Versatile and concurrent FPGA-based architecturefor practical quantum communication systems

Andrea Stanco1,∗, Francesco B. L. Santagiustina1,2, Luca Calderaro1 Marco Avesani1,Tommaso Bertapelle1, Daniele Dequal3, Giuseppe Vallone1,4 and Paolo Villoresi1

1Dipartimento di Ingegneria dell’Informazione, Universita degli Studi di Padova, via Gradenigo 6B, 35131 Padova, Italy2Dipartimento di Matematica ”Tullio Leci-Civita”, Universita degli Studi di Padova, Via Trieste 63, 35121 Padova, Italy

3Unita Telecomunicazioni e Navigazione, Agenzia Spaziale Italiana, contrada Terlecchia s.n.c., Matera, Italy4Dipartimento di Fisica e Astronomia, Universita degli Studi di Padova, via Marzolo 8, 35131 Padova, Italy

©2021 IEEE. Personal use of this material is permitted. Permission from IEEE must be obtained for all other uses, in any current or future media, includingreprinting/republishing this material for advertising or promotional purposes, creating new collective works, for resale or redistribution to servers or lists, orreuse of any copyrighted component of this work in other works.

Abstract—This work presents a hardware and software ar-chitecture which can be used in those systems that implementpractical Quantum Key Distribution (QKD) and Quantum Ran-dom Number Generation (QRNG) schemes. This architecturefully exploits the capability of a System-on-a-Chip (SoC) whichcomprehends both a Field Programmable Gate Array (FPGA)and a dual core CPU unit. By assigning the time-related tasksto the FPGA and the management to the CPU, we built aflexible system with optimized resource sharing on a commercialoff-the-shelf (COTS) evaluation board which includes a SoC.Furthermore, by changing the dataflow direction, the versatilesystem architecture can be exploited as a QKD transmitter, QKDreceiver and QRNG control-acquiring unit. Finally, we exploitedthe dual core functionality and realized a concurrent streamdevice to implement a practical QKD transmitter where onecore continuously receives fresh data at a sustained rate froman external QRNG source while the other operates with theFPGA to drive the qubits transmission to the QKD receiver. Thesystem was successfully tested on a long-term run proving itsstability and security. This demonstration paves the way towardsa more secure QKD implementation, with fully unconditionalsecurity as the QKD states are entirely generated by a truerandom process and not by deterministic expansion algorithms.Eventually, this enables the realization of a standalone quantumtransmitter, including both the random numbers and the qubitsgeneration.

Index Terms—Quantum Communication (QC), Quantum KeyDistribution (QKD), Quantum Random Number Generator(QRNG), Field Programmable Gate Array (FPGA), EmbeddedSystem.

I. INTRODUCTION

QUANTUM Communication (QC) is one of the promis-ing applications of quantum technology and is recently

receiving a relevant boost towards commercial applications.Quantum Key Distribution (QKD) and Quantum RandomNumber Generation (QRNG) are the two leading technologiesof QC since their combination allows to realize the perfectsecrecy protocol, resistant to any external attack. The realiza-tion of such a system requires the design and developmentof several components: from the optical setup to the drivingelectronics, from the digital control board to the managementsoftware. Besides the particular quantum implementationswhich can vary according to different security protocols, anessential component of the whole setup is a supervision board

*andrea.stanco@unipd.it

capable to provide deterministic behaviour, high temporal res-olution, and high speed computation. A Field ProgrammableGate Array (FPGA) is almost a mandatory choice for suchapplications [1], [2], [3]. FPGA also offers an advantage interms of power consumption [4], which can be a key featurefor critical applications such as Cubesat missions for SatelliteQuantum Communication [5]. In this work, we present a gen-eralized FPGA-based architecture that can be easily applied toDiscrete Variable QKD (DV-QKD) and QRNG (DV-QRNG)applications. Moreover, the schematic has the potentialityto be used even in Continuous Variables QKD (CV-QKD)and QRNG (CV-QRNG), provided that an auxiliary Digital-to-Analog (DAC) and Analog-to-Digital (ADC) should beincluded. The architecture was implemented and tested onthe Zynq-7020 System-on-a-Chip (SoC) mounted on an entrylevel evaluation board: ZedBoard by Avnet. The exploitationof both the FPGA layer and the CPU one of the SoC leads toa high level of flexibility, allowing to scale the applicationfunctionalities to the specific part of the chip. Accordingto the specific application, the system can be set in a top-down (dataflow from pc/user to quantum system) or bottom-up (dataflow from quantum system to pc/user) configuration.The system was successfully used in different configurationsin several experiments over the past years [6], [7], [8], [9],[10], [11], [12], [13], [14]. Recently, it was also tested inthe prototype of a QKD transmitter for Cubesat mission [15]making it suitable for Satellite Quantum Communications, akey sector of QC. Given the presence of a dual core CPU,we also designed, developed, and successfully tested a dualcore application capable to sustain a continuous data transferfrom an external source to the CPUs and then to the FPGA.This feature is the key to implement a provably secure QKDsystem since it allows to combine a QRNG output stream witha QKD stream without the need of random number expansion[16], [17], paving the way to commercial QKD devices withfull unconditional security. The work is structured as follow: inSection II an overall overview of the architecture is presented;in Sections III and IV the FPGA and CPU layers are described;in Section V the dual core architecture for a QKD transmitteris presented along with the system test results.

arX

iv:2

107.

0185

7v1

[qu

ant-

ph]

5 J

ul 2

021

II. ARCHITECTURE OVERVIEW

The system architecture is organized in two different layers.The lower layer is the FPGA one where all the deterministicand high resolution operations are carried out. The higher layeris the CPU(s) one which is responsible for the parameters anddata management operations as well as the communicationwith the outside world. Besides the functions separation,this subdivision is also a key point for the maintenanceand the upgrading of the architecture since the two layersrequire different programming languages (VHDL/Verilog vs.C/C++) and different design teams. Two additional layers,End User/External Source and Quantum System, enclose theprevious ones completing the whole practical system. Thearchitecture is designed to easily switch between top-downand bottom-up workflows, which represents the distinctionbetween QKD transmitter and QKD receiver/QRNG applica-tions. An overview of the whole schematic is given in Figure1. In the following, we provide a general description of theTop-Down and Bottom-Up applications.

A. Top-Down application

In this configuration, the dataflow starts from an externaldevice, e.g., a QRNG or PC, goes through the CPU, thento the FPGA and finally to the chip input-output pins (I/O).This layout is suitable for a QKD transmitter, as the rawcryptographic key, either generated in real time by a QRNGor previously stored in a PC, is fed through the CPU tothe FPGA, which drives the hardware dedicated to quantumstate generator accordingly. As detailed in the following, thefirst communication step, from the external device to theCPU, has been performed over Gigabit Ethernet. This choiceprovides both a high throughput of the data transfer (¿600Mbit/s) and a great flexibility, being Ethernet a widespreadstandard. As there is no encryption of the dataflow, it is ofparamount importance to protect the communication channelfrom eavesdropping. This can be done by setting up a privateLocal Area Network (LAN), physically disconnected fromother networks, between the SoC and the external device. Thesecond step in the stack is from the CPU to the FPGA. For thisstep, two solutions have been implemented. The configurationparameters, e.g., qubit frequency or total transmission length,which have a very slow refresh rate, are exchanged with adirect communication via the Advanced eXtensible Interface(AXI) protocol. Instead, for the raw key exchange, which canreach 400 Mbps of steady data transmission, we exploitedboth the onboard DDR-RAM memory, accessible from theCPU, and the Block RAM memory (BRAM), integrated inthe FPGA but accessible from the CPU through AXI protocol.The BRAM, with a maximum length in the order of Mbits, hasbeen divided in two halves, so that while the FPGA is readingfrom one section, the CPU can update the contents of theother with the data stored in the RAM and previously receivedvia Ethernet. This allows for a continuous and synchronizeddataflow from the external device to the FPGA, and hence itsI/Os. According to the specific quantum system, the outputsignals are routed to either PMOD (LVCMOS33 standard) or

Fig. 1. Overview of the four-layer structure of the system. The embeddedarchitecture is divided into two different layers (FPGA+CPU) which areenclosed by the two outside-world layers (End User/External Source andQuantum System).

FMC ports (LVCMOS18 standard) of the ZedBoard and thenproperly amplified by an external driving stage.

B. Bottom-Up application

In this configuration, the dataflow starts from the chip I/Oscontrolled by the FPGA, is then transmitted from the FPGAto the CPU and finally from the CPU to the external device.This layout can be used either for a QKD receiver or fora QRNG, where the electrical signal coming from externaldevices, i.e., single photon detectors, is sampled by the FPGAI/Os. The sampled and stored signal is then transferred, via theCPU, to an external computer, for the implementation of thepost-processing phases of the QKD protocol, i.e., parameterestimation, error correction and privacy amplification. The

communication interfaces for the bottom-up configuration arethe same as for the top-down. It must be mentioned that also inthis case the communication between the CPU and the externalcomputer must be performed over a secure LAN, as the datastream at this level is not encrypted. To guarantee a high levelof security, the LAN used for the PC-CPU communication hasto be reserved and so physically separated from the one usedfor communication between the transmitter and receiver PCs.

III. FPGA LAYER

The FPGA implementation allows to have a perfect timecontrol over the optical system. Indeed, the capability toschedule every operation according to a system clock is akey feature for the realization of a QKD/QRNG system.When used in a QKD transmitter configuration, the FPGA isresponsible for the rightful generation of the electrical pulseswhich drive the electro-optical elements of the setup. Whenused as a QRNG/QKD receiver, the FPGA takes care of theread-out operations of the external electrical signals comingfrom single-photon detectors. For the sake of completeness, itis also possible to consider the application of the architecturefor CV-QKD [18] and CV-QRNG [19], [20]. The differencewould be that the FPGA needs to interface with proper externalDAC (for CV-QKD transmitter) and external ADC (for CV-QKD receiver and CV-QRNG). The general and simplifiedstructure of the FPGA design is shown in Figure 2. Thedesign uses AXI-capable blocks for communication and datatransfer to (from) the CPU along with BRAMs and customVHDL blocks for FPGA data management, Memory Manager(MM) block, and external signal generation (readout), QStatesController (QSC) and SPD Reader (SR) blocks. The QRNGapplication also includes dedicated modules implementingrandom generation protocols [21], [22]. AXI-GPIOs allow toset parameters from the CPU and to read out interrupt signalsasserted from custom VHDL blocks. AXI-CDMA enables thepossibility to move data to (from) the board RAM from (to)the BRAM(s). The MM is responsible for managing the datatransfer between the BRAM(s) and the other custom blocks.Being the BRAM divided into two halves, the MM asserts asignal every time it reaches the end of one of the two halves(while reading or writing) and, in turn, the signal is read by anAXI-GPIO and interpreted as an interrupt from the CPU whichwrites (reads) new data to (from) the BRAM. The system clockwas set in a range between 100 and 200 MHz depending onthe specific application. Future improvements will considerpushing further this frequency in order to increase the overallsystem speed. Indeed, apart from tighter timing constraints,a higher frequency clock implies a higher data throughtputto/from the external device, which may exceed the gigabitrange of the board.

A. QKD Transmitter

In addition to the previously described general architecture,the FPGA for a DV-QKD transmitter requires a specific designof the QSC module to encode the raw key data into elec-trical output pulses which drive the laser and electro-optical

QSTATES CONTROLLER

-SPD READER

(+ QRNGPROTOCOLS)

BRAM(s)

AXI GPIO AXI GPIO

AXI GPIO

ZYNQ PS

to RAM Memory

AXI CDMA

FPGA

QUANTUM SYSTEMSPDSLASERMODULATORS

AXI GPIO

MEMORY MANAGER

Interrupt

Fig. 2. Schematic view of the FPGA system. The modules in green are customVHDL blocks which control the memory management, the qubit generationand the single photon detector readout. The orange modules are the AXI-based ones and they are AXI-CDMA and AXI-GPIO. The BRAM modulehas a mixed color since it is controlled both by AXI and by custom VHDLmodules. The CPU part is initialized in the FPGA design and is identified bythe ZYNQ Processing System (PS) module which can also access to RAMmemory.

modulators. We designed several variations of this moduleaccording to the chosen QKD protocol [23], [24], [25], [26],derived from the well-known BB84 [27], and implementation[9], [13], [11], [15]. Here, we give a brief description of oneof the most recent versions, presented in [15]. With a systemclock set to 200 MHz, a pulse of 5 ns can be provided atthe output. The encoding of every qubit requires, nominally,no more than 15 ns time slot since the polarization encodingdescribes three different polarization states and necessitates anoutput pulse in three different temporal positions (0-5 ns, 5-10ns, 10-15 ns). The decoy implementation works in a similarway, describing three different intensity level, but requests anoutput pulse in only two temporal position (0-5 ns, 5-10 ns)in combination with a possible laser switch off. The pulse forthe laser driver is output at the begin of every slot (0-5 ns)unless the case of a specific decoy state. To compensate andsynchronize the output signals with the optical path length, adedicated time offset can also be applied to each signal. Twodifferent BRAMs were instantiated, one for the polarizationencoding data and one for the decoy one. Since every qubitrequires two bits to distinguish among three polarization statesas well as other two bits to discriminate among three decoystates, the BRAMs were set to the same size and operateswith the same interrupt routine. For the sake of clearness, it ispossible to optimize the overall qubit encoding using just threebits for the polarization+decoy encoding. Nevertheless, wechose to use two+two encoding for mainly two reasons. Thefirst reason is that a three-bit encoding would have requireda quite complicated, and in a certain way inefficient, routineto distinguish the data within each byte as more than two butless than three-qubits-encoding-data would have been stored inone byte. The second reason is that a two+two bit encoding

allows to separate the paths, the memories and, in turn, theTCP sockets of the polarization and decoy data enhancing therobustness and flexibility of the overall system.

B. QKD Receiver/QRNG

In principle, the FPGA schematic for a QKD receiver issimilar to the one for a DV-QRNG. In both cases, the I/Osare connected to the output signals of single-photon detectorsand the FPGA implements the sampling process to producea bitstring containing the digital temporal description of thesingle-photon events. First of all, the input signal is translatedto the FPGA clock domain by using a proper async-to-synchardware module included in the SR. Then, in the caseof a QRNG application, the sampled bits are temporarilyaccumulated and later processed by proper modules whichapply random generation protocols to a small set of data, asdescribed in [7]. The random bit is then stored and managedby the MM which, in turn, transfers a 32 bit array to the i-thaddress of a BRAM and calls an interrupt whenever it reacheshalf or the end of it. Moreover, this architecture was also theperfect option to implement a synchronized QRNG which wasneeded for the realization of [14]. For this application, whichrequired to output a random number generated only after aspecific trigger event, the architecture was modified to allow aresetting of all the random data (even the sampled bits). Theresetting was triggered by an external electrical signal comingfrom the experiment setup. The random bit was then usedto produce an auxiliary output port which set a componentof the experiment. In order to improve the randomness ofthe output number, the architecture was also doubled andproduced two random bits which were XORed. For furtherdetails, refer to [14]. As a matter of fact, by removing thegeneration protocol modules, the architecture becomes suitableto be used as a QKD receiver. However, a drawback of thisimplementation is the low time resolution provided by thesystem clock which, even in a high-range FPGA-chip casescenario, does not exceed 1 GHz. For a high performanceQKD a sub-ns time resolution at the receiver is required.Therefore, this implementation can be a solution only for lowcost QKD systems. Nevertheless, the design and integrationof a Time-to-Digital Converter (TDC) FPGA-module (such as[28], [29], [30]) or the exploitation of an external integratedcircuit (such as [31]) would allow for a sub-ns time resolutionand thus the use in high performance QKD systems. Indeed,future steps will investigate such solutions.

IV. CPU LAYER

The CPU software is implemented as a standalone/bare-metal application and no Operative System is required. Thishas the great advantage of having a very light and fast softwareat a higher design cost. The software, developed in C and C++languages, has the role to interface the FPGA layer with theexternal source and the final user. It mainly implements theinterrupt routine to move (read) data from (to) the RAM to(from) the BRAM anytime the MM reaches the half of the end

of a BRAM. It also implements the TCP connection sockets toreceive commands and data from the external source or user.

A. TCP Connection

To communicate with the outside world, a TCP protocolwas chosen. Given the robustness of the TCP protocol overany possibility of losing data packets, this choice has to bepreferred over the UDP protocol which cannot guarantee areliable communication to the application layer, thus under-mining the validity of the QKD implementation. For a QRNGapplication where the data are output to an external receiver,a UDP protocol might be suitable in any case since any(negligible) data losses do not affect the overall quality andperformance of the QRNG device. Nevertheless, for QKDpost-processing purposes, one can consider to send the randomstream to two different devices, e.g., a QKD transmitter anda computer, and in this case a data loss would jeopardize thewhole system. Moreover, changing the protocol only for theQRNG application would reduce the overall system flexibility.

The connection between the PC and the CPU applications isstructured in two or more different TCP server-client sockets:one is for commands and parameters exchange while theother(s) is for data exchange. Indeed, the data socket hasthe only purpose to receive new data from the externalsource. Thus, the number of required operations and statementconditions in the data-received-callback are quite few allowingto have optimal performance over the TCP bandwidth (¿600Mbit/s).

V. QKD-TX CONTINUOUS STREAM IMPLEMENTATION

A fundamental feature of any future commercial QC deviceis the capability to continuously sustain the transmission offresh random data. That is, the external randomness source,like a QRNG device or a computer where random keys arestored, must provide new data with a sufficient bitrate and theQKD transmitter must be able to perform at the same time boththe reading/storing of these data and the transmission of elec-trical pulses. Nowadays, specific workarounds allow to avoidthe implementation of such functionality [16] but necessarilyreduce the overall security of the system. For instance, onecan connect a low bitrate QRNG to the QKD source wherethe random data is expanded to reach the required bitrate [17].The expansion process, although implemented via standardcryptographic primitives, does not offer an unconditional typeof security, and can represent a security breach in the entireQKD system. Hence, we developed a dual core architectureable to sustain the required data rate for a secure QKDimplementation, allowing a random data stream generatedentirely by a QRNG. This approach has the advantage of beingunconditionally secure. Moreover, keeping the random datastored on the PC eases the QKD postprocessing procedureor, alternatively, lowers the memory resources of the SoCneeded to store the transmitted bitstring until the receivercommunicates the detected qubits. Furthermore, the bias ofthe random bits, required by some efficient QKD protocols[25], can be adjusted without the need of programming or

CPU1

QRNG-PC

RAM

CPU0

FPGA

BRAM

BRAMTCP

Co

nn

ec�

on

New (Random)

Data

Data

Data

Data Interrupt:ask new data

for BRAM

Interrupt: check if block size was reached

TCPCommand:

ask new datafor RAM

Fig. 3. Schematic view of the dual core system, representing the flow of data from the QRNG-PC to the FPGA. The request of new data is triggered bythe FPGA, each time it reads half of the BRAM, by means of an interrupt to the CPU1, which then moves the data from the buffer to the RAM. Each timeCPU1 reads 18.75 MiB of data from the buffer it sends an interrupt to the CPU0 to update the new block with fresh data from the QRNG-PC.

setting the FPGA, allowing to optimize it according to thecurrent quantum channel condition.

The data stream flow is represented in Figure 3. The datagenerated from the QRNG-PC is received by a TCP socketand then moved by the CPU0 into a buffer in the RAM.Meanwhile, the CPU1 reads the data from the RAM and movesit to the BRAM, which can be read by the FPGA. The buffersize is set to 187.5 MiB and divided into 10 blocks, that arewritten atomically by the CPU0. Hence, when a block has beenmoved to the FPGA, an interrupt from the CPU1 is sent to theCPU0 to notify that a new block of the buffer can be written.The CPU0 forward a request of a new block of 18.75 MiBto the QRNG-PC. The CPU1 reads smaller chuncks from thebuffer, whose size is half of the BRAM’s size, when it receivesan interrupt from the FPGA. Compared to the BRAM size, thebuffer is larger to avoid an unwanted stop of the continuousfeed of data to the FPGA, which may happen due to thetemporary loss of speed of the TCP channel, or the latencyof the CPU0. The whole architecture is doubled in order tomanage both the stream for polarization and decoy data.

A. System tests

We implemented this system on a QKD transmitter totest the top-down application in continuous stream mode.We performed a double stress test: the first one was witha real QRNG device, based on the scheme of [32] offeringhigh security and bitrate, while the second test was carriedout with a Cryptographically Secure Pseudo Random Number

Generator (CSPRNG) able to provide a sufficient data rateas well. We chose to perform the test also with a CSPRNGto show the system capability in a fallback scenario whereno QRNG device is available. The (pseudo-)random data wasstored in a buffer of the PC, to ease the retrieve of the quantumstates sent to the receiver needed for the raw key sifting.Indeed, once the QKD transmitter has produced and sentthe quantum states, the QKD receiver measures and detectsa subset of these states due to unavoidable channel losses.The QKD receiver communicates to the transmitter the listof states it detected (without revealing the outcome of themeasurement). Hence, the QKD transmitter selects the subsetof random data that will be used for the sifting.

The stream of data at the PC is managed by three threads:one for the production of blocks of random sequences; onefor the system managing the transfer, upon request, of therandom data from the buffer to the board via TCP; andone for the selection of the states detected by the QKDreceiver. As anticipated, the (pseudo-)random data can eitherbe received from a QRNG device or generated internally bya CSPRNG. In the former case, the first thread is used toreceive (via UDP or TCP) the random bits from the QRNG andto bias them according to the desired Bernoulli distribution.In the latter case, the thread carry on the generation of thepseudo-random data by using a Chacha20 based CSPRNG,seeded with the Intel® Secure Key hardware random numbergenerator embedded in the recent generations of Intel CPUs.

0 10 20 30 40 50capture time [hours]

198

200

202

204

206

208

210

outp

ut ra

te [M

b/s] Control and data throughput (QNRG test)

Data throughput (PRNG test)Data goodput (PRNG test)Control plane rateTCP/IP overheadData plane rate

Fig. 4. Plot of the TCP traffic from the PC to the Zynq-7020 for thetransmission of the random sequences and control messages, for two 55 hourslong tests using either the QRNG or CSPRNG as randomness source. Weplotted in red the aggregated traffic of the data and control plane for theQRNG test, amounting totally to about 208 Mb/s. The transmission of statesand intensities sequences accounts for 200 Mb/s. This stream is representedin yellow with the data from the PRNG test. Finally, we can appreciate asmall TCP/IP overhead (as seen from the PC OS) due to TCP segmentationoffload.

We synchronized the write and read operations on the bufferof these multiple threads by using semaphores. The buffer wasdivided in chuncks that could be either written or read at atime. Hence, one semaphore is needed to allow the writingof new chuncks of data by the RNG thread, which can bedone only on those chuncks that have been read by the threadselecting the subset of states arrived at the QKD receiver.Another semaphore is needed to ensure that the chuncks ofdata sent to the system are those that have been rewritten bythe RNG thread.

In our test, the QKD repetition rate was set to 50 MHz.Since the state encoding uses two bits for the state polarizationand two bits for the mean photon number, we have twodata streams of 100 Mb/s, plus a third stream for controlcommunications. The outbound traffic was monitored fromthe transmitting PC during the two tests and is reported inFigure 4. Given this steady input, the system was able to carryon all the needed operations seamlessly along all the 55 hoursof the tests, resulting in a successful execution of the QKDprotocol.

VI. CONCLUSION

In this work, we presented a versatile architecture basedon FPGA technology exploiting also a CPU counterpart forthe implementation of practical Quantum Communication sys-tems. The architecture was developed in different layers withdifferent tasks and is easily interchangeable among differentQC applications such DV-QKD transmitter, DV-QKD receiverand DV-QRNG. We also implemented and tested a dual corefunctionality performing a TCP continuous stream between

a QRNG source and a QKD transmitter without the need ofdata expansion to reach the amount of data required to encodeevery qubit. This allows to strengthen the security of the QKDimplementation, as the random settings needed by the QKDprotocol are guaranteed to be unconditionally secure, unlikethose generated by expansion algorithms. The system wasimplemented on a low-budget COTS and it was successfullytested to continuously provide 4 bits to encode a qubit every 20ns. Future steps will consider higher frequency implementationas well as CV applications by including proper DAC and ADChardwares.

ACKNOWLEDGMENT

Part of this work was supported by Ministerodell’Istruzione, dell’Universita e della Ricerca (MIUR)(Italian Ministry of Education, University and Research)under the initiative “Departments of Excellence” (Law232/2016). A. S. and D. D. Authors would like to thank Dr.S. Gaiarin for useful help and hints in the general architecturedesign. A. S. and L. C. Authors would like to thank Mr.F. Berra for useful discussions about dual core architectureverification. A. S. Author would like to thank Dr. D. G.Marangon for useful help and discussion for the DV-QRNGarchitecture design.

REFERENCES

[1] Davide Bacco, Matteo Canale, Nicola Laurenti, Giuseppe Vallone, andPaolo Villoresi. Experimental quantum key distribution with finite-keysecurity analysis for noisy channels. Nature Communications, 4(1):2363,Sep 2013.

[2] Kejin Wei, Wei Li, Hao Tan, Yang Li, Hao Min, Wei-Jun Zhang, Hao Li,Lixing You, Zhen Wang, Xiao Jiang, Teng-Yun Chen, Sheng-Kai Liao,Cheng-Zhi Peng, Feihu Xu, and Jian-Wei Pan. High-speed measurement-device-independent quantum key distribution with integrated siliconphotonics. Phys. Rev. X, 10:031030, Aug 2020.

[3] H. F. Zhang, J. Wang, K. Cui, C. L. Luo, S. Z. Lin, L. Zhou, H. Liang,T. Y. Chen, K. Chen, and J. W. Pan. A real-time qkd system based onfpga. Journal of Lightwave Technology, 30(20):3226–3234, 2012.

[4] Murad Qasaimeh, Kristof Denolf, Jack Lo, Kees Vissers, Joseph Zam-breno, and Phillip H. Jones. Comparing energy efficiency of cpu, gpuand fpga implementations for vision kernels. In 2019 IEEE InternationalConference on Embedded Software and Systems (ICESS), pages 1–8,2019.

[5] Daniel KL Oi, Alex Ling, Giuseppe Vallone, Paolo Villoresi, SteveGreenland, Emma Kerr, Malcolm Macdonald, Harald Weinfurter, HansKuiper, Edoardo Charbon, and Rupert Ursin. Cubesat quantum commu-nications mission. EPJ Quantum Technology, 4(1):6, Apr 2017.

[6] Hamid Tebyanian, Mujtaba Zahidy, Marco Avesani, Andrea Stanco,Paolo Villoresi, and Giuseppe Vallone. Practical semi-device indepen-dent randomness generation based on quantum state’s indistinguishably,2021.

[7] Andrea Stanco, Davide G. Marangon, Giuseppe Vallone, Samuel Burri,Edoardo Charbon, and Paolo Villoresi. Efficient random numbergeneration techniques for cmos single-photon avalanche diode arrayexploiting fast time tagging units. Phys. Rev. Research, 2:023287, Jun2020.

[8] Marco Avesani, Luca Calderaro, Giulio Foletto, Costantino Agnesi,Francesco Picciariello, Francesco B. L. Santagiustina, Alessia Scrim-inich, Andrea Stanco, Francesco Vedovato, Mujtaba Zahidy, GiuseppeVallone, and Paolo Villoresi. Resource-effective quantum key distribu-tion: a field trial in padua city center. Opt. Lett., 46(12):2848–2851, Jun2021.

[9] Marco Avesani, Costantino Agnesi, Andrea Stanco, Giuseppe Vallone,and Paolo Villoresi. Stable, low-error, and calibration-free polar-ization encoder for free-space quantum communication. Opt. Lett.,45(17):4706–4709, Sep 2020.

[10] Luca Calderaro, Andrea Stanco, Costantino Agnesi, Marco Avesani,Daniele Dequal, Paolo Villoresi, and Giuseppe Vallone. Fast and simplequbit-based synchronization for quantum key distribution. Phys. Rev.Applied, 13:054041, May 2020.

[11] Costantino Agnesi, Marco Avesani, Luca Calderaro, Andrea Stanco,Giulio Foletto, Mujtaba Zahidy, Alessia Scriminich, Francesco Ve-dovato, Giuseppe Vallone, and Paolo Villoresi. Simple quantum keydistribution with qubit-based synchronization and a self-compensatingpolarization encoder. Optica, 7(4):284–290, Apr 2020.

[12] M. Avesani, L. Calderaro, M. Schiavon, A. Stanco, C. Agnesi,A. Santamato, M. Zahidy, A. Scriminich, G. Foletto, G. Contestabile,M. Chiesa, D. Rotta, M. Artiglia, A. Montanaro, M. Romagnoli, V. Sori-anello, F. Vedovato, G. Vallone, and P. Villoresi. Full daylight quantum-key-distribution at 1550 nm enabled by integrated silicon photonics. npjQuantum Information, 7(1):93, Jun 2021.

[13] Costantino Agnesi, Marco Avesani, Andrea Stanco, Paolo Villoresi, andGiuseppe Vallone. All-fiber self-compensating polarization encoder forquantum key distribution. Opt. Lett., 44(10):2398–2401, May 2019.

[14] Francesco Vedovato, Costantino Agnesi, Matteo Schiavon, Daniele De-qual, Luca Calderaro, Marco Tomasin, Davide G. Marangon, AndreaStanco, Vincenza Luceri, Giuseppe Bianco, Giuseppe Vallone, and PaoloVilloresi. Extending wheeler’s delayed-choice experiment to space. Sci.Adv., 3(10):e1701180, 2017.

[15] A. Balossino, E. Fazzoletto, S. Ciaglia, N. Tisat, A. Di Paola, E. Scarpa,B. Cotugno, C. Agnesi, L. Calderaro, A. Stanco, G. Vallone, andP. Villoresi. Seqbo - a miniaturized system for quantum key distribution.volume 2020-October, 2020.

[16] N. Walenta, A. Burg, D. Caselunghe, J. Constantin, N. Gisin, O. Guin-nard, R. Houlmann, P. Junod, B. Korzh, N. Kulesza, M. Legre, C. W.Lim, T. Lunghi, L. Monat, C. Portmann, M. Soucarros, R. T. Thew,P. Trinkler, G. Trolliet, F. Vannel, and H. Zbinden. A fast and versatilequantum key distribution system with hardware key distillation andwavelength multiplexing. New Journal of Physics, 16(1):013047, jan2014.

[17] Jeremy Constantin, Raphael Houlmann, Nicholas Preyss, Nino Walenta,Hugo Zbinden, Pascal Junod, and Andreas Burg. An fpga-based 4mbps secret key distillation engine for quantum key distribution systems.Journal of Signal Processing Systems, 86(1):1–15, Jan 2017.

[18] Fabian Laudenbach, Christoph Pacher, Chi-Hang Fred Fung, AndreasPoppe, Momtchil Peev, Bernhard Schrenk, Michael Hentschel, PhilipWalther, and Hannes Hubel. Continuous-Variable Quantum Key Distri-bution with Gaussian Modulation-The Theory of Practical Implementa-tions. Advanced Quantum Technologies, 1(1):1800011, aug 2018.

[19] Davide G. Marangon, Giuseppe Vallone, and Paolo Villoresi. Source-device-independent ultrafast quantum random number generation. Phys.Rev. Lett., 118:060503, 02 2017.

[20] Marco Avesani, Davide G. Marangon, Giuseppe Vallone, and PaoloVilloresi. Source-device-independent heterodyne-based quantum randomnumber generator at 17 Gbps. Nature Communications, 9(1):5365, dec2018.

[21] Harald Furst, Henning Weier, Sebastian Nauerth, Davide G. Marangon,Christian Kurtsiefer, and Harald Weinfurter. High speed optical quantumrandom number generation. Opt. Express, 18(12):13029–13037, 062010.

[22] M. Stipcevic and B. Medved Rogina. Quantum random numbergenerator based on photonic emission in semiconductors. Rev. Sci.Instrum., 78(4):045104, 2007.

[23] Kiyoshi Tamaki, Marcos Curty, Go Kato, Hoi-Kwong Lo, and KojiAzuma. Loss-tolerant quantum cryptography with imperfect sources.Physical Review A, 90(5):052314, nov 2014.

[24] Won-Young Hwang. Quantum key distribution with high loss: Towardglobal secure communication. Phys. Rev. Lett., 91:057901, Aug 2003.

[25] Hoi-Kwong Lo, H. F. Chau, and M. Ardehali. Efficient quantum keydistribution scheme and a proof of its unconditional security. Journalof Cryptology, 18(2):133–165, Apr 2005.

[26] Davide Rusca, Alberto Boaron, Fadri Grunenfelder, Anthony Martin, andHugo Zbinden. Finite-key analysis for the 1-decoy state qkd protocol.Applied Physics Letters, 112(17):171104, 2018.

[27] Charles H. Bennett and Gilles Brassard. Quantum cryptography: Publickey distribution and coin tossing. Theor. Comput. Sci., 560(P1):7–11,dec 2014.

[28] Jian Song, Qi An, and Shubin Liu. A high-resolution time-to-digitalconverter implemented in field-programmable-gate-arrays. IEEE Trans.Nuc. Sci., 53(1):236–241, 02 2006.

[29] M. Fishburn, L. H. Menninga, C. Favi, and E. Charbon. A 19.6 ps, fpga-based tdc with multiple channels for open source applications. IEEETrans. Nuc. Sci., 60(3):2203–2208, 06 2013.

[30] Haochang Chen and David Day-Uei Li. Multichannel, low nonlinearitytime-to-digital converters based on 20 and 28 nm fpgas. IEEE Transac-tions on Industrial Electronics, 66(4):3265–3274, 2019.

[31] ScioSense. Tdc-gpx high-end time-to-digital converter.https://www.sciosense.com/products/time-to-digital-converters/tdc-gpx-high-end-time-to-digital-converter/.

[32] Christian Gabriel, Christoffer Wittmann, Denis Sych, Ruifang Dong,Wolfgang Mauerer, Ulrik L. Andersen, Christoph Marquardt, and GerdLeuchs. A generator for unique quantum random numbers based onvacuum states. Nature Photonics, 4(10):711–715, oct 2010.