Quantum Computing: Foundations to Frontier Fall 2018

Lecture 2
Lecturer: Henry Yuen Scribes: Motasem Suleiman, Chenyang Li
Noah Fleming, Ian Mertz

1 Overview

In this lecture we will first go over measuring in different bases, the Heisenberg Uncertainty Prin-
ciple, and then explore quantum entanglement. We will talk about non-classical correlations that
arise in the CHSH game, its relation to Bell’s theorem and the EPR paradox, and conclude with
applications of the CHSH game to the problem of certifying randomness generation.

2 Main Section

2.1 Measuring in Different Bases

Measurements are typically performed in the standard basis which is also known as the computa-
tional basis, {|0i, |1i}. In the single qubit case, we recall that a qubit is a complex vector α|0i+β|1i.
One can think of the measurement on this qubit is by projecting the vector on |0i or |1i.
Let V be an orthonormal basis of Cd where V = {|u1 i, |u2 i, |u3 i, . . . , |ud i}. Let |ψi ∈ Cd be a
d-dimensional quantun state. We can measure |ψi in the basis V . If we associate basis vector
|ui i with outcome i ∈ {1, . . . , d}, then we obtain outcome i with probability |hψ|ui i|2 , and the
post-measurement state is |ui i. In other words, we project the state |ψi onto the basis vector |ui i.
Physically, what does “measuring in a non-standard basis” mean? There exists a unitary U that
depends on the basis V such this non-standard basis measurement is equivalent to first applying U
to the state |ψi, measuring in the standard basis, and then applying the inverse unitary U † to the
post-measurement state.
In other words, the probability of obtaining outcome |ui i if we measured |ψi in the V basis is the
same as obtaining outcome |ii if we measured |ψ 0 i = U |ψi in the standard basis.

P
Partial measurement rule. What if we take a two-qubit state |ψi = αij |ii|ji and measure
the first qubit in a non-standard basis V = {|v0 i, |v1 i}?
Fix a k ∈ {0, 1}. We will calculate the probability of obtaining outcome |vk i. Consider the following
vector: X
|vi = αij hvk |ii |ji.
ij

Note that this is, in general, not a normalized state. Also note that |vi is a vector in C2 (not

1
C2 ⊗ C2 !). The probability of obtaining outcome |vk i is the norm squared of |vi:
2
2
X X
k |vik = αij hvk |ii .
j i

The post-measurement state of both qubits is

1
|vk i ⊗ |vi.
k |vik

You should check that this is a normalized state.

Example. Let V = {|+i, |−i} where

1 1
|+i = √ (|0i + |1i) |−i = √ (|0i − |1i).
2 2
q q
Let |ψi = 23 |01i + 13 |10i. The probability of obtaining the |−i outcome when measuring the
first qubit of |ψi in the basis V is the following. We first calculate
r r
2 1
|vi = h−|0i |1i + h−|1i |0i
3 3
r r r r !
2 1 1 1
= |1i + − |0i
3 2 3 2
r r
1 1
= |1i − |0i.
3 6
The norm of |vi is 1/3 + 1/6 = 1/2. Thus the probability of obtaining outcome |−i is 1/2. The
post-measurement state is then
r r !
2 1
|−i ⊗ |1i − |0i .
3 3

2.2 Heisenberg Uncertainty Principle

The principle arises in physics and chemistry in which it states that one cannot tell the position
and the momentum of a particle at the same time. In quantum information theory terms, this boils
down to the following statement: it is not possible for a qubit |ψi to be determined using both the
standard basis {|0i, |1i} and {|+i, |−i} basis. In other words, if we measure |ψi in the standard
basis and get a deterministic outcome, then we cannot get a deterministic outcome when measuring
|ψi in the {|+i, |−i} basis, and vice-versa. We say that these two bases are incompatible.
In physics, measuring the position or momentum of a particle is measuring in two incompatible
bases.

2
2.3 Entanglement

In general, a two-qubit state |ψi ∈ C2 ⊗ C2 cannot be represnted as |ψi = |φi ⊗ |θi for some
|φi, |θi ∈ C2 . Such states are called product or unentangled states. The equality holds when the
two qubits act independently. i.e. measuring one does not affect the other one. However, general
quantum states are entangled, which means that the two qubits show correlation between one
another. This means that measuring one qubit influences the outcome measurement of the other
one.
An example of two entangled two-qubit system is: |ψi = √1 |00i + |11i) This is called the EPR
2
pair (Bell state or maximally entangled state).
Let’s explore some properties of the EPR pair. Suppose Alice gets one qubit and Bob gets the
other qubit. When measuring in the standard basis, both Alice and Bob obtain the same outcome.
Hence, they are correlated. This correlation is not special to the quantum world, it can also be
done classically. Interestingly, with the EPR pair, the correlation might get more complicated, as
we will see.

3 CHSH game

We will see that there can be interesting correlations between Alice and Bob’s measurement out-
comes that would not be possible in a classical world. These correlations can be illustrated by
means of Clauser-Horne-Shimony-Holt (CHSH) game [CHSH69].

Alice Bob

‫ݔ‬ ‫ݕ‬
ܽ ܾ

Referee

Figure 1: The CHSH game.

As depicted in Fig. 1 in the CHSH game, there are two players (Alice and Bob) who are viewed as
cooperating with one another but cannot communicate directly with one another . A referee runs
the game, and all communication in the game is between the players and the referee. The referee
randomly selects and sends a question x to Alice and a question y to Bob. Each player sends an
answer, say answer a for Alice wand b for Bob, back to the referee. All questions and answers,
x, y, a, b, are single bits. Based on all of the questions and answers, the referee determines whether
the players win or lose.
The winning condition is a + b = xy mod 2. In other words, if xy = 0, then Alice and Bob have
to output matching answers. If xy = 1, Alice and Bob have to output opposite answers.
What is the maximum winning probability for Alice and Bob in this game?

3
3.1 Classical strategy

Suppose Alice and Bob only use classical strategies, i.e., each player generate their answers as a
deterministic function of their questions. It is easy to find a strategy with a wining probability of
3/4 and, i.e., they both answer 0 all the time. In fact, the maximum wining probability with a
classical strategy is 3/4. One way of checking this is by trying all possible classical strategies (there
aren’t that many).
Furthermore, allowing randomized strategies can not help them to get a better success probability.
This is because any classical randomized strategy for the CHSH game (where say Alice’s answer is
a function of the question x, as well as some random string r that might be possibly shared with
Bob, and similarly for Bob’s answer) can be converted into a deterministic strategy that has the
same winning probability.

3.2 Quantum strategy

ͳ
Ȱൌ ሺȁͲͲۧ ൅ ȁͳͳۧሻ
ξʹ
Alice Bob

‫ݔ‬ ‫ݕ‬
ܽ ܾ

Referee

Figure 2: CHSH game with maximally entanglement states.

What if Alice and Bob use quantum strategy? They can get a better result if they can use
entanglement. Suppose that before the game starts, as depicted in Fig.2, Alice and Bob get
together in a lab and create an entangled two-qubit state:
1
|Φi = √ (|00i + |11i). (1)
2
Alice takes one qubit and Bob takes the other one. When the game starts, Alice gets x ∈ {0, 1} and
Bob gets y ∈ {0, 1}. As depicted in Table 1, depending on their questions, they perform different
measurements on their respective qubits.
(a)If Alice receives the question 0, she will measure her qubit with respect to the basis {|0i, |1i}.
Alice outputs 0 if the measurement result is |0i, or 1 if the measurement result is |1i.
(b)If Alice receives the question 1, she will measure her qubit with respect to the basis {|+i, |−i},
where{|+i = √12 (|0i + |1i), |−i = √12 (|0i − |1i)}. Alice outputs 0 if the measurement result is |+i,
or 1 if the measurement result is |−i.
(c)If Bob receives the question 0, he will measure his qubit with respect to the basis {|a0 i, |a1 i},
where {|a0 i = cos(π/8)|0i + sin(π/8)|1i, |a1 i = − sin(π/8)|0i + cos(π/8)|1i}. Alice outputs 0 if the
measurement result is |a0 i, or 1 if the measurement result is |a1 i.

4
(c)If Bob receives the question 1, he will measure his qubit with respect to the basis {|b0 i, |b1 i},where
{|b0 i = cos(π/8)|0i − sin(π/8)|1i, |b1 i = sin(π/8)|0i + cos(π/8)|1i}. Alice outputs 0 if the measure-
ment result is |b0 i, or 1 if the measurement result is |b1 i.

Table 1: Alice’s and Bob’s quantum strategy

Alice Bob
Question x Basis state Output Question y Basis state Output
|0i 0 |a0 i 0
x=0 y=0
|1i 1 |a1 i 1
|+i 0 |b0 i 0
x=1 y=1
|−i 1 |b1 i 1

Now, let us consider the winning probability. The total winning probability, P (win), can be written
as:
Pr(win)
= Pr(a = 0, b = 0|x = 0, y = 0) Pr(x = 0, y = 0) + Pr(a = 1, b = 1|x = 0, y = 0) Pr(x = 0, y = 0)
+ Pr(a = 0, b = 0|x = 1, y = 0) Pr(x = 1, y = 0) + Pr(a = 1, b = 1|x = 1, y = 0) Pr(x = 1, y = 0)
+ Pr(a = 0, b = 0|x = 0, y = 1) Pr(x = 0, y = 1) + Pr(a = 1, b = 1|x = 0, y = 1) Pr(x = 0, y = 1)
+ Pr(a = 0, b = 1|x = 1, y = 1) Pr(x = 1, y = 1) + Pr(a = 1, b = 0|x = 1, y = 1) Pr(x = 1, y = 1).
(2)

Let’s calculate probability that Alice and Bob win when their question pair is (x, y) = (0, 0):

Pr(a = 0, b = 0|x = 0, y = 0) = |(h0| ⊗ ha0 |) |Φi|2

2
1
= (h0| ⊗ ha0 |) √ (|00i + |11i)
2
2 (3)
1
= √ ha0 |0i
2
1
= cos2 (π/8),
2

Pr(a = 1, b = 1|x = 0, y = 0) = |(h1| ⊗ ha1 |) |Φi|2

2
1
= (h1| ⊗ ha1 |) √ (|00i + |11i)
2
2 (4)
1
= √ ha1 |1i
2
1
= cos2 (π/8),
2

Thus, Pr(win|x = 0, y = 0) = Pr(a = 0, b = 0|x = 0, y = 0) + Pr(a = 1, b = 1|x = 0, y = 0) =

cos2 (π/8) ≈ .854. Similarity, we can compute the other conditional probabilities, Pr(a, b|x, y). In
fact, it will turn out that Pr(win|x, y) = cos2 (π/8) irrespective of the question pair (x, y). This

5
implies that Pr(win) = cos2 (π/8) ≈ .854 which is strictly greater than 3/4, the maximum classical
success probability.
It is not possible to do better than cos2 (π/8) with a quantum strategy for the CHSH game (although
proving this is outside the scope of this lecture).
Thus, quantum entanglement gives rise to correlations that cannot be reproduced by classical
randomness, and furthermore these correlations can help in playing this CHSH game.

4 Historical Perspective

The CHSH game is not just a cute demonstration of the advantage that using quantum entangle-
ment can give in some esoteric game. In fact, the CHSH game arose naturally from one of the most
important debates in Quantum Mechanics. In 1935, out of their great discomfort with the model
of the real world that the theory of Quantum Mechanics presented, Einstein, Podolsky and Rosen
(EPR), published a (now famous) paper titled “Can Quantum-Mechanical Description of Physical
Reality be considered Complete?” [EPR35]. Their paper argued that although Quantum Mechan-
ics may be remarkably good at predicting the outcome of experiments, it cannot be a complete
description of nature.
Einstein, Podolsky and Rosen’s grief with Quantum Mechanics can be summed up by the following
experiment. Define the state
1
|ψi = √ (|00i + |11i) ,
2
and imagine the following two thought experiments: Alice and Bob share |ψi and are unable to
communicate with each other. We will say that the first qubit belongs to Alice and the second
belongs to Bob.

Experiment A: Alice measures her qubit in the standard basis {|0i, |1i}.

Experiment B : Alice measures her qubit in the Fourier basis {|+i, |−i}.

In Experiment A, Alices outcomes are as follows:

outcome: |0i with probability 1/2, with post measurement state |00i,

outcome: |1i with probability 1/2, with post measurement state |11i.

For, experiment B, the probability that

outcome: |+i with probability 1/2, with post measurement state | + +i,

outcome: |−i with probability 1/2, with post measurement state | − −i.

To see that this is correct for experiment B, observe that the probability of Alice measuring |+i is
  2 2
1 1 1 1 1 1
(|+ih+| ⊗ I) √ |0i ⊗ |0i + √ |1i ⊗ |1i = kh+|0i|0i + h+|1i|1ik2 = √ |0i + √ |1i = 1/2.
2 2 2 2 2 2

6
 √
The post-measurement state is then |+i ⊗ (1/ 2(|0i + |1i) = |+i ⊗ |+i. Similarly for the case when
Alice measures |−i.
Therefore, if Alice measures |ii for i ∈ {0, 1}, then she knows Bob’s qubit must have collapsed to
|ii. Similarly, if Alice measures |ji for j ∈ {+, −}, then she knows Bob’s must have collapsed to |ji.
Therefore, Bob’s qubit is both in the {|0i, |1i} and {|+i, |−i} basis simultaneously. The punchline
is that no matter what basis Alice chooses to measure in, and no matter what outcome she gets,
Bob’s state always collapses to that outcome simultaneously.
This is difficult to reconcile with Heisenberg uncertainty principle. Bob’s qubit could be billions of
light years away and yet Quantum Mechanics states that the state of the two particles collapsed
in a way that make it appear that Bob’s qubit knew what basis Alice chose to measure in, in the
sense that after Alice performs one of the two experiments, she knows the state of Bob’s qubit. But
because of the locality of physics, Alice’s choice of measurement couldn’t have affected the intrinsic
state of Bob’s qubit (or so EPR’s reasoning went).
Because of this, Einstein, Podolsky and Rosen concluded that Bob’s qubit has its answers for both
the {|0i, |1i} basis and the {|+i, |−i} basis prepared ahead of time. This violates Heisenberg’s un-
certainty principle which states that the outcome of these two incompatible measurements cannot
be determined. Therefore, something must be wrong. The conclusion of Einstein, Podolsky and
Rosen was that Quantum Mechanics wasn’t really describing reality. They posited that instead
there was a deeper classical theory – consistent with the statistical predictions of Quantum Mechan-
ics – but explains the paradox above by saying that in fact there are hidden variables that describe
the intrinsic state of each particle. These variables describe different outcomes for each outcomes
for each possible measurement you could make on them. But these variables would respect locality
(i.e. signals cannot travel faster than the speed of light).
That is, they posited that there was an underlying classical theory called a local hidden variable
theory that

1. Respects relativity/locality/causality, and

2. Reproduces the statistics of Quantum Mechanics.

To Einstein, this would be much more satisfactory, this would be the best of both worlds.
In 1964, a physicist named John Bell made an amazing contribution to quantum physics, that is at
once incredibly simple but also profound. His contribution came in the form of (something similar
to) the CHSH game. We make a modern reformulation of Bell’s theorem here:
Theorem 1. (Bell’s Theorem [Bel64]) Any classical strategy for the CHSH game can win at most
3/4ths of the time, while there exists a quantum strategy for the CHSH game that wins at least a
cos2 (π/8) ≥ .853 fraction of the time.

If the universe truly followed Einstein’s model of local hidden variables, then any strategy in
particular would also be described using local hidden variables. But such a strategy is classical and
so it cannot win more than 75% of the time. However, Quantum Mechanics predicts something
different, and indeed this has been verified experimentally (See for example [CS78]). This says that
no classical theory – such as a local hidden variable model – can ever reproduce all of the predictions
of Quantum Mechanics and also be consistent with special relativity. The world is fundamentally
non-classical.

7
5 Certifying randomness

We will now look at another, more practically motivated application of the CHSH game: generating
random bits. When working with computers one never runs out of uses for truly random bits,
both in computer science (cryptography, privacy randomized algorithms) and in general computer
applications (gambling websites, your iTunes visualizer. . . ). We don’t yet have a full understanding
of the power of randomness, but at the moment it’s one of the workhorses keeping the internet
afloat.

Pseudorandomness. Sometimes it’s enough to get away with pseudorandomness, or bits that
“look random enough” despite being generated deterministically. Of course it’s enough to have your
iTunes visualizer do something that looks sort of random to the naked eye, but pseudorandomness
is a powerful tool in theoretical computer science with connections to both obtaining efficient
algorithms and proving such algorithms don’t exist.
However it would be a pretty big leap of faith to trust a deterministic procedure with protecting
your credit card info, or shuffling the deck on your poker website. While it’s true that these
pseudorandom generators are given a seed—a small amount of randomness to get started—even
these sources are hard enough to come by, and the hacks that most systems use are appallingly
bad. Some of the most common seed sources come from the number of milliseconds since midnight,
CPU temperature, inputs from your computer such as mouse movements or keyboard presses, and
other physical mechanisms that are not particularly hard to predict1 . Even the built in randomness
function for most programming languages uses an algorithm called the Mersenne Twister, which
can be infinitely determined with 624 consecutive samples [Wikb].

Certifying randomness. This suggests a question of testing whether or not a given string is
random. Say you buy a random number generator on Amazon, a little black box that, for the low
price of no less than $500 or so, promises that the string is actual true randomness, not based on
some shady seeding method. Of course many companies have promised this in the past, and as
we’ve already seen there’s usually a smart computer scientist who breaks it by noticing the right
pattern. But this could be the cleverest box we’ve seen yet, or more likely is using a novel way to
generate terrible randomness.
As cryptographers, it is our job to certify that this box is actually putting out randomness beyond
a shadow of a doubt. Because cryptography deals with transmitting messages in the presence of
an adversary, cryptographers tend to be as paranoid as they come, and would never assume that
their Amazon box has our best interest, ie outputting truly random bits, at heart. In fact given
the NSA’s history with exactly this issue [Wika], it’s always better to assume the opposite. With
that said, no one will get anywhere by just throwing the box away; we need to get our random bits
eventually. So instead we ask the natural question:

Question: Does there exist a deterministic test to determine whether or not your box is gen-
erating true randomness and not a deterministic procedure?
1
It would take days to go through all the hits on Google that come up for lottery and gambling sites that have
been publically broken by bored cryptographers and even some notorious hackers. More many were based on sources
coming from the timestamp, and were broken by people who learned the right time window in which they had to
press the button [All17].

8
The answer, of course, is no. The first way to reject this idea is to note that every string of
length n is equally likely to occur, so if your box outputs a particular string, say r ∈ {0, 1}n ,
there’s no firm reason to reject even if r is the all zeroes string. An equivalent counterargument
is by an adversarial argument: if you had such a test T , Amazon could send you a box that has
a few strings your test T accepts and it simply prints them out when you press the button, no
randomness involved.

5.1 Quantum randomness

In contrast to the deterministic setting, where true randomness is nigh impossible to come by, a
quantum system is practically overflowing with it. Even a simple quantum procedure is enough to
generate true randomness. We illustrate this using one of quantum computing’s most important
unitary gates, called the Hadamard gate, which in a word maps |0i ↔ |+i and |1i ↔ |−i. We detail
the procedure for completeness:
|ψi = |0i
 
1 1 1
U=√
2 1 −1
1
U |ψi = √ (|0i + |1i) = |+i
2
If we measureqU |ψi and return the result this is a uniformly random bit, as the coefficient on both
|0i and |1i is 12 .

Certifying quantum randomness. So all hope is not lost. For a number of years the hardware
random number generators you see on the internet have been promising to use quantum sources to
extract their randomness, with similar tricks to what we just saw. Unfortunately one could (and
should) imagine the same box showing up at our house, even with “quantum” stamped across the
top. We’ve already seen that it’s hopeless to try and certify randomness just by looking at the
output string in isolation, but there is one hope: we at least know how to check that stamp, in the
form of the CHSH game.
Imagine the following scenario: you decide to shell out $1000 instead of $500 to get a hold of two
boxes, both of which claim to use quantum mechanics to generate randomness. You put them on
your desk, and wrap them up so they’re free of generating any heat, sound, or anything else they
might pick up from each other. You then play the CHSH game with these two boxes, randomly
generating x and y and then pressing the button to get a and b. After running this game for a few
hours their win rate is at 80%. With what we’ve seen in the lecture up until now we know that
with almost perfect assurance this means there are quantum effects at play in these boxes, and in
particular that the bits you’re receiving have information-theoretic entropy (randomness) coming
from quantum effects. Better yet, we’ve made practically no assumptions about the setting; the
strongest thing we’ve assumed is that they aren’t communicating, which can be easily fixed by just
moving them to adjacent rooms, or shipping one off to China [Bil17].
There are two reasonable objections to come out of this test. The first is what to conclude when the
win rate is close to (or even below) 75%. The short answer is that we can’t conclude anything. Two

9
quantum players playing the CHSH game can easily underperform the best strategy, if their goal
was to convince you that they weren’t sharing any entanglement (remember, we’re cryptographers,
and we’re as paranoid as it gets). The second objection is that we needed randomness to generate
x and y, meaning that by all measures we’ve lost a treasure trove of random bits for the sake of
testing that these boxes have any quantum randomness in them at all, possibly far less than the
amount we put in.

5.2 Randomness expansion.

This problem was formalized in Roger Colbeck’s Ph.D thesis [Col06], wherein he developed a
procedure to not only certify quantum randomness when it’s present, but to certify that the outputs
of these two boxes2 contains more randomness than the amount used to play the game.
Theorem 2 ([Col06], Section 5.2.3). For every constant c > 1 there exists a game which requires
n bits of randomness where the boxes win the game iff there exist cn bits of randomness in their
outputs.

Even more, [Col06] also shows that it’s possible to extract cn bits, not just certify them. This is
an important distinction in theoretical computer science, where having a bitstring with entropy ω
in no way guarantees a way to get ω purely random bits. This led to a line of work in quantum
cryptography which we summarize now:

• Colbeck (2006)[Col06]: n → cn, c > 1 (linear expansion)

• Pironio et al (2010) [PAM+ 10]: n → n2 (quadratic expansion)

• Vazirani, Vidick (2012) [VV12]: n → exp(Ω(n1/3 )) (exponential expansion)

The central technique behind these expansion arguments is to play a protocol like the following.
Let R denote the total number of rounds of CHSH being played.

1. The verifier (i.e. you) randomly chooses a small subset S ⊆ {1, . . . , R} of size |S| = n.

2. Play R rounds of the CHSH game in sequence with the two devices. In round j, if j ∈ S,
then choose the questions x, y uniformly at random. If j ∈
/ S, then set x = 0, y = 0.

3. Count how many of the CHSH games in the rounds S the boxes won. If the number is at
least, say, 0.8n, then accept. Otherwise, reject.

The randomness expansion results above show that, for different tradeoffs between n and R, if
the verifier accepts, then with high probability the answers of the devices (which forms an R-
length string), will contain roughly Ω(R) bits of entropy (which is much more than the amount of
randomness used by the verifier to select set S and also the randomness for the S-round questions).
The intuition for why this works is the following: while the rounds outside of the set S seem useless,
recall that neither of the devices can communicate, and thus the first box receiving a 0 doesn’t
2
Colbeck’s setup contained three boxes instead of two, and used a different game. A follow up work of Barrett,
Colbeck, and Kent [BCK12] uses only two devices, as do all other follow-up works we discuss in this section.

10
guarantee that the other box did as well. Even if both boxes knew that there were only going to
be an  fraction of the games where either of them would see a 1, [Col06] argued that they can’t
do much with the information without knowing where those games would appear. Ultimately the
randomness in both the actual CHSH rounds and in deciding when they would appear is much
less than the amount of randomness the boxes have to generate in order to not fall below the 75%
threshold. All follow-up works used the same basic strategy but primarily varied the number of
rounds where the actual game would be played.

Infinite randomness expansion. While exponential expansion seems like a natural stopping
point, one might ask if it’s the last stop on our way to infinite randomness expansion. All other
strategies for expansion used this sparsified game method, but in order to go to infinite expansion
we clearly need a much different approach.
The only strategy that immediately comes to mind when discussing infinite expansion, and one
that may have occurred to most readers as soon as we talked about expanding n bits to more
than n bits, is to just feed this new pure randomness back into the same game. This does not
immediately succeed, as the two boxes are allowed to keep their transcripts between rounds and
thus know exactly what randomness the tester has pressed out of them. Thus they could easily
switch to a deterministic strategy as soon as they see their own bits coming back.
After showing linear expansion, [Col06] made the (near trivial) observation that infinite randomness
can be achieved by rigging up these pairs of boxes in parallel and using the same initial random
string for all of them. This runs into the obvious problem of costing far more than $1000, but
it suggests a similar strategy, namely using randomness from one instance of the game for a new
instance, and then eventually looping back to the first set of boxes once the new randomness is
independent enough from the bits that it generated. In fact, it turns out that $4000, or rather eight
boxes, suffices.

Theorem 3 ([CY14], Theorem 2.1). For every k there exists a k-round protocol involving eight
non-signalling quantum devices that, starting with n bit seed, can certify that an output string s is
drawn from a distribution that is exp(−Ω(n1/3 ))-close to uniform. Furthermore, the string s has
length g (k) (n), where g (k) is the k-fold composition of the function g(m) = exp(Ω(m1/3 )),

The current frontier is infinite randomness expansion using four boxes [MS16], a total of two in-
stances of the CHSH game. It is still open whether it can be done using three or even two boxes,
for some variant of CHSH. Note that while there may be room for improvement in the parameters
of the argument, such as the probability of failure as a function of the seed length, the seed length
itself must be greater than zero; information theory promises that even in the quantum setting we
can’t ever hope to get something from nothing.

Open problem. Find the minimum number of non-signaling quantum devices needed in an infinite
randomness expansion scheme.

11
References

[All17] Willy Allison. Security & surveillance: Running the rng risk. GGB Magazine, 2017.
Accessed: 2018-09-20.

[BCK12] Jonathan Barrett, Roger Colbeck, and Adrian Kent. Unconditionally secure device-
independent quantum key distribution with only two devices. CoRR, abs/1209.0435,
2012.

[Bel64] John Stewart Bell. On the Einstein Podolsky Rosen paradox. Physics, 1(3):195–200,
1964.

[Bil17] Lee Billings. China shatters “spooky action at a distance” record, preps for quantum
internet. Scientific American, 2017. Accessed: 2018-09-20.

[CHSH69] John F Clauser, Michael A Horne, Abner Shimony, and Richard A Holt. Proposed
experiment to test local hidden-variable theories. Physical review letters, 23(15):880,
1969.

[Col06] Roger Colbeck. Quantum and relativistic protocols for secure multi-party computation.
Ph.D thesis, University of Cambridge, 2006.

[CS78] John F Clauser and Abner Shimony. Bell’s theorem. experimental tests and implications.
Reports on Progress in Physics, 41(12):1881, 1978.

[CY14] Matthew Coudron and Henry Yuen. Infinite randomness expansion with a constant
number of devices. In Symposium on Theory of Computing, STOC 2014, New York,
NY, USA, May 31 - June 03, 2014, pages 427–436, 2014.

[EPR35] Albert Einstein, Boris Podolsky, and Nathan Rosen. Can quantum-mechanical descrip-
tion of physical reality be considered complete? Phys. Rev., 47(10):777–780, May 1935.

[MS16] Carl A Miller and Yaoyun Shi. Robust protocols for securely expanding randomness
and distributing keys using untrusted quantum devices. Journal of the ACM (JACM),
63(4):33, 2016.

[PAM+ 10] Stefano Pironio, Antonio Acı́n, Serge Massar, Antoine Boyer de la Giroday, Dzmitry N.
Matsukevich, Peter Maunz, Steven Matthew Olmschenk, David Hayes, Le Luo, T. An-
drew Manning, and Christopher R. Monroe. Random numbers certified by bell’s theo-
rem. Nature, 464(7291):1021–1024, 2010.

[VV12] Umesh Vazirani and Thomas Vidick. Certifiable quantum dice: Or, true random num-
ber generation secure against quantum adversaries. In Proceedings of the Forty-fourth
Annual ACM Symposium on Theory of Computing, STOC ’12, pages 61–76, 2012.

[Wika] Wikipedia. Dual ec drbg. Accessed: 2018-09-20.

[Wikb] Wikipedia. Mersenne twister. Accessed: 2018-09-20.

12