## Abstract

It has been proposed that a secure key distribution scheme using correlated random bit sequences can be implemented using common random-signal induced synchronization of semiconductor laser systems. In this scheme it is necessary to use laser systems consisting of multiple cascaded lasers to be secure against a powerful eavesdropper. In this paper, we report the results of an experimental study that demonstrate that the common random-signal induced synchronization is possible in cascaded semiconductor laser systems. We also show that the correlated random bit sequences generated in the synchronized cascaded laser systems can be used to create an information-theoretically secure key between two legitimate users.

©2013 Optical Society of America

## 1. Introduction

Information security technologies are becoming increasingly important in communication and computer systems. In secret-key communication systems, secure communication between two legitimate users is based on a secret key which is known only to them. Secure key distribution is necessary for the two users to share this secret key. The ultimate security of quantum key distribution (QKD) [1,2] is based on properties of quantum mechanics. However, it is difficult to realize these effects over large distances. Other approaches using classical optical devices have been proposed [3–9]. One of the examples is ultra-long fiber laser systems with optical noise [4–6]. Other examples use characteristics of synchronization between two lasers with mutual optical couplings [7–9].

Classical schemes for secure key distribution rely on one of two main security paradigms, namely computational security [10] and information-theoretic security [11]. Computational security is based on the hypothetical hardness of computational problems such as the integer-factoring or discrete logarithm problems. Information-theoretic security is based on probability theory, where it is secure against adversary’s unlimited computational power.

One approach to information theoretic security assumes that legitimate users and an adversary are able to obtain correlated random sequences. It is known that it is possible for the legitimate users to create a shared secret key from correlated random sequences by exchanging messages over a public channel [12]. Recently, it has been shown that this approach can be implemented based on a property called *bounded observability* [13]. In the context of physical systems, bounded observability can occur due to the practical difficulty of completely observing physical phenomena. An implementation based on this concept has been proposed using the synchronized responses of laser systems injected with common random light signal with broad bandwidth [14]. The response laser system consists of unidirectionally-coupled laser units, and requires a large number of cascaded units to resist attack from a powerful eavesdropper. The common random-signal induced synchronization and generation of correlated random bit sequences suitable for secure key distribution has been experimentally achieved for single-unit semiconductor lasers [14–17]. However, there is no experimental result for the case of cascaded laser systems.

In this paper, we experimentally study the common random-signal induced synchronization of cascaded semiconductor lasers and its application to the generation of correlated random bit sequences. We show that realizing the required synchronization properties and the generation of correlated random bit sequences suitable for secure key distribution are possible in cascaded laser systems. We measure some statistical quantities relevant to the secure key distribution, and estimate the final key generation rate, assuming a passive eavesdropper. The number of laser units in the cascaded laser systems is two in our experiments, which is the minimum number required to demonstrate the main effects of a cascade configuration. However, the present experimental results combined with numerical modeling for larger number of cascades strongly suggests that the secure key distribution is feasible for a larger number of laser units.

The present paper is organized as follows. In Sec. 2, we describe the configuration of the cascaded laser system and its required synchronization properties. Then we explain the procedure for sharing a secret key and the method for evaluating the key generation rate. In Sec. 3, we describe our experimental setup, which consists of two cascaded laser systems injected with common random light. In Sec. 4, experimental results for tests of synchronization properties are shown. In Sec. 5, we describe a sampling method to efficiently obtain bit sequences from analog outputs of the cascaded laser systems. Then we estimate the key generation rate of the present experimental system. In Sec. 6, we show an evaluation of information leakage in a passive attack by an eavesdropper. In Sec. 7, an extrapolation of the key generation rate is made for the case of a larger number of units in the cascaded laser system. Conclusions are drawn in Sec. 8.

## 2. Cascaded laser system and secure key distribution

#### 2.1 Configuration of cascaded laser system

Figure 1 shows the configuration of a cascaded laser system with injection. The cascaded laser system is indicated by dashed line in Fig. 1. The cascaded laser system consists of *N* laser units (*N* stages). Each unit consists of a semiconductor laser, which is labeled Response A-*j*, *j* = 1, ..., *N*, in Fig. 1, and an optical self-feedback (i.e., closed-loop configuration [18]). The phase of feedback light is changed by a phase modulator. The amount of phase change is 0 or π. The external driving light signal from Drive system, which has randomly fluctuating phase and/or amplitude, is injected into the first laser unit at the stage 1. In our experiment we used a constant-amplitude and random-phase (CARP) light as a drive signal [14,15] (see Sec. 3). All the laser units except the first one receive the output of their preceding laser unit as their input. The output of the cascaded laser system is given by that of the last stage unit. We will set the number of the laser units (stages) to *N* = 2 in our experiment, which will be described in Secs. 3 and 4.

#### 2.2 Cascaded laser systems with common injection

Figure 2 shows the configuration of two cascaded laser systems driven by a common random light from Drive system. Assume that the two systems are possessed by users, Alice and Bob. Let *θ _{A,j}* and

*θ*be the parameters which represent the amounts of feedback light phase shifts in Alice and Bob’s units at

_{B,j}*j-*th stage, respectively. We assume that

*θ*and

_{A,j}*θ*take one of the two values 0 and π. Let

_{B,j}*v*and

_{A}*v*denote the parameter sets as

_{B}*v*= (

_{A}*θ*, ...,

_{A,1}*θ*) and

_{A,N}*v*= (

_{B}*θ*, ...,

_{B,1}*θ*). Each of the cascaded laser systems generates optical output, which depends on both the common random light and the parameter set

_{B,N}*v*or

_{A}*v*.

_{B}#### 2.3 Required synchronization property of the system

In order to realize secure key sharing between the two users Alice and Bob with cascaded laser systems, there are requirements on the properties of synchronization between the cascaded laser systems. To describe the requirement, we define the analog cross correlation coefficient *C _{A}*, which quantitatively evaluates the quality of synchronization. Let

*I*and

_{x}*I*be the output intensity waveforms of two lasers. The analog cross correlation for

_{y}*I*and

_{x}*I*is defined by

_{y}*I*,

_{x}*I*, and

_{y}*σ*,

_{x}*σ*are their standard deviations. The angle brackets denote time averaging.

_{y}The required synchronization properties are described in terms of the cross correlation between outputs of the two systems. Let *I _{A}*(

*t*) and

*I*(

_{B}*t*) be the output light intensity waveforms of Alice and Bob’s systems, respectively, and

*C*(

_{A}*I*,

_{A}*I*) be their cross correlation given by Eq. (1) with

_{B}*I*=

_{x}*I*and

_{A}*I*=

_{y}*I*. The required properties are that the correlation is high (

_{B}*C*~1) if and only if the parameter values are identical with each other at every stage (

_{A}*v*=

_{A}*v*) while it is low (

_{B}*C*~0) if the parameter values are mismatched at any of the stages (

_{A}*v*≠

_{A}*v*), and that the correlation between the waveform of the injection signal and the output of each of the Response lasers is low for all parameter values.

_{B}#### 2.4 Scheme of secure key distribution

Next, we explain the secure key distribution scheme proposed in [14], which uses the correlated random bit sequences generated by using the outputs from the cascaded laser systems. This scheme is illustrated in Fig. 3. We show the case of the cascaded laser systems with two laser units (two stages) in Fig. 3, corresponding to our experimental setup. We note that in principle the cascaded laser system is extensible by increasing the number *N* of stages. We will discuss this point in Sec. 7.

The procedure for generating a secret key, that is the “secure key generation procedure”, is as follows (see also Fig. 3):

- 1. Two legitimate users, Alice and Bob, decide their sets
*v*and_{A}*v*of phase-shift parameter values (0 or π for each laser unit) randomly and independently._{B} - 2. Common random light from Drive system is injected into the cascaded laser systems of Alice and Bob, and the laser systems generate optical outputs depending on both the injected light and their phase-shift parameters.
- 3. Alice and Bob extract their binary outputs
*x*and_{A}*x*from the temporal intensity waveforms of their system outputs by sampling at a predetermined timing and quantizing their sampled values. The pairs (_{B}*x*,_{A}*v*) and (_{A}*x*,_{B}*v*) are stored in Alice and Bob’s data recorders, respectively._{B} - 4. Alice and Bob repeat the above steps 1~3 for a large number of times
*m*, injecting continuously varying nonrepeating random light, to obtain the pairs (*x*,_{A,i}*v*) and (_{A,i}*x*,_{B,i}*v*),_{B,i}*i*=*1, 2, ..., m*, respectively. - 5. Once step 4 is finished, each of Alice and Bob has a sequence of many pairs of the generated bit and the corresponding parameter set. They exchange their sequences {
*v*} and {_{A,i}*v*},_{B,i}*i*=*1, 2, ..., m*, of the used parameter sets via a public channel. - 6. Alice and Bob retain only the bits
*x*and_{A,i}*x*for_{B,i}*i*such that*v*=_{A,i}*v*, otherwise the bits are discarded._{B,i} - 7. A common secret key is obtained from the retained bits by using an information reconciliation protocol and a privacy amplification protocol [19].

The retained bits, which are obtained in step 6, are highly correlated between Alice and Bob, and the expected number of different bits (i.e., “error bits”) is small because of the correlation property required for the cascaded laser systems. Alice and Bob are able to generate a common secret key from their retained bits if an eavesdropper Eve does not have information about their retained bits more than a certain threshold amount. This point is explained in the next subsection in detail.

In step 7, the technique of privacy amplification [19] can be used to combine multiple bits to create a more secure key bit, so that the chances of Eve guessing a key bit can be made arbitrarily small by using a large enough number of bits to make each key bit. It is not necessary for Alice and Bob to know which bits Eve knows in order for them to implement privacy amplification. As a simple example, we can consider that Alice and Bob use the exclusive-OR operation to generate one key bit from two of their bits. Eve cannot know for certain the key bit unless she has both of these two bits. Methods of private amplification allow Alice and Bob to ensure that the chances of Eve obtaining a key bit become arbitrarily small by increasing the number of bits used to make each key bit.

#### 2.5 Secure key generation rate

Since the design of cascaded laser system is disclosed, it should be assumed that the same systems are available to eavesdroppers as well as legitimate users. We assume a passive eavesdropper, Eve, that can use the common random light - for example, inject it into one or more cascaded laser systems - and also obtain any information exchanged through a public channel between Alice and Bob. The security of the present scheme depends on the amount of information which Eve can obtain about the retained bits of Alice and Bob.

A fundamental assumption of the present scheme is the following physical limitation: the common random light has a fluctuation bandwidth which is too broad to completely observe its fast temporal variation with current technology, i.e., no one, neither a legitimate user Alice or Bob nor an attacker Eve, can continuously measure and record the entire common light. This implies that Eve cannot reproduce the entire common light to repeat the observations of Alice or Bob and infer their retained bits *after* the parameter settings have been exchanged at an arbitrary later time. Therefore, Eve has to make her observations at the same time as Alice and Bob, *while* the common random light is being broadcast.

It is reasonable to suppose that Eve can simultaneously operate more than one, say *M _{E}*, cascaded laser systems, which have different parameter sets

*v*,

_{E,i}*i*= 1, 2, …,

*M*, to increase her chances of making the same observations as Alice or Bob. In this situation, the final key generation rate

_{E}*R*, which is the ratio of the number of secret key bits to the number

_{final}*m*of samples in step 4, is given as follows [14]:

*M*is the number of all possible values of the parameter sets,

*M*is the maximum number of the cascaded laser systems which Eve can operate simultaneously, and

_{E}*I*is an upper bound of the information per bit known by Eve about the retained bits of Alice or Bob when the parameter sets of Alice and Bob are identical and any of the Eve’s parameter sets

_{E}*v*does not match that of Alice and Bob. The quantity

_{E,i}*R*is the bit error rate between Alice’s retained bits and Bob’s. In practice, the dynamics of the lasers devices and detectors are not completely identical, so there will be some bit errors. To reduce this error rate, we employ a particular quantization method for step 3, which leads to a modification of Eq. (2) that will be described in detail in Sec. 5.1.

_{fail}*h*is the binary entropy function defined by $h\left(x\right)=-x\mathrm{log}\left(x\right)-\left(1-x\right)\mathrm{log}\left(1-x\right)$.

It is possible for Alice and Bob to generate secret keys up to rate *R _{final}* with security guaranteed when

*R*is strictly positive. In an ideal system,

_{final}*I*and

_{E}*R*are zero, so the only condition is

_{fail}*M*<

_{E}*M*. The number

*M*is given by

*M = 2*, where

^{N}*N*is the number of stages in the cascaded laser system, so this condition can be satisfied for any given

*M*by making

_{E}*N*large enough. In practice, it is necessary to ensure that

*I*and

_{E}*R*are also sufficiently small so that

_{fail}*R*is strictly positive. The important feature of this secure key distribution scheme is the fact that Eve needs to increase exponentially the number of her systems as

_{final}*2*in order to be certain of making the same measurements as Alice and Bob and so obtain all the bits matching between Alice and Bob. For example, if the laser cascade has

^{N}*N*= 20 stages, Eve would require over 1 million systems (2

^{20}≈10

^{6}).

In this paper, we show that it is practically feasible to achieve a positive value of *R _{final}* by using the cascaded laser systems. Indeed, a small value of

*I*<< 1 can be achieved due to the correlation property of the cascaded laser systems: when Eve’s parameter sets

_{E}*v*do not match that of Alice and Bob, the output intensities of Eve’s systems are uncorrelated with those of Alice and Bob, and they do not provide enough information for inferring the retained bits of Alice and Bob. As for

_{E,i}*R*, below we shall show that a small value of

_{fail}*R*can also be achieved in practice.

_{fail}## 3. Experimental setup

Figure 4 shows our experimental setup for secure key distribution. We used five semiconductor lasers. The lasers are single-mode distributed-feedback (DFB) lasers (NTT Electronics, NLK1C5GAAA, the optical wavelength of 1547 nm) with external optical injection and optical feedback, as used in previous experiments [15]. In order to achieve the required synchronization and correlation properties, the lasers should be as similar as possible, and the temperature, electrical injection current, optical injection strength, optical feedback length and optical feedback strength, need to be tuned so that (i) optical injection locking occurs for all response lasers with respect to injection signal, (ii) the optical and radio-frequency (RF) spectra are as similar as possible at each stage, (iii) correlation between drive and response lasers is low, and (iv) correlation between response lasers in each stage is high when the phase-shift parameter is the same, and low when the phase-shift parameter is different. Details of how to achieve these conditions are described in the following (also see [15] in the case of a single stage).

One laser was used for a common drive signal (called Drive laser) and the other lasers were used for Response lasers for legitimate users. One legitimate user (Alice) had two Response lasers (called Response A-1 and A-2 lasers), and the other user (Bob) had two other lasers (called Response B-1 and B-2 lasers), as the cascaded laser system with two laser units (*N* = 2).

The Response A-1 and B-1 lasers were subject to a common random drive signal at the first stage. The output light from the Drive laser was injected to the Response A-1 and B-1 lasers, using an optical isolator (ISO) to achieve unidirectional injection. We used a phase modulator (PM) (Photline, MPX-LN-05-P-P-FA-FA, 5 GHz bandwidth), driven by an electronic noise generator (Noisecom, UFX7110, 1.5 GHz bandwidth) to generate constant-amplitude and random-phase (CARP) light for the Drive light with the bandwidth of 1.5 GHz [15]. The CARP light was divided into two beams at a fiber coupler (FC) and each of the CARP beams was transmitted through 60-km-long dispersion-shifted fibers (DSF). This corresponds to a practical scenario with a maximum distance of 120 km between the two legitimate users. After the transmission, each light power was amplified by an erbium-doped fiber-optical amplifier (EDFA). The center wavelength was extracted at around 1.5 μm by using a wavelength filter (WL Filter). The polarization direction of each beam was adjusted by a polarization controller (PC) to achieve coherent optical injection. Each beam was attenuated by an optical attenuator (ATT) to adjust the injection strength and then injected to Response A-1 (or B-1) laser. A tracking procedure is needed to adjust for the slow variation of the timing offset between the waveform and the sampling clock, and the slow variation of polarization direction.

The output of the Response A-1 (or B-1) laser was injected into the Response A-2 (or B-2) laser at the second stage for synchronization. The parameter values are set so that the dynamical behavior of the lasers is as similar as possible at each stage, i.e., between Response A-1 and B-1 lasers, and between Response A-2 and B-2 lasers. For example, the injection currents were set to 30.00 mA (2.84 *I _{th}*), 12.30 mA (1.31

*I*), 12.68 mA (1.34

_{th}*I*), 12.84 mA (1.30

_{th}*I*), and 11.99 mA (1.27

_{th}*I*) for the Drive, Response A-1, B-1, A-2, and B-2 lasers, respectively, where

_{th}*I*is the injection current at the lasing threshold. The relaxation oscillation frequencies were 7.0, 2.0, 2.0. 1.5, and 1.5 GHz for the Drive, Response A-1, B-1, A-2, and B-2 lasers, respectively.

_{th}Each of the Response A-1 and B-1 lasers was subject to optical feedback from a fiber mirror reflector (M). In the context of synchronization of lasers with complex dynamics this is commonly called a “closed-loop” configuration [18,20]. The external cavity lengths were set to 7.36 m for both the Response A-1 and B-1 lasers, and the corresponding feedback delay time was 35.4 ns. The phase of the optical feedback light from each Response laser was shifted by a random binary waveform, generated with an arbitrary waveform generator, with the binary values corresponding to phase shift π or 0. Note that each Response laser had an independent phase-shift generator with independently generated random sequences of π and 0. The output of each of the two Response lasers was divided into two beams by a fiber coupler, - one for monitoring, and one for injection to the next laser in the cascade. Each of the latter injection beams was attenuated by an optical attenuator and injected into the Response A-2 (or B-2) laser. The Response A-2 and B-2 lasers were set up similar to the Response A-1 and B-1, except that the external cavity had a different length (11.74 m for both the Response A-2 and B-2 lasers) and, correspondingly, a different feedback delay time (56.5 ns). Note that precise matching of the external cavity lengths is required to achieve high-quality synchronization for each stage between the Response A-1 and B-1 lasers and between the Response A-2 and B-2 lasers. On the other hand, the different external cavity lengths were used between the stage 1 and 2 to avoid correlation of temporal waveforms between Response A-1 and A-2 lasers and between Response B-1 and B-2 lasers. The phases of the optical feedback for Response A-2 and B-2 were shifted by two independently random values π or 0. Each of the monitor beams was detected by a photodiode (PD), amplified by an electric amplifier (Amp), and observed by a digital oscilloscope (Tektronix, DPO71604B, 16 GHz bandwidth).

We set the optical wavelengths of the Drive and Response lasers by adjusting the temperature of the lasers. We set the optical wavelengths of 1547.281 nm for the Drive laser, 1547.257 nm for the Response A-1 laser, and 1547.256 nm for the Response B-1 laser, respectively, without optical injection. The optical wavelength detuning between Drive and Response A-1 is *Δλ _{A1,D}* =

*λ*−

_{A1}*λ*= − 0.024 nm (−3.0 GHz in frequency) and that between Drive and Response B-1 is

_{D}*Δλ*=

_{B1,D}*λ*−

_{B1}*λ*= − 0.025 nm (−3.1 GHz) without optical injection. In the presence of optical injection from the Drive to the Response lasers, the dominant peak in the optical spectra of each of the Response A-1 and B-1 lasers matches that of the Drive laser at the wavelength of 1547.281 nm. The matching is due to injection locking of the main oscillation component of the Response laser. For the second stage, we set the optical wavelengths of 1547.258 nm for the Response A-2 laser, and 1547.261 nm for the Response B-2 laser, respectively. The optical wavelength detuning between Response A-2 and Drive lasers is

_{D}*Δλ*=

_{A2,D}*λ*−

_{A2}*λ*= −0.023 nm (−2.9 GHz) and that between Response B-2 and Drive lasers is

_{D}*Δλ*=

_{B2,D}*λ*−

_{B2}*λ*= −0.020 nm (−2.5 GHz) without optical injection. In the presence of optical injection from the first to the second stages, the injection locking occurs between the Response A-1 and A-2 lasers and between the Response B-1 and B-2 lasers as well. As a result, the optical wavelengths of all the five lasers are matched at 1547.281 nm (i.e., the wavelength of the Drive laser) under injection locking.

_{D}## 4. Common random-signal induced synchronization with constant-amplitude random-phase light

In this section we show that the cascaded laser systems exhibit the required synchronization and correlation properties.

#### 4.1 Experimental results of temporal waveforms, correlation plots, and RF spectra

We first show temporal waveforms and cross correlation plots of the laser outputs when common random-signal induced synchronization is achieved by optical injection locking. The feedback phases are set to be matched at each stage, i.e., between the Response A-1 and B-1 lasers, and between the Response A-2 and B-2 lasers. The temporal waveforms of the Response A-1 and B-1 and their cross correlation plots are shown in Figs. 5(a) and 5(b). The temporal waveforms of the Response A-2 and B-2 and their cross correlation plots are shown in Fig. 5(c) and 5(d). The temporal waveforms of the Response lasers are similar at each stage. The analog cross correlation values *C _{A}* are 0.894 and 0.888 between the Response A-1 and B-1 lasers and between the Response A-2 and B-2 lasers, respectively. The analog cross correlation value between the corresponding Response lasers at each stage is high when injection locking is achieved and the feedback phases are matched.

The temporal waveforms of the Drive and Response A-2 lasers and their cross-correlation plot are shown in Fig. 6. The value of the analog cross correlation between the Drive and Response A-2 lasers is 0.021 and this observed value is low and negligible. Ideally zero correlation is expected when using ideal constant-amplitude random-phase light for the Drive laser. In practice, even though the external modulator only modulates the optical phase, the Drive laser has a small intensity fluctuation due to the intrinsic relaxation oscillation fluctuations of the semiconductor laser. Therefore, there remains a small nonzero correlation.

Next we show the effect of the feedback phases on characteristics of synchronization between the Response A-2 and B-2 lasers. The two users, Alice and Bob, can select the phase shift *θ _{A,j}* and

*θ*of either π or 0 independently for each stage. Four cases of the parameter settings of phase shift can be considered in the cascaded laser systems with two laser units: (i) Alice and Bob have the same parameter values at both the first (Response A-1 and B-1) and second (Response A-2 and B-2) stages (i.e.,

_{B,j}*θ*=

_{A,1}*θ*and

_{B,1}*θ*=

_{A,2}*θ*), (ii) they have the same value at the first stage but different values at the second stage (

_{B,2}*θ*=

_{A,1}*θ*and

_{B,1}*θ*≠

_{A,2}*θ*), (iii) they have different values at the first stage but the same value at the second stage (

_{B,2}*θ*≠

_{A,1}*θ*and

_{B,1}*θ*=

_{A,2}*θ*), (iv) they have different values at both of the two stages (

_{B,2}*θ*≠

_{A,1}*θ*and

_{B,1}*θ*≠

_{A,2}*θ*). Figure 7 shows the cross correlation plots between the Response A-2 and B-2 lasers for the above-mentioned four cases. Synchronization can be achieved only when they have the same parameter values at both of the two stages, as shown in Fig. 7(a). High cross correlation of 0.888 is achieved only when the feedback phases are matched at every stage. For other cases, no synchronization is achieved. The cross correlations less than 0.2 are obtained when the feedback phases at the first and/or second stages are mismatched. We confirmed that parameter matching of the optical feedback phase at every stage is required for achieving high-correlation between the Response A-2 and B-2 lasers.

_{B,2}Figure 8 shows the RF spectra of the Drive and the four Response lasers. The RF spectra of the Response A-1 and B-1 (Figs. 8(b) and 8(d)) are very similar, as well as those of the Response A-2 and B-2 (Figs. 8(c) and 8(e)). On the contrary, the RF spectra of the Drive and Response lasers are completely different. The RF spectra of the Response lasers have peak frequencies at around 1.5 and 4.0 GHz. The peak frequency of 1.5 GHz corresponds to the bandwidth of the noise signal used for random phase modulation at the Drive laser. The peak frequency of 4.0 GHz corresponds to the detuning of the two main peaks of the optical spectrum, corresponding to the optical wavelength of the Drive laser and the wavelength of the Response laser, slightly shifted due to the optical injection (see [15] for details). The shape of the RF spectra is independent of the optical feedback phase.

From these results, we experimentally confirmed that common random-signal induced synchronization in unidirectionally-coupled cascades of semiconductor lasers can be achieved with the CARP drive signal. We also note that degradation of the synchronization due to distortion of the drive signal waveform by propagation over the two 60-km optical fibers was hardly observable. This suggests similar performance could be obtained over much longer optical fibers. From the point of view of security of key generation using this synchronization phenomenon, the bandwidth of the noise signal generator for the CARP light should be increased further to avoid complete detection and recording of phase fluctuation by Eve. Superluminescent diodes or erbium-doped fiber amplifiers could be good candidates for a source of CARP light with much larger bandwidth.

#### 4.2 Experimental result of modulation of phase-shift parameter values

Next, we observed short-term cross-correlation between the Response A-2 and B-2 lasers when the optical feedback phases are shifted independently by random parameter choices π or 0 at the each stage. In this experiment, we set the period of 0.5 μs for one parameter choice (i.e., the modulation frequency of the phase shift is 2.0 MHz) because the transient time for synchronization requires several hundreds of nanoseconds due to the long external cavity lengths of the Response lasers. The Return to Zero (RZ) format is used for the random parameter shift to reset the temporal waveforms to synchronized states after one parameter choice. Figure 9 shows the time evolutions of randomly-selected parameter shifts for the four Response lasers and the short-term cross-correlation values of the temporal waveforms between the Response A-2 and B-2 lasers (the bottom trace). Figure 9 demonstrates a main result of this paper. When the same parameter values are selected at each stage (i.e., *θ _{A,1}* =

*θ*and

_{B,1}*θ*=

_{A,2}*θ*), the short-term cross-correlation indicates high values at ~0.8, as denoted by the dashed boxes in Fig. 9. On the other hand, low correlation values (~0.2) are obtained when different parameter values are selected for at least one stage. This result is consistent with that shown in Fig. 7. The temporal synchronization characteristics with parameter shift shown in Fig. 9 are suitable for real-time successive generation of the correlated bit sequences required for secure key distribution, as will be described in Sec. 5.

_{B,2}## 5. Secure key distribution

#### 5.1 Robust sampling method

In this section, we describe a correlated bit generation method by using synchronized temporal waveforms between the Response A-2 and B-2 lasers shown in Sec. 4. In experiments, there is unavoidable noise in the cascaded laser systems. We use a robust sampling method as a practical technique to reduce the bit error rate (BER) due to this noise at the step 3 in the secure key generation procedure shown in Sec. 2.4. In each period of the phase shift, the intensities of optical outputs from Response A-2 and B-2 are sampled at a predetermined timing before the end of the period, and compared with threshold values. We set two threshold values as follows:

where*I*and

_{th,u}*I*are the upper and lower threshold values for random bit generation,

_{th,l}*m*is the mean of the temporal waveform,

*σ*is the standard deviation of the temporal waveform,

*C*and

_{+}*C*are the threshold coefficients to determine the two threshold values. A bit ‘1’ is obtained when a sampled value is larger than the upper threshold

_{-}*I*. A bit ‘0’ is obtained when a sampled value is lower than the lower threshold

_{th,u}*I*. No bit is generated when a sampled value is located between

_{th,l}*I*and

_{th,u}*I*.

_{th,l}In this robust sampling method, only a proportion of the sampled values are used for bit generation, because of the discarded sampled values between *I _{th,u}* and

*I*. If this fact is taken into account, Eq. (2) for the final key generation rate

_{th,l}*R*is modified as follows:

_{final}*R*is the constant representing the proportion of non-discarded samples to the total samples (see also Appendix A.1).

_{gen}An example of the robust sampling method is shown in Fig. 10. Two thresholds (black lines) are shown on the temporal waveforms of the Response A-2 and B-2 lasers in Fig. 10(a) and on the correlation plot in Fig. 10(b). The temporal waveforms outside the two thresholds are similar to each other between the two Response outputs in Fig. 10(a). In Fig. 10(b), there are four regions denoted as 00, 01, 10 and 11. The first number corresponds to the bit generated by Alice, and the second number corresponds to the bit generated by Bob. The same bits are generated by the robust sampling in the regions of 00 and 11. On the other hand, the bits are different in the regions of 01 and 10. The proportion of points in 01 and 10 regions become negligible by increasing the region within the two thresholds (colored regions in Figs. 10(a) and 10(b)). This implies that the bit error rate can be improved. However, as a trade-off, the bit generation rate decreases with increasing the region within the two thresholds.

We make an estimation for the bit error rate and bit generation rate, assuming that the two legitimate users perform the key generation procedure in Sec. 2.4 with the robust sampling method. Figure 11 shows the two-dimensional maps for the bit generation rate *R _{gen}* and the bit error rate

*R*obtained by the robust sampling method as functions of the two threshold coefficients

_{fail}*C*and

_{+}*C*(see Appendix A.1 for the definitions of

_{-}*R*and

_{gen}*R*). Bright (white or yellow) region indicates high value and dark (black) region indicates low value in Fig. 11. Figure 11(a) shows that the bit generation rate is decreased by increasing the two threshold coefficients, because the number of sampled data located outside the two thresholds is decreased. Figure 11(b) shows that the bit error rate is also decreased by increasing the two threshold coefficients: the difference in temporal waveforms due to noise can be eliminated by increasing the two threshold values. Therefore, there is a trade-off between minimization of

_{fail}*R*and maximization of

_{fail}*R*: lower bit error rate can be achieved only at the expense of lowering the bit generation rate.

_{gen}#### 5.2 Final key generation rate

The final key generation rate *R _{final}* of Eq. (5) in Sec. 5.1 is estimated in this subsection. The bit error rate

*R*and bit generation rate

_{fail}*R*in Eq. (5) vary with changing the two threshold coefficients

_{gen}*C*and

_{+}*C*of the robust sampling. Figure 12(a) shows the final key generation rate

_{-}*R*of Eq. (5) as a function of

_{final}*C*and

_{+}*C*estimated using our experimental data. The parameter values of the cascaded laser system with two laser units are as follows:

_{-}*N*= 2,

*M*= 2

^{2}= 4,

*M*= 2

_{E}^{2-1}= 2. The quantity

*I*was set at a fixed value of

_{E}*I*= 0.20, and was independent of

_{E}*C*and

_{+}*C*(see Section 6 for further explanation). The white region in Fig. 12(a) corresponds to the region where the final key generation rate

_{-}*R*is less than 0, i.e., the two users cannot share a secret key. Figure 12(a) shows that secret key generation becomes possible by increasing the two threshold coefficients, demonstrating the effectiveness of the robust sampling method. However, too large thresholds result in smaller value of

_{final}*R*. So, there are optimal values of the thresholds to obtain the maximum value of

_{final}*R*.

_{final}Here we introduce a constraint in optimizing the threshold coefficients. The probability of the occurrence of bit ‘0’ needs to be ideally 0.5 for random bits (‘0’ or ‘1’) of both of the legitimate users [20, 21]. The choices of the two threshold values change the probability of the occurrence of 0. The black line in Fig. 12(a) indicates a set of the threshold coefficients by which the probability of the occurrence of 0 in the generated bits is within the range 0.500 ± 0.003. Figure 12(b) shows the final key generation rate along with the black line, where the horizontal axis is the lower threshold coefficient *C _{-}*. The upper threshold coefficient

*C*is determined automatically from the constraint between

_{+}*C*and

_{-}*C*imposed by the black line in Fig. 12(a). The curve in Fig. 12(b) shows that the maximum final key generation rate of 3.24 × 10

_{+}^{−2}is obtained when the threshold coefficient values are set to be

*C*= 0.640 and

_{+}*C*= 0.495. The white dotted circle in Fig. 12(a) corresponds to this maximum point.

_{-}We used these two optimal threshold coefficients and evaluated statistical measures of secure key generation. The results are summarized in Table 1. The average analog cross-correlation of 0.845 is achieved, and 14142 bits are obtained by robust sampling in our experiment. The bit generation rate by robust sampling and the bit error rate are 0.446 and 1.45 × 10^{−2}, respectively. The probabilities of the occurrence of 0 for Alice and Bob are 0.5006 and 0.4979, respectively, and these values are close to the ideal value of 0.5. The mutual information *I*(*A*;*B*) between Alice and Bob’s retained bits is 0.8911. We denote stochastic variables representing the retained bits of Alice and Bob with *A* and *B*, respectively, and the definition of *I*(*A*;*B*) is given in the Appendix A.1. The final key generation rate is calculated as 3.24 × 10^{−2} from Eq. (5) with the values *M* = 4, *M _{E}* = 2,

*R*= 0.446,

_{gen}*R*= 1.45 × 10

_{fail}^{−2}, and

*I*= 0.20 (see also Fig. 12(b)). The value of

_{E}*I*was estimated from our experimental results, and the details will be described in Sec. 6. We also calculate the final key generation speed from the parameter modulation frequency. The modulation frequency of the parameter shift is 2 MHz in our experiment and the final key generation speed is calculated as 2 MHz × 3.24 × 10

_{E}^{−2}= 64 kb/s. The final key generation speed can be increased by increasing the modulation frequency of the parameter shift if the transient time for synchronization is shortened. The time for the parameter shift would be proportional to the number

*N*of cascaded laser system since the transient time for synchronization is almost constant for each stage.

## 6. Evaluation of eavesdroppers’ attack

We showed that the legitimate users (Alice and Bob) can generate a common secret key from correlated temporal waveforms in Sec. 5, based on an assumed value of *I _{E}*, i.e.,

*I*= 0.2. In this section, we give a basis for this estimation of

_{E}*I*. As mentioned in Sec. 2.5, suppose that Eve simultaneously operates

_{E}*M*cascaded laser systems with different parameter sets

_{E}*v*,

_{E,i}*i*= 1, 2, …,

*M*, to increase her chances of making the same observations as Alice or Bob while the common random light is being broadcast and of knowing their bits.

_{E}*I*is an upper bound of Eve’s information about a retained bit of Alice (or Bob) in the case that the parameter sets of Alice and Bob are identical,

_{E}*v*=

_{A}*v*, and any of

_{B}*v*does not match them, i.e., the case where Eve fails to make the same observations. This case sometimes happens when

_{E,i}*M*<

_{E}*M*. For this case, we consider some possible situations where Eve attempts to infer the retained bits of Alice (or Bob) by using temporal waveforms of Eve’s cascaded laser system with mismatched parameter values. Then, we make an estimation of

*I*.

_{E}#### 6.1 Evaluation by experiments

We first assume that Eve samples a temporal waveform output at the last stage (stage 2) in the cascaded laser system with two laser units (*N* = 2) to estimate a common bit when the parameter sets are mismatched between Eve and Alice (or Bob). We calculated the mutual information *I*(*A*;*E*) between Alice’s and Eve’s bits sampled from their analog temporal waveforms (see Appendix A.1 for the definition of *I*(*A*;*E*)). We assumed that Eve uses the mean value for a single threshold to generate bits, whereas Alice uses two threshold values for the robust sampling. The three cases are considered: (i) the parameter value is mismatched only at the stage 1 (*θ _{A,1}* ≠

*θ*and

_{E,1}*θ*=

_{A,2}*θ*), (ii) the parameter value is mismatched only at the stage 2 (

_{E,2}*θ*=

_{A,1}*θ*and

_{E,1}*θ*≠

_{A,2}*θ*), and (iii) both of the parameter values are mismatched at the stage 1 and 2 (

_{E,2}*θ*≠

_{A,1}*θ*and

_{E,1}*θ*≠

_{A,2}*θ*). Table 2 shows the analog cross correlation

_{E,2}*C*between the experimentally-obtained temporal waveforms of the Response laser outputs at the stage 2 in Alice’s and Eve’s systems with parameter mismatch. The mutual information

_{A}*I*(

*A*;

*E*) is also shown, which is calculated from the bits generated from these temporal waveforms. The stochastic variables

*A*and

*E*represent Alice and Eve’s bits, respectively. The largest analog cross correlation is 0.179 when the parameter value is mismatched only at the stage 2, and the mutual information is 0.0208 between bits generated by Alice and Eve, as shown in Table 2. For all the cases, it is confirmed that only small information leakage can occur with this type of attack.

Next, we assume that Eve can sample a Response waveform at the stage 1, instead of the stage 2, to estimate a common bit when the sets of the parameter values are mismatched between Eve and Alice (or Bob). Table 3 shows the analog cross correlation between the temporal waveform of the output at the stage 1 in Eve’s system and that at the stage 2 in Alice’s system with parameter mismatch, and the mutual information *I*(*A*;*E*) calculated from the bits generated from these temporal waveforms. The largest analog cross correlation is 0.361 when the parameter value is mismatched only at the stage 2. This large cross correlation results from the fact that the Response temporal waveforms in stage 1 and 2 have some correlation, since a chaotic temporal waveform is injected from the stage 1 laser to the stage 2 laser [16,17]. However, the mutual information between bits generated by Alice and Eve is not large (0.0925).

From the above results, we can judge that the value of *I _{E}* = 0.20, used in our previous calculation with Eq. (5) described in Sec. 5.2, is a safe upper estimate of the information leakage. In the above arguments, we have considered two reasonable types of Eve’s attacks, i.e., the use of quantized output of stage 1 or 2. However, there could be other ways of inferring which achieve somewhat larger

*I*(

*A*;

*E*). Therefore, for safety, we assumed the value

*I*= 0.20 which is much larger than the experimentally obtained maximum

_{E}*I*(

*A*;

*E*) = 0.0925.

#### 6.2 Evaluation by numerical simulation

There is a possibility that Eve operates several cascaded laser systems to increase her information about the retained bits of Alice and Bob, though we considered only the situation that Eve has only one system in Sec. 6.1. We carried out numerical simulations to evaluate *I _{E}* in the case that Eve operates

*M*systems up to

_{E}*M*= 3. The parameter values in our simulation are experimentally reasonable one, and the details of our simulation are given in Appendix A.2.

_{E}First, we consider the case that each of Alice and Eve operate one system and the parameter sets of their systems are mismatched. Table 4 shows numerical results for the analog cross correlation between the temporal waveform of the output at the stage 1 or 2 for Eve’s system and that at the stage 2 for Alice’s system, and the mutual information when bits are generated from these temporal waveforms. Since spontaneous emission noise is neglected in our simulation, a single threshold given by the mean value is used in the bit generation both for Alice and Eve. These numerically obtained values roughly coincide with those of our experiments shown in Table 2 and 3. In addition, it is clear that both *C _{A}* and

*I*(

*A*;

*E*) take much larger values than the other cases when Eve samples the output of stage 1 laser and the parameters are mismatched only at stage 2. This is the feature observed in the experiment. These agreements with experiment may validate the present numerical simulation.

Next, we consider the case that Eve operates three systems and samples the outputs of lasers at both stages 1 and 2 for all the three systems, while Alice operates one system. It is assumed that the parameter sets of three Eve’s systems are mismatched with that of Alice’s system. Eve obtains six bits in this case, and we denote the stochastic variable for these bits with *E’*. The mutual information between Alice’s bit and Eve’s set of six bits is obtained as *I*(*A*;*E’*) = 8.23 × 10^{−2}. This value is close to the maximum *I*(*A*;*E*) = 5.84 × 10^{−2} in Table 4, which is for the case that Eve uses one system and samples the output of stage 1 with mismatch only at stage 2. The mutual information does not significantly increase with increasing *M _{E}* up to

*M*= 3:

_{E}*I*(

*A*;

*E’*) is less than twice of

*I*(

*A*;

*E*). This property is expected to hold also experimentally, and suggests that the value of

*I*= 0.2, which was estimated from

_{E}*I*(

*A*;

*E*) of

*M*= 1 case, will be valid also for

_{E}*M*= 3 case.

_{E}## 7. Estimation of final key generation rate for large number of Eve’s cascaded laser systems

Consider the case that Eve attempts to obtain a better estimate of the retained bits of Alice and Bob by increasing the number of her cascaded laser systems. This attack is called *sampling attack* [22]. Eve prepares a large number of the cascaded laser systems, which are subject to a common drive signal, and each of her systems has different values of the optical feedback phase parameter. Suppose that a cascaded laser system consists of *N* stages and the optical feedback phase at each stage is shifted with binary values 0 or π. The total number of all the possible sets of parameter values is *M* = 2* ^{N}*. If Eve has

*M*= 2

_{E}*cascaded laser systems corresponding to all the possible sets of parameter values, one of them must coincide with the one Alice and Bob use, and Eve can succeed in generating the retained bit. Therefore, it is necessary to satisfy the condition*

^{N}*M*<

_{E}*M*= 2

*for the key distribution to be secure against the sampling attack [14,22]. To cope with the sampling attack, it is effective to increase the number*

^{N}*N*of the laser units (stages) in the cascaded laser system, because Eve needs to increase exponentially the number of her systems as 2

*to perform the perfect sampling attack. For example, for only*

^{N}*N*= 20 laser cascade stages, Eve needs 2

^{20}≈10

^{6}cascaded laser systems for the perfect sampling attack.

Although we have so far only been able to perform an experiment for *N* = 2 stage systems, it has been numerically confirmed that cascaded laser systems can satisfy the required synchronization property described in Sec. 2.3 also for larger *N >* 2. The details of our simulation are described in Appendix A.3. We estimate the performance of secure key distribution for *N >* 2 using Eq. (5). Table 5 compares experimental values of *R _{gen}* and

*R*in the cases of

_{fail}*N*= 1 and

*N*= 2. The values of both

*R*and

_{gen}*R*are similar to each other and do not significantly depend on

_{fail}*N*. This fact suggests that

*R*and

_{gen}*R*may be assumed constant independent of

_{fail}*N*. Therefore, we estimate the final key generation rate for larger

*N*by using this experimental data obtained for the two laser unit case (

*N*= 2). In addition, we use

*I*= 0.20 in Eq. (5), since the required synchronization property holds for larger

_{E}*N*.

The maximum final key generation rate *R _{final}* estimated by using Eq. (5) is shown in Fig. 13 as a function of

*N*, where the parameter values

*R*= 0.446,

_{gen}*R*= 1.45 × 10

_{fail}^{−2}, and

*I*= 0.20, and

_{E}*M*= 2

*were used. We assume three types of Eve, named Weak Eve, Moderate Eve and Strong Eve, with different numbers of cascaded laser systems (different*

^{N}*M*) for sampling attack. Weak Eve has only one cascaded laser system, i.e.,

_{E}*M*= 1. Moderate Eve has just half of all the possible cascaded laser systems, i.e.,

_{E}*M*= 2

_{E}

^{N}^{−1}. Strong Eve has

*M*= 2

_{E}*̶ 1 cascaded laser systems, just by one less than the perfect sampling attack for which secure bit generation cannot be achieved between Alice and Bob. In Fig. 13, the left and right vertical axes represent the final key generation rate and the corresponding final key generation speed estimated from the parameter modulation frequency 2 MHz. The final key generation rate decreases exponentially as the number of the laser units*

^{N}*N*increases for all the three cases. Note that the plots for the Weak and Moderate Eves are close to each other and the slopes of these plots decrease slowly, while the slope for the Strong Eve decreases rapidly.

The secure key generation speed can be improved by increasing the parameter modulation frequency (2 MHz) and by reducing the transient time for synchronization of the corresponding Response lasers. The parameter modulation frequency is restricted by the long external cavity lengths (7.36 m and 11.74 m at the stage 1 and 2) of our cascaded laser systems. The transient time for synchronization requires several to ten times the feedback delay time (35.4 ns and 56.5 ns at the stage 1 and 2) in the external cavity [23,24]. We expect that the transient time can be shortened and the parameter modulation frequency can be increased to the order of several hundreds of MHz by using photonic integrated circuits [25–28], instead of the current optical fiber systems. The final key generation speed of several tens of kb/s would be expected for 10 laser units with photonic integrated circuits.

Finally, we present an argument for the optimum number *N* of the stages when the number *M _{E}* of Eve’s cascaded laser systems is fixed. Assume an ideal case of bit generation in Eq. (5):

*R*= 1,

_{gen}*R*= 0,

_{fail}*h*(

*R*) = 0, and

_{fail}*I*= 0. This means that the cascaded laser systems are synchronized identically, the sampling is completed with no error, and the information leakage is prevented. Under this assumption, Eq. (5) reads,

_{E}For fixed *M _{E}*, Eq. (6) is a function of

*M*( = 2

*) with maximum when*

^{N}*M*= 2

*M*. Therefore, once Eve’s ability

_{E}*M*is assumed, the maximum bit generation rate can be achieved when the legitimate users use the number

_{E}*N*of stages which is an approximate integer solution of 2

*= 2*

^{N}*M*. As an example, we plot

_{E}*R*as a function of

_{final}*N*for a fixed

*M*= 2

_{E}^{10}by using Eq. (5) in Fig. 14, which does not correspond to an ideal case but to our experimental case. Note that secure key distribution (positive

*R*) is achieved for

_{final}*N*> 10, whereas it is not achieved for $N\le 10$ because of the possibility of perfect sampling attack. It can be confirmed that the largest bit generation rate is obtained at

*N*= 11, which is the integer solution of 2

*= 2*

^{N}*M*. The security can be guaranteed if the cascaded laser systems have just

_{E}*N*+ 1 stages when the eavesdropper has

*M*= 2

_{E}*cascaded laser systems for a sampling attack.*

^{N}## 8. Conclusions

We experimentally demonstrated that common random-signal induced synchronization is possible in unidirectionally-coupled cascades of semiconductor lasers. Moreover, we experimentally demonstrated that correlated random bit sequences generated by using this synchronization phenomenon is suitable for secure key distribution, and that information-theoretic secure key distribution between two legitimate users using the correlated random bit sequences with a secure key generation procedure is possible. To evaluate the security of the system, we considered the situation where an eavesdropper attempts to estimate the common bits from temporal waveforms of her own cascaded laser systems with mismatched parameter values. The mutual information between the eavesdropper and a legitimate user is estimated to be less than 0.1. We optimized the two threshold values for robust binary sampling and maximized the secure key generation rate. The final secure key generation speed of 64 kb/s was obtained using parameter modulation frequency of 2 MHz in cascaded laser systems with two cascaded laser units, separated by 120 km of optical fiber. Finally, we evaluated the secure key generation rates for the case of a large number of laser cascade units secure against a sampling attack, based on some reasonable assumptions. We showed that the security can be guaranteed if the laser cascade systems have just *N* + 1 stages when the eavesdropper has *M _{E}* = 2

*cascaded laser systems for a sampling attack. Our results indicate that the proposed scheme for generating correlated random bit sequences using common random-signal induced synchronization in cascaded semiconductor lasers is a promising approach to implementing information-theoretic secure key distribution.*

^{N}## Appendix

#### A.1 Definition of parameters in Eqs. (2) and (5)

The definition of the parameters of Eqs. (2) and (5) in Secs. 2.5 and 5.1 is described in this Appendix. First, we define the bit generation rate ${R}_{gen}$ by robust sampling as follows:

*N*is the number of total samplings of the analog temporal waveforms,

_{sample}*N*is the number of non-discarded samples under the robust sampling operation.

_{gen}*N*and ${R}_{gen}$ depend on the two threshold values of robust sampling.

_{gen}The bit error rate *R _{fail}* is defined as follows:

*N*is the number of bits that are different between Alice and Bob when their parameter sets are identical with each other. The bit error rate also depends on the two threshold values of robust sampling through

_{diff}*N*.

_{gen}The mutual information *I*(*X*;*Y*) between random bits *X* and *Y* is defined as follows:

*p*(

_{X}*a*) is the probability of the occurrence of

*X*=

*a*(0 or 1),

*p*(

_{Y}*b*) is the probability of the occurrence of

*Y*=

*b*(0 or 1), and

*p*(

_{X,Y}*a,b*) is the joint probability of the occurrence of bit

*a*for

*X*and bit

*b*for

*Y*. The mutual information

*I*(

*X*;

*Y*) indicates how much information is shared between

*X*and

*Y*. In particular we evaluate

*I*(

*A*;

*E*), the amount of information leakage from legitimate user Alice to eavesdropper Eve. We use the amount of

*I*(

*A*;

*E*) to eliminate the information leakage to Eve by information reconciliation and privacy amplification [19].

#### A.2 Details of numerical simulations in Section 6.2

To model the cascaded laser systems driven by common CARP light, we use the Lang-Kobayashi equation [29] with the CARP injection term:

*E*and

_{j}*N*are the complex electric field and the carrier number density, respectively. Their index

_{j}*j*(

*j = 1*,...,

*N*) indicates the laser at

*j-*th stage.

*τ*is the delay time of the optical self feedback,

_{j}*κ*

_{r}

*is the feedback strength,*

_{,j}*θ*is the optical phase shift of the feedback light, and

_{j}*κ*

_{inj}

*is the injection strength. Each*

_{,j}*θ*takes 0 or π, and the parameter set

_{j}*v*is given by

*v*= (

*θ*). The last term

_{1},...,θ_{N}*E*

_{inj}

*in the first equation represents the optical injection to the*

_{,j}*j-*th stage laser, which is given by

*E*

_{0}is a real constant and

*ϕ*(t) represents the random phase modulation. The detuning parameter Δ

*ω*is defined by Δ

_{j}*ω*=

_{j}*ω*-

_{j-1}*ω*, where ω

_{j}*is the optical angular frequency of the*

_{j}*j-*th stage laser and

*ω*

_{0}is defined as that of Drive light. As for the random phase modulation

*ϕ*(

*t*), we assumed the Ornstein-Uhlenbeck process defined by the stochastic differential equation.

*τ*

_{m}and

*σ*are positive constants and

*ξ*(

*t*) is the normalized white Gaussian noise with the properties $\u3008\xi (t)\u3009=0$ and $\u3008\xi (t)\xi (s)\u3009=\delta (t-s)$, where $\delta $ is Dirac's delta function and $\u3008\text{\hspace{0.17em}}\text{\hspace{0.17em}}\u3009$ denotes the ensemble average. It can be shown that

*ϕ*(

*t*) has the properties $\u3008\varphi (t)\u3009=0$ and $\u3008\varphi (t)\varphi (s)\u3009={\sigma}^{2}\mathrm{exp}[-|t-s|/{\tau}_{m}]$. The latter property indicates that the correlation time and standard deviation of

*ϕ*(

*t*) are given by

*τ*

_{m}and

*σ*, respectively.

We carried out our numerical simulation for *N* =2 and *M* =2* ^{N}*=4. In the simulation, the following parameter values were used: α = 3,

*G*= 8.4×10

_{N}^{−13}m

^{3}s

^{−1},

*N*= 1.4×10

_{0}^{24}m

^{−3},

*N*

_{th}= 2.018×10

^{24}m

^{−3},

*τ*

_{in}= 8.0 ps,

*τ*= 2.04 ns,

_{s}*κ*

_{inj}

*= 0.25,*

_{,1}*κ*

_{inj}

*= 0.15,*

_{,2}*τ*= 35.4 ns,

_{1}*τ*= 56.5 ns,

_{2}*κ*

_{r}

*= 0.07,*

_{,1}*κ*

_{r}

*= 0.09,*

_{,2}*J*= 1.190

_{1}*J*

_{th},

*J*= 1.107

_{2}*J*

_{th}, where

*J*

_{th}=

*N*

_{th}/

*τ*is the threshold of the injection current. For these values of

_{s}*J*, Response lasers at stage 1 and 2 have the relaxation oscillation frequencies 2.0 GHz and 1.5 GHz, respectively. The detuning parameters are set as Δ

_{j}*ω*= −3.0 GHz and Δ

_{1}*ω*= 0 for

_{j}*j*=

*2*,...,

*N*. As for the CARP light, we set as ${E}_{0}=\sqrt{0.19{J}_{\text{th}}/{G}_{N}({N}_{\text{th}}-{N}_{0})}$,

*τ*

_{m}= 1.0 ns, and $\sigma =\pi /2$. The delay times and the relaxation oscillation frequencies coincide with the values in our experiment. As for the other parameters, it is difficult to precisely determine their values in our experimental system. We assumed physically reasonable values for them. The numerical calculation method used here is described in the reference [30].

#### A.3 Details of numerical simulations in Section 7

We carried out numerical simulations to confirm that the required synchronization property can be satisfied for large *N*. Consider two identical cascaded laser systems, each of which is described by Eqs. (A4) and (A5). We denote their parameter sets with *v* and *v’*, and their output intensity waveforms with *I* and *I’*, respectively. The analog correlation *C _{A}* between

*I*and

*I’*depends on the parameter sets

*v*and

*v’*. So, we denote the correlation as

*C*(

_{A}*v*,

*v’*). Let

*C*and

_{H}*C*be defined by

_{L}*C*is the minimum correlation when the parameter sets are identical, while

_{H}*C*is the maximum correlation when the parameter sets are different. The required synchronization property is that

_{L}*C*~1 and

_{H}*C*~0. Table A1 shows an example of

_{L}*C*and

_{H}*C*values for different

_{L}*N*. The cascaded laser system has many parameters such as

*τ*or

_{j}*κ*

_{r}

*. Note that the results for each*

_{,j}*N*in Table A1 is only for a particular choice of the parameters. Table A1 clearly shows that

*C*~1 and

_{H}*C*< 0.3, which is close to zero, hold for all the

_{L}*N*values up to 8. It should be noted that both

*C*and

_{H}*C*do not significantly depend on

_{L}*N*. This fact suggests that the required synchronization property can be satisfied for arbitrary large

*N*, provided that the system parameters are appropriately chosen.

In the simulation, the parameter values were set as follows: *κ*_{r}* _{,j}* =

*κ*

_{t}+(

*κ*

_{b}-

*κ*

_{t})×(

*j-*1)/(

*N*-1),

*τ*= 0.1+0.04×(

_{j}*j-*1) ns,

*κ*

_{inj}

*= 0.40, and*

_{,j}*J*= 1.190

_{j}*J*

_{th}, where

*j*= 1,…,

*N*. This value of

*J*leads to the relaxation oscillation frequency 2.0 GHz. The other parameters are the same as in Sec. A.2. As for the delay time

_{j}*τ*, we assumed small values of

_{j}*τ*, which correspond to the case that a photonic integrated circuit is used for a laser unit at each stage. We assigned different values

_{j}*τ*to each stage because synchronizing the cascaded systems tends to be difficult if all the

_{j}*τ*are the same. As for the feedback strength

_{j}*κ*

_{r}

*, the two parameters*

_{,j}*κ*

_{t}and

*κ*

_{b}were appropriately chosen and their values are shown in Table A1.

## Acknowledgments

We acknowledge support from Grants-in-Aid for Scientific Research and Management Expenses Grants from the Ministry of Education, Culture, Sports, Science and Technology in Japan. We also would like to thank Naonori Ueda, Eisaku Maeda, Junji Yamato, Atsushi Nakamura, Kenichi Arai, and Susumu Shinohara at NTT Communication Science Laboratories for their continuous encouragement and support.

## References and links

**1. **C. H. Bennett and G. Brassard, “Quantum cryptography: Public key distribution and coin tossing,” in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing (Institute of Electrical and Electronics Engineers, Bangalore, India,1984), 175–179.

**2. **N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. **74**(1), 145–195 (2002). [CrossRef]

**3. **A. Uchida, P. Davis, and S. Itaya, “Generation of information theoretic secure keys using a chaotic semiconductor laser,” Appl. Phys. Lett. **83**(15), 3213–3215 (2003). [CrossRef]

**4. **J. Scheuer and A. Yariv, “Giant Fiber Lasers: A New Paradigm for Secure Key Distribution,” Phys. Rev. Lett. **97**(14), 140502 (2006). [CrossRef] [PubMed]

**5. **A. Zadok, J. Scheuer, J. Sendowski, and A. Yariv, “Secure key generation using an ultra-long fiber laser: transient analysis and experiment,” Opt. Express **16**(21), 16680–16690 (2008). [CrossRef] [PubMed]

**6. **D. Bar-Lev and J. Scheuer, “Enhanced key-establishing rates and efficiencies in Fiber Laser Key Distribution systems,” Phys. Lett. A **373**(46), 4287–4296 (2009). [CrossRef]

**7. **E. Klein, N. Gross, E. Kopelowitz, M. Rosenbluh, L. Khaykovich, W. Kinzel, and I. Kanter, “Public-channel cryptography based on mutual chaos pass filters,” Phys. Rev. E Stat. Nonlin. Soft Matter Phys. **74**(4), 046201 (2006). [CrossRef] [PubMed]

**8. **I. Kanter, M. Butkovski, Y. Peleg, M. Zigzag, Y. Aviad, I. Reidler, M. Rosenbluh, and W. Kinzel, “Synchronization of random bit generators based on coupled chaotic lasers and application to cryptography,” Opt. Express **18**(17), 18292–18302 (2010). [CrossRef] [PubMed]

**9. **R. Vicente, C. R. Mirasso, and I. Fischer, “Simultaneous bidirectional message transmission in a chaos-based communication scheme,” Opt. Lett. **32**(4), 403–405 (2007). [CrossRef] [PubMed]

**10. **W. Diffie and M. Hellman, “New Directions in cryptography,” IEEE Trans. Inf. Theory **22**(6), 644–654 (1976). [CrossRef]

**11. **C. E. Shannon, “Communication theory of secret system,” Bell Syst. Tech. J. **28**, 656–715 (1949).

**12. **U. M. Maurer, “Secret key agreement by public discussion from common information,” IEEE Trans. Inf. Theory **39**(3), 733–742 (1993). [CrossRef]

**13. **J. Muramatsu, K. Yoshimura, and P. Davis, “Information theoretic security based on bounded observability,” Lect. Notes Comput. Sci. **5973**, 128–139 (2010). [CrossRef]

**14. **K. Yoshimura, J. Muramatsu, P. Davis, T. Harayama, H. Okumura, S. Morikatsu, H. Aida, and A. Uchida, “Secure key distribution using correlated randomness in lasers driven by common random light,” Phys. Rev. Lett. **108**(7), 070602 (2012). [CrossRef] [PubMed]

**15. **H. Aida, M. Arahata, H. Okumura, H. Koizumi, A. Uchida, K. Yoshimura, J. Muramatsu, and P. Davis, “Experiment on synchronization of semiconductor lasers by common injection of constant-amplitude random-phase light,” Opt. Express **20**(11), 11813–11829 (2012). [CrossRef] [PubMed]

**16. **T. Yamamoto, I. Oowada, H. Yip, A. Uchida, S. Yoshimori, K. Yoshimura, J. Muramatsu, S. I. Goto, and P. Davis, “Common-chaotic-signal induced synchronization in semiconductor lasers,” Opt. Express **15**(7), 3974–3980 (2007). [CrossRef] [PubMed]

**17. **I. Oowada, H. Ariizumi, M. Li, S. Yoshimori, A. Uchida, K. Yoshimura, and P. Davis, “Synchronization by injection of common chaotic signal in semiconductor lasers with optical feedback,” Opt. Express **17**(12), 10025–10034 (2009). [CrossRef] [PubMed]

**18. **R. Vicente, T. Pérez, and C. R. Mirasso, “Open- versus closed-loop performance of synchronized chaotic external-cavity semiconductor lasers,” IEEE J. Quantum Electron. **38**(9), 1197–1204 (2002). [CrossRef]

**19. **J. Muramatsu, “Secret key agreement from correlated source outputs using low density parity check matrices,” IEICE Trans. Fundamentals **E89-A**(7), 2036–2046 (2006). [CrossRef]

**20. **A. Uchida, *Optical Communication with Chaotic Lasers, Applications of Nonlinear Dynamics and Synchronization*, (Wiley-VCH, Weinheim, 2012).

**21. **A. Uchida, K. Amano, M. Inoue, K. Hirano, S. Naito, H. Someya, I. Oowada, T. Kurashige, M. Shiki, S. Yoshimori, K. Yoshimura, and P. Davis, “Fast physical random bit generation with chaotic semiconductor lasers,” Nat. Photonics **2**(12), 728–732 (2008). [CrossRef]

**22. **J. Muramatsu, K. Yoshimura, K. Arai, and P. Davis, “Secret key capacity for optimally correlated sources under sampling attack,” IEEE Trans. Inf. Theory **52**(11), 5140–5151 (2006). [CrossRef]

**23. **T. Heil, J. Mulet, I. Fischer, C. R. Mirasso, M. Peil, P. Colet, and W. Elsäßer, “On/off phase shift keying for chaos-encrypted communication using external-cavity semiconductor lasers,” IEEE J. Quantum Electron. **38**(9), 1162–1170 (2002). [CrossRef]

**24. **A. Uchida, N. Shibasaki, S. Nogawa, and S. Yoshimori, “Transient characteristics of chaos synchronization in a semiconductor laser subject to optical feedback,” Phys. Rev. E Stat. Nonlin. Soft Matter Phys. **69**(5), 056201 (2004). [CrossRef] [PubMed]

**25. **A. Argyris, M. Hamacher, K. E. Chlouverakis, A. Bogris, and D. Syvridis, “Photonic integrated device for chaos applications in communications,” Phys. Rev. Lett. **100**(19), 194101 (2008). [CrossRef] [PubMed]

**26. **A. Argyris, E. Grivas, M. Hamacher, A. Bogris, and D. Syvridis, “Chaos-on-a-chip secures data transmission in optical fiber links,” Opt. Express **18**(5), 5188–5198 (2010). [CrossRef] [PubMed]

**27. **A. Argyris, S. Deligiannidis, E. Pikasis, A. Bogris, and D. Syvridis, “Implementation of 140 Gb/s true random bit generator based on a chaotic photonic integrated circuit,” Opt. Express **18**(18), 18763–18768 (2010). [CrossRef] [PubMed]

**28. **T. Harayama, S. Sunada, K. Yoshimura, P. Davis, K. Tsuzuki, and A. Uchida, “Fast nondeterministic random-bit generation using on-chip chaos lasers ,” Phys. Rev. A **83**(3), 031803(R) (2011).

**29. **R. Lang and K. Kobayashi, “External optical feedback effects on semiconductor laser properties,” IEEE J. Quantum Electron. **16**(3), 347–355 (1980). [CrossRef]

**30. **K. Yoshimura, I. Valiusaityte, and P. Davis, “Synchronization induced by common colored noise in limit cycle and chaotic systems,” Phys. Rev. E Stat. Nonlin. Soft Matter Phys. **75**(2), 026208 (2007). [CrossRef] [PubMed]