\documentclass[aps,pra,twocolumn,superscriptaddress]{revtex4}
\setlength{\paperheight}{11in}

\usepackage{mathtools}
\usepackage{graphicx}
\usepackage{epstopdf}
\usepackage{lmodern}
\usepackage{xfrac}
\usepackage{natbib}
\usepackage[breaklinks]{hyperref}
\usepackage{verbatim}

\usepackage{mathtools}
\DeclarePairedDelimiter\ceil{\lceil}{\rceil}
\DeclarePairedDelimiter\floor{\lfloor}{\rfloor}

\newcommand{\ket}[1]{|{#1}\rangle}
\newcommand{\bra}[1]{\langle{#1}|}
\newcommand{\OD}[0]{\mathrm{OD}}
\newcommand{\norm}[1]{\left\lVert #1 \right\rVert}

\newcommand\inner[2]{\langle #1, #2 \rangle}
\newcommand\innerHS[2]{\langle #1, #2 \rangle_{\mathrm{HS}}}
\newcommand{\BH}{\mathcal{B}(\mathcal{H})}
\newcommand{\tr}{\mathrm{tr}}
\newcommand{\ketbrad}[2]{| \hspace{1pt} #1 \rangle \langle #2 \hspace{1pt} |}
\newcommand{\ketbra}[1]{\ketbrad{#1}{#1}}
\newcommand{\braket}[2]{\langle #1 \hspace{1pt} | \hspace{1pt} #2 \rangle}
\newcommand{\abs}[1]{| #1 |}

\newcommand{\diff}{\mathrm{d}}
\newcommand{\binwidth}{\tau}

\newcommand{\epsc}{\epsilon_\textrm{c}} % completeness
\newcommand{\epss}{\epsilon_\textrm{s}} % soundness
\newcommand{\epsp}{\epsilon'} % smoothing parameter
\newcommand{\epsEX}{\epsilon_\textrm{EX}} % extractor
\newcommand{\epsEA}{\epsilon_\textrm{EA}} % entropy accumulation
\newcommand{\epsSA}{\epsilon_\textrm{SA}}
\newcommand{\epsest}{\epsilon_\textrm{est}}
\newcommand{\abort}{\textrm{abort}}
\newcommand{\pass}{\textrm{pass}}
\newcommand{\omegaexp}{\omega_{\textrm{exp}}}
\newcommand{\deltaest}{\delta_{\textrm{est}}}
\newcommand{\Ext}{\textrm{Ext}}
\newcommand{\Hmin}{H_{\textrm{min}}}
\newcommand{\etaopt}{\eta_\textrm{opt}}
\newcommand{\unittime}{\textrm{sec}^{-1}}

%\usepackage{seqsplit}
%\usepackage{xcolor}
%\newcommand{\jd}[1]{{\color{cyan}#1}}
%\newcommand{\ac}[1]{{\color{orange}#1}}


\begin{document}
\title{Randomness extraction from Bell violation  with continuous parametric down conversion}

\author{Lijiong~Shen}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}
\affiliation{Department of Physics, National University of Singapore, 2 Science Drive 3, Singapore 117551}

\author{Jianwei~Lee}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}

\author{Le~Phuc~Thinh}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}

\author{Jean-Daniel~Bancal}
\affiliation{Department of Physics, University of Basel, Klingelbergstrasse 82, 4056 Basel, Switzerland}

\author{Alessandro~Cer\`{e}}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}

\author{Antia~Lamas-Linares}
\affiliation{Texas Advanced Computing Center, The University of Texas at Austin, Austin, Texas}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}


\author{Adriana~Lita}
\affiliation{National Institute of Standards and Technology, Boulder 80305, CO, USA}

\author{Thomas~Gerrits}
\affiliation{National Institute of Standards and Technology, Boulder 80305, CO, USA}

\author{Sae~Woo~Nam}
\affiliation{National Institute of Standards and Technology, Boulder 80305, CO, USA}

\author{Valerio~Scarani}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}
\affiliation{Department of Physics, National University of Singapore, 2 Science Drive 3, Singapore 117551}

\author{Christian~Kurtsiefer}
\affiliation{Centre for Quantum Technologies, National University of Singapore, 3 Science Drive 2, Singapore 117543}
\affiliation{Department of Physics, National University of Singapore, 2 Science Drive 3, Singapore 117551}


\email[]{christian.kurtsiefer@gmail.com}
\date{\today}
\begin{abstract}
We present a violation of the CHSH inequality without the fair sampling assumption with
a continuously pumped photon pair source combined with two high efficiency superconducting detectors.
Due to the continuous nature of the source, the choice of the duration of each measurement round effectively controls the average number of photon pairs participating in the Bell test.
We observe a maximum violation of
$S= 2.01602(32)$ with average number of pairs per round of $\approx 0.32$, compatible with
our system overall detection efficiencies. 
Systems that violate a Bell inequality are guaranteed to generate private randomness, with the randomness extraction rate depending on the observed violation and on the repetition rate of the Bell test.
For our realization, the optimal rate of randomness generation is a compromise
between the observed violation and the duration of each measurement round,
with the latter realistically limited by the detection time jitter.
Using an extractor composably secure against quantum adversary with quantum side information,
we calculate an asymptotic rate of $\approx 1300$ random bits/s.
With an experimental run of~$43$~minutes, we generated~617\,920~random bits, corresponding to~$\approx 240$ random bits/s.
\end{abstract}

% insert suggested PACS numbers in braces on next line
\pacs{03.65.Ud, 42.50.Xa, 42.65.Lm}

\maketitle


Based on a violation of a Bell inequality, quantum physics can provide
randomness that can be certified to be private, i.e.,  uncorrelated to any outside process~\cite{Colbeck:2007vo,Pironio:2010bu,Acin:2016ke}. Initial experimental realizations of such sources of certified randomness are
based on atomic or atomic-like systems, but exhibit extremely low generation rates, making them impractical for most applications~\cite{Pironio:2010bu,Hensen:2015ccp}. Advances in high efficiency infrared photon detectors~\cite{Lita:2008wv, Marsili:2013fs},
combined with highly efficient photon pair sources, allowed experimental demonstrations of loophole free violation of the Bell inequality using photons~\cite{giustina2015,Shalm:2015cw}.
Due to
the small observed violation of the Bell inequality in these setups,
the random bit generation rate is on the order of tens per second in~\cite{Bierhorst:2018uk}, where they close all loopholes and are limited by the repetition rate of the polarization modulators, 
and 114~bit/s~\cite{Liu:2017uz}, where they close only the detection loophole and the main limitation is the fixed repetition rate of the photon pair source.

In this work, we use a source of polarization entangled photon pairs operating in a continuous wave (CW) mode, and define measurement rounds by organizing the detection events in uniform time bins.
The binning is set independently of the detection time, thus avoiding the coincidence loophole~\cite{Larsson:2004bt, Christensen:2015kn}.
Superconducting detectors with a high detection efficiency allow us to close the detection loophole. We show how, for fixed overall detection efficiency and pair generation rate, the time bin duration determines the observed Bell violation. We then estimate the rate of random bits that can be extracted from the system and its dependence on time bin width. 

\textit{Theory. --} Bell tests are carried out in successions of rounds. In
each round, each party chooses a measurement and records an outcome. The
simplest meaningful scenario involves two parties, each of which can choose
between two measurements with binary outcome. Alice and Bob's measurements are
labelled by $x,y\in\{0,1\}$, respectively; their outcomes are labelled $a,b\in\{+1,-1\}$. As figure of merit we use the Clauser-Horne-Shimony-Holt (CHSH) expression
\begin{align}\label{eq:bell}
    S = E_{00}+E_{01}+E_{10}-E_{11}\,,
\end{align} where the correlators are defined by
\begin{align}
    E_{xy}:=\Pr(a=b|x,y)-\Pr(a\neq b|x,y)\,.
\end{align} As well known, if $S>2$, the correlations cannot be due to pre-established agreement; and if they can't be attributed to signaling either, the underlying process is necessarily random. This is not only a qualitative statement: the amount of extractable private randomness can be quantified. In the limit in which the statistics are collected from an arbitrarily large number of rounds, the number of random bits per round, according to~\cite{Pironio:2010bu}, is at least
\begin{equation}
    r_\infty \geq 1 - \log_2\left(1+\sqrt{2-\frac{S^2}{4}}\right)\,.
\end{equation}
Tighter bounds on the extractable randomness as a function of~$S$ can be obtained by solving a sequence of semidefinite programs~\cite{Pironio:2010bu}.

Besides the no-signaling assumption, \textit{this certification of randomness is device-independent}: it relies on the value of $S$ extracted from the observed statistics, but not on any characterisation of the degrees of freedom or of the devices used in the experiment. All that matters is that in every round both parties produce an outcome. In our case, we decide that, if a party's detectors did not fire in a given round, that party will output $+1$ for that round. This convention allows us to use only one detector per party \cite{Giustina:2013uf,Bancal:2013wa}: in the rounds when the detector fires, the outcome will be~$-1$.

While the certification is device-independent, the design of the experiment requires detailed knowledge and control of the physical degrees of freedom. Our experiment uses photons entangled in polarisation, produced by spontaneous parametric down-conversion (SPDC). 




Let us first consider a simplified model, in which a pair of photons is created in each round. Eberhard~\cite{Eberhard:1993tx} famously proved that, when the collection efficiencies $\eta_A$ and $\eta_B$ are not unity, higher values of $S$ are obtained using non-maximally entangled pure states. So we aim at preparing 
\begin{equation}\label{eq:eb_state} \ket{\psi} = \cos\theta \ket{HV} -
  e^{i\phi} \sin\theta\ket{VH}\,,
\end{equation}
where~$H$ and~$V$ represent the horizontal and vertical polarization modes, respectively. The state and measurement that maximise $S$ are a function of $\eta_A$ and $\eta_B$. For $\phi=0$, the optimal measurements correspond to linear polarisation directions, denoted $\cos \alpha_x \hat{e}_H + \sin \alpha_x \hat{e}_V$ and $\cos \beta_y \hat{e}_H + \sin \beta_y \hat{e}_V$.

For a down-conversion source, the number of photons produced per round is not
fixed. If the duration~$\binwidth$ of a round is much longer than the
single-photon coherence time, and no multi-photon states are generated (a
realistic assumption in a CW pumped scenario), the output of the source is accurately described by independent photon pairs, whose number~$v$ follows a Poissonian distribution $P_{\mu}(v)$ of average pairs per round $\mu$.
The main contribution to $S>2$ will come from the single-pair events; notice that $P_{\mu}(1)\leq \frac{1}{e}\approx 0.37$ for a Poissonian distribution. So there is always a large fraction of other pair number events, and the observed value of $S$ depends significantly on it~\cite{Vivoli:2015aa}. For $\mu\rightarrow 0$, almost all rounds will give no detection, that is $P(+1,+1|x,y)\approx 1$ which leads to $S=2$. So, for $\mu\ll 1$ we expect a violation $S\approx P_{\mu}(1)\,S_{\textrm{qubits}}+(1-P_{\mu}(1))2$, where $S_{\textrm{qubits}}$ is the value achievable with state \eqref{eq:eb_state}. In the other limit, $\mu\gg 1$, almost all round will have a detection, that is $P(-1,-1|x,y)\approx 1$ and again $S=2$. Before this behavior kicks in, when more than one pair is frequently present we expect a drop in the value of $S$, since the detections may be triggered by independent pairs. An accurate modelling for any value of $\mu$ is conceptually simple but notationally cumbersome; we leave it for Appendix~\ref{appmodel}.\\
Photon pair sources based on pulsing quasi-CW sources with a fixed repetition
rate control the value of $\mu$ by limiting the pump power. With true CW pumping the average number of pairs per round is
$\mu = (\textit{pair rate})\cdot \binwidth$, where $\binwidth$ is the round duration. The resulting repetition rate of the experiment is $1/\binwidth$. In this work, we fix the pair rate, while $\binwidth$ is a free parameter that can be optimized to extract the highest amount of randomness.

\begin{figure}
%    \includegraphics[width=\columnwidth]{figures/setup/Sagnac2017.eps}
    \includegraphics[width=\columnwidth]{figure1.eps}
    \caption{\label{fig:setup}
        Schematic of the experimental setup, including the source of the non-maximally entangled photon pairs.
        A PPKTP crystal, cut and poled for type II spontaneous parametric down conversion from 405~nm to 810~nm, is placed at the waist of a Sagnac-style interferometer
        and pumped from both sides.
        Light at 810~nm from the two SPDC process is overlapped in a
        polarizing beam splitter (PBS), generating the non-maximally entangled
        state described by Eq.~(\ref{eq:eb_state}) when considering a single
        photon pair.
        A laser diode (LD) provides the continuous wave UV pump light.
        The combination of a half wave plate and polarization beam splitter (PBS)
        sets~$\theta$ by controlling
        the relative intensity of the two pump beams, while
        a thin glass plate controls their relative phase~$\phi$.
        The pump beams enter the interferometer through dichroic mirrors.
        At each output of the PBS, the combination of a HWP and PBS projects the mode polarization before coupling into a fiber single mode for light at 810~nm (SMF@810).
        A free space link is used to transfer light from SMF@810 to single
        mode fibers designed for 1550~nm (SMF-28e).
        Eventually the light is detected with high efficiency superconducting Transition Edge Sensors (TES), and timestamped with a resolution of 2~ns. 
        }
\end{figure}

\textit{Experimental setup. --} A sketch of the experimental setup is shown in Fig.~\ref{fig:setup}. The source
for entangled photon pairs is based on the coherent combination of two
collinear type-II SPDC processes~\cite{Fiorentino:2004bu}.
We pump a periodically poled potassium titanylphyspate crystal (PPKTP,
$2\times1\times10$\,mm$^3$) from two opposite directions with light from the
same laser diode (405\,nm). Both pump beams have the same
Gaussian waists of~$\approx350\,\mu$m located within the crystal.
Light at 810\,nm from the two SPDC processes is overlapped in a polarizing beam
splitter (PBS), entangling the polarization modes, and collected into single
mode fibers.
When a single photon pair is generated, the resulting polarization state is given by
Eq.~\eqref{eq:eb_state}, where $\theta$ and~$\phi$ are determined by the
relative intensity and phase of the two pump beams set by rotating a half wave
plate before the first PBS, and the tilt of a glass plate in one of the pump
arms.

The effective collection modes for the downconverted light, determined by the
single mode optical fibers and incoupling optics was chosen to have a Gaussian
beam waist of $\approx130~\mu$m centered in the crystal in order to maximize
collection efficiency~\cite{Bennink:2010kd,Dixon:2014bg}.
The combination of a zero-order half-wave plate and another PBS (extinction
rate 1:1000 in transmission
) sets the measurement bases
for light entering the single mode fibers.
All optical elements are anti-reflection coated for 810\,nm.
Light from each collection fiber is sent to a superconducting transition edge
sensor (TES) optimized for detection at 810\,nm~\cite{Lita:2008wv}, which are
kept at $\approx80$~mK within a cryostat.
As the detectors show the highest efficiency when coupled to telecom fibers
(SMF28+), the light collected in to single mode fibers from the parametric
conversion source is transferred to these fibers via a free-space link.
The TES output signal is translated into photodetection event arrival times
using a constant fraction discriminator with an overall timing jitter $\approx 170$\,ns,
and recorded with a resolution of 2\,ns.
Setting Alice's and Bob's analyzing waveplates in the natural basis of the
combining PBS, $HV$ and $VH$, we estimate heralded efficiencies of
$82.42\pm0.31$~\% ($HV$) and $82.24\pm0.30$~\% ($VH$).
We identified two main sources of uncorrelated detection events: intrinsic
detector and background events at rates of $6.7\pm0.58\,{\text{s}}^{-1}$ for Alice and $11.9\pm0.77\,{\text{s}}^{-1}$
for Bob, respectively, and fluorescence caused by the UV pump in
the PPKTP crystal~\cite{Hegde:2007jc}, contributing $0.135\pm 0.08\%$ of the signal.
With a total pump power at the crystal of 5.8\,mW we estimate a pair
generation rate~$\approx2.4\times 10^4\,{\text{s}}^{-1}$ (detected $\approx20\times 10^3\,{\text{s}}^{-1}$),
and dark count / background rates of 45.7\,${\text{s}}^{-1}$ (Alice) and
41.5\,${\text{s}}^{-1}$ (Bob).
\begin{figure}
%    \includegraphics[width=1\columnwidth]{figures/S_curve/s_vs_bin.eps}
    \includegraphics[width=1\columnwidth]{figure2.eps}
    \caption{\label{fig:vio_bin}
        Measured CHSH violation as function of bin width $\binwidth$ (blue circles).
        A theoretical model (orange continuous line) is sketched in the main
        text and described in detail in Appendix \ref{appmodel}.
        Both the simulation and the experimental data show a violation for
        short $\binwidth$ (zoom in inset).
        The uncertainty on the measured value, calculated assuming i.i.d., corresponding
        to one standard deviation due to a Poissonian distribution of the
        events, is smaller than the symbols. For~$\binwidth\lesssim 1~\mu$s the detection jitter ($\approx 170$~ns) is comparable with the time bin, resulting in a loss of observable correlation and a fast drop of the value of $S$.}
\end{figure}

\textit{Violation. --} For the measured system efficiencies ($\eta_A\approx 82.4\%$, $\eta_B\approx 82.2\%$)
and rate of uncorrelated counts at each detector
(45.7\,${\text{s}}^{-1}$ Alice, 41.5\,${\text{s}}^{-1}$ Bob),
a numerical optimisation gives the following values of the state and
measurement parameters (see Appendix \ref{appmodel} for details):
$\theta = 25.9^{\circ}$, $\alpha_0 = -7.2^{\circ}$,
$\alpha_1 = 28.7^{\circ}$,
$\beta_0 = 82.7^{\circ}$, and
$\beta_1 = -61.5^{\circ}$. These are close to optimal for all values of~$\mu$, and the maximal violation is expected for~$\mu= 0.322$. 

We collected data for approximately~$42.8$~minutes, changing the measurement basis every 2~minutes,
cycling through the four possible basis combinations.
The sequence of the four settings is determined for every cycle using a pseudo-random number generator. 
We periodically ensure that~$\phi\approx 0$ by rotating the phase plate until the visibility in the~$+45^\circ/-45^\circ$ basis is larger than~0.985. Excluding the phase lock, the effective data acquisition time is $\approx34$~min.

In Fig.~\ref{fig:vio_bin} we show the result of processing the timestamped events for different bin widths~$\binwidth$. The largest violation $S=2.01602(32)$ is observed for~$\binwidth = 13.150~\mu$s, which, with the cited pair generation rate of $24\times 10^3\,$s$^{-1}$, corresponds to $\mu\approx 0.32$.
The uncertainty is calculated assuming that measurement results are independent and identically distributed (i.i.d.). Since the fluctuations of $S$ are identical in the i.i.d. and non-i.i.d. settings, this uncertainty is also representative of the p-value associated with local models~\cite{Bierhorst:2015fq,Elkouss:2016ii}.
The slight discrepancy between the experimental violation and the simulation is attributed to the non-ideal visibility of the state generated by the photon pair source. When $\binwidth$ is comparable to the detection jitter, detection events due to a single pair may be assigned to different rounds, decreasing the correlations. This explains the drop of $S$ below 2 (which our simulation does not capture because we have not included the jitter as a parameter).


\begin{figure}
%    \includegraphics[width=1\columnwidth]{figures/S_curve/rnd_vs_bin.eps}
    \includegraphics[width=1\columnwidth]{figure3.eps}
    \caption{\label{fig:rnd_bin}
        Randomness generation rate~$r_n/\binwidth$ as a function of~$\binwidth$
        for different block sizes~$n$.
        The points are calculated via Eq.~\eqref{eq:rand_finite} for finite
        $n$ (Eq.~\eqref{eq:rand_asymp} for $n\to\infty$) and the 
        violation measured in the experiment,
        assuming $\gamma=0$ (no testing rounds) and
        $\epsc=\epss=10^{-10}$.
        The continuous line is the asymptotic rate Eq.~\eqref{eq:rand_asymp}
        evaluated on the values of~$S$ of the simulation shown in Fig.~\ref{fig:vio_bin}, for the same security assumptions.
        }
\end{figure}

\textit{Randomness extraction. --} In order to turn the output data generated
from our experiment into uniformly random bits, we need to employ a randomness
expansion protocol~\cite{Rotem:diproofs}. Such a protocol consists of a pre-defined number of rounds~$n$, forming a block. Each round is randomly assigned (with probability $\gamma$ and $1-\gamma$, respectively) to one of two tasks: testing the device for faults or eavesdropping attempts, or generating random bits. When the test rounds show a sufficient violation, one applies a quantum-proof randomness extractor to the block, obtaining~$m$ random bits. 
The performance of the extraction protocol is determined by completeness and soundness security parameters, $\epsc$ and $\epss$. To ensure the resulting string is uniform to within $\approx10^{-10}$, we choose $\epsc=\epss=10^{-10}$.
The extraction protocol is a one-shot extraction protocol, i.e., the security analysis does not assume i.i.d..
The output randomness is composable and secure against a quantum adversary holding quantum side information~\cite{Rotem:diproofs}. The details of the protocol execution and its security proof are given in Appendix~\ref{sec:proofs}.

For a block consisting of $n$ rounds, the number of random bits per round is at least
\begin{align}
    \label{eq:rand_finite}
    r_n = \eta_\textrm{opt}(\epsilon',\epsEA) -4\frac{\log n}{n} + 4\frac{\log\epsEX}{n} -\frac{10}{n}\,,
\end{align} 
where the function $\etaopt$ depends on the block size~$n$, detected
violation~$S$, and auxiliary security parameters~$\epsilon'$, $\epsEA$, $\epsEX$. The choice of these auxiliary security parameters
is required to add up to the chosen level of completeness and soundness.
In the limit~$n\to\infty$ we obtain a lower bound on the number of random bits per round
\begin{equation}\label{eq:rand_asymp}
    r_\infty =
    \;1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{\frac{S^2}{4}-1}\right)\,,
\end{equation}
where $h(p) := - p\,\log_2p - (1 - p)\log_2(1 - p)$ is the binary entropy function. 

The extractable randomness rate~$r_n/\binwidth$ based on the observed~$S$ is presented
in Fig.~\ref{fig:rnd_bin} for various block sizes~$n$. For comparison, we also
plot the asymptotic value~$r_\infty/\binwidth$ with~$S$ given by the simulation.
The most obvious feature is that the highest randomness rate is not obtained at maximal violation of the inequality. There one gets highest randomness
per round, but it turns out to be advantageous to sacrifice randomness per round in favor of a larger number of rounds per unit time. This optimization will be part of the calibration procedure for a random number generator with an active switch of measurement bases.
As explained previously, the detection jitter affects the observable violation for~$\binwidth$ comparable to it.
This causes the sharp drop for short time bins observed for the experimental data.
For fixed detector efficiencies,
we expect the randomness rate to increase with higher photon pair generation
rate, that is by increasing the pump power, and to be ultimately limited by
the detection time jitter. Here, the use of efficient superconducting nanowire detectors will be a significant advantage.


We generated a random string from the data used to demonstrate the violation.
We sacrificed~$\approx22$\% of the data as calibration to determine the optimal bin width ($8.9~\mu$s),
and estimate the corresponding violation.
We
applied the extractor to the remaining~$\approx78$\% of the data, corresponding to 
175\,288\,156~bins, 
obtaining 617\,920~random bits.
From the total measurement time of 42.8~min,
we calculate a rate of~$\approx240$ random bit/s.
For details of the extraction process see Appendix~\ref{appextraction}.
Considering only the net measurement time,
that is without
the acquisition of the calibration fraction of the data, the phase lock of the source, and the rotation of waveplate motors,
we obtain a randomness rate of~$\approx396$~bit/s.
These numbers are not necessarily optimal; more sophisticated analysis demonstrated randomness extraction for very low detected violations~\cite{Bierhorst:2018uk, martingale_randomness}, and may yield a larger extractable randomness also in our case.
Details of the extraction procedure are in Appendix~\ref{appextraction}.


\textit{Conclusion. --}
We experimentally observed a violation of CHSH inequality with a continuous wave photon entangled pair source without the fair-sampling assumption combining a high collection efficiency source and high detection efficiency superconducting detectors,
with the largest detected violation of~$S=2.01602(32)$.

The generation rate
of all probabilistic sources of entangled photon pairs is limited by the probability of generation of multiple pairs
per experimental round, according to Poissonian statistics.
The flexible definition of an experimental round permitted by the CW nature of our setup allowed us to study the dependence of the observable violation as function of the average number of photon pairs per experimental round.
This same flexibility can be exploited to reduce the time necessary to acquire sufficient statistics for this kind of experiments: an increase in the pair generation rate is accompanied by a reduction of the
round duration.
This approach shifts the experimental repetition rate limitation from the photon statistics to the other elements of the setup, e.g. detectors time response or active polarization basis switching speed.

The observation of a Bell violation also certifies the generation of randomness.
We estimate the amount of randomness generated per round both in an asymptotic
regime and for a finite number of experimental rounds, assuming a required level of uniformity of $10^{-10}$.
When considering the largest attainable \textit{rate} of random bit generation,
the optimal round duration is the result of 
the trade-off between observed violation and number of rounds per unit time.
While for an ideal realization the optimal
round duration would be infinitesimally short,
it is limited in our system by the detection jitter time.
Our proof of principle demonstration can be extended into a complete, loophole-free random number source.
This requires closing the locality and freedom-of-choice loopholes, with techniques not different from pulsed photonic-sources, with the only addition of a periodic calibration necessary for determining the optimal time-bin.

\section*{Acknowledgments} This research is supported by the Singapore Ministry of Education Academic Research Fund Tier 3 (Grant No.~MOE2012-T3-1-009); by the National Research Fund and the Ministry of Education, Singapore, under the Research Centres of Excellence programme; by the Swiss National Science Foundation (SNSF), through the Grants PP00P2-150579 and PP00P2-179109; and by the Army Research Laboratory Center for Distributed Quantum Information via the project SciNet.
This work includes contributions of the National Institute of Standards and Technology, which are not subject to U.S. copyright.


\bibliographystyle{apsrev4-1}
%\bibliography{randomness}
%merlin.mbs apsrev4-1.bst 2010-07-25 4.21a (PWD, AO, DPC) hacked
%Control: key (0)
%Control: author (72) initials jnrlst
%Control: editor formatted (1) identically to author
%Control: production of article title (-1) disabled
%Control: page (0) single
%Control: year (1) truncated
%Control: production of eprint (0) enabled
\begin{thebibliography}{29}%
\makeatletter
\providecommand \@ifxundefined [1]{%
 \@ifx{#1\undefined}
}%
\providecommand \@ifnum [1]{%
 \ifnum #1\expandafter \@firstoftwo
 \else \expandafter \@secondoftwo
 \fi
}%
\providecommand \@ifx [1]{%
 \ifx #1\expandafter \@firstoftwo
 \else \expandafter \@secondoftwo
 \fi
}%
\providecommand \natexlab [1]{#1}%
\providecommand \enquote  [1]{``#1''}%
\providecommand \bibnamefont  [1]{#1}%
\providecommand \bibfnamefont [1]{#1}%
\providecommand \citenamefont [1]{#1}%
\providecommand \href@noop [0]{\@secondoftwo}%
\providecommand \href [0]{\begingroup \@sanitize@url \@href}%
\providecommand \@href[1]{\@@startlink{#1}\@@href}%
\providecommand \@@href[1]{\endgroup#1\@@endlink}%
\providecommand \@sanitize@url [0]{\catcode `\\12\catcode `\$12\catcode
  `\&12\catcode `\#12\catcode `\^12\catcode `\_12\catcode `\%12\relax}%
\providecommand \@@startlink[1]{}%
\providecommand \@@endlink[0]{}%
\providecommand \url  [0]{\begingroup\@sanitize@url \@url }%
\providecommand \@url [1]{\endgroup\@href {#1}{\urlprefix }}%
\providecommand \urlprefix  [0]{URL }%
\providecommand \Eprint [0]{\href }%
\providecommand \doibase [0]{http://dx.doi.org/}%
\providecommand \selectlanguage [0]{\@gobble}%
\providecommand \bibinfo  [0]{\@secondoftwo}%
\providecommand \bibfield  [0]{\@secondoftwo}%
\providecommand \translation [1]{[#1]}%
\providecommand \BibitemOpen [0]{}%
\providecommand \bibitemStop [0]{}%
\providecommand \bibitemNoStop [0]{.\EOS\space}%
\providecommand \EOS [0]{\spacefactor3000\relax}%
\providecommand \BibitemShut  [1]{\csname bibitem#1\endcsname}%
\let\auto@bib@innerbib\@empty
%</preamble>
\bibitem [{\citenamefont {Colbeck}(2007)}]{Colbeck:2007vo}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {R.}~\bibnamefont
  {Colbeck}},\ }\emph {\bibinfo {title} {Quantum And Relativistic Protocols For
  Secure Multi-Party Computation}},\ \href@noop {} {Ph.D. thesis},\ \bibinfo
  {school} {University of Cambridge} (\bibinfo {year} {2007})\BibitemShut
  {NoStop}%
\bibitem [{\citenamefont {Pironio}\ \emph {et~al.}(2010)\citenamefont
  {Pironio}, \citenamefont {Ac{\'\i}n}, \citenamefont {Massar}, \citenamefont
  {de~la Giroday}, \citenamefont {Matsukevich}, \citenamefont {Maunz},
  \citenamefont {Olmschenk}, \citenamefont {Hayes}, \citenamefont {Luo},
  \citenamefont {Manning},\ and\ \citenamefont {Monroe}}]{Pironio:2010bu}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {S.}~\bibnamefont
  {Pironio}}, \bibinfo {author} {\bibfnamefont {A.}~\bibnamefont {Ac{\'\i}n}},
  \bibinfo {author} {\bibfnamefont {S.}~\bibnamefont {Massar}}, \bibinfo
  {author} {\bibfnamefont {A.~B.}\ \bibnamefont {de~la Giroday}}, \bibinfo
  {author} {\bibfnamefont {D.~N.}\ \bibnamefont {Matsukevich}}, \bibinfo
  {author} {\bibfnamefont {P.}~\bibnamefont {Maunz}}, \bibinfo {author}
  {\bibfnamefont {S.}~\bibnamefont {Olmschenk}}, \bibinfo {author}
  {\bibfnamefont {D.}~\bibnamefont {Hayes}}, \bibinfo {author} {\bibfnamefont
  {L.}~\bibnamefont {Luo}}, \bibinfo {author} {\bibfnamefont {T.~A.}\
  \bibnamefont {Manning}}, \ and\ \bibinfo {author} {\bibfnamefont {C.~R.}\
  \bibnamefont {Monroe}},\ }\href {\doibase 10.1038/nature09008} {\bibfield
  {journal} {\bibinfo  {journal} {Nature}\ }\textbf {\bibinfo {volume} {464}},\
  \bibinfo {pages} {1021} (\bibinfo {year} {2010})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Ac{\'\i}n}\ and\ \citenamefont
  {Masanes}(2016)}]{Acin:2016ke}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {A.}~\bibnamefont
  {Ac{\'\i}n}}\ and\ \bibinfo {author} {\bibfnamefont {L.}~\bibnamefont
  {Masanes}},\ }\href {\doibase 10.1038/nature20119} {\bibfield  {journal}
  {\bibinfo  {journal} {Nature}\ }\textbf {\bibinfo {volume} {540}},\ \bibinfo
  {pages} {213} (\bibinfo {year} {2016})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Hensen}\ \emph {et~al.}(2015)\citenamefont {Hensen},
  \citenamefont {Bernien}, \citenamefont {Dr{\'e}au}, \citenamefont {Reiserer},
  \citenamefont {Kalb}, \citenamefont {Blok}, \citenamefont {Ruitenberg},
  \citenamefont {Vermeulen}, \citenamefont {Schouten}, \citenamefont
  {Abell{\'a}n}, \citenamefont {Amaya}, \citenamefont {Pruneri}, \citenamefont
  {Mitchell}, \citenamefont {Markham}, \citenamefont {Twitchen}, \citenamefont
  {Elkouss}, \citenamefont {Wehner}, \citenamefont {Taminiau},\ and\
  \citenamefont {Hanson}}]{Hensen:2015ccp}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {B.~J.}\ \bibnamefont
  {Hensen}}, \bibinfo {author} {\bibfnamefont {H.}~\bibnamefont {Bernien}},
  \bibinfo {author} {\bibfnamefont {A.~E.}\ \bibnamefont {Dr{\'e}au}}, \bibinfo
  {author} {\bibfnamefont {A.}~\bibnamefont {Reiserer}}, \bibinfo {author}
  {\bibfnamefont {N.}~\bibnamefont {Kalb}}, \bibinfo {author} {\bibfnamefont
  {M.~S.}\ \bibnamefont {Blok}}, \bibinfo {author} {\bibfnamefont
  {J.}~\bibnamefont {Ruitenberg}}, \bibinfo {author} {\bibfnamefont {R.~F.~L.}\
  \bibnamefont {Vermeulen}}, \bibinfo {author} {\bibfnamefont {R.~N.}\
  \bibnamefont {Schouten}}, \bibinfo {author} {\bibfnamefont {C.}~\bibnamefont
  {Abell{\'a}n}}, \bibinfo {author} {\bibfnamefont {W.}~\bibnamefont {Amaya}},
  \bibinfo {author} {\bibfnamefont {V.}~\bibnamefont {Pruneri}}, \bibinfo
  {author} {\bibfnamefont {M.~W.}\ \bibnamefont {Mitchell}}, \bibinfo {author}
  {\bibfnamefont {M.}~\bibnamefont {Markham}}, \bibinfo {author} {\bibfnamefont
  {D.~J.}\ \bibnamefont {Twitchen}}, \bibinfo {author} {\bibfnamefont
  {D.}~\bibnamefont {Elkouss}}, \bibinfo {author} {\bibfnamefont
  {S.}~\bibnamefont {Wehner}}, \bibinfo {author} {\bibfnamefont {T.~H.}\
  \bibnamefont {Taminiau}}, \ and\ \bibinfo {author} {\bibfnamefont
  {R.}~\bibnamefont {Hanson}},\ }\href {\doibase 10.1038/nature15759}
  {\bibfield  {journal} {\bibinfo  {journal} {Nature}\ }\textbf {\bibinfo
  {volume} {526}},\ \bibinfo {pages} {682} (\bibinfo {year}
  {2015})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Lita}\ \emph {et~al.}(2008)\citenamefont {Lita},
  \citenamefont {Miller},\ and\ \citenamefont {Nam}}]{Lita:2008wv}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {A.~E.}\ \bibnamefont
  {Lita}}, \bibinfo {author} {\bibfnamefont {A.~J.}\ \bibnamefont {Miller}}, \
  and\ \bibinfo {author} {\bibfnamefont {S.~W.}\ \bibnamefont {Nam}},\ }\href
  {http://www.opticsinfobase.org/abstract.cfm?id=154340} {\bibfield  {journal}
  {\bibinfo  {journal} {Opt. Express}\ }\textbf {\bibinfo {volume} {16}},\
  \bibinfo {pages} {3032} (\bibinfo {year} {2008})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Marsili}\ \emph {et~al.}(2013)\citenamefont
  {Marsili}, \citenamefont {Verma}, \citenamefont {Stern}, \citenamefont
  {Harrington}, \citenamefont {Lita}, \citenamefont {Gerrits}, \citenamefont
  {Vayshenker}, \citenamefont {Baek}, \citenamefont {Shaw}, \citenamefont
  {Mirin},\ and\ \citenamefont {Nam}}]{Marsili:2013fs}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {F.}~\bibnamefont
  {Marsili}}, \bibinfo {author} {\bibfnamefont {V.~B.}\ \bibnamefont {Verma}},
  \bibinfo {author} {\bibfnamefont {J.~A.}\ \bibnamefont {Stern}}, \bibinfo
  {author} {\bibfnamefont {S.}~\bibnamefont {Harrington}}, \bibinfo {author}
  {\bibfnamefont {A.~E.}\ \bibnamefont {Lita}}, \bibinfo {author}
  {\bibfnamefont {T.}~\bibnamefont {Gerrits}}, \bibinfo {author} {\bibfnamefont
  {I.}~\bibnamefont {Vayshenker}}, \bibinfo {author} {\bibfnamefont
  {B.}~\bibnamefont {Baek}}, \bibinfo {author} {\bibfnamefont {M.~D.}\
  \bibnamefont {Shaw}}, \bibinfo {author} {\bibfnamefont {R.~P.}\ \bibnamefont
  {Mirin}}, \ and\ \bibinfo {author} {\bibfnamefont {S.~W.}\ \bibnamefont
  {Nam}},\ }\href {\doibase 10.1038/nphoton.2013.13} {\bibfield  {journal}
  {\bibinfo  {journal} {Nature Photonics}\ }\textbf {\bibinfo {volume} {7}},\
  \bibinfo {pages} {210} (\bibinfo {year} {2013})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Giustina}\ \emph {et~al.}(2015)\citenamefont
  {Giustina}, \citenamefont {Versteegh}, \citenamefont {Wengerowsky},
  \citenamefont {Handsteiner}, \citenamefont {Hochrainer}, \citenamefont
  {Phelan}, \citenamefont {Steinlechner}, \citenamefont {Kofler}, \citenamefont
  {Larsson}, \citenamefont {Abell\'an}, \citenamefont {Amaya}, \citenamefont
  {Pruneri}, \citenamefont {Mitchell}, \citenamefont {Beyer}, \citenamefont
  {Gerrits}, \citenamefont {Lita}, \citenamefont {Shalm}, \citenamefont {Nam},
  \citenamefont {Scheidl}, \citenamefont {Ursin}, \citenamefont {Wittmann},\
  and\ \citenamefont {Zeilinger}}]{giustina2015}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {M.}~\bibnamefont
  {Giustina}}, \bibinfo {author} {\bibfnamefont {M.~A.~M.}\ \bibnamefont
  {Versteegh}}, \bibinfo {author} {\bibfnamefont {S.}~\bibnamefont
  {Wengerowsky}}, \bibinfo {author} {\bibfnamefont {J.}~\bibnamefont
  {Handsteiner}}, \bibinfo {author} {\bibfnamefont {A.}~\bibnamefont
  {Hochrainer}}, \bibinfo {author} {\bibfnamefont {K.}~\bibnamefont {Phelan}},
  \bibinfo {author} {\bibfnamefont {F.}~\bibnamefont {Steinlechner}}, \bibinfo
  {author} {\bibfnamefont {J.}~\bibnamefont {Kofler}}, \bibinfo {author}
  {\bibfnamefont {J.-A.}\ \bibnamefont {Larsson}}, \bibinfo {author}
  {\bibfnamefont {C.}~\bibnamefont {Abell\'an}}, \bibinfo {author}
  {\bibfnamefont {W.}~\bibnamefont {Amaya}}, \bibinfo {author} {\bibfnamefont
  {V.}~\bibnamefont {Pruneri}}, \bibinfo {author} {\bibfnamefont {M.~W.}\
  \bibnamefont {Mitchell}}, \bibinfo {author} {\bibfnamefont {J.}~\bibnamefont
  {Beyer}}, \bibinfo {author} {\bibfnamefont {T.}~\bibnamefont {Gerrits}},
  \bibinfo {author} {\bibfnamefont {A.~E.}\ \bibnamefont {Lita}}, \bibinfo
  {author} {\bibfnamefont {L.~K.}\ \bibnamefont {Shalm}}, \bibinfo {author}
  {\bibfnamefont {S.~W.}\ \bibnamefont {Nam}}, \bibinfo {author} {\bibfnamefont
  {T.}~\bibnamefont {Scheidl}}, \bibinfo {author} {\bibfnamefont
  {R.}~\bibnamefont {Ursin}}, \bibinfo {author} {\bibfnamefont
  {B.}~\bibnamefont {Wittmann}}, \ and\ \bibinfo {author} {\bibfnamefont
  {A.}~\bibnamefont {Zeilinger}},\ }\href {\doibase
  10.1103/PhysRevLett.115.250401} {\bibfield  {journal} {\bibinfo  {journal}
  {Phys. Rev. Lett.}\ }\textbf {\bibinfo {volume} {115}},\ \bibinfo {pages}
  {250401} (\bibinfo {year} {2015})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Shalm}\ \emph {et~al.}(2015)\citenamefont {Shalm},
  \citenamefont {Meyer-Scott}, \citenamefont {Christensen},\ and\ \citenamefont
  {Bierhorst}}]{Shalm:2015cw}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {L.~K.}\ \bibnamefont
  {Shalm}}, \bibinfo {author} {\bibfnamefont {E.}~\bibnamefont {Meyer-Scott}},
  \bibinfo {author} {\bibfnamefont {B.~G.}\ \bibnamefont {Christensen}}, \ and\
  \bibinfo {author} {\bibfnamefont {P.}~\bibnamefont {Bierhorst}},\ }\href
  {\doibase 10.1103/PhysRevLett.115.250402} {\bibfield  {journal} {\bibinfo
  {journal} {Phys. Rev.}\ }\textbf {\bibinfo {volume} {115}},\ \bibinfo {pages}
  {250402} (\bibinfo {year} {2015})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Bierhorst}\ \emph {et~al.}(2018)\citenamefont
  {Bierhorst}, \citenamefont {Knill}, \citenamefont {Glancy}, \citenamefont
  {Zhang}, \citenamefont {Mink}, \citenamefont {Jordan}, \citenamefont
  {Rommal}, \citenamefont {Liu}, \citenamefont {Christensen}, \citenamefont
  {Nam}, \citenamefont {Stevens},\ and\ \citenamefont
  {Shalm}}]{Bierhorst:2018uk}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {P.}~\bibnamefont
  {Bierhorst}}, \bibinfo {author} {\bibfnamefont {E.}~\bibnamefont {Knill}},
  \bibinfo {author} {\bibfnamefont {S.}~\bibnamefont {Glancy}}, \bibinfo
  {author} {\bibfnamefont {Y.}~\bibnamefont {Zhang}}, \bibinfo {author}
  {\bibfnamefont {A.}~\bibnamefont {Mink}}, \bibinfo {author} {\bibfnamefont
  {S.}~\bibnamefont {Jordan}}, \bibinfo {author} {\bibfnamefont
  {A.}~\bibnamefont {Rommal}}, \bibinfo {author} {\bibfnamefont {Y.-K.}\
  \bibnamefont {Liu}}, \bibinfo {author} {\bibfnamefont {B.}~\bibnamefont
  {Christensen}}, \bibinfo {author} {\bibfnamefont {S.~W.}\ \bibnamefont
  {Nam}}, \bibinfo {author} {\bibfnamefont {M.~J.}\ \bibnamefont {Stevens}}, \
  and\ \bibinfo {author} {\bibfnamefont {L.~K.}\ \bibnamefont {Shalm}},\ }\href
  {\doibase 10.1038/s41586-018-0019-0} {\bibfield  {journal} {\bibinfo
  {journal} {Nature}\ }\textbf {\bibinfo {volume} {556}},\ \bibinfo {pages}
  {223} (\bibinfo {year} {2018})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Liu}\ \emph {et~al.}(2018)\citenamefont {Liu},
  \citenamefont {Yuan}, \citenamefont {Li}, \citenamefont {Zhang},
  \citenamefont {Zhao}, \citenamefont {Zhong}, \citenamefont {Cao},
  \citenamefont {Li}, \citenamefont {Chen}, \citenamefont {Li}, \citenamefont
  {Peng}, \citenamefont {Chen}, \citenamefont {Peng}, \citenamefont {Shi},
  \citenamefont {Wang}, \citenamefont {You}, \citenamefont {Ma}, \citenamefont
  {Fan}, \citenamefont {Zhang},\ and\ \citenamefont {Pan}}]{Liu:2017uz}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {Y.}~\bibnamefont
  {Liu}}, \bibinfo {author} {\bibfnamefont {X.}~\bibnamefont {Yuan}}, \bibinfo
  {author} {\bibfnamefont {M.-H.}\ \bibnamefont {Li}}, \bibinfo {author}
  {\bibfnamefont {W.}~\bibnamefont {Zhang}}, \bibinfo {author} {\bibfnamefont
  {Q.}~\bibnamefont {Zhao}}, \bibinfo {author} {\bibfnamefont {J.}~\bibnamefont
  {Zhong}}, \bibinfo {author} {\bibfnamefont {Y.}~\bibnamefont {Cao}}, \bibinfo
  {author} {\bibfnamefont {Y.-H.}\ \bibnamefont {Li}}, \bibinfo {author}
  {\bibfnamefont {L.-K.}\ \bibnamefont {Chen}}, \bibinfo {author}
  {\bibfnamefont {H.}~\bibnamefont {Li}}, \bibinfo {author} {\bibfnamefont
  {T.}~\bibnamefont {Peng}}, \bibinfo {author} {\bibfnamefont {Y.-A.}\
  \bibnamefont {Chen}}, \bibinfo {author} {\bibfnamefont {C.-Z.}\ \bibnamefont
  {Peng}}, \bibinfo {author} {\bibfnamefont {S.-C.}\ \bibnamefont {Shi}},
  \bibinfo {author} {\bibfnamefont {Z.}~\bibnamefont {Wang}}, \bibinfo {author}
  {\bibfnamefont {L.}~\bibnamefont {You}}, \bibinfo {author} {\bibfnamefont
  {X.}~\bibnamefont {Ma}}, \bibinfo {author} {\bibfnamefont {J.}~\bibnamefont
  {Fan}}, \bibinfo {author} {\bibfnamefont {Q.}~\bibnamefont {Zhang}}, \ and\
  \bibinfo {author} {\bibfnamefont {J.-W.}\ \bibnamefont {Pan}},\ }\href
  {\doibase 10.1103/PhysRevLett.120.010503} {\bibfield  {journal} {\bibinfo
  {journal} {Phys. Rev. Lett.}\ }\textbf {\bibinfo {volume} {120}},\ \bibinfo
  {pages} {010503} (\bibinfo {year} {2018})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Larsson}\ and\ \citenamefont
  {Gill}(2004)}]{Larsson:2004bt}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {J.-A.}\ \bibnamefont
  {Larsson}}\ and\ \bibinfo {author} {\bibfnamefont {R.~D.}\ \bibnamefont
  {Gill}},\ }\href {\doibase 10.1209/epl/i2004-10124-7} {\bibfield  {journal}
  {\bibinfo  {journal} {EPL}\ }\textbf {\bibinfo {volume} {67}},\ \bibinfo
  {pages} {707} (\bibinfo {year} {2004})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Christensen}\ \emph {et~al.}(2015)\citenamefont
  {Christensen}, \citenamefont {Hill}, \citenamefont {Kwiat}, \citenamefont
  {Knill}, \citenamefont {Nam}, \citenamefont {Coakley}, \citenamefont
  {Glancy}, \citenamefont {Shalm},\ and\ \citenamefont
  {Zhang}}]{Christensen:2015kn}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {B.~G.}\ \bibnamefont
  {Christensen}}, \bibinfo {author} {\bibfnamefont {A.}~\bibnamefont {Hill}},
  \bibinfo {author} {\bibfnamefont {P.~G.}\ \bibnamefont {Kwiat}}, \bibinfo
  {author} {\bibfnamefont {E.}~\bibnamefont {Knill}}, \bibinfo {author}
  {\bibfnamefont {S.~W.}\ \bibnamefont {Nam}}, \bibinfo {author} {\bibfnamefont
  {K.}~\bibnamefont {Coakley}}, \bibinfo {author} {\bibfnamefont
  {S.}~\bibnamefont {Glancy}}, \bibinfo {author} {\bibfnamefont {L.~K.}\
  \bibnamefont {Shalm}}, \ and\ \bibinfo {author} {\bibfnamefont
  {Y.}~\bibnamefont {Zhang}},\ }\href {\doibase 10.1103/PhysRevA.92.032130}
  {\bibfield  {journal} {\bibinfo  {journal} {Phys. Rev. A}\ }\textbf {\bibinfo
  {volume} {92}},\ \bibinfo {pages} {032130} (\bibinfo {year}
  {2015})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Giustina}\ \emph {et~al.}(2013)\citenamefont
  {Giustina}, \citenamefont {Mech}, \citenamefont {Ramelow}, \citenamefont
  {Wittmann}, \citenamefont {Kofler}, \citenamefont {Beyer}, \citenamefont
  {Lita}, \citenamefont {Calkins}, \citenamefont {Gerrits}, \citenamefont
  {Nam}, \citenamefont {Ursin},\ and\ \citenamefont
  {Zeilinger}}]{Giustina:2013uf}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {M.}~\bibnamefont
  {Giustina}}, \bibinfo {author} {\bibfnamefont {A.}~\bibnamefont {Mech}},
  \bibinfo {author} {\bibfnamefont {S.}~\bibnamefont {Ramelow}}, \bibinfo
  {author} {\bibfnamefont {B.}~\bibnamefont {Wittmann}}, \bibinfo {author}
  {\bibfnamefont {J.}~\bibnamefont {Kofler}}, \bibinfo {author} {\bibfnamefont
  {J.}~\bibnamefont {Beyer}}, \bibinfo {author} {\bibfnamefont {A.~E.}\
  \bibnamefont {Lita}}, \bibinfo {author} {\bibfnamefont {B.}~\bibnamefont
  {Calkins}}, \bibinfo {author} {\bibfnamefont {T.}~\bibnamefont {Gerrits}},
  \bibinfo {author} {\bibfnamefont {S.~W.}\ \bibnamefont {Nam}}, \bibinfo
  {author} {\bibfnamefont {R.}~\bibnamefont {Ursin}}, \ and\ \bibinfo {author}
  {\bibfnamefont {A.}~\bibnamefont {Zeilinger}},\ }\href {\doibase
  10.1038/nature12012} {\bibfield  {journal} {\bibinfo  {journal} {Nature}\
  }\textbf {\bibinfo {volume} {497}},\ \bibinfo {pages} {227} (\bibinfo {year}
  {2013})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Bancal}\ \emph {et~al.}(2014)\citenamefont {Bancal},
  \citenamefont {Sheridan},\ and\ \citenamefont {Scarani}}]{Bancal:2013wa}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {J.-D.}\ \bibnamefont
  {Bancal}}, \bibinfo {author} {\bibfnamefont {L.}~\bibnamefont {Sheridan}}, \
  and\ \bibinfo {author} {\bibfnamefont {V.}~\bibnamefont {Scarani}},\ }\href
  {\doibase 10.1088/1367-2630/16/3/033011} {\bibfield  {journal} {\bibinfo
  {journal} {New J. Phys.}\ }\textbf {\bibinfo {volume} {16}},\ \bibinfo
  {pages} {033011} (\bibinfo {year} {2014})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Eberhard}(1993)}]{Eberhard:1993tx}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {P.~H.}\ \bibnamefont
  {Eberhard}},\ }\href {http://link.aps.org/doi/10.1103/PhysRevA.47.R747}
  {\bibfield  {journal} {\bibinfo  {journal} {Phys. Rev. A}\ }\textbf {\bibinfo
  {volume} {47}},\ \bibinfo {pages} {R747} (\bibinfo {year}
  {1993})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Caprara~Vivoli}\ \emph {et~al.}(2015)\citenamefont
  {Caprara~Vivoli}, \citenamefont {Sekatski}, \citenamefont {Bancal},
  \citenamefont {Lim}, \citenamefont {Christensen}, \citenamefont {Martin},
  \citenamefont {Thew}, \citenamefont {Zbinden}, \citenamefont {Gisin},\ and\
  \citenamefont {Sangouard}}]{Vivoli:2015aa}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {V.}~\bibnamefont
  {Caprara~Vivoli}}, \bibinfo {author} {\bibfnamefont {P.}~\bibnamefont
  {Sekatski}}, \bibinfo {author} {\bibfnamefont {J.-D.}\ \bibnamefont
  {Bancal}}, \bibinfo {author} {\bibfnamefont {C.~C.~W.}\ \bibnamefont {Lim}},
  \bibinfo {author} {\bibfnamefont {B.~G.}\ \bibnamefont {Christensen}},
  \bibinfo {author} {\bibfnamefont {A.}~\bibnamefont {Martin}}, \bibinfo
  {author} {\bibfnamefont {R.~T.}\ \bibnamefont {Thew}}, \bibinfo {author}
  {\bibfnamefont {H.}~\bibnamefont {Zbinden}}, \bibinfo {author} {\bibfnamefont
  {N.}~\bibnamefont {Gisin}}, \ and\ \bibinfo {author} {\bibfnamefont
  {N.}~\bibnamefont {Sangouard}},\ }\href {\doibase 10.1103/PhysRevA.91.012107}
  {\bibfield  {journal} {\bibinfo  {journal} {Phys. Rev. A}\ }\textbf {\bibinfo
  {volume} {91}},\ \bibinfo {pages} {012107} (\bibinfo {year}
  {2015})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Fiorentino}\ \emph {et~al.}(2004)\citenamefont
  {Fiorentino}, \citenamefont {Messin}, \citenamefont {Kuklewicz},
  \citenamefont {Wong},\ and\ \citenamefont {Shapiro}}]{Fiorentino:2004bu}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {M.}~\bibnamefont
  {Fiorentino}}, \bibinfo {author} {\bibfnamefont {G.}~\bibnamefont {Messin}},
  \bibinfo {author} {\bibfnamefont {C.~E.}\ \bibnamefont {Kuklewicz}}, \bibinfo
  {author} {\bibfnamefont {F.~N.~C.}\ \bibnamefont {Wong}}, \ and\ \bibinfo
  {author} {\bibfnamefont {J.~H.}\ \bibnamefont {Shapiro}},\ }\href {\doibase
  10.1103/PhysRevA.69.041801} {\bibfield  {journal} {\bibinfo  {journal} {Phys.
  Rev. A}\ }\textbf {\bibinfo {volume} {69}},\ \bibinfo {pages} {041801}
  (\bibinfo {year} {2004})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Bennink}(2010)}]{Bennink:2010kd}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {R.~S.}\ \bibnamefont
  {Bennink}},\ }\href {\doibase 10.1103/PhysRevA.81.053805} {\bibfield
  {journal} {\bibinfo  {journal} {Phys. Rev. A}\ }\textbf {\bibinfo {volume}
  {81}},\ \bibinfo {pages} {053805} (\bibinfo {year} {2010})}\BibitemShut
  {NoStop}%
\bibitem [{\citenamefont {Dixon}\ \emph {et~al.}(2014)\citenamefont {Dixon},
  \citenamefont {Rosenberg}, \citenamefont {Stelmakh}, \citenamefont {Grein},
  \citenamefont {Bennink}, \citenamefont {Dauler}, \citenamefont {Kerman},
  \citenamefont {Molnar},\ and\ \citenamefont {Wong}}]{Dixon:2014bg}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {P.~B.}\ \bibnamefont
  {Dixon}}, \bibinfo {author} {\bibfnamefont {D.}~\bibnamefont {Rosenberg}},
  \bibinfo {author} {\bibfnamefont {V.}~\bibnamefont {Stelmakh}}, \bibinfo
  {author} {\bibfnamefont {M.~E.}\ \bibnamefont {Grein}}, \bibinfo {author}
  {\bibfnamefont {R.~S.}\ \bibnamefont {Bennink}}, \bibinfo {author}
  {\bibfnamefont {E.~A.}\ \bibnamefont {Dauler}}, \bibinfo {author}
  {\bibfnamefont {A.~J.}\ \bibnamefont {Kerman}}, \bibinfo {author}
  {\bibfnamefont {R.~J.}\ \bibnamefont {Molnar}}, \ and\ \bibinfo {author}
  {\bibfnamefont {F.~N.~C.}\ \bibnamefont {Wong}},\ }\href {\doibase
  10.1103/PhysRevA.90.043804} {\bibfield  {journal} {\bibinfo  {journal} {Phys.
  Rev. A}\ }\textbf {\bibinfo {volume} {90}},\ \bibinfo {pages} {043804}
  (\bibinfo {year} {2014})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Hegde}\ \emph {et~al.}(2007)\citenamefont {Hegde},
  \citenamefont {Schepler}, \citenamefont {Peterson},\ and\ \citenamefont
  {Zelmon}}]{Hegde:2007jc}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {S.~M.}\ \bibnamefont
  {Hegde}}, \bibinfo {author} {\bibfnamefont {K.~L.}\ \bibnamefont {Schepler}},
  \bibinfo {author} {\bibfnamefont {R.~D.}\ \bibnamefont {Peterson}}, \ and\
  \bibinfo {author} {\bibfnamefont {D.~E.}\ \bibnamefont {Zelmon}},\ }in\ \href
  {\doibase 10.1117/12.718475} {\emph {\bibinfo {booktitle} {Defense and
  Security Symposium}}},\ \bibinfo {editor} {edited by\ \bibinfo {editor}
  {\bibfnamefont {G.~L.}\ \bibnamefont {Wood}}\ and\ \bibinfo {editor}
  {\bibfnamefont {M.~A.}\ \bibnamefont {Dubinskii}}}\ (\bibinfo  {publisher}
  {SPIE},\ \bibinfo {year} {2007})\ p.\ \bibinfo {pages} {65520V}\BibitemShut
  {NoStop}%
\bibitem [{\citenamefont {Bierhorst}(2015)}]{Bierhorst:2015fq}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {P.}~\bibnamefont
  {Bierhorst}},\ }\href {\doibase 10.1088/1751-8113/48/19/195302} {\bibfield
  {journal} {\bibinfo  {journal} {J. Phys. A: Math. Theor.}\ }\textbf {\bibinfo
  {volume} {48}},\ \bibinfo {pages} {195302} (\bibinfo {year}
  {2015})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Elkouss}\ and\ \citenamefont
  {Wehner}(2016)}]{Elkouss:2016ii}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {D.}~\bibnamefont
  {Elkouss}}\ and\ \bibinfo {author} {\bibfnamefont {S.}~\bibnamefont
  {Wehner}},\ }\href {\doibase 10.1038/npjqi.2016.26} {\bibfield  {journal}
  {\bibinfo  {journal} {npj Quantum Inf}\ }\textbf {\bibinfo {volume} {2}},\
  \bibinfo {pages} {042111} (\bibinfo {year} {2016})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Arnon-Friedman}\ \emph {et~al.}(2018)\citenamefont
  {Arnon-Friedman}, \citenamefont {Dupuis}, \citenamefont {Fawzi},
  \citenamefont {Renner},\ and\ \citenamefont {Vidick}}]{Rotem:diproofs}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {R.}~\bibnamefont
  {Arnon-Friedman}}, \bibinfo {author} {\bibfnamefont {F.}~\bibnamefont
  {Dupuis}}, \bibinfo {author} {\bibfnamefont {O.}~\bibnamefont {Fawzi}},
  \bibinfo {author} {\bibfnamefont {R.}~\bibnamefont {Renner}}, \ and\ \bibinfo
  {author} {\bibfnamefont {T.}~\bibnamefont {Vidick}},\ }\href {\doibase
  10.1038/s41467-017-02307-4} {\bibfield  {journal} {\bibinfo  {journal} {Nat
  Comms}\ }\textbf {\bibinfo {volume} {9}},\ \bibinfo {pages} {459} (\bibinfo
  {year} {2018})}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {{Knill}}\ \emph {et~al.}(2017)\citenamefont
  {{Knill}}, \citenamefont {{Zhang}},\ and\ \citenamefont
  {{Bierhorst}}}]{martingale_randomness}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {E.}~\bibnamefont
  {{Knill}}}, \bibinfo {author} {\bibfnamefont {Y.}~\bibnamefont {{Zhang}}}, \
  and\ \bibinfo {author} {\bibfnamefont {P.}~\bibnamefont {{Bierhorst}}},\
  }\href@noop {} {\bibfield  {journal} {\bibinfo  {journal} {ArXiv e-prints}\ }
  (\bibinfo {year} {2017})},\ \Eprint {http://arxiv.org/abs/1709.06159}
  {arXiv:1709.06159 [quant-ph]} \BibitemShut {NoStop}%
\bibitem [{\citenamefont {Hao}\ and\ \citenamefont
  {Hoshi}(1997)}]{interval_algorithm}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {T.~S.}\ \bibnamefont
  {Hao}}\ and\ \bibinfo {author} {\bibfnamefont {M.}~\bibnamefont {Hoshi}},\
  }\href {\doibase 10.1109/18.556116} {\bibfield  {journal} {\bibinfo
  {journal} {IEEE Transactions on Information Theory}\ }\textbf {\bibinfo
  {volume} {43}},\ \bibinfo {pages} {599} (\bibinfo {year} {1997})}\BibitemShut
  {NoStop}%
\bibitem [{\citenamefont {Mauerer}\ \emph {et~al.}(2012)\citenamefont
  {Mauerer}, \citenamefont {Portmann},\ and\ \citenamefont
  {Scholz}}]{Mauerer:extractors}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {W.}~\bibnamefont
  {Mauerer}}, \bibinfo {author} {\bibfnamefont {C.}~\bibnamefont {Portmann}}, \
  and\ \bibinfo {author} {\bibfnamefont {V.~B.}\ \bibnamefont {Scholz}},\
  }\href@noop {} {\bibfield  {journal} {\bibinfo  {journal} {ArXiv e-prints}\ }
  (\bibinfo {year} {2012})},\ \Eprint {http://arxiv.org/abs/1212.0520}
  {arXiv:1212.0520} \BibitemShut {NoStop}%
\bibitem [{\citenamefont {Shi}\ \emph {et~al.}(2016)\citenamefont {Shi},
  \citenamefont {Chng},\ and\ \citenamefont {Kurtsiefer}}]{Shi:2016kw}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {Y.}~\bibnamefont
  {Shi}}, \bibinfo {author} {\bibfnamefont {B.}~\bibnamefont {Chng}}, \ and\
  \bibinfo {author} {\bibfnamefont {C.}~\bibnamefont {Kurtsiefer}},\ }\href
  {\doibase 10.1063/1.4959887} {\bibfield  {journal} {\bibinfo  {journal}
  {Appl. Phys. Lett.}\ }\textbf {\bibinfo {volume} {109}},\ \bibinfo {pages}
  {041101} (\bibinfo {year} {2016})}\BibitemShut {NoStop}%
\bibitem [{anc()}]{ancillary}%
  \BibitemOpen
  \href@noop {} {}\bibinfo {howpublished}
  {\url{https://arxiv.org/help/ancillary_files}}\BibitemShut {NoStop}%
\bibitem [{\citenamefont {Rukhin}\ \emph {et~al.}(2010)\citenamefont {Rukhin},
  \citenamefont {Soto}, \citenamefont {Nechvatal}, \citenamefont {Smid},
  \citenamefont {Barker}, \citenamefont {Leigh}, \citenamefont {Levenson},
  \citenamefont {Vangel}, \citenamefont {Banks}, \citenamefont {Heckert},
  \citenamefont {Dray},\ and\ \citenamefont {Vo}}]{Rukhin:2010dn}%
  \BibitemOpen
  \bibfield  {author} {\bibinfo {author} {\bibfnamefont {A.}~\bibnamefont
  {Rukhin}}, \bibinfo {author} {\bibfnamefont {J.}~\bibnamefont {Soto}},
  \bibinfo {author} {\bibfnamefont {J.}~\bibnamefont {Nechvatal}}, \bibinfo
  {author} {\bibfnamefont {M.}~\bibnamefont {Smid}}, \bibinfo {author}
  {\bibfnamefont {E.}~\bibnamefont {Barker}}, \bibinfo {author} {\bibfnamefont
  {S.}~\bibnamefont {Leigh}}, \bibinfo {author} {\bibfnamefont
  {M.}~\bibnamefont {Levenson}}, \bibinfo {author} {\bibfnamefont
  {M.}~\bibnamefont {Vangel}}, \bibinfo {author} {\bibfnamefont
  {D.}~\bibnamefont {Banks}}, \bibinfo {author} {\bibfnamefont
  {A.}~\bibnamefont {Heckert}}, \bibinfo {author} {\bibfnamefont
  {J.}~\bibnamefont {Dray}}, \ and\ \bibinfo {author} {\bibfnamefont
  {S.}~\bibnamefont {Vo}},\ }\href {\doibase 10.6028/NIST.SP.800-22r1a}
  {\enquote {\bibinfo {title} {{A statistical test suite for the validation of
  cryptographic random number generators}},}\ }\bibinfo {howpublished}
  {National Institute of Standards and Technology},\ \bibinfo {address}
  {Gaithersburg} (\bibinfo {year} {2010})\BibitemShut {NoStop}%
\end{thebibliography}%




\appendix

\section{Modelling the violation of CHSH by a Poissonian source of qubit pairs}
\label{appmodel}

The output of a CW-pumped SPDC process can be accurately described as the emission of independent pairs distributed according to Poissonian statistics of average $\mu$, if the time under consideration (in our case, the length of a round) is much longer than the single-photon coherence time. The goal of this appendix is to provide an estimate of the observed CHSH parameter $S$ for such a source.

The pairs being independent, it helps to think in two steps. First, each pair is converted into classical information $(\alpha,\beta)\in\{+,-\}$ with probability
\begin{align}
    P_Q(\alpha,\beta|x,y)=\textrm{Tr}(\rho \Pi_\alpha^x\otimes \Pi_\beta^y)\,,
\end{align}
where the $\Pi$'s are measurement operators. If some of the events have $\alpha=-$ ($\beta=-$), Alice's (Bob's) detector may be triggered, leading to the observed outcome $a=-1$ ($b=-1$).

For the purpose of studying CHSH, it is sufficient to consider $P(-1,+1|x,y)$ and $P(+1,-1|x,y)$, since
\begin{align}
    E_{xy}=1-P(-1,+1|x,y)-P(+1,-1|x,y)\,.
\end{align}
With our convention of outcomes, $P(-1,+1|x,y)$ is the
probability associated with the
case when Alice's
detector clicks and Bob's does not.
Thus, Bob's detector should not be triggered by any pair: each pair will contribute to $P(-1,+1|x,y)$ with
\begin{align}
    D(\alpha)\equiv P_Q(\alpha,+|x,y)+(1-\eta_B)P_Q(\alpha,-|x,y)\,.
\end{align}
Now, let us look at the contribution by $v$ pairs to $P(-1,+1|x,y)$. At least one of the $\alpha$'s must be $-$ for the detector to be triggered; and multiple detections will also be treated as $a=-1$. Thus, a configuration in which exactly $k$ $\alpha$'s are $-$ leads to $a=-1$ with probability $1-(1-\eta_A)^k$ (i.e. at least one $\alpha=-$ must trigger a detection). Obviously there can be $\binom{v}{k}$ such configurations, so the contribution of the $v$ pair events to $P(-1,+1|x,y)$ is
\begin{equation}\label{eq:Dn}
    D_v=\sum_{k=1}^v \binom{v}{k} [1-(1-\eta_A)^k] D(-)^kD(+)^{v-k}\,.
\end{equation}
Finally,
\begin{equation}
    P(-1,+1|x,y)=\sum_{v=0}^{\infty} P_{\mu}(v)D_v\,.
\end{equation} The calculation of $P(+1,-1|x,y)$ is identical, with $D(\beta)\equiv P_Q(+,\beta|x,y)+(1-\eta_A)P_Q(-,\beta|x,y)$ and $\eta_B$ instead of $\eta_A$ in \eqref{eq:Dn}.

Because the quantum probabilities appear in such a convoluted way, the optimal parameters for both the state and the measurements are not the same as for the single-pair case. Upon inspection, however, the values are close, as expected from the fact that the violation is mostly contributed by the single-pair events.

The curves presented in Fig.~\ref{fig:vio_bin} have been obtained with a slightly modified model that
includes the effect of the background events. The quantum probabilities $P_Q(\alpha,\beta|x,y)$ have been computed with $\rho=\ket{\psi}\bra{\psi}$ given in \eqref{eq:eb_state} and with projective measurements, with the values of the parameters given in the main text.


\section{\label{sec:proofs}Protocol and security proof}

For completeness, we will present the protocol studied in~\cite{Rotem:diproofs} and give explicit constants in its security proof. We also refer to this paper for basic definitions of (smooth) min-entropy and related quantities. It will be more convenient for us to switch to to the notation $a,b\in\{0,1\}$ for the outcome labels (instead of $a,b\in\{+1,-1\}$ of the main text) and use the language of nonlocal games with winning condition
\begin{align}
     w_\textrm{CHSH}(a,b,x,y) = \begin{cases} 1 &\textrm{if } a\oplus b=x\cdot y\,,\\
     0 &\textrm{otherwise}\,.
     \end{cases}
\end{align}
The game winning probability is then $w=1/2+S/8$ in terms of the CHSH value. The optimal classical winning strategy achieve a winning probability of 0.75, while the optimal quantum strategy achieves a winning probability of $(2+\sqrt{2})/4\approx0.85$.

A randomness expansion protocol is a procedure that consumes $r$-bits of randomness and generates $m$-bits of almost uniform randomness. Formally, a $(\epsc,\epss)$-secure $r\to m$ randomness expansion protocol if given $r$ uniformly random bits,
\begin{itemize}
    \item (Soundness) For any implementation of the device it either aborts or returns an $m$-bit string $Z\in\{0,1\}^m$ with
    \begin{align*}
        (1-\Pr[\abort])\norm{\rho_{ZRE}-\rho_{U_m}\otimes\rho_{U_r}\otimes\rho_E}_1  \leq \epss\,,
    \end{align*}
    where $R$ is the input randomness register, $E$ is the adversary system, and $\rho_{U_m}, \rho_{U_r}$ are the completely mixed states on appropriate registers.
    \item (Completeness) There exists an honest implementation with $\Pr[\abort]\leq\epsc$.
\end{itemize}
We remark that this security definition is a composable definition assuming quantum adversary, but not composable assuming a no-signalling adversary~\cite{Rotem:diproofs}. Composability allows the randomness generated to be safely used inside a larger protocol, such as quantum key distribution, without compromising the latter's security.

For a concrete randomness expansion protocol, we present the protocol studied in~\cite{Rotem:diproofs}. The protocol takes parameters $\gamma$ expected fraction (marginal probability) of test rounds, $\omegaexp$ expected winning probability for an honest (perhaps noisy) implementation, and $\deltaest$ width of the statistical confidence interval for the estimation test. In an execution, for every round $i\in\{1,\dots,n\}$:
\begin{itemize}
    \item Bob chooses a random bit $T_i\in\{0,1\}$ such that $\Pr(T_i=1)=\gamma$ using the interval algorithm~\cite{interval_algorithm}.
    \item If $T_i=0$ (randomness generation), Alice and Bob choose deterministically $(X_i,Y_i)=(0,0)$, otherwise $T_i=1$ (test round) they choose uniformly random inputs $(X_i,Y_i)$.
    \item Alice and Bob use the physical devices with the said inputs $(X_i,Y_i)$ and record their outputs $(A_i,B_i)$.
    \item If $T_i=1$, they compute 
    \begin{align}
        C_i=w_\textrm{CHSH}(A_i,B_i,X_i,Y_i)\,.
    \end{align}
\end{itemize}
They abort the protocol if $\sum_jC_j<(\omegaexp\gamma-\deltaest)n$ where $j$ is the index of test rounds, otherwise they return $\Ext({\bf AB},{\bf Z})$ where $\textrm{Ext}$ is a randomness extractor, ${\bf AB}=A_1B_1...A_nB_n$ and  ${\bf Z}$ is a uniformly random seed.

More precisely, we use a Trevisan extractor in~\cite{Mauerer:extractors} based on polynomial hashing with block weak design, because of its efficiency in terms of seed length. This is a function $\Ext:\{0,1\}^{2n}\times\{0,1\}^{d}\to\{0,1\}^{m}$ such that if $\Hmin({\bf AB}|E)\geq 4\log\frac{1}{\epsilon_1}+6+m$ then
\begin{align}
    \frac{1}{2}\norm{\rho_{\Ext({\bf AB},{\bf Z}){\bf Z}E}-\rho_{U_m}\otimes\rho_{U_d}\otimes\rho_E}_1 \leq m\epsilon_1
\end{align}
The seed length of this extractor is $d = a(2\ell)^2$ where
\begin{align}
    a &= \ceil*{\frac{\log(m-2e)-\log(2\ell-2e)}{\log(2e)-\log(2e-1)}}\\
    \ell &= \ceil*{\log 2n+2\log\frac{2}{\epsilon_1}}
\end{align}

Now it can be shown that the entropy accumulation protocol gives the completeness and soundness of our randomness expansion protocol. However, let us mention how the input randomness affects the soundness and completeness of the final protocol.

In the protocol we assume access to a certain uniform randomness source, from which the random bits required in the protocol are generated: the $T_i$, $X_i$ and $Y_i$. In certain rounds, $X_i$ and $Y_i$ are either deterministic or fully random bits and can be directly obtained from the source. On the other hand, $T_i$ must be simulated from the uniform source (except when $\gamma=1/2$ which is not usually the case in practice). This can be done efficiently by the interval algorithm~\cite{interval_algorithm}: the expected number of random bits needed to generate one Bernoulli$(\gamma)$ is at most $h(\gamma)+2$ and the maximum number of random bits needed is at most $L_{\max}:=\max\{\log\gamma^{-1},\log(1-\gamma)^{-1}\}$. Then Lemma 16 of~\cite{Rotem:diproofs} gives us: let $\gamma>0$, for any $n$ there is an efficient procedure that given (at most) $6h(\gamma)n$ uniformly random bits either it aborts with probability at most $\epsSA = \exp(-18h(\gamma)^3n/L_{\max})$ or outputs $n$ bits $T_1,\dots,T_n$ whose distribution is within statistical distance at most $\epsSA$ of $n$ i.i.d. Bernoulli$(\gamma)$ random variables. This raises both the completeness and soundness parameter of the final protocol by $\epsSA$.

In an honest implementation of the protocol, Alice and Bob execute the protocol with a device that performs i.i.d. measurements on a tensor product state resulting in an expected winning probability $\omegaexp$. Here Lemma 8 of~\cite{Rotem:diproofs} bounds the probability of aborting using Hoeffding's inequality. That is, the probability that our randomness expansion protocol aborts for an honest implementation is
\begin{align}
    \Pr[\abort] \leq \exp(-2n\delta_{\textrm{est}}^2)=:\epsest\,.
\end{align}
Therefore, the total completeness is bounded by $\epsSA+\epsest$. (Note that $\epsest$ is actually the completeness parameter of the entropy accumulation protocol in~\cite{Rotem:diproofs}.)

For the soundness, Corollary 11 of~\cite{Rotem:diproofs} ensures that for any $\epsEA,\epsilon'\in(0,1)$ either the protocol aborts with probability greater than $1-\epsEA$ or
\begin{align}
    \Hmin^{\epsilon'}({\bf AB}|{\bf XYT}E)_{\rho_{|\pass}} > n\cdot\eta_\textrm{opt}(\epsilon',\epsEA)\,.
\end{align}
Together with our extractor, for all $\epsilon_1\in(0,1)$, if the length $m$ of the final string satisfies
\begin{align}
    n\cdot\eta_\textrm{opt}(\epsilon',\epsEA) = 4\log\frac{1}{\epsilon_1}+6+m
    \label{eq:rand_length_relation}
\end{align}
then we are guaranteed that
\begin{align}
    \frac{1}{2}\norm{\rho_{SRE}-\rho_{U_m}\otimes\rho_{U_R}\otimes\rho_E}_1 \leq \epsilon'/2 + m\epsilon_1\,.
\end{align}
Here $\eta_\textrm{opt}(\epsilon',\epsEA)$ is given by the following equations: for $h$ the binary entropy and $\gamma,p(1)\in(0,1]$
\begin{widetext}
\begin{align}
    \eta_\textrm{opt}(\epsilon',\epsEA) &= \max_{\frac{3}{4}<\frac{p_t(1)}{\gamma}<\frac{2+\sqrt{2}}{4}} \eta(\omega_{\textrm{exp}}\gamma-\delta_{\textrm{est}},p_t,\epsilon',\epsEA)\,,\\
    \eta(p,p_t,\epsilon',\epsEA) &= f_{\min}(p,p_t)-\frac{1}{\sqrt{n}}2\left(\log13+\frac{\diff}{\diff p(1)}g(p)|_{p_t}\right)\sqrt{1-2\log(\epsilon'\epsEA)}\,,\\
    f_{\min}(p,p_t) &= \begin{cases}
    g(p) &\textrm{ if } p(1)\leq p_t(1)\,,\\
    \frac{\diff}{\diff p(1)}g(p)|_{p_t}\cdot p(1) + \left(g(p_t)-\frac{\diff}{\diff p(1)}g(p)|_{p_t}\cdot p_t(1)\right) &\textrm{ if } p(1)>p_t(1)
    \end{cases}\\
    g(p) &= \begin{cases}
    1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{16\frac{p(1)}{\gamma}\left(\frac{p(1)}{\gamma}-1\right)+3}\right) &\textrm{ if } \frac{p(1)}{\gamma} \in \left[0,\frac{2+\sqrt{2}}{4}\right] \\
    1  &\textrm{ if } \frac{p(1)}{\gamma} \in \left[\frac{2+\sqrt{2}}{4},1\right]
    \end{cases}
\end{align}
\end{widetext}
Combined with the input sampling soundness, the total soundness is bounded by $\epsSA+\epsEA+\epsilon'/2 + m\epsilon_1$.

\begin{table}[h]
    \centering
    \begin{tabular}{|c|l|}
        \hline
        Parameter & \multicolumn{1}{c|}{Definition}\\
        \hline
        $\epsc$ & completeness, bounding honest abort probability\\
        $\epss$ & soundness, bounding randomness security\\
        $\epsSA$ & input sampling error tolerance\\
        $\epsilon'$ & smoothing parameter\\
        $\epsilon_1$ & 1-bit extractor error tolerance\\
        $\epsEX$ & randomness extractor error tolerance\\
        $\epsest$ & Bell estimation error tolerance\\
        $\epsEA$ & soundness of entropy accumulation protocol\\ 
        \hline
    \end{tabular}
    \caption{Definition of security parameters.}
    \label{tab:security_params}
\end{table}

Finally, let us count the number of random bits consumed in the protocol. It consists of the randomness used to decide if a round is a test or generation round, the randomness used to pick the inputs in a test round, and the randomness used for the Trevisan extractor. Taking into account the finite statistical fluctuations, we need at most $6h(\gamma)n$ bits to choose between test and generation except with probability $\epsSA$. This results in at most $2\gamma n$ testing rounds except with probability $\epsSA$, which equates to $2\times 2\gamma n$ random bits being consumed for generating the inputs for test rounds. The randomness for Trevisan extractor is $d$ bits. (Practically, after the first run of the protocol, we can omit this amount because the extractor is a strong extractor: we can reuse the seed for next run of the protocol). Summing these up, we have consumed at most $6h(\gamma)n+4\gamma n+d$ uniformly random bits with probability at least $1-2\epsSA$.

In summary, for a device with $\omegaexp$, any choice of $\gamma,\epsilon_1,\epsilon',\epsEA\in(0,1)$, and $n$ large enough, our protocol is an $(\epsSA+\epsest,\epsSA+\epsEA+\epsilon'/2 + m\epsilon_1)$-secure $[6h(\gamma)n+4\gamma n+d]\to m$ randomness expansion protocol. That is either our protocol abort with probability greater than $1-\epsEA$, or it produces a string of length $m$ such that $\frac{1}{2}\norm{\rho_{SRE}-\rho_{U_m}\otimes\rho_{U_R}\otimes\rho_E}\leq\epsSA+\epsilon'/2 + m\epsilon_1$\,. The protocol consume at most $6h(\gamma)n+4\gamma n+d$ uniformly random bits with probability at least $1-2\epsSA$.\\

\section{\label{sec:randomness_formula}Input/Output randomness analysis}
The previous Appendix gives a complete picture of the (one-shot) behavior of
our randomness expansion protocol. For the purpose of this paper, it suffices
to obtain rough estimates on the randomness output, but further optimization
can be done.

For simplicity, we introduce some bounds on the resources. Since $m\leq2n$ we can let $m\epsilon_1\leq2n\epsilon_1=:\epsEX$ which gives $\epsilon_1=\epsEX/(2n)$. Plugging this back in~\eqref{eq:rand_length_relation} gives us the number of random bits one can extract,
\begin{align}
    m = n\cdot\eta_\textrm{opt}(\epsilon',\epsEA) -4\log n + 4\log\epsEX -10\,,
    \label{eq:rand_length}
\end{align}
for a given level of soundness $\epsSA+\epsEA+\epsilon'/2+\epsEX$. Moreover, the protocol consumes $6h(\gamma)n+4\gamma n + d$  bits of randomness with probability at least $1-\epsSA$, where
\begin{align}
    d = a(2\ell)^2 &\textrm{ with } a \leq \frac{\log(2n-2e)-\log(2\ell-2e)}{\log(2e)-\log(2e-1)} + 1 \nonumber \\
    &\textrm{ and } \, \, \, \ell \leq 3\log n +6 - 2\log\epsEX\,.
    \label{eq:rand_usage}
\end{align}
This leads to an expansion of $m-6h(\gamma)n-4\gamma n - d$. Hence, the output randomness rate per unit time is
\begin{align}
    r_n = \frac{1}{\binwidth}\left(\eta_\textrm{opt}(\epsilon',\epsEA) -4\frac{\log n}{n} + 4\frac{\log\epsEX}{n} -\frac{10}{n}\right)\,,
\end{align}
and the net randomness rate per unit time is
\begin{widetext}
\begin{align}
    r^\textrm{net}_n = \frac{1}{\binwidth}\left(\eta_\textrm{opt}(\epsilon',\epsEA) -4\frac{\log n}{n} + 4\frac{\log\epsEX}{n} -\frac{10}{n} - 6h(\gamma) - 4\gamma - \frac{d}{n}\right)  \,.
\end{align}
\end{widetext}
These formulas are of course given for a protocol with completeness $\epsSA+\epsest$ and soundness $\epsSA+\epsEA+\epsilon'/2+\epsEX$, where
\begin{align}
    \epsSA &= \exp(-18h(\gamma)^3n/L_{\max})\label{eq:epsSA}\\
    L_{\max}&=\max\{\log\gamma^{-1},\log(1-\gamma)^{-1}\}\\
    \epsest &= \exp(-2n\delta_{\textrm{est}}^2)\label{eq:deltaest}\,.
\end{align}

The asymptotic rate for the block size $n\to\infty$ is given by taking the limit of block size $n$
\begin{equation}
    r_\infty = \frac{1}{\binwidth} \;\left[1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{\frac{S^2}{4}-1}\right)\right]\,.
\end{equation}
For the net asymptotic rate we could also take the same limit, however we could obtain a better bound by the expected behavior of the interval algorithm. Since the expected number of random bits needed to generate $T_1,...,T_n$ is $nh(\gamma)+2$ by~\cite{interval_algorithm}, and $\gamma n$ of which is expected to be test rounds each consuming 2 random bits, we have the asymptotic net rate
\begin{equation}
    r_\infty^\textrm{net} = \frac{1}{\binwidth} \;\left[1-h\left(\frac{1}{2}+\frac{1}{2}\sqrt{\frac{S^2}{4}-1}\right)-h(\gamma) - 2\gamma\right]\,.
\end{equation}


From an end-user perspective, one may argue that the only parameters of
interest are the completeness and soundness security parameters which will
constrain the rest of protocol parameters---$\gamma,\deltaest,n,\epsilon$'s---for a given objective such as maximizing randomness rate or net randomness rate. For the illustrative plots we set the
constraints 
\begin{align}\label{eq:epsilons}
    \epsSA+\epsEA+\epsilon'/2+\epsEX &= \epss\,,\\
    \epsSA+\epsest &= \epsc\,,
\end{align}
and fix $\epsc=10^{-10},\epss=10^{-10}$.
One then maximizes randomness output or net randomness output given these constraints. This gives us the best (as measured by our objective function) protocol parameters within the relaxations made to obtain~\eqref{eq:rand_length} and~\eqref{eq:rand_usage}.

However, in the main text we take a simpler approach without optimizing over the variables $\gamma,\deltaest,\epsilon$'s. For each block size $n$, we compute $\epsSA$ as given by~\eqref{eq:epsSA} which then fixes $\deltaest$ via $\epsest=10^{-10}-\epsSA$ and~\eqref{eq:deltaest}. The remaining $\epsilon$'s which have weight $10^{-10}-\epsSA$ are chosen in a $1:2:1$ ratio of $\epsEA:\epsilon':\epsEX$, which is guaranteed to add up to the specified level of completeness and soundness. This approach is not far from optimal in the regime of large block size $n$. This results in the
experimental points reported in Figure~\ref{fig:rnd_bin}.

\section{Random bits extraction procedure}
\label{appextraction}

As mentioned in the main text, the data observed during the experiment contains certified randomness. Here we describe the procedure we use to extract this randomness in a finite run of the experiment. We consider two blocks of data, corresponding to an acquisition time of $\approx42.8$ min (\texttt{dataset1}) and $\approx17.33$ hours (\texttt{dataset2}).

The randomness protocol we use (described in Appendix B) relies on two elements:
\begin{itemize}
\item an honest implementation, and
\item security parameters.
\end{itemize}
These elements must be chosen adequately before proceeding to the extraction. Indeed, if a too optimistic honest implementation is chosen, for instance, the data observed will fail to pass the test, and the whole protocol will abort: no randomness can then be extracted.

Moreover, our setup allows us to choose freely the
\begin{itemize}
\item bin width
\end{itemize}
which can significantly affect the amount of certified randomness.

We dedicate a fraction $\gamma_\text{calib}$ of our data to the estimation of these parameters
so as to maximize the amount of randomness certified.
The randomness protocol is then run with these parameters on the remaining fraction $(1-\gamma_\text{calib})$ of the data only.
We determine
the fraction of data~$\gamma_\text{calib}$ to use for the calibration of the randomness extraction procedure
from a simulation of the experiment.
We estimate the number of random bits that can be certified from an experiment of the envisioned length if a fraction $\gamma_\text{calib}$ of the data is dedicated to calibration purpose (all other parameters being set as expected). We choose the value of $\gamma_\text{calib}$ that maximizes this quantity. We find that $\gamma_\text{calib}=22\%$ is adequate for
\texttt{dataset1}, and $\gamma_\text{calib}=8\%$ for \texttt{dataset2}.

We then proceed to define the parameters of the randomness protocol.
The security parameters $\epss, \epsc$ are set a priori, with all the other parameters derived as described in Appendices~\ref{sec:proofs} and~\ref{sec:randomness_formula}, with~$\gamma=1$.
We define \textit{honest implementation}
an implementation which reproduces the CHSH violation observed during the calibration stage with probability
\begin{equation}
P(S_\text{exp}\geq S_\text{calib})\geq \epsilon_\text{calib}\,.
\end{equation}
For concreteness, we set $\epsilon_\text{calib}=10^{-10}$. This step guarantees that we will not overestimate the amount of Bell violation which we can expect from a honest experiment. This is crucial for the whole certification procedure to succeed with a large probability. We then have
\begin{equation}
w_\text{exp} = w_\text{calib} - \delta_\text{calib}\,,
\end{equation}
with $\delta_\text{calib} = B(\omega_\text{exp},(1-\gamma_\text{calib})n,\omega_\text{calib})$, where
\begin{equation}
B(p,n,q) = \sum_{i=0}^{nq}\binom{n}{i}p^i(1-p)^{n-i}
\end{equation}
is the cumulative distribution of $n$ Bernoulli variable with parameter $p$. For simplicity, we use the upper bound
\begin{equation}
\delta_\text{calib}\leq \sqrt{\frac{\log(1/\epsilon_\text{calib})}{2n}}
\end{equation}
valid for all winning probability~$\omega_\text{calib}$, which leads to a conservative estimate of the honest implementation Bell violation~$S_\text{est}$.



Having fixed all security parameters and defined our honest implementation, we are now left with the choice of the bin width. For this, following the procedure discussed in the main text, we compute the number of certified random bits that we can hope to certify in the remaining $(1-\gamma_\text{calib})$ fraction of the data as a function of the bin width. We then choose the bin width which yields the maximum rate of random bits.
We find that optimal bin widths 8.9~$\mu$s for \texttt{dataset1} and 5.35~$\mu$s for \texttt{dataset2}.
This allows us to define how the remaining data is to be treated: first, we extract the outcomes corresponding to the chosen bin width, then we use the exact number of bins so extracted to compute precisely the threshold Bell violation $w_\text{exp}-\delta_\text{est}$ and the number of certified bits $m$ corresponding to this dataset, finally we check whether the data indeed yields a Bell violation larger than $w_\text{exp}-\delta_\text{est}$.
If this is not the case, we abort. Otherwise, we apply a randomness extractor on the string of outcomes.
Both datasets pass this test.

Finally, we use the Trevisan extractor implemented by Mauerer et al.~\cite{Mauerer:extractors}, and further improved by Bierhorst et al.~\cite{Bierhorst:2018uk} to extract the certified bits.
The advantage of Trevisan extractors over other kinds of randomness extractors is that they require little initial seeds, and that they are composable, strong extractors, and secure against quantum side information. Following the suggestion of~\cite{Mauerer:extractors}, we use the block weak design construction with a RSH extractor to maximize the number of extracted bits. The extractor also require a supply of seed randomness. For this, we use the bits generated with the random number generator described in~\cite{Shi:2016kw}.

In the end, we extract 617\,920 and 35\,799\,872 uniformly random bits from \texttt{dataset1} and \texttt{dataset2} respectively, using seeds of length 1\,808\,802 and 2\,923\,224.
The corresponding rates,
calculated including the acquisition time of the calibration data, source phase lock and basis switching, are~$\approx240$~bits/s and~$\approx~573$~bits/s.
If we consider only the time necessary for the data acquisition, we obtain net randomness rates of~$\approx 396$~bit/s and~$\approx 943$~bit/s.

These rates do not include the processing time of the Trevisan extractor.
This classical computation took 9 hours for \texttt{dataset1} on a machine processing 24 threads in parallel. The bits extracted can be found in the ancillary files~\cite{ancillary}.
For \texttt{dataset2} we estimated an unreasonable extraction time of $\approx18$\,years if run on the same hardware.
In order to reduced this time to few days it would be necessary to employ thousands of cores. We decided not to pursue this effort as we do not think this would add any more interest to the presented results.
% and 22
% days for \texttt{dataset2} on a machine processing 24 threads in parallel.
% This task could be heavily parallelized. The bits extracted can be found in the ancillary files.

We used the NIST Statistical Test Suite~\cite{Rukhin:2010dn} to ensure the quality of generated strings is at least on par with acceptable pseudo-randomness. This suit of test can only verify the uniformity of the generated random string, it does not certify its privacy.
The string generated from \texttt{dataset1} passed all
the tests that are meaningful for this relatively short data sample, assuming an acceptable significance level~$\alpha=0.01$. The result of the individual tests are summarized in table~\ref{tab:NISTtest}.
\begin{table}[h]
    \centering
    \begin{tabular}{|l|c|c| }
        \hline
        \multicolumn{1}{|c|}{Test} & $P$--value & Proportion\\
        \hline
        Frequency & 0.590949 & 96/97\\
        Block Frequency & 0.275709 & 95/97\\
        Cumulative Sums Forward & 0.964295 & 96/97\\
        Cumulative Sums Backward & 0.637119 & 96/97\\
        Runs & 0.162606 & 97/97\\
        Longest Run of Ones & 0.590949 & 96/97\\
        Discrete Fourier Transform & 0.183769 & 96/97\\
        \hline
    \end{tabular}
    \caption{Result of the NIST Statistical Test Suite for the bits extracted from \texttt{dataset1}. We split the random bits into 97 sequences of 6300 bits each.}
    \label{tab:NISTtest}
\end{table}

% \pagebreak

% \onecolumngrid
% \pagebreak

% \section{One page with the first 5712 generated random bits}

% \noindent\seqsplit{0100001111111001101000111001111110011010110011001110111100000010
% 1010111001011111111101010011100010011000100011011100001000110000
% 0001110001101101010111100000111011100111110000001110111000000000
% 0111111111001001011001101010001011101100001001111100010011010100
% 0000111000011111101011010000010110010110111010100010001000111000
% 1100001001010010101001001010100110001111001101001111100100011100
% 1111000010000010111011001000000010011100000000000111000111100011
% 0110111010110001001000001000000001010110001001011110110100000110
% 0011000010011010110111001001010101100000100000110101100001000001
% 1100111100110010000110000110110101011100110100101111111011000100
% 0010101011101100110011001100001000010101011100010001100010110100
% 1010010011110100101000110111000011010000101011010010110100011001
% 1000100001101000001001110100001010110010110110110011001010010011
% 0001101111001101100010000100010000100111101000101000001010111010
% 1101011001000010111101010001101110000100011010001011110000100111
% 0101110100001011110111110101001100010000110111011011010001010111
% 1000011100110000001011100111101101010101110001100001111011010001
% 0010010000110011110010010100000100001110111000100000110011101011
% 0110011101111110001010101110010010110101011011101100100100011000
% 1010011001001101100000010100111001100010110011110110101001001000
% 1100011000001111010000000010111101101000101101011101111001111101
% 0110010011111001110000101000010101100100100000111001000010101010
% 1100011000111001101101010110110101111101110011010100101111000100
% 0010110001101001100110011100111111000000010110110100011010001100
% 1110101011011001110011010101100101001111111001110011101001000100
% 0001000101100110011111001110110100001010010110001011110100010101
% 0011000010000110110000001011111011101111111101000110110001001100
% 1100101101101000010010100001000011010100101111100101101011110011
% 0111001001001111100011000000000100110101111010010011110010110100
% 1101111001000111000010111101101001010100110001101000011100010100
% 1111001100110001100100000100011100110000111011000010100011000010
% 0010100010111001010101100110011011100111000111011000000000100110
% 1100001100110011001011001011110110101010110110011000010111101100
% 1001001100101000110010110111101010101111011011011000011110011011
% 0010111110011110110001011101000100100010010101001110101011010000
% 1100101110111111111011010011100101110010001111011011101100100111
% 1100101110101111101111111100110100001010111010110110001101011010
% 1110000000111101100010100000010010011100101101000000101010100110
% 1001111010101001101010110011111110101010101110010111110010010101
% 1010101101000110101100101100110101100101011101011101011111011001
% 0000111111010011110110011010111011011011010111010010101111001011
% 1101010110100100110101000111001010001010111111100010110001000000
% 1100101111001000001101110010000110011000010111000000101011001100
% 0000010011000001110010101110010101001111100011010111011100010101
% 0100101010010101100010000010000100111000111101110100011001101010
% 1010111001011011001011011101001010101100111011011011001100011011
% 0100011000001111111101000101111100001001000110001010000110010010
% 0111100100010100010101010110011010010011111101010101101011011100
% 1101000000100001011010000010101100110010111001001011101101111010
% 0100101010000111110110010000110011001001100000111011101101110100
% 1010100011001011100111110001101101111111101101000101110100101110
% 0100100000001010001010000001001111001100100010001110000001000010
% 1010011001011110100011100011011100001011001000101111011111010101
% 1011001011111110000100101001101011000011010111110110000100111011
% 0111000011001010110001101001011100110110110001100110100100101000
% 1111111111111110110010101100110100010001110111110100001010101110
% 0011011000101001000001001001001100110001001110101000110001111011
% 1100110001000110101010000000110110000110000010110000101101101010
% 0001111111101001101110001111111011101001011010001110110101100001
% 1000011100001001101010001001111101101000100011001110100101000101
% 0110000000000111001111011001001001110010110001000010111101011010
% 0110101010000110010110111010111000011111001000000011000010100111
% 1011000011101100010111111010101110101000011101110001111011010011
% 0010100010011010001001000011111001001101111101110010000001000000
% 1011110011001111011101001110001110110111001111111111100110000111
% 1000001000001100000011010101110101111001110001101101100000010011
% 0110000111011000100100100101000010101111101111010011010010010000
% 1001000111100100110100011010101001000110010110111011001111011001
% 1111000110100001100111110010111010001010011000101000101100000101
% 0111010101000010001111010000100001010010111111000001011011010011
% 0100011000011101110111100000011100011101001100101010010110100011
% 1000101000010010001000010110111111001101101110000010100011011100
% 0100000100111101001100001100011100010110001111101011100010111011
% 0111001100000010101011110101101101100101010111011001110011100111
% 1110010110011101100110001000111001100101000000001010000101100000
% 1110000011100000001100000000010010000111100010100101010000000001
% 0000000100110000100111100101111000110101110000010000011100110001
% 0010110010111000011000100111100011110100001111111000100010000000
% 1100111100111110101101000101011101001111100011101001010101000100
% 1101000101000001110011101111110000101010011111111111101100011010
% 0000100010110011011111011001010000010111101010101011010111110011
% 1110100000010111100011011110000011100110111100001110101100001000
% 0001001110001010010111100100111100101001110100110010011000011001
% 0001011011100100101111011011010001110000010100110110100010000001
% 0000111000110110101100101111101000010110000100011110000101011110
% 0000000010001001001110101101011010010011011111010000000000100010
% 1111100111000001010010100001000000001000001011100101110100000000
% 0011011100110011010110111001111010110111000110001101111011111001
% 0001011001010011010111010001110100110111111000001011101111010110
% 0010010100100000}


\end{document}
