1. Introduction

Information security technologies are becoming increasingly important in communication and computer systems. In secret-key communication systems, secure communication between two legitimate users is based on a secret key which is known only to them. Secure key distribution is necessary for the two users to share this secret key. The ultimate security of quantum key distribution (QKD) [1,2] is based on properties of quantum mechanics. However, it is difficult to realize these effects over large distances. Other approaches using classical optical devices have been proposed [3–9]. One of the examples is ultra-long fiber laser systems with optical noise [4–6]. Other examples use characteristics of synchronization between two lasers with mutual optical couplings [7–9].

Classical schemes for secure key distribution rely on one of two main security paradigms, namely computational security [10] and information-theoretic security [11]. Computational security is based on the hypothetical hardness of computational problems such as the integer-factoring or discrete logarithm problems. Information-theoretic security is based on probability theory, where it is secure against adversary’s unlimited computational power.

One approach to information theoretic security assumes that legitimate users and an adversary are able to obtain correlated random sequences. It is known that it is possible for the legitimate users to create a shared secret key from correlated random sequences by exchanging messages over a public channel [12]. Recently, it has been shown that this approach can be implemented based on a property called bounded observability [13]. In the context of physical systems, bounded observability can occur due to the practical difficulty of completely observing physical phenomena. An implementation based on this concept has been proposed using the synchronized responses of laser systems injected with common random light signal with broad bandwidth [14]. The response laser system consists of unidirectionally-coupled laser units, and requires a large number of cascaded units to resist attack from a powerful eavesdropper. The common random-signal induced synchronization and generation of correlated random bit sequences suitable for secure key distribution has been experimentally achieved for single-unit semiconductor lasers [14–17]. However, there is no experimental result for the case of cascaded laser systems.

In this paper, we experimentally study the common random-signal induced synchronization of cascaded semiconductor lasers and its application to the generation of correlated random bit sequences. We show that realizing the required synchronization properties and the generation of correlated random bit sequences suitable for secure key distribution are possible in cascaded laser systems. We measure some statistical quantities relevant to the secure key distribution, and estimate the final key generation rate, assuming a passive eavesdropper. The number of laser units in the cascaded laser systems is two in our experiments, which is the minimum number required to demonstrate the main effects of a cascade configuration. However, the present experimental results combined with numerical modeling for larger number of cascades strongly suggests that the secure key distribution is feasible for a larger number of laser units.

The present paper is organized as follows. In Sec. 2, we describe the configuration of the cascaded laser system and its required synchronization properties. Then we explain the procedure for sharing a secret key and the method for evaluating the key generation rate. In Sec. 3, we describe our experimental setup, which consists of two cascaded laser systems injected with common random light. In Sec. 4, experimental results for tests of synchronization properties are shown. In Sec. 5, we describe a sampling method to efficiently obtain bit sequences from analog outputs of the cascaded laser systems. Then we estimate the key generation rate of the present experimental system. In Sec. 6, we show an evaluation of information leakage in a passive attack by an eavesdropper. In Sec. 7, an extrapolation of the key generation rate is made for the case of a larger number of units in the cascaded laser system. Conclusions are drawn in Sec. 8.

2. Cascaded laser system and secure key distribution

2.1 Configuration of cascaded laser system

Figure 1 shows the configuration of a cascaded laser system with injection. The cascaded laser system is indicated by dashed line in Fig. 1. The cascaded laser system consists of N laser units (N stages). Each unit consists of a semiconductor laser, which is labeled Response A-j, j = 1, ..., N, in Fig. 1, and an optical self-feedback (i.e., closed-loop configuration [18]). The phase of feedback light is changed by a phase modulator. The amount of phase change is 0 or π. The external driving light signal from Drive system, which has randomly fluctuating phase and/or amplitude, is injected into the first laser unit at the stage 1. In our experiment we used a constant-amplitude and random-phase (CARP) light as a drive signal [14,15] (see Sec. 3). All the laser units except the first one receive the output of their preceding laser unit as their input. The output of the cascaded laser system is given by that of the last stage unit. We will set the number of the laser units (stages) to N = 2 in our experiment, which will be described in Secs. 3 and 4.

 

Fig. 1 Configuration of cascaded laser system.

Download Full Size | PDF

2.2 Cascaded laser systems with common injection

Figure 2 shows the configuration of two cascaded laser systems driven by a common random light from Drive system. Assume that the two systems are possessed by users, Alice and Bob. Let θ_A,j and θ_B,j be the parameters which represent the amounts of feedback light phase shifts in Alice and Bob’s units at j-th stage, respectively. We assume that θ_A,j and θ_B,j take one of the two values 0 and π. Let v_A and v_B denote the parameter sets as v_A = (θ_A,1, ..., θ_A,N) and v_B = (θ_B,1, ..., θ_B,N). Each of the cascaded laser systems generates optical output, which depends on both the common random light and the parameter set v_A or v_B.

 

Fig. 2 Configuration of the cascaded laser system driven by a common random light.

Download Full Size | PDF

2.3 Required synchronization property of the system

In order to realize secure key sharing between the two users Alice and Bob with cascaded laser systems, there are requirements on the properties of synchronization between the cascaded laser systems. To describe the requirement, we define the analog cross correlation coefficient C_A, which quantitatively evaluates the quality of synchronization. Let I_x and I_y be the output intensity waveforms of two lasers. The analog cross correlation for I_x and I_y is defined by

The required synchronization properties are described in terms of the cross correlation between outputs of the two systems. Let I_A(t) and I_B(t) be the output light intensity waveforms of Alice and Bob’s systems, respectively, and C_A(I_A,I_B) be their cross correlation given by Eq. (1) with I_x = I_A and I_y = I_B. The required properties are that the correlation is high (C_A ~1) if and only if the parameter values are identical with each other at every stage (v_A = v_B) while it is low (C_A ~0) if the parameter values are mismatched at any of the stages (v_A ≠ v_B), and that the correlation between the waveform of the injection signal and the output of each of the Response lasers is low for all parameter values.

2.4 Scheme of secure key distribution

Next, we explain the secure key distribution scheme proposed in [14], which uses the correlated random bit sequences generated by using the outputs from the cascaded laser systems. This scheme is illustrated in Fig. 3. We show the case of the cascaded laser systems with two laser units (two stages) in Fig. 3, corresponding to our experimental setup. We note that in principle the cascaded laser system is extensible by increasing the number N of stages. We will discuss this point in Sec. 7.

 

Fig. 3 Schematic diagram of the secure key distribution scheme based on correlated randomness phenomena. In the example, random switching of the binary (0 or π) phase shift parameter and one bit sampling of the corresponding waveform is repeated eight times. The parameter settings and sampled bits of Alice and Bob match in two of the eight instances.

Download Full Size | PDF

The procedure for generating a secret key, that is the “secure key generation procedure”, is as follows (see also Fig. 3):

The retained bits, which are obtained in step 6, are highly correlated between Alice and Bob, and the expected number of different bits (i.e., “error bits”) is small because of the correlation property required for the cascaded laser systems. Alice and Bob are able to generate a common secret key from their retained bits if an eavesdropper Eve does not have information about their retained bits more than a certain threshold amount. This point is explained in the next subsection in detail.

In step 7, the technique of privacy amplification [19] can be used to combine multiple bits to create a more secure key bit, so that the chances of Eve guessing a key bit can be made arbitrarily small by using a large enough number of bits to make each key bit. It is not necessary for Alice and Bob to know which bits Eve knows in order for them to implement privacy amplification. As a simple example, we can consider that Alice and Bob use the exclusive-OR operation to generate one key bit from two of their bits. Eve cannot know for certain the key bit unless she has both of these two bits. Methods of private amplification allow Alice and Bob to ensure that the chances of Eve obtaining a key bit become arbitrarily small by increasing the number of bits used to make each key bit.

2.5 Secure key generation rate

Since the design of cascaded laser system is disclosed, it should be assumed that the same systems are available to eavesdroppers as well as legitimate users. We assume a passive eavesdropper, Eve, that can use the common random light - for example, inject it into one or more cascaded laser systems - and also obtain any information exchanged through a public channel between Alice and Bob. The security of the present scheme depends on the amount of information which Eve can obtain about the retained bits of Alice and Bob.

A fundamental assumption of the present scheme is the following physical limitation: the common random light has a fluctuation bandwidth which is too broad to completely observe its fast temporal variation with current technology, i.e., no one, neither a legitimate user Alice or Bob nor an attacker Eve, can continuously measure and record the entire common light. This implies that Eve cannot reproduce the entire common light to repeat the observations of Alice or Bob and infer their retained bits after the parameter settings have been exchanged at an arbitrary later time. Therefore, Eve has to make her observations at the same time as Alice and Bob, while the common random light is being broadcast.

It is reasonable to suppose that Eve can simultaneously operate more than one, say M_E, cascaded laser systems, which have different parameter sets v_E,i, i = 1, 2, …, M_E, to increase her chances of making the same observations as Alice or Bob. In this situation, the final key generation rate R_final, which is the ratio of the number of secret key bits to the number m of samples in step 4, is given as follows [14]:

It is possible for Alice and Bob to generate secret keys up to rate R_final with security guaranteed when R_final is strictly positive. In an ideal system, I_E and R_fail are zero, so the only condition is M_E < M. The number M is given by M = 2^N, where N is the number of stages in the cascaded laser system, so this condition can be satisfied for any given M_E by making N large enough. In practice, it is necessary to ensure that I_E and R_fail are also sufficiently small so that R_final is strictly positive. The important feature of this secure key distribution scheme is the fact that Eve needs to increase exponentially the number of her systems as 2^N in order to be certain of making the same measurements as Alice and Bob and so obtain all the bits matching between Alice and Bob. For example, if the laser cascade has N = 20 stages, Eve would require over 1 million systems (2²⁰ ≈10⁶).

In this paper, we show that it is practically feasible to achieve a positive value of R_final by using the cascaded laser systems. Indeed, a small value of I_E << 1 can be achieved due to the correlation property of the cascaded laser systems: when Eve’s parameter sets v_E,i do not match that of Alice and Bob, the output intensities of Eve’s systems are uncorrelated with those of Alice and Bob, and they do not provide enough information for inferring the retained bits of Alice and Bob. As for R_fail, below we shall show that a small value of R_fail can also be achieved in practice.

3. Experimental setup

Figure 4 shows our experimental setup for secure key distribution. We used five semiconductor lasers. The lasers are single-mode distributed-feedback (DFB) lasers (NTT Electronics, NLK1C5GAAA, the optical wavelength of 1547 nm) with external optical injection and optical feedback, as used in previous experiments [15]. In order to achieve the required synchronization and correlation properties, the lasers should be as similar as possible, and the temperature, electrical injection current, optical injection strength, optical feedback length and optical feedback strength, need to be tuned so that (i) optical injection locking occurs for all response lasers with respect to injection signal, (ii) the optical and radio-frequency (RF) spectra are as similar as possible at each stage, (iii) correlation between drive and response lasers is low, and (iv) correlation between response lasers in each stage is high when the phase-shift parameter is the same, and low when the phase-shift parameter is different. Details of how to achieve these conditions are described in the following (also see [15] in the case of a single stage).

 

Fig. 4 Experimental setup for the synchronization of semiconductor lasers subject to a common constant-amplitude random-phase (CARP) light. Amp, electronic amplifier; ATT, optical attenuator; DSF, dispersion-shifted fiber; EDFA, erbium-doped fiber amplifier; FC, fiber coupler; ISO, optical isolator; M, mirror; PC, polarization controller; PD, photodetector; PM, phase modulator; SL, semiconductor laser; WL Filter, wavelength filter.

Download Full Size | PDF

One laser was used for a common drive signal (called Drive laser) and the other lasers were used for Response lasers for legitimate users. One legitimate user (Alice) had two Response lasers (called Response A-1 and A-2 lasers), and the other user (Bob) had two other lasers (called Response B-1 and B-2 lasers), as the cascaded laser system with two laser units (N = 2).

The Response A-1 and B-1 lasers were subject to a common random drive signal at the first stage. The output light from the Drive laser was injected to the Response A-1 and B-1 lasers, using an optical isolator (ISO) to achieve unidirectional injection. We used a phase modulator (PM) (Photline, MPX-LN-05-P-P-FA-FA, 5 GHz bandwidth), driven by an electronic noise generator (Noisecom, UFX7110, 1.5 GHz bandwidth) to generate constant-amplitude and random-phase (CARP) light for the Drive light with the bandwidth of 1.5 GHz [15]. The CARP light was divided into two beams at a fiber coupler (FC) and each of the CARP beams was transmitted through 60-km-long dispersion-shifted fibers (DSF). This corresponds to a practical scenario with a maximum distance of 120 km between the two legitimate users. After the transmission, each light power was amplified by an erbium-doped fiber-optical amplifier (EDFA). The center wavelength was extracted at around 1.5 μm by using a wavelength filter (WL Filter). The polarization direction of each beam was adjusted by a polarization controller (PC) to achieve coherent optical injection. Each beam was attenuated by an optical attenuator (ATT) to adjust the injection strength and then injected to Response A-1 (or B-1) laser. A tracking procedure is needed to adjust for the slow variation of the timing offset between the waveform and the sampling clock, and the slow variation of polarization direction.

The output of the Response A-1 (or B-1) laser was injected into the Response A-2 (or B-2) laser at the second stage for synchronization. The parameter values are set so that the dynamical behavior of the lasers is as similar as possible at each stage, i.e., between Response A-1 and B-1 lasers, and between Response A-2 and B-2 lasers. For example, the injection currents were set to 30.00 mA (2.84 I_th), 12.30 mA (1.31 I_th), 12.68 mA (1.34 I_th), 12.84 mA (1.30 I_th), and 11.99 mA (1.27 I_th) for the Drive, Response A-1, B-1, A-2, and B-2 lasers, respectively, where I_th is the injection current at the lasing threshold. The relaxation oscillation frequencies were 7.0, 2.0, 2.0. 1.5, and 1.5 GHz for the Drive, Response A-1, B-1, A-2, and B-2 lasers, respectively.

Each of the Response A-1 and B-1 lasers was subject to optical feedback from a fiber mirror reflector (M). In the context of synchronization of lasers with complex dynamics this is commonly called a “closed-loop” configuration [18,20]. The external cavity lengths were set to 7.36 m for both the Response A-1 and B-1 lasers, and the corresponding feedback delay time was 35.4 ns. The phase of the optical feedback light from each Response laser was shifted by a random binary waveform, generated with an arbitrary waveform generator, with the binary values corresponding to phase shift π or 0. Note that each Response laser had an independent phase-shift generator with independently generated random sequences of π and 0. The output of each of the two Response lasers was divided into two beams by a fiber coupler, - one for monitoring, and one for injection to the next laser in the cascade. Each of the latter injection beams was attenuated by an optical attenuator and injected into the Response A-2 (or B-2) laser. The Response A-2 and B-2 lasers were set up similar to the Response A-1 and B-1, except that the external cavity had a different length (11.74 m for both the Response A-2 and B-2 lasers) and, correspondingly, a different feedback delay time (56.5 ns). Note that precise matching of the external cavity lengths is required to achieve high-quality synchronization for each stage between the Response A-1 and B-1 lasers and between the Response A-2 and B-2 lasers. On the other hand, the different external cavity lengths were used between the stage 1 and 2 to avoid correlation of temporal waveforms between Response A-1 and A-2 lasers and between Response B-1 and B-2 lasers. The phases of the optical feedback for Response A-2 and B-2 were shifted by two independently random values π or 0. Each of the monitor beams was detected by a photodiode (PD), amplified by an electric amplifier (Amp), and observed by a digital oscilloscope (Tektronix, DPO71604B, 16 GHz bandwidth).

We set the optical wavelengths of the Drive and Response lasers by adjusting the temperature of the lasers. We set the optical wavelengths of 1547.281 nm for the Drive laser, 1547.257 nm for the Response A-1 laser, and 1547.256 nm for the Response B-1 laser, respectively, without optical injection. The optical wavelength detuning between Drive and Response A-1 is Δλ_A1,D = λ_A1 − λ_D = − 0.024 nm (−3.0 GHz in frequency) and that between Drive and Response B-1 is Δλ_B1,D = λ_B1 − λ_D = − 0.025 nm (−3.1 GHz) without optical injection. In the presence of optical injection from the Drive to the Response lasers, the dominant peak in the optical spectra of each of the Response A-1 and B-1 lasers matches that of the Drive laser at the wavelength of 1547.281 nm. The matching is due to injection locking of the main oscillation component of the Response laser. For the second stage, we set the optical wavelengths of 1547.258 nm for the Response A-2 laser, and 1547.261 nm for the Response B-2 laser, respectively. The optical wavelength detuning between Response A-2 and Drive lasers is Δλ_A2,D = λ_A2 − λ_D = −0.023 nm (−2.9 GHz) and that between Response B-2 and Drive lasers is Δλ_B2,D = λ_B2 − λ_D = −0.020 nm (−2.5 GHz) without optical injection. In the presence of optical injection from the first to the second stages, the injection locking occurs between the Response A-1 and A-2 lasers and between the Response B-1 and B-2 lasers as well. As a result, the optical wavelengths of all the five lasers are matched at 1547.281 nm (i.e., the wavelength of the Drive laser) under injection locking.

4. Common random-signal induced synchronization with constant-amplitude random-phase light

In this section we show that the cascaded laser systems exhibit the required synchronization and correlation properties.

4.1 Experimental results of temporal waveforms, correlation plots, and RF spectra

We first show temporal waveforms and cross correlation plots of the laser outputs when common random-signal induced synchronization is achieved by optical injection locking. The feedback phases are set to be matched at each stage, i.e., between the Response A-1 and B-1 lasers, and between the Response A-2 and B-2 lasers. The temporal waveforms of the Response A-1 and B-1 and their cross correlation plots are shown in Figs. 5(a) and 5(b). The temporal waveforms of the Response A-2 and B-2 and their cross correlation plots are shown in Fig. 5(c) and 5(d). The temporal waveforms of the Response lasers are similar at each stage. The analog cross correlation values C_A are 0.894 and 0.888 between the Response A-1 and B-1 lasers and between the Response A-2 and B-2 lasers, respectively. The analog cross correlation value between the corresponding Response lasers at each stage is high when injection locking is achieved and the feedback phases are matched.

 

Fig. 5 Experimental results of (a) temporal waveforms and (b) corresponding correlation plots for the outputs of the Response A-1 and B-1 lasers, (c) temporal waveforms and (d) corresponding correlation plots for the outputs of the Response A-2 and B-2 lasers. The feedback phases are matched at each stage.

Download Full Size | PDF

The temporal waveforms of the Drive and Response A-2 lasers and their cross-correlation plot are shown in Fig. 6. The value of the analog cross correlation between the Drive and Response A-2 lasers is 0.021 and this observed value is low and negligible. Ideally zero correlation is expected when using ideal constant-amplitude random-phase light for the Drive laser. In practice, even though the external modulator only modulates the optical phase, the Drive laser has a small intensity fluctuation due to the intrinsic relaxation oscillation fluctuations of the semiconductor laser. Therefore, there remains a small nonzero correlation.

 

Fig. 6 Experimental results of (a) temporal waveforms and (b) corresponding correlation plots for the outputs of the Drive and Response A-2 lasers.

Download Full Size | PDF

Next we show the effect of the feedback phases on characteristics of synchronization between the Response A-2 and B-2 lasers. The two users, Alice and Bob, can select the phase shift θ_A,j and θ_B,j of either π or 0 independently for each stage. Four cases of the parameter settings of phase shift can be considered in the cascaded laser systems with two laser units: (i) Alice and Bob have the same parameter values at both the first (Response A-1 and B-1) and second (Response A-2 and B-2) stages (i.e., θ_A,1 = θ_B,1 and θ_A,2 = θ_B,2), (ii) they have the same value at the first stage but different values at the second stage (θ_A,1 = θ_B,1 and θ_A,2 ≠ θ_B,2), (iii) they have different values at the first stage but the same value at the second stage (θ_A,1 ≠ θ_B,1 and θ_A,2 = θ_B,2), (iv) they have different values at both of the two stages (θ_A,1 ≠ θ_B,1 and θ_A,2 ≠ θ_B,2). Figure 7 shows the cross correlation plots between the Response A-2 and B-2 lasers for the above-mentioned four cases. Synchronization can be achieved only when they have the same parameter values at both of the two stages, as shown in Fig. 7(a). High cross correlation of 0.888 is achieved only when the feedback phases are matched at every stage. For other cases, no synchronization is achieved. The cross correlations less than 0.2 are obtained when the feedback phases at the first and/or second stages are mismatched. We confirmed that parameter matching of the optical feedback phase at every stage is required for achieving high-correlation between the Response A-2 and B-2 lasers.

 

Fig. 7 Experimental results of correlation plots for the outputs of the Response A-2 and Response B-2 lasers when the feedback phases θ_A,j and θ_B,j are matched at (a) both the first (Response A-1 and B-1) and second (Response A-2 and B-2) stages (i.e., θ_A,1 = θ_B,1 and θ_A,2 = θ_B,2), (b) only the first stage (θ_A,1 = θ_B,1 and θ_A,2 ≠ θ_B,2), (c) only the second stage (θ_A,1 ≠ θ_B,1 and θ_A,2 = θ_B,2), and (d) no stages (θ_A,1 ≠ θ_B,1 and θ_A,2 ≠ θ_B,2).

Download Full Size | PDF

Figure 8 shows the RF spectra of the Drive and the four Response lasers. The RF spectra of the Response A-1 and B-1 (Figs. 8(b) and 8(d)) are very similar, as well as those of the Response A-2 and B-2 (Figs. 8(c) and 8(e)). On the contrary, the RF spectra of the Drive and Response lasers are completely different. The RF spectra of the Response lasers have peak frequencies at around 1.5 and 4.0 GHz. The peak frequency of 1.5 GHz corresponds to the bandwidth of the noise signal used for random phase modulation at the Drive laser. The peak frequency of 4.0 GHz corresponds to the detuning of the two main peaks of the optical spectrum, corresponding to the optical wavelength of the Drive laser and the wavelength of the Response laser, slightly shifted due to the optical injection (see [15] for details). The shape of the RF spectra is independent of the optical feedback phase.

 

Fig. 8 Experimental result of RF spectra for (a) Drive, (b) Response A-1, (c) Response A-2, (d) Response B-1, and (e) Response B-2 lasers. Experimental parameter is the same as shown in Figs. 5 and 6.

Download Full Size | PDF

From these results, we experimentally confirmed that common random-signal induced synchronization in unidirectionally-coupled cascades of semiconductor lasers can be achieved with the CARP drive signal. We also note that degradation of the synchronization due to distortion of the drive signal waveform by propagation over the two 60-km optical fibers was hardly observable. This suggests similar performance could be obtained over much longer optical fibers. From the point of view of security of key generation using this synchronization phenomenon, the bandwidth of the noise signal generator for the CARP light should be increased further to avoid complete detection and recording of phase fluctuation by Eve. Superluminescent diodes or erbium-doped fiber amplifiers could be good candidates for a source of CARP light with much larger bandwidth.

4.2 Experimental result of modulation of phase-shift parameter values

Next, we observed short-term cross-correlation between the Response A-2 and B-2 lasers when the optical feedback phases are shifted independently by random parameter choices π or 0 at the each stage. In this experiment, we set the period of 0.5 μs for one parameter choice (i.e., the modulation frequency of the phase shift is 2.0 MHz) because the transient time for synchronization requires several hundreds of nanoseconds due to the long external cavity lengths of the Response lasers. The Return to Zero (RZ) format is used for the random parameter shift to reset the temporal waveforms to synchronized states after one parameter choice. Figure 9 shows the time evolutions of randomly-selected parameter shifts for the four Response lasers and the short-term cross-correlation values of the temporal waveforms between the Response A-2 and B-2 lasers (the bottom trace). Figure 9 demonstrates a main result of this paper. When the same parameter values are selected at each stage (i.e., θ_A,1 = θ_B,1 and θ_A,2 = θ_B,2), the short-term cross-correlation indicates high values at ~0.8, as denoted by the dashed boxes in Fig. 9. On the other hand, low correlation values (~0.2) are obtained when different parameter values are selected for at least one stage. This result is consistent with that shown in Fig. 7. The temporal synchronization characteristics with parameter shift shown in Fig. 9 are suitable for real-time successive generation of the correlated bit sequences required for secure key distribution, as will be described in Sec. 5.

 

Fig. 9 Time evolutions of randomly-selected parameter shifts of the optical feedback phases for the four Response lasers (RZ format) and the corresponding short-term cross-correlation values (the bottom trace) between the Response A-2 and B-2 lasers. The dashed boxes indicate that the phase-shift parameters are matched at each stage (θ_A,1 = θ_B,1 and θ_A,2 = θ_B,2) and high cross-correlation values are obtained.

Download Full Size | PDF

5. Secure key distribution

5.1 Robust sampling method

In this section, we describe a correlated bit generation method by using synchronized temporal waveforms between the Response A-2 and B-2 lasers shown in Sec. 4. In experiments, there is unavoidable noise in the cascaded laser systems. We use a robust sampling method as a practical technique to reduce the bit error rate (BER) due to this noise at the step 3 in the secure key generation procedure shown in Sec. 2.4. In each period of the phase shift, the intensities of optical outputs from Response A-2 and B-2 are sampled at a predetermined timing before the end of the period, and compared with threshold values. We set two threshold values as follows:

In this robust sampling method, only a proportion of the sampled values are used for bit generation, because of the discarded sampled values between I_th,u and I_th,l. If this fact is taken into account, Eq. (2) for the final key generation rate R_final is modified as follows:

An example of the robust sampling method is shown in Fig. 10. Two thresholds (black lines) are shown on the temporal waveforms of the Response A-2 and B-2 lasers in Fig. 10(a) and on the correlation plot in Fig. 10(b). The temporal waveforms outside the two thresholds are similar to each other between the two Response outputs in Fig. 10(a). In Fig. 10(b), there are four regions denoted as 00, 01, 10 and 11. The first number corresponds to the bit generated by Alice, and the second number corresponds to the bit generated by Bob. The same bits are generated by the robust sampling in the regions of 00 and 11. On the other hand, the bits are different in the regions of 01 and 10. The proportion of points in 01 and 10 regions become negligible by increasing the region within the two thresholds (colored regions in Figs. 10(a) and 10(b)). This implies that the bit error rate can be improved. However, as a trade-off, the bit generation rate decreases with increasing the region within the two thresholds.

 

Fig. 10 Example of the robust sampling method with two threshold values. (a) Temporal waveforms and (b) corresponding correlation plot. (b) The two bits indicate Alice’s and Bob’s bits. 11 and 00 indicate that the same bit can be shared, whereas 10 and 01 indicate that different bits are generated.

Download Full Size | PDF

We make an estimation for the bit error rate and bit generation rate, assuming that the two legitimate users perform the key generation procedure in Sec. 2.4 with the robust sampling method. Figure 11 shows the two-dimensional maps for the bit generation rate R_gen and the bit error rate R_fail obtained by the robust sampling method as functions of the two threshold coefficients C₊ and C_- (see Appendix A.1 for the definitions of R_gen and R_fail). Bright (white or yellow) region indicates high value and dark (black) region indicates low value in Fig. 11. Figure 11(a) shows that the bit generation rate is decreased by increasing the two threshold coefficients, because the number of sampled data located outside the two thresholds is decreased. Figure 11(b) shows that the bit error rate is also decreased by increasing the two threshold coefficients: the difference in temporal waveforms due to noise can be eliminated by increasing the two threshold values. Therefore, there is a trade-off between minimization of R_fail and maximization of R_gen: lower bit error rate can be achieved only at the expense of lowering the bit generation rate.

 

Fig. 11 (a) Bit generation rate R_gen and (b) bit error rate R_fail as functions of two threshold coefficients C₊ and C_-. (b) Bit error rate is plotted with a logarithmic scale.

Download Full Size | PDF

5.2 Final key generation rate

The final key generation rate R_final of Eq. (5) in Sec. 5.1 is estimated in this subsection. The bit error rate R_fail and bit generation rate R_gen in Eq. (5) vary with changing the two threshold coefficients C₊ and C_- of the robust sampling. Figure 12(a) shows the final key generation rate R_final of Eq. (5) as a function of C₊ and C_- estimated using our experimental data. The parameter values of the cascaded laser system with two laser units are as follows: N = 2, M = 2² = 4, M_E = 2^2-1 = 2. The quantity I_E was set at a fixed value of I_E = 0.20, and was independent of C₊ and C_- (see Section 6 for further explanation). The white region in Fig. 12(a) corresponds to the region where the final key generation rate R_final is less than 0, i.e., the two users cannot share a secret key. Figure 12(a) shows that secret key generation becomes possible by increasing the two threshold coefficients, demonstrating the effectiveness of the robust sampling method. However, too large thresholds result in smaller value of R_final. So, there are optimal values of the thresholds to obtain the maximum value of R_final.

 

Fig. 12 (a) Final key generation rate R_final as functions of two threshold coefficients, C₊ and C_-. The black line indicates a set of the threshold coefficients by which the probability of the occurrence of 0 for generated bits is within 0.500 ± 0.003. The white dotted circle indicates the maximum value on the black line. (b) Final key generation rate R_final along with the black line shown in (a).

Download Full Size | PDF

Here we introduce a constraint in optimizing the threshold coefficients. The probability of the occurrence of bit ‘0’ needs to be ideally 0.5 for random bits (‘0’ or ‘1’) of both of the legitimate users [20, 21]. The choices of the two threshold values change the probability of the occurrence of 0. The black line in Fig. 12(a) indicates a set of the threshold coefficients by which the probability of the occurrence of 0 in the generated bits is within the range 0.500 ± 0.003. Figure 12(b) shows the final key generation rate along with the black line, where the horizontal axis is the lower threshold coefficient C_-. The upper threshold coefficient C₊ is determined automatically from the constraint between C_- and C₊ imposed by the black line in Fig. 12(a). The curve in Fig. 12(b) shows that the maximum final key generation rate of 3.24 × 10⁻² is obtained when the threshold coefficient values are set to be C₊ = 0.640 and C_- = 0.495. The white dotted circle in Fig. 12(a) corresponds to this maximum point.

We used these two optimal threshold coefficients and evaluated statistical measures of secure key generation. The results are summarized in Table 1. The average analog cross-correlation of 0.845 is achieved, and 14142 bits are obtained by robust sampling in our experiment. The bit generation rate by robust sampling and the bit error rate are 0.446 and 1.45 × 10⁻², respectively. The probabilities of the occurrence of 0 for Alice and Bob are 0.5006 and 0.4979, respectively, and these values are close to the ideal value of 0.5. The mutual information I(A;B) between Alice and Bob’s retained bits is 0.8911. We denote stochastic variables representing the retained bits of Alice and Bob with A and B, respectively, and the definition of I(A;B) is given in the Appendix A.1. The final key generation rate is calculated as 3.24 × 10⁻² from Eq. (5) with the values M = 4, M_E = 2, R_gen = 0.446, R_fail = 1.45 × 10⁻², and I_E = 0.20 (see also Fig. 12(b)). The value of I_E was estimated from our experimental results, and the details will be described in Sec. 6. We also calculate the final key generation speed from the parameter modulation frequency. The modulation frequency of the parameter shift is 2 MHz in our experiment and the final key generation speed is calculated as 2 MHz × 3.24 × 10⁻² = 64 kb/s. The final key generation speed can be increased by increasing the modulation frequency of the parameter shift if the transient time for synchronization is shortened. The time for the parameter shift would be proportional to the number N of cascaded laser system since the transient time for synchronization is almost constant for each stage.

Table 1. Statistical evaluation on the generated bit stream. The thresholds for the robust sampling are set to C₊ = 0.640 and C_- = 0.495.

View Table | View all tables in this article

6. Evaluation of eavesdroppers’ attack

We showed that the legitimate users (Alice and Bob) can generate a common secret key from correlated temporal waveforms in Sec. 5, based on an assumed value of I_E, i.e., I_E = 0.2. In this section, we give a basis for this estimation of I_E. As mentioned in Sec. 2.5, suppose that Eve simultaneously operates M_E cascaded laser systems with different parameter sets v_E,i, i = 1, 2, …, M_E, to increase her chances of making the same observations as Alice or Bob while the common random light is being broadcast and of knowing their bits. I_E is an upper bound of Eve’s information about a retained bit of Alice (or Bob) in the case that the parameter sets of Alice and Bob are identical, v_A = v_B, and any of v_E,i does not match them, i.e., the case where Eve fails to make the same observations. This case sometimes happens when M_E < M. For this case, we consider some possible situations where Eve attempts to infer the retained bits of Alice (or Bob) by using temporal waveforms of Eve’s cascaded laser system with mismatched parameter values. Then, we make an estimation of I_E.

6.1 Evaluation by experiments

We first assume that Eve samples a temporal waveform output at the last stage (stage 2) in the cascaded laser system with two laser units (N = 2) to estimate a common bit when the parameter sets are mismatched between Eve and Alice (or Bob). We calculated the mutual information I(A;E) between Alice’s and Eve’s bits sampled from their analog temporal waveforms (see Appendix A.1 for the definition of I(A;E)). We assumed that Eve uses the mean value for a single threshold to generate bits, whereas Alice uses two threshold values for the robust sampling. The three cases are considered: (i) the parameter value is mismatched only at the stage 1 (θ_A,1 ≠ θ_E,1 and θ_A,2 = θ_E,2), (ii) the parameter value is mismatched only at the stage 2 (θ_A,1 = θ_E,1 and θ_A,2≠ θ_E,2), and (iii) both of the parameter values are mismatched at the stage 1 and 2 (θ_A,1 ≠ θ_E,1 and θ_A,2 ≠ θ_E,2). Table 2 shows the analog cross correlation C_A between the experimentally-obtained temporal waveforms of the Response laser outputs at the stage 2 in Alice’s and Eve’s systems with parameter mismatch. The mutual information I(A;E) is also shown, which is calculated from the bits generated from these temporal waveforms. The stochastic variables A and E represent Alice and Eve’s bits, respectively. The largest analog cross correlation is 0.179 when the parameter value is mismatched only at the stage 2, and the mutual information is 0.0208 between bits generated by Alice and Eve, as shown in Table 2. For all the cases, it is confirmed that only small information leakage can occur with this type of attack.

Table 2. Analog cross correlation C_A and mutual information I(A;E) between Alice and Eve when Eve samples the Response signal at stage 2 with parameter values mismatched at stage 1 and/or 2.

View Table | View all tables in this article

Next, we assume that Eve can sample a Response waveform at the stage 1, instead of the stage 2, to estimate a common bit when the sets of the parameter values are mismatched between Eve and Alice (or Bob). Table 3 shows the analog cross correlation between the temporal waveform of the output at the stage 1 in Eve’s system and that at the stage 2 in Alice’s system with parameter mismatch, and the mutual information I(A;E) calculated from the bits generated from these temporal waveforms. The largest analog cross correlation is 0.361 when the parameter value is mismatched only at the stage 2. This large cross correlation results from the fact that the Response temporal waveforms in stage 1 and 2 have some correlation, since a chaotic temporal waveform is injected from the stage 1 laser to the stage 2 laser [16,17]. However, the mutual information between bits generated by Alice and Eve is not large (0.0925).

Table 3. Analog cross correlation C_A and mutual information I(A;E) between Alice and Eve when Eve samples the Response signal at stage 1 with parameter values mismatched at stage 1 and/or 2.

View Table | View all tables in this article

From the above results, we can judge that the value of I_E = 0.20, used in our previous calculation with Eq. (5) described in Sec. 5.2, is a safe upper estimate of the information leakage. In the above arguments, we have considered two reasonable types of Eve’s attacks, i.e., the use of quantized output of stage 1 or 2. However, there could be other ways of inferring which achieve somewhat larger I(A;E). Therefore, for safety, we assumed the value I_E = 0.20 which is much larger than the experimentally obtained maximum I(A;E) = 0.0925.

6.2 Evaluation by numerical simulation

There is a possibility that Eve operates several cascaded laser systems to increase her information about the retained bits of Alice and Bob, though we considered only the situation that Eve has only one system in Sec. 6.1. We carried out numerical simulations to evaluate I_E in the case that Eve operates M_E systems up to M_E = 3. The parameter values in our simulation are experimentally reasonable one, and the details of our simulation are given in Appendix A.2.

First, we consider the case that each of Alice and Eve operate one system and the parameter sets of their systems are mismatched. Table 4 shows numerical results for the analog cross correlation between the temporal waveform of the output at the stage 1 or 2 for Eve’s system and that at the stage 2 for Alice’s system, and the mutual information when bits are generated from these temporal waveforms. Since spontaneous emission noise is neglected in our simulation, a single threshold given by the mean value is used in the bit generation both for Alice and Eve. These numerically obtained values roughly coincide with those of our experiments shown in Table 2 and 3. In addition, it is clear that both C_A and I(A;E) take much larger values than the other cases when Eve samples the output of stage 1 laser and the parameters are mismatched only at stage 2. This is the feature observed in the experiment. These agreements with experiment may validate the present numerical simulation.

Table 4. Numerical result of statistical evaluation of the analog cross correlation C_A and mutual information I(A;E) between Alice and Eve. Eve samples the Response signal of the stage 1 or 2, when the parameter values are mismatched at the stage 1 and/or 2. The number in () is the stage number of Eve’s sampling.

View Table | View all tables in this article

Next, we consider the case that Eve operates three systems and samples the outputs of lasers at both stages 1 and 2 for all the three systems, while Alice operates one system. It is assumed that the parameter sets of three Eve’s systems are mismatched with that of Alice’s system. Eve obtains six bits in this case, and we denote the stochastic variable for these bits with E’. The mutual information between Alice’s bit and Eve’s set of six bits is obtained as I(A;E’) = 8.23 × 10⁻². This value is close to the maximum I(A;E) = 5.84 × 10⁻² in Table 4, which is for the case that Eve uses one system and samples the output of stage 1 with mismatch only at stage 2. The mutual information does not significantly increase with increasing M_E up to M_E = 3: I(A;E’) is less than twice of I(A;E). This property is expected to hold also experimentally, and suggests that the value of I_E = 0.2, which was estimated from I(A;E) of M_E = 1 case, will be valid also for M_E = 3 case.

7. Estimation of final key generation rate for large number of Eve’s cascaded laser systems

Consider the case that Eve attempts to obtain a better estimate of the retained bits of Alice and Bob by increasing the number of her cascaded laser systems. This attack is called sampling attack [22]. Eve prepares a large number of the cascaded laser systems, which are subject to a common drive signal, and each of her systems has different values of the optical feedback phase parameter. Suppose that a cascaded laser system consists of N stages and the optical feedback phase at each stage is shifted with binary values 0 or π. The total number of all the possible sets of parameter values is M = 2^N. If Eve has M_E = 2^N cascaded laser systems corresponding to all the possible sets of parameter values, one of them must coincide with the one Alice and Bob use, and Eve can succeed in generating the retained bit. Therefore, it is necessary to satisfy the condition M_E < M = 2^N for the key distribution to be secure against the sampling attack [14,22]. To cope with the sampling attack, it is effective to increase the number N of the laser units (stages) in the cascaded laser system, because Eve needs to increase exponentially the number of her systems as 2^N to perform the perfect sampling attack. For example, for only N = 20 laser cascade stages, Eve needs 2²⁰ ≈10⁶ cascaded laser systems for the perfect sampling attack.

Although we have so far only been able to perform an experiment for N = 2 stage systems, it has been numerically confirmed that cascaded laser systems can satisfy the required synchronization property described in Sec. 2.3 also for larger N > 2. The details of our simulation are described in Appendix A.3. We estimate the performance of secure key distribution for N > 2 using Eq. (5). Table 5 compares experimental values of R_gen and R_fail in the cases of N = 1 and N = 2. The values of both R_gen and R_fail are similar to each other and do not significantly depend on N. This fact suggests that R_gen and R_fail may be assumed constant independent of N. Therefore, we estimate the final key generation rate for larger N by using this experimental data obtained for the two laser unit case (N = 2). In addition, we use I_E = 0.20 in Eq. (5), since the required synchronization property holds for larger N.

Table 5. Experimental values of bit generation rate by robust sampling R_gen and the bit error rate R_fail for the cascaded laser systems with one laser unit (N = 1) and two laser units (N = 2).

View Table | View all tables in this article

The maximum final key generation rate R_final estimated by using Eq. (5) is shown in Fig. 13 as a function of N, where the parameter values R_gen = 0.446, R_fail = 1.45 × 10⁻², and I_E = 0.20, and M = 2^N were used. We assume three types of Eve, named Weak Eve, Moderate Eve and Strong Eve, with different numbers of cascaded laser systems (different M_E) for sampling attack. Weak Eve has only one cascaded laser system, i.e., M_E = 1. Moderate Eve has just half of all the possible cascaded laser systems, i.e., M_E = 2^N−1. Strong Eve has M_E = 2^N ̶ 1 cascaded laser systems, just by one less than the perfect sampling attack for which secure bit generation cannot be achieved between Alice and Bob. In Fig. 13, the left and right vertical axes represent the final key generation rate and the corresponding final key generation speed estimated from the parameter modulation frequency 2 MHz. The final key generation rate decreases exponentially as the number of the laser units N increases for all the three cases. Note that the plots for the Weak and Moderate Eves are close to each other and the slopes of these plots decrease slowly, while the slope for the Strong Eve decreases rapidly.

 

Fig. 13 The maximum final key generation rate R_final and the final key generation speed as a function of the number of laser units (stages) N when the parameter frequency is 2 MHz. Three types of Eve are assumed. Weak Eve only has one cascaded Response laser system, i.e., M_E = 1. Moderate Eve has half of the total number of cascaded Response laser systems that are required to produce all possible sets of parameter values, i.e., M_E = 2^N−1. Strong Eve has M_E = 2^N - 1 cascaded laser systems, just one less than necessary to make it impossible for key generation to be secure against sampling attack.

Download Full Size | PDF

The secure key generation speed can be improved by increasing the parameter modulation frequency (2 MHz) and by reducing the transient time for synchronization of the corresponding Response lasers. The parameter modulation frequency is restricted by the long external cavity lengths (7.36 m and 11.74 m at the stage 1 and 2) of our cascaded laser systems. The transient time for synchronization requires several to ten times the feedback delay time (35.4 ns and 56.5 ns at the stage 1 and 2) in the external cavity [23,24]. We expect that the transient time can be shortened and the parameter modulation frequency can be increased to the order of several hundreds of MHz by using photonic integrated circuits [25–28], instead of the current optical fiber systems. The final key generation speed of several tens of kb/s would be expected for 10 laser units with photonic integrated circuits.

Finally, we present an argument for the optimum number N of the stages when the number M_E of Eve’s cascaded laser systems is fixed. Assume an ideal case of bit generation in Eq. (5): R_gen = 1, R_fail = 0, h(R_fail) = 0, and I_E = 0. This means that the cascaded laser systems are synchronized identically, the sampling is completed with no error, and the information leakage is prevented. Under this assumption, Eq. (5) reads,

For fixed M_E, Eq. (6) is a function of M ( = 2^N) with maximum when M = 2M_E. Therefore, once Eve’s ability M_E is assumed, the maximum bit generation rate can be achieved when the legitimate users use the number N of stages which is an approximate integer solution of 2^N = 2M_E. As an example, we plot R_final as a function of N for a fixed M_E = 2¹⁰ by using Eq. (5) in Fig. 14, which does not correspond to an ideal case but to our experimental case. Note that secure key distribution (positive R_final) is achieved for N > 10, whereas it is not achieved for $N\le 10$ because of the possibility of perfect sampling attack. It can be confirmed that the largest bit generation rate is obtained at N = 11, which is the integer solution of 2^N = 2M_E. The security can be guaranteed if the cascaded laser systems have just N + 1 stages when the eavesdropper has M_E = 2^N cascaded laser systems for a sampling attack.

 

Fig. 14 Final key generation rate R_final as a function of N for a fixed M_E = 2¹⁰ obtained from Eq. (5).

Download Full Size | PDF

8. Conclusions

We experimentally demonstrated that common random-signal induced synchronization is possible in unidirectionally-coupled cascades of semiconductor lasers. Moreover, we experimentally demonstrated that correlated random bit sequences generated by using this synchronization phenomenon is suitable for secure key distribution, and that information-theoretic secure key distribution between two legitimate users using the correlated random bit sequences with a secure key generation procedure is possible. To evaluate the security of the system, we considered the situation where an eavesdropper attempts to estimate the common bits from temporal waveforms of her own cascaded laser systems with mismatched parameter values. The mutual information between the eavesdropper and a legitimate user is estimated to be less than 0.1. We optimized the two threshold values for robust binary sampling and maximized the secure key generation rate. The final secure key generation speed of 64 kb/s was obtained using parameter modulation frequency of 2 MHz in cascaded laser systems with two cascaded laser units, separated by 120 km of optical fiber. Finally, we evaluated the secure key generation rates for the case of a large number of laser cascade units secure against a sampling attack, based on some reasonable assumptions. We showed that the security can be guaranteed if the laser cascade systems have just N + 1 stages when the eavesdropper has M_E = 2^N cascaded laser systems for a sampling attack. Our results indicate that the proposed scheme for generating correlated random bit sequences using common random-signal induced synchronization in cascaded semiconductor lasers is a promising approach to implementing information-theoretic secure key distribution.

Appendix

A.1 Definition of parameters in Eqs. (2) and (5)

The definition of the parameters of Eqs. (2) and (5) in Secs. 2.5 and 5.1 is described in this Appendix. First, we define the bit generation rate $R_{gen}$ by robust sampling as follows:

(A1)$$R_{gen}=\frac{N_{gen}}{N_{sample}}$$

N_sample is the number of total samplings of the analog temporal waveforms, N_gen is the number of non-discarded samples under the robust sampling operation. N_gen and $R_{gen}$ depend on the two threshold values of robust sampling.

The bit error rate R_fail is defined as follows:

(A2)$$R_{fail}=\frac{N_{diff}}{N_{gen}}$$

N_diff is the number of bits that are different between Alice and Bob when their parameter sets are identical with each other. The bit error rate also depends on the two threshold values of robust sampling through N_gen.

The mutual information I(X;Y) between random bits X and Y is defined as follows:

(A3)$$I\left(X;Y\right)={\displaystyle \sum _{a=0}^1{\displaystyle \sum _{b=0}^1{p}_{X,Y}\left(a,b\right){\log }_2\frac{p_{X,Y}\left(a,b\right)}{p_X\left(a\right)p_Y\left(b\right)}}}$$

where p_X(a) is the probability of the occurrence of X = a (0 or 1), p_Y(b) is the probability of the occurrence of Y = b (0 or 1), and p_X,Y(a,b) is the joint probability of the occurrence of bit a for X and bit b for Y. The mutual information I(X;Y) indicates how much information is shared between X and Y. In particular we evaluate I(A;E), the amount of information leakage from legitimate user Alice to eavesdropper Eve. We use the amount of I(A;E) to eliminate the information leakage to Eve by information reconciliation and privacy amplification [19].

A.2 Details of numerical simulations in Section 6.2

To model the cascaded laser systems driven by common CARP light, we use the Lang-Kobayashi equation [29] with the CARP injection term:

(A4)$${\dot{E}}_j(t)=\frac{1}{2}\left(1+i\alpha \right)G_N\left(N_j(t)-N_{\text{th}}\right)E_j(t)+\frac{{\kappa }_{\text{r},j}}{{\tau }_{\text{in}}}{E}_j(t-{\tau }_j)\exp [i{\theta }_j]+\frac{{\kappa }_{\text{inj},j}}{{\tau }_{\text{in}}}{E}_{\text{inj},j},$$

(A5)$${\dot{N}}_j(t)=J_j-\frac{1}{{\tau }_s}{N}_j(t)-G_N\left(N_j(t)-N_0\right)\cdot {\left|E_j(t)\right|}^2,$$

where E_j and N_j are the complex electric field and the carrier number density, respectively. Their index j (j = 1,...,N) indicates the laser at j-th stage. τ_j is the delay time of the optical self feedback, κ_r,j is the feedback strength, θ_j is the optical phase shift of the feedback light, and κ_inj,j is the injection strength. Each θ_j takes 0 or π, and the parameter set v is given by v = (θ₁,...,θ_N). The last term E_inj,j in the first equation represents the optical injection to the j-th stage laser, which is given by

(A6)$$E_{\text{inj},j}=\{\begin{array}{cc}{E}_0\exp [i(\Delta {\omega }_{j}t+\varphi (t))]& \text{for}j=1,\\ E_{j-1}(t)\exp [i\Delta {\omega }_{j}t]& \text{for}j\ge 2,\end{array}$$

where E₀ is a real constant and ϕ(t) represents the random phase modulation. The detuning parameter Δω_j is defined by Δω_j = ω_j-1-ω_j, where ω_j is the optical angular frequency of the j-th stage laser and ω₀ is defined as that of Drive light. As for the random phase modulation ϕ(t), we assumed the Ornstein-Uhlenbeck process defined by the stochastic differential equation.

(A7)$$\dot{\varphi }(t)=-\frac{1}{{\tau }_{\text{m}}}\varphi (t)+\sqrt{\frac{2}{{\tau }_{\text{m}}}}\sigma \cdot \xi (t),$$

Where τ_m and σ are positive constants and ξ(t) is the normalized white Gaussian noise with the properties $〈\xi (t)〉=0$ and $〈\xi (t)\xi (s)〉=\delta (t-s)$, where $\delta$ is Dirac's delta function and $〈〉$ denotes the ensemble average. It can be shown that ϕ(t) has the properties $〈\varphi (t)〉=0$ and $〈\varphi (t)\varphi (s)〉={\sigma }^2\exp [-|t-s|/{\tau }_m]$. The latter property indicates that the correlation time and standard deviation of ϕ(t) are given by τ_m and σ, respectively.

We carried out our numerical simulation for N =2 and M =2^N=4. In the simulation, the following parameter values were used: α = 3, G_N = 8.4×10⁻¹³ m³s⁻¹, N₀ = 1.4×10²⁴ m⁻³, N_th = 2.018×10²⁴ m⁻³, τ_in = 8.0 ps, τ_s = 2.04 ns, κ_inj,1 = 0.25, κ_inj,2 = 0.15, τ₁ = 35.4 ns, τ₂ = 56.5 ns, κ_r,1 = 0.07, κ_r,2 = 0.09, J₁ = 1.190J_th, J₂ = 1.107J_th, where J_th = N_th/ τ_s is the threshold of the injection current. For these values of J_j, Response lasers at stage 1 and 2 have the relaxation oscillation frequencies 2.0 GHz and 1.5 GHz, respectively. The detuning parameters are set as Δω₁ = −3.0 GHz and Δω_j = 0 for j = 2,...,N. As for the CARP light, we set as $E_0=\sqrt{0.19J_{\text{th}}/G_N(N_{\text{th}}-N_0)}$, τ_m = 1.0 ns, and $\sigma =\pi /2$. The delay times and the relaxation oscillation frequencies coincide with the values in our experiment. As for the other parameters, it is difficult to precisely determine their values in our experimental system. We assumed physically reasonable values for them. The numerical calculation method used here is described in the reference [30].

A.3 Details of numerical simulations in Section 7

We carried out numerical simulations to confirm that the required synchronization property can be satisfied for large N. Consider two identical cascaded laser systems, each of which is described by Eqs. (A4) and (A5). We denote their parameter sets with v and v’, and their output intensity waveforms with I and I’, respectively. The analog correlation C_A between I and I’ depends on the parameter sets v and v’. So, we denote the correlation as C_A(v,v’). Let C_H and C_L be defined by

(A8)$$C_H=\underset{v=v\text{'}}{\min }C{}_A(v,v\text{'})$$

(A9)$$C_L=\underset{v\ne v\text{'}}{\max }{C}_A(v,v\text{'})$$

C_H is the minimum correlation when the parameter sets are identical, while C_L is the maximum correlation when the parameter sets are different. The required synchronization property is that C_H ~1 and C_L ~0. Table A1 shows an example of C_H and C_L values for different N. The cascaded laser system has many parameters such as τ_j or κ_r,j. Note that the results for each N in Table A1 is only for a particular choice of the parameters. Table A1 clearly shows that C_H ~1 and C_L < 0.3, which is close to zero, hold for all the N values up to 8. It should be noted that both C_H and C_L do not significantly depend on N. This fact suggests that the required synchronization property can be satisfied for arbitrary large N, provided that the system parameters are appropriately chosen.

In the simulation, the parameter values were set as follows: κ_r,j = κ_t+(κ_b -κ_t)×(j-1)/(N-1), τ_j = 0.1+0.04×(j-1) ns, κ_inj,j = 0.40, and J_j = 1.190J_th, where j = 1,…,N. This value of J_j leads to the relaxation oscillation frequency 2.0 GHz. The other parameters are the same as in Sec. A.2. As for the delay time τ_j, we assumed small values of τ_j, which correspond to the case that a photonic integrated circuit is used for a laser unit at each stage. We assigned different values τ_j to each stage because synchronizing the cascaded systems tends to be difficult if all the τ_j are the same. As for the feedback strength κ_r,j, the two parameters κ_t and κ_b were appropriately chosen and their values are shown in Table A1.

Table A1. Example of C_H and C_L for different N.

View Table | View all tables in this article

Acknowledgments

We acknowledge support from Grants-in-Aid for Scientific Research and Management Expenses Grants from the Ministry of Education, Culture, Sports, Science and Technology in Japan. We also would like to thank Naonori Ueda, Eisaku Maeda, Junji Yamato, Atsushi Nakamura, Kenichi Arai, and Susumu Shinohara at NTT Communication Science Laboratories for their continuous encouragement and support.

References and links

1. C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing (Institute of Electrical and Electronics Engineers, Bangalore, India,1984), 175–179.

2. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74(1), 145–195 (2002). [CrossRef]  

3. A. Uchida, P. Davis, and S. Itaya, “Generation of information theoretic secure keys using a chaotic semiconductor laser,” Appl. Phys. Lett. 83(15), 3213–3215 (2003). [CrossRef]  

4. J. Scheuer and A. Yariv, “Giant Fiber Lasers: A New Paradigm for Secure Key Distribution,” Phys. Rev. Lett. 97(14), 140502 (2006). [CrossRef]   [PubMed]  

5. A. Zadok, J. Scheuer, J. Sendowski, and A. Yariv, “Secure key generation using an ultra-long fiber laser: transient analysis and experiment,” Opt. Express 16(21), 16680–16690 (2008). [CrossRef]   [PubMed]  

6. D. Bar-Lev and J. Scheuer, “Enhanced key-establishing rates and efficiencies in Fiber Laser Key Distribution systems,” Phys. Lett. A 373(46), 4287–4296 (2009). [CrossRef]  

7. E. Klein, N. Gross, E. Kopelowitz, M. Rosenbluh, L. Khaykovich, W. Kinzel, and I. Kanter, “Public-channel cryptography based on mutual chaos pass filters,” Phys. Rev. E Stat. Nonlin. Soft Matter Phys. 74(4), 046201 (2006). [CrossRef]   [PubMed]  

8. I. Kanter, M. Butkovski, Y. Peleg, M. Zigzag, Y. Aviad, I. Reidler, M. Rosenbluh, and W. Kinzel, “Synchronization of random bit generators based on coupled chaotic lasers and application to cryptography,” Opt. Express 18(17), 18292–18302 (2010). [CrossRef]   [PubMed]  

9. R. Vicente, C. R. Mirasso, and I. Fischer, “Simultaneous bidirectional message transmission in a chaos-based communication scheme,” Opt. Lett. 32(4), 403–405 (2007). [CrossRef]   [PubMed]  

10. W. Diffie and M. Hellman, “New Directions in cryptography,” IEEE Trans. Inf. Theory 22(6), 644–654 (1976). [CrossRef]  

11. C. E. Shannon, “Communication theory of secret system,” Bell Syst. Tech. J. 28, 656–715 (1949).

12. U. M. Maurer, “Secret key agreement by public discussion from common information,” IEEE Trans. Inf. Theory 39(3), 733–742 (1993). [CrossRef]  

13. J. Muramatsu, K. Yoshimura, and P. Davis, “Information theoretic security based on bounded observability,” Lect. Notes Comput. Sci. 5973, 128–139 (2010). [CrossRef]  

14. K. Yoshimura, J. Muramatsu, P. Davis, T. Harayama, H. Okumura, S. Morikatsu, H. Aida, and A. Uchida, “Secure key distribution using correlated randomness in lasers driven by common random light,” Phys. Rev. Lett. 108(7), 070602 (2012). [CrossRef]   [PubMed]  

15. H. Aida, M. Arahata, H. Okumura, H. Koizumi, A. Uchida, K. Yoshimura, J. Muramatsu, and P. Davis, “Experiment on synchronization of semiconductor lasers by common injection of constant-amplitude random-phase light,” Opt. Express 20(11), 11813–11829 (2012). [CrossRef]   [PubMed]  

16. T. Yamamoto, I. Oowada, H. Yip, A. Uchida, S. Yoshimori, K. Yoshimura, J. Muramatsu, S. I. Goto, and P. Davis, “Common-chaotic-signal induced synchronization in semiconductor lasers,” Opt. Express 15(7), 3974–3980 (2007). [CrossRef]   [PubMed]  

17. I. Oowada, H. Ariizumi, M. Li, S. Yoshimori, A. Uchida, K. Yoshimura, and P. Davis, “Synchronization by injection of common chaotic signal in semiconductor lasers with optical feedback,” Opt. Express 17(12), 10025–10034 (2009). [CrossRef]   [PubMed]  

18. R. Vicente, T. Pérez, and C. R. Mirasso, “Open- versus closed-loop performance of synchronized chaotic external-cavity semiconductor lasers,” IEEE J. Quantum Electron. 38(9), 1197–1204 (2002). [CrossRef]  

19. J. Muramatsu, “Secret key agreement from correlated source outputs using low density parity check matrices,” IEICE Trans. Fundamentals E89-A(7), 2036–2046 (2006). [CrossRef]  

20. A. Uchida, Optical Communication with Chaotic Lasers, Applications of Nonlinear Dynamics and Synchronization, (Wiley-VCH, Weinheim, 2012).

21. A. Uchida, K. Amano, M. Inoue, K. Hirano, S. Naito, H. Someya, I. Oowada, T. Kurashige, M. Shiki, S. Yoshimori, K. Yoshimura, and P. Davis, “Fast physical random bit generation with chaotic semiconductor lasers,” Nat. Photonics 2(12), 728–732 (2008). [CrossRef]  

22. J. Muramatsu, K. Yoshimura, K. Arai, and P. Davis, “Secret key capacity for optimally correlated sources under sampling attack,” IEEE Trans. Inf. Theory 52(11), 5140–5151 (2006). [CrossRef]  

23. T. Heil, J. Mulet, I. Fischer, C. R. Mirasso, M. Peil, P. Colet, and W. Elsäßer, “On/off phase shift keying for chaos-encrypted communication using external-cavity semiconductor lasers,” IEEE J. Quantum Electron. 38(9), 1162–1170 (2002). [CrossRef]  

24. A. Uchida, N. Shibasaki, S. Nogawa, and S. Yoshimori, “Transient characteristics of chaos synchronization in a semiconductor laser subject to optical feedback,” Phys. Rev. E Stat. Nonlin. Soft Matter Phys. 69(5), 056201 (2004). [CrossRef]   [PubMed]  

25. A. Argyris, M. Hamacher, K. E. Chlouverakis, A. Bogris, and D. Syvridis, “Photonic integrated device for chaos applications in communications,” Phys. Rev. Lett. 100(19), 194101 (2008). [CrossRef]   [PubMed]  

26. A. Argyris, E. Grivas, M. Hamacher, A. Bogris, and D. Syvridis, “Chaos-on-a-chip secures data transmission in optical fiber links,” Opt. Express 18(5), 5188–5198 (2010). [CrossRef]   [PubMed]  

27. A. Argyris, S. Deligiannidis, E. Pikasis, A. Bogris, and D. Syvridis, “Implementation of 140 Gb/s true random bit generator based on a chaotic photonic integrated circuit,” Opt. Express 18(18), 18763–18768 (2010). [CrossRef]   [PubMed]  

28. T. Harayama, S. Sunada, K. Yoshimura, P. Davis, K. Tsuzuki, and A. Uchida, “Fast nondeterministic random-bit generation using on-chip chaos lasers ,” Phys. Rev. A 83(3), 031803(R) (2011).

29. R. Lang and K. Kobayashi, “External optical feedback effects on semiconductor laser properties,” IEEE J. Quantum Electron. 16(3), 347–355 (1980). [CrossRef]  

30. K. Yoshimura, I. Valiusaityte, and P. Davis, “Synchronization induced by common colored noise in limit cycle and chaotic systems,” Phys. Rev. E Stat. Nonlin. Soft Matter Phys. 75(2), 026208 (2007). [CrossRef]   [PubMed]