

Cheap image sensors really work at the quantum level

QRNG can be made cheaply and integrated, using existing

technology

(29)

T

HANKS

FOR

YOUR

ATTENTION

Anthony! Martin Hugo ! Zbinden Nicolas! Gisin

(30)

7 TH

ID Q

UANTIQUE

W

INTER

SCHOOL

18 J

AN

-22 J

AN

2015

Price:

► € 3’480.

- per participant

(Early booking discount, see below)

The price includes:

-

Board and accommodation (6 nights, single room in a *** hotel)

-

Course participation

-

Teaching materials

-

Recreational activities (various winter sports)

Travel to and from Les Diablerets not included.

Certificate:

► Granted upon completion of the Winter School

Insurance:

► Health and accident insurance is the responsibility of the participant.

Accompanying

► Possibility to come with an accompanying person.

Person:

Price: € 1’200.

- per person, which includes:

Accommodation in a double room, breakfast, lunch and dinner, and

recreational activities. Travel to and from Les Diablerets not included.

Application:

► Before

November 15

th

, 2014

(The number of participants is limited. Applications will be accepted on a first

come first served basis.)

Early booking:

► For booking and payment before October 15

th

, 2014, special price of €

2’780.

-

per participant (€ 960.

- per accompanying person).

Act quickly to take advantage of this

20% discount!

Optional visit:

► Possibility to visit the premises of ID Quantique on Friday morning and/or

the Group of Applied Physics of the University of Geneva on Friday afternoon,

January 23

th