Synchronization-Based Key Distribution Utilizing ... - IEEE Xplore

IEEE JOURNAL OF QUANTUM ELECTRONICS, VOL. 51, NO. 12, DECEMBER 2015

8000208

Synchronization-Based Key Distribution Utilizing Information Reconciliation Longsheng Wang, Yanqiang Guo, Yuanyuan Sun, Qi Zhao, Doudou Lan, Yuncai Wang, and Anbang Wang, Member, IEEE Abstract— We propose a scheme to realize a synchronizationbased key distribution utilizing the information reconciliation method of lower triangular error-bits detection. The proposed method can solve the problem of error bits caused by parameter mismatches of two synchronized semiconductor lasers in the scheme of synchronization-based key distribution. Theoretical analysis shows that this method can detect error bits with high probability through one-time information transmission of public keys. Moreover, reconciliation efficiency of this method is also studied theoretically. Finally, we demonstrate the feasibility of this method and investigate the security against leakage of information in the reconciliation procedure. Index Terms— Secure communication, key distribution, chaos synchronization, information reconciliation.

I. I NTRODUCTION

S

YNCHRONIZATION is a fascinating phenomenon which has been widely studied because of its potential in secure communication [1]–[6]. Recently, much attention is focused on key distribution based on the synchronization of chaotic lasing in coupled semiconductor lasers (SLs). This is because it provides some other alternative schemes for key distribution based on physical principles besides quantum key distribution (QKD) which is difficult to implement in practice [7]–[12]. Typical schemes based on synchronization are as follows. Kanter et al. proposed a synchronized random bit generation scheme using a mutual chaos pass filter procedure for the purpose of encryption [13]. Yoshimura and associates, and Uchida et al. demonstrated the schemes based on synchronization of cascading optical scramblers, which depend on bounded observability [14], [15]. Jiang et al. proposed a key distribution scheme based on synchronization in

Manuscript received August 22, 2015; revised October 17, 2015; accepted November 4, 2015. Date of publication November 11, 2015; date of current version November 24, 2015. This work was supported in part by the Program for the Outstanding Innovative Teams of Information Security and Fault Detection in Communication Network, in part by the International Science and Technology Cooperation Program of China under Grant 2014DFA50870, in part by NSFC under Grants 61405138, 61227016, 61475111, and 61505137, in part by the Natural Science Foundation for Excellent Young Scientists of Shanxi Province under Grant 2015021004, in part by the Programs for the Outstanding Innovative Teams and for the Innovative Talents of Higher Learning Institutions of Shanxi, and in part by the High End Foreign Experts Project under Grant GDW201400042. The authors are with the Key Laboratory of Advanced Transducers and Intelligent Control System, College of Physics and Optoelectronics, Ministry of Education, Taiyuan University of Technology, Taiyuan 030024, China (e-mail: [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]; [email protected]). Color versions of one or more of the figures in this paper are available online at http://ieeexplore.ieee.org. Digital Object Identifier 10.1109/JQE.2015.2499727

bandwith-enhanced random bit generators with dynamic postprocessing [16]. These schemes based on synchronization of SLs rely on great synchronization quality between two users (traditionally called Alice and Bob). The high-quality synchronization relies on two SLs being closely matched. However, parameters’ mismatches of SLs inevitably arise in practice, which greatly degrades the synchronization quality. Consequently, error bits are generated between the keys of Alice and Bob and hinder the synchronization-based key distribution. In this work, we propose to realize a synchronization-based key distribution utilizing the information reconciliation method of lower-triangular error-bits detection, which can solve the problem of error bits caused by parameter mismatches of SLs. Synchronization between Alice and Bob is achieved by using mutually coupled chaotic SLs [13], [17]. Raw keys with error bits are extracted from temporal waveforms of these two synchronized lasers. To find the error bits, we put the raw keys into some lower-triangular Boolean matrices and calculate the ratios of numbers of bits 1 and 0 row by row, column by column, and diagonal by diagonal, respectively. The resulting ratios are public keys which are then exchanged in a public channel. By comparison of public keys, error bits can be detected and deleted. Finally, both communication parties can achieve identical keys and the synchronizationbased key distribution is realized. The remainder of this manuscript is organized as follows. In section II, the scheme of key distribution based on synchronization is described. In section III, details about the method of lower-triangular error-bits detection are presented including the reconciliation procedure in part A, the probability of errorbits detection in part B, and the reconciliation efficiency in part C. Section IV demonstrates the feasibility of the proposed method in part A and the security against leakage of information in part B. A discussion is offered in section V. Finally, the manuscript ends with brief conclusion in section VI. II. S YNCHRONIZATION -BASED K EY D ISTRIBUTION As shown in Fig. 1, two chaotic SLs (A, B) with optical feedback, which represent both communication parties (Alice and Bob), are coupled symmetrically [13]. The symbols k and σ represent strengths of self-feedback and mutual coupling, respectively. Time delays of self-feedback are denoted as τ A and τ B , and the time delay of the mutual coupling is denoted as τ . In general, two types of synchronization exist in the mutual coupling structure: generalized synchronization and zero-lag synchronization [18], [19].

0018-9197 © 2015 IEEE. Personal use is permitted, but republication/redistribution requires IEEE permission. See http://www.ieee.org/publications_standards/publications/rights/index.html for more information.

8000208

Fig. 1. SLs.


(Color online) The schematic diagram of mutually coupled chaotic

An obvious difference between them is a time shift of the synchronized signals. For simplicity of discussion, we focus on the latter type of synchronization. Zero-lag synchronization can be achieved when the sum of self-feedback delay times of the SLs A and B equals twice the mutual coupling delay time [13], [19]. We investigate the case where self-feedback time delays and the mutual coupling time delay are all equal to 2ns. The injection current to the threshold current ratio is selected at 1.07. Parameters of self-feedback and mutual coupling strengths are chosen as k = σ = 0.05. Moreover, a small frequency detuning ∼ 0.005GHz is allowed to exist between SLs A and B. It can be obtained in practice by finely adjusting the frequency detuning of two SLs because the linewidth of a single mode distributed-feedback laser diode is about several MHz or even narrower in general [20]–[22]. In simulations, we use the modified Lang-Kobayashi (LK) equations [23] to describe the dynamics of SLs, which are given in references [19] and [24]. The Lang-Kobayashi (LK) equations are described by equations (1)-(2): 1 + iα 1 d E A,B (t) = E A,B (t) G A,B − dt 2 τp k + E A,B (t − τ ) exp −iω A,B τ (1) τin σ + E B,A (t − τ ) exp (−i ω B,A τ ) τin ×exp (∓i 2πυt) 2 I N A,B (t) d N A,B (t) = − − G A,B E A,B (t) (2) dt qV τn where E A,B (t) is the complex amplitude of optical field and N A,B (t) represents the corresponding carrier number. |· · · | denotes the amplitude of the complex field. The optical gain function G A,B is given by g N A,B (t) − N0 G A,B = 2 1 + ε E A,B (t) In these equations, I is the bias current, i t h is the threshold current, α is the linewidth enhancement factor, τ p is the photon lifetime, τn is the carrier lifetime, τin is the laser cavity roundtrip time, g is the differential gain, N0 is the carrier number at transparency, ε is the gain saturation coefficient. The lasers’ frequency detuning between A and B is defined as υ = (ω A −ω B ) /2π where ω A and ω B are the angular frequencies of the free-running lasers. The synchronized chaotic signals of SLs A and B are shown in Fig. 2. Fast and random jitters of the time series as illustrated in Figs. 2(a) and 2(b) are beneficial to generating ultrafast raw keys [25]–[34]. Fig. 2(c) shows the correlation plots

Fig. 2. Time series and correlation plots of chaotic signals, (a) Time series of SL A (b) Time series of SL B (c) Correlation plots of the outputs of SLs A and B. TABLE I VALUES OF PARAMETERS U SED IN S IMULATIONS

of the outputs of SLs A and B. Furthermore, the maximum correlation value between them is 0.93. In our simulations, synchronization quality is quantified by calculating the crosscorrelation function (CCF) of the outputs of the SLs, which is given in reference [35]. CCF =

[P1 (t) − P1 (t)] · [P2 (t − τ ) − P2 (t − τ )] 1

1

|P1 (t) − P1 (t)|2 2 · |P2 (t − τ ) − P2 (t − τ )|2 2

where the bracket · means time averaging, P(t) is the photon 2 number, which is equal to E A,B (t) . The maximum value of CCF is used to represent the synchronization coefficient. The values for the parameters used in our simulations are listed in the Table I [36]. One notes that the outputs of SLs A and B cannot be synchronized completely as shown in Fig. 2. This is because of the frequency detuning between the SLs. In practice, it is virtually impossible for the parameters of SLs to be identical and the mismatches of parameters such as center frequency, bias current, and linewidth enhancement factor, etc., will lead to degradation of synchronization quality. Raw keys are extracted from the temporal waveforms of the chaotic signals shown in Fig. 2 by sampling at predetermined timings and comparing sampled values with thresholds.

WANG et al.: SYNCHRONIZATION-BASED KEY DISTRIBUTION UTILIZING INFORMATION RECONCILIATION

8000208

Fig. 3. (Color online) Time series of chaotic signals and extracted raw keys, (a) Time series of SL A and corresponding keys (b) Time series of SL B and corresponding keys. The red circles represent the sampling points with sampling rate of 1Gbps; the blue solid lines represent the thresholds of analog-digital conversion.

Fig. 5.

(Color online) The procedure of error-bits detection.

III. T HE L OWER -T RIANGULAR E RROR -B ITS D ETECTION M ETHOD A. Reconciliation Procedure

Fig. 4. (Color online) Synchronization coefficient (red diamonds) and BER (blue squares) as a function of frequency detuning.

The whole procedure is controlled by a clock generator. In general, the average intensity of chaotic signal is set to be the threshold. The raw keys extracted are shown in Fig. 3 and the sampling rate is 1 Gbps. One notes that these keys are almost identical except for one bit marked in red. This phenomenon can be explained as follows. Chaotic signals A and B establish highly correlated randomness, which contributes to the generation of almost identical raw keys. However, chaotic signals A and B are not synchronized completely because of frequency detuning, which results in the generation of error bits and hinders the synchronization-based key distribution. In addition, the maximum cross-correlation value of SLs A and B and the bit-error rate (BER) of raw keys as a function of frequency detuning are also investigated as shown in Fig. 4. The length of raw keys is about 103 bits. It can be seen that the synchronization quality degrades with increasing frequency detuning and the BER increases with increasing frequency detuning. It further indicates that parameter mismatches between SLs will not only degrade synchronization quality but also lead to generation of error bits in the scheme of synchronization-based key distribution. It is worth pointing out that the relationship between the maximum cross-correlation value and the BER provides a reference for a pre-estimated BER which will be used in the information reconciliation shown further on.

To solve the problem of error bits in the scheme of synchronization-based key distribution, an information reconciliation method named lower-triangular error-bits detection is proposed. Here, a lower-triangular matrix is used in our proposed method. The matrix is actually a Boolean matrix because it is filled with bits 1 and 0. The definition of a lower-triangular matrix’s structure is similar to that from the mathematical discipline of linear algebra, in which a square matrix is called lower-triangular matrix if all the entries above the main diagonal are zero. However, the difference is that no entries exist above the main diagonal in our lower-triangular matrix. Taking a lower-triangular matrix with size 15 (meaning 15 entries) as an example, we show the procedure of errorbits detection is in Fig. 5. Firstly, raw keys are put into the matrices row by row as shown in step 1. The size of a matrix is set to be about 1/(2γ), where γ is the preestimated BER. The choice of a matrix’s size can make the reconciliation efficiency comparatively high as explained in section C. Secondly, the ratios of numbers of bits 1 and 0 are calculated along three directions i.e. row by row, column by column, and diagonal by diagonal. The ratios are denoted as public keys {R A (i ),C A ( j ),D A (k)}, {R B (i ),C B ( j ),D B (k)} (i , j , k are integers) used for information reconciliation as shown in step 2. It should be pointed out that a public key is denoted as if there is no bit 0 on a corresponding row (column, diagonal) in the matrix. This is because the ratio of numbers of bits 1 and 0 is infinity. After that, public keys are transmitted and exchanged through a public channel. Through comparing the received public keys with her or his own public keys, Alice or Bob uses some lines to mark the corresponding row, column and diagonal on which different public keys exist

8000208

in the matrix, and the intersections of these lines are generated. Moreover, the keys located in the intersections of marked lines are error bits to be deleted as shown in step 3. Finally, identical keys are obtained by Alice and Bob by deleting the error bits in step 4 and the synchronization-based key distribution is realized. The proposed reconciliation method of lower-triangular error-bits detection depends on the nature of error bits which exist in raw keys. In general, the ratios of numbers of bits 1 and 0 are different for the corresponding row, column and diagonal where the error bits exist. This phenomenon provides an opportunity to detect the error bits. It is obvious that the marked lines of only one fixed direction cannot determine accurately the positions of error bits in a lowertriangular matrix. Therefore, the other two directions provide assistant roles to detect error bits by generating intersections which show the positions of error bits in the matrix. Error bits can be definitely detected if there are only one or two error bits in a lower-triangular matrix. However, we have to admit that there are some special cases under which some error bits fail to be detected when a matrix contains more than two error bits during one round of information reconciliation. Here, one round of information reconciliation means a one-time transmission of public keys. Therefore, a new round of information reconciliation is needed, i.e., repeating the steps 1, 2 and 3. Before starting the next round of information reconciliation, the raw keys are obtained from remaining keys of a previous round of information reconciliation. After a few rounds of information reconciliation, we will verify whether or not there are still error bits by using a method of parity checking for a sub-collection of keys obtained, which is proposed in references [37] and [38]. If error bits still exist, more rounds of information reconciliation are still needed until identical keys are obtained.


Fig. 6. (Color online) Two cases of failure to detect error bits. (a) Two directions (row, diagonal) meet conditions (i) and (ii), (b) Three directions (row, column and diagonal) meet conditions (i) and (ii). Error bits marked in dark gray (purple) fail to be detected and other error bits marked in gray (red) are detected.

Fig. 7. The variation of probability η as a function of the number of even error bits N on a row or column or diagonal in a matrix.

B. Probability of Error-Bits Detection Two conditions must be met if an error bit in a lowertriangular matrix fails to be detected during one round of information reconciliation. (i) Among the three directions (row, column and diagonal) surrounding an error bit, there are at least two directions having even error bits. (ii) The ratio of numbers of error bits 1 and 0 in the direction with even error bits is 1:1. As shown in Fig. 6 (a), the error bit marked in dark gray (purple) fails to be detected because of that the two directions (row and diagonal) surrounding it both have even error bits and the ratio of numbers of error bits 1 and 0 in each direction with even error bits is 1:1. The situation in Fig. 6(b) which considers three directions surrounding an error bit (dark gray) is basically similar to that of Fig. 6(a). The condition (i) includes two cases. One case is that among the three directions (row, column and diagonal) surrounding an error bit, there are two directions having even error bits. The probability for this case can be represented by C23 q 2 p using the theory of combinations. Here, p and q ( p + q = 1) represents the probability of odd and even error bits on the row or column or diagonal surrounding an error bit in a matrix, respectively. The other case is that among the three

directions surrounding an error bit, there are three directions having even error bits. The probability for this case can be represented by C33 q 3 . Therefore, the probability of condition (i) is represented by μ and given by μ = 3q 2 p + q 3

(3)

When there are even error bits on a row or column or diagonal, the probability of condition (ii) is represented by η and given by η=

N! 2 N × ( N2 !)

2

(4)

where N is the number of even error bits. The variation of η as a function of N is shown in Fig. 7. One notes that the value of η decreases gradually with the increasing N. The probability that an error bit fails to be detected can be represented by ξ and given by ξ = 3q 2 pη2 + q 3 η3

(5)

where the first (second) term represents the joint probability for that two (three) directions surrounding an error bit in a


8000208

for the worst case scenario mentioned above provided that error bits distribute uniformly below. We use symbols β and α to represent the number of error bits in a lower-triangular matrix and the size of the matrix, respectively. If there are β error bits in a matrix, the number β of the worst case scenarios is C2 based on the theory of combinations. Therefore, the maximum number of mistakenly β deleted keys can be represented by 6 × C2 which is equal to 3β (β − 1) under an assumption that α ≥ 3β (β − 1) . The reconciliation efficiency is represented by Fig. 8. (Color online) Mistakenly deleted identical keys marked in dark gray (purple) with two error bits marked in gray (red) existing in a matrix.

lower-triangular matrix meet the conditions (i) and (ii) in the right-hand side of equation (5). We might as well assume the values p and q to be 0.5 respectively considering the uniform distribution of error bits in a matrix. We can also set the value of η to be the maximum, i.e., 0.5. Moreover, the maximum value of ξ is calculated to be 0.109 which is relatively low during one round of information reconciliation. In general, the probability that an error bit fails to be detected is lower than the theoretical maximum (0.109) mentioned above in practical applications because we consider the worst case scenario. It indicates that the proposed method can hold a high probability of detecting error bits. C. Reconciliation Efficiency For some other reconciliation methods, e.g., BBBSS, CASCADE, the reconciliation efficiency is low because of multiple transmissions and the discarding of a large number of keys [37], [38]. We need also to discuss the reconciliation efficiency of our proposed method. This is because some identical keys are also discarded during information reconciliation, which is due to mistaken deletion. Reconciliation efficiency is usually defined to be the ratio of the length of identical keys after reconciliation and the length of raw keys before reconciliation. The theoretical value of reconciliation efficiency is 1-ε, where ε is the precise initial BER which is a little different from the pre-estimated BER. However, the reconciliation efficiency is usually lower than the theoretical value, resulting from information reconciliation methods. Using our proposed reconciliation method, if there is only one error bit in each lower-triangular matrix, the error bits will be completely deleted without deleting identical keys and the theoretically largest reconciliation efficiency can be obtained. However, some cases under which two or more error bits exist in the matrix inevitably appear. Consequently, some identical keys may be deleted mistakenly, which affects reconciliation efficiency. As shown in Fig. 8, six identical keys marked in dark gray (purple) at most are deleted mistakenly when two error bits marked in gray (red) exist in a matrix. This is the worst case scenario in which there are three marked lines for each error bit and the distribution of error bits tends to generate the most intersections which show the locations of the mistakenly deleted keys. Here, we analyze the reconciliation efficiency of our proposed reconciliation method

3β (β − 1) k (6) αk where k is the number of matrices, 3β (β − 1) k represents the number of total error bits, and αk represents the number of total keys. Owing to the fact that uniform distribution of error bits is considered, β/α is equal to the initial BERε. Furthermore, equation (6) can be transformed into equation (7). =1−

= 1 − 3ε(εα − 1)

(7)

Considering that 0 < ε < 1 and > 0, we can obtain a relationship between the initial BER and the matrix size, which is given by inequality (8). √ 3 + 9 + 12α (8) 0 0. Moreover, the maximum reconciliation efficiency, i.e., = 1 − 3/(4α), can be obtained when ε is equal to 1/(2α). This is why we set the size of a lower-triangular matrix to be about 1/(2γ) where γ is the pre-estimated BER in section A. It indicates that we can obtain a comparatively high reconciliation efficiency by adjusting the size of a lower-triangular matrix when the initial BER is settled. It is worth pointing out that the phenomenon of deleting identical keys does not wholly mean a weakness for the method lower-triangular error-bits detection. This is because the ratios of numbers of bits 1 and 0 may be exposed during one round of information reconciliation, which can be used to speculate the keys’ information by an eavesdropper. Deleting some identical keys with appropriate percentage is beneficial to decreasing leakage of information during reconciliation procedure. IV. N UMERICAL D EMONSTRATION AND S ECURITY A NALYSIS A. Numerical Demonstration In this section, we demonstrate the feasibility of the proposed reconciliation method. Here are some of keys extracted from chaotic signals A and B with frequency detuning of about 10 MHz as shown in Fig. 9. The bit rate is 10 Gbps. The length of the keys is 1050 bits, among which there are 109 error bits. Therefore, the precise initial BER is 0.104. It can be concluded from Fig. 4 that the pre-estimated BER is about 0.1 when the frequency detuning is about 10 MHz.

8000208

Fig. 9. (Color online) Some of the keys obtained from chaotic signals of SLs A and B.

We performed the first round of information reconciliation with a lower-triangular matrix of size 6 by using our proposed method, reducing the keys’ length to 880 bits with 2 remaining error bits. The deleted keys’ length is 170 bits, among which 107 keys are error bits and 63 keys are deleted mistakenly. The remaining 2 error bits are also deleted with a second round of information reconciliation. Finally, 878 identical keys are obtained with reconciliation efficiency of 0.836 through only two rounds of information reconciliation. It is close to the theoretically maximum reconciliation efficiency of 0.875. To more clearly demonstrate our results, the chaotic signals, keys and corresponding CCFs are shown in Fig. 10. As shown in the first row of Fig. 10, the maximum correlation value of chaotic signals is only about 0.84, which results from the frequency detuning. The extracted keys from these two chaotic signals and corresponding CCF are presented in the middle row of Fig. 10. One notes that there are error bits between the keys, and the maximum correlation value is only about 0.78, which is slightly less than that of chaotic signals in general. These error bits are mostly caused by poorquality synchronization between chaotic signals and greatly hinder a synchronization-based key distribution. By contrast, through only two rounds of information reconciliation using the proposed method, identical keys are obtained and the maximum correlation value of both communication parties’ keys reaches 1 as shown in the last row of Fig. 10. It indicates that the problem of error bits resulted from the parameters’ mismatch of SLs can be solved by the information reconciliation method of lower-triangular error-bits detection, by which a synchronization-based key distribution can be implemented. B. Security Analysis During the information reconciliation, leakage of information in the reconciliation procedure can be used by a passive attacker to deduce the keys [13]. In this section, our analysis shows that the attacker fails to recover the keys though some information is leaked. A passive attacker which is capable of unidirectionally coupling to Alice (Bob) and achieving useful information is assumed in our analysis. To evaluate how much useful information a passive attacker (C) possesses about Alice (A) and Bob (B), the mutual information [39] of random sequence bits (SCA , SCB , SA , SB ) is used. Here, SCA (SCB ) is the random sequence bits achieved by the attacker using unidirectional coupling synchronization, and SA (SB ) is the random sequence


bits of the legal communication party. It is easy to know that the mutual information I(SCA , SCB ) is always less than the mutual information I(SCA , SB ), i.e., I(SCA ,SCB ) < I(SCA , SB ). The reason is that an identical synchronization cannot be established between the attacker and the legal communication party under unidirectional coupling, i.e., the synchronization coefficient of C and A (B) cannot be boosted to 1. In the analysis, we calculate the values of I = I(SA , SB )I(SCA , SB ) under different mutual coupling synchronization and unidirectional coupling synchronization cases. Here, the mutual coupling synchronization indicates the synchronization of A and B, and the unidirectional coupling synchronization indicates the synchronization of C and A. As shown in Fig. 11, I > 0 is always achieved. It indicates that I(SA , SB ) is always more than I(SCA , SB ). Furthermore, it can be concluded that I(SA , SB ) is also always more than I(SCA , SCB ). From another perspective, 1-I(SA , SB ) is always less than 1-I(SCA , SCB ). It indicates that the minimum required exchange of information between SA and SB for the reconciliation procedure is less than the total missing information C possesses about SA and SB . In other words, the attacker doesn’t have enough information to recover the shared keys between Alice and Bob. Consequently, the secure key distribution is allowed in our scheme. V. D ISCUSSION Note that, a synchronized random bit generation scheme using a mutual chaos pass filter procedure for the purpose of encryption is proposed in the mutual coupling laser system [13]. In this scheme, the external private keys are used to modulate chaotic signals which act as the carrier waveforms. In our scheme, we directly extract raw keys from the temporal waveforms of chaotic signals as shown in Fig. 3. Then, the identical keys are achieved by using the reconciliation method, which is proposed and demonstrated in detail in our paper. Finally, the synchronization-based key distribution is realized. We also note that some peaks are located at the delay time and its integer multiple in the mutual coupling laser system as shown in the last column of Fig. 10. It indicates an obvious time-delay signature [40], [41]. The suppression of time-delay signature is beneficial to the system’s security. We further investigate the reconciliation performance of our method when the time-delay signature is suppressed. By increasing the frequency detuning to 50MHz, the sidelobe amplitude is about 0.4. In this situation, the synchronization coefficient is 0.55 and the initial BER is 0.25. After two rounds of information reconciliation, the identical keys are achieved. The reconciliation efficiency is 0.703, which is close to the theoretically maximum reconciliation efficiency (0.750). Note that this reconciliation efficiency decreases compared to that (0.836) when the sidelobe amplitude is about 0.6. The reason is that the synchronization quality is degraded when the timedelay signature is suppressed [42]. Actually, the security of the system can still be guaranteed even though an eavesdropper obtains the time-delay signature and reconstructs an identical system. The reason is that the legal communication parties’ error-bit rate is always less


8000208

Fig. 10. Chaotic signals and the corresponding CCF (first row), Keys extracted from chaotic signals and the corresponding CCF (middle row), Keys after two rounds of information reconciliation and the corresponding CCF (last row).

theoretical analysis indicates that a comparatively high reconciliation efficiency can still be obtained by adjusting the lower-triangular matrix size. Moreover, we demonstrate the feasibility of our method and the security against leakage of information in the reconciliation procedure, which shows that an efficient and secure scheme is provided for the realization of synchronization-based key distribution. R EFERENCES

Fig. 11. (Color online) Map of I = I(SA , SB )-I(SCA , SB ) in the parameter space of different synchronization coefficients. The values of I are coded by color.

than that of the eavesdropper in the mutual coupling scheme because of that the mutual coupling synchronization is superior to the unidirectional coupling synchronization [13]. VI. C ONCLUSION A scheme to realize the synchronization-based key distribution is proposed. Both legitimate communication parties (Alice and Bob) extract keys from correlated chaotic signals. However, identical synchronization cannot be achieved because of parameter mismatches and error bits are generated between keys of Alice and Bob, which hinders the synchronizationbased key distribution. To address this problem, we proposed an information reconciliation method named lower-triangular error-bits detection. Using the proposed method, error bits can be detected by comparison of public keys, which are exchanged through one-time transmission in a public channel. To obtain identical keys, a few rounds of information reconciliation may be needed. Through analysis, it is found that the proposed method can hold a high probability of detecting error bits during one round of information reconciliation. Although some identical keys are also deleted mistakenly,

[1] T. Heil et al., “ON/OFF phase shift keying for chaos-encrypted communication using external-cavity semiconductor lasers,” IEEE J. Quantum Electron., vol. 38, no. 9, pp. 1162–1170, Sep. 2002. [2] F. Zhang and P. L. Chu, “Effect of transmission fiber on chaos communication system based on erbium-doped fiber ring laser,” J. Lightw. Technol., vol. 21, no. 12, pp. 3334–3343, Dec. 2003. [3] S. Li, G. Álvarez, and G. Chen, “Breaking a chaos-based secure communication scheme designed by an improved modulation method,” Chaos, Solitons Fractals, vol. 25, no. 1, pp. 109–120, Jul. 2005. [4] A. Argyris et al., “Chaos-based communications at high bit rates using commercial fibre-optic links,” Nature, vol. 438, no. 7066, pp. 343–346, Nov. 2005. [5] X. F. Li, W. Pan, B. Luo, and D. Ma, “Chaos synchronization and communication of cascade-coupled semiconductor lasers,” J. Lightw. Technol., vol. 24, no. 12, pp. 4936–4945, Dec. 2006. [6] F.-Y. Lin and M.-C. Tsai, “Chaotic communication in radio-over-fiber transmission based on optoelectronic feedback semiconductor lasers,” Opt. Exp., vol. 15, no. 2, pp. 302–311, Jan. 2007. [7] N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Modern Phys., vol. 74, no. 1, pp. 145–195, Mar. 2002. [8] P. Toliver et al., “Experimental investigation of quantum key distribution through transparent optical switch elements,” IEEE Photon. Technol. Lett., vol. 15, no. 11, pp. 1669–1671, Nov. 2003. [9] K. J. Gordon, V. Fernandez, P. D. Townsend, and G. S. Buller, “A short wavelength gigahertz clocked fiber-optic quantum key distribution system,” IEEE J. Quantum Electron., vol. 40, no. 7, pp. 900–908, Jul. 2004. [10] A. R. Dixon, Z. L. Yuan, J. F. Dynes, A. W. Sharpe, and A. J. Shields, “Continuous operation of high bit rate quantum key distribution,” Appl. Phys. Lett., vol. 96, no. 16, p. 161102, Apr. 2010. [11] H.-K. Lo, M. Curty, and K. Tamaki, “Secure quantum key distribution,” Nature Photon., vol. 8, no. 8, pp. 595–604, Jul. 2014. [12] T. Sasaki, Y. Yamamoto, and M. Koashi, “Practical quantum key distribution protocol without monitoring signal disturbance,” Nature, vol. 509, no. 7501, pp. 475–478, May 2014. [13] I. Kanter et al., “Synchronization of random bit generators based on coupled chaotic lasers and application to cryptography,” Opt. Exp., vol. 18, no. 17, pp. 18292–18302, Aug. 2010.

8000208

[14] K. Yoshimura et al., “Secure key distribution using correlated randomness in lasers driven by common random light,” Phys. Rev. Lett., vol. 108, no. 7, pp. 070602-1–070602-5, Feb. 2012. [15] H. Koizumi et al., “Information-theoretic secure key distribution based on common random-signal induced synchronization in unidirectionallycoupled cascades of semiconductor lasers,” Opt. Exp., vol. 21, no. 15, pp. 17869–17893, Jul. 2013. [16] C. Xue, N. Jiang, K. Qiu, and Y. Lv, “Key distribution based on synchronization in bandwidth-enhanced random bit generators with dynamic post-processing,” Opt. Exp., vol. 23, no. 11, pp. 14510–14519, May 2015. [17] E. Klein et al., “Public-channel cryptography based on mutual chaos pass filters,” Phys. Rev. E, vol. 74, no. 4, pp. 046201-1–046201-4, Oct. 2006. [18] N. Jiang et al., “Properties of leader-laggard chaos synchronization in mutually coupled external-cavity semiconductor lasers,” Phys. Rev. E, vol. 81, no. 6, pp. 066217-1–066217-9, Jun. 2010. [19] E. Klein, N. Gross, M. Rosenbluh, W. Kinzel, L. Khaykovich, and I. Kanter, “Stable isochronal synchronization of mutually coupled chaotic lasers,” Phys. Rev. E, vol. 73, no. 6, p. 066214-1–066214-4, Jun. 2006. [20] K. Kojima, K. Kyuma, and T. Nakayama, “Analysis of the spectral linewidth of distributed feedback laser diodes,” J. Lightw. Technol., vol. 3, no. 5, pp. 1048–1055, Oct. 1985. [21] M. Okai, M. Suzuki, and T. Taniwatari, “Strained multiquantum-well corrugation-pitch-modulated distributed feedback laser with ultranarrow (3.6 kHz) spectral linewidth,” Electron. Lett., vol. 29, no. 19, pp. 1696–1697, Sep. 1993. [22] Y. Kotaki, S. Ogita, M. Matsuda, Y. Kuwahara, and H. Ishikawa, “Tunable, narrow-linewidth and high-power λ/4-shifted DFB laser,” Electron. Lett., vol. 25, no. 15, pp. 990–992, Jul. 1989. [23] R. Lang and K. Kobayashi, “External optical feedback effects on semiconductor injection laser properties,” IEEE J. Quantum Electron., vol. 16, no. 3, pp. 347–355, Mar. 1980. [24] A.-B. Wang, Y.-C. Wang, and J.-F. Wang, “Route to broadband chaos in a chaotic laser diode subject to optical injection,” Opt. Lett., vol. 34, no. 8, pp. 1144–1146, Mar. 2009. [25] A. Uchida et al., “Fast physical random bit generation with chaotic semiconductor lasers,” Nature Photon., vol. 2, no. 12, pp. 728–732, Nov. 2008. [26] I. Reidler, Y. Aviad, M. Rosenbluh, and I. Kanter, “Ultrahigh-speed random number generation based on a chaotic semiconductor laser,” Phys. Rev. Lett., vol. 103, no. 2, pp. 024102-1–024102-4, Jul. 2009. [27] I. Kanter, Y. Aviad, I. Reidler, E. Cohen, and M. Rosenbluh, “An optical ultrafast random bit generator,” Nature Photon., vol. 4, no. 1, pp. 58–61, Dec. 2010. [28] N. Oliver, M. C. Soriano, D. W. Sukow, and I. Fischer, “Fast random bit generation using a chaotic laser: Approaching the information theoretic limit,” IEEE J. Quantum Electron., vol. 49, no. 11, pp. 910–918, Nov. 2013. [29] R. M. Nguimdo, G. Verschaffelt, J. Danckaert, X. Leijtens, J. Bolk, and G. Van der Sande, “Fast random bits generation based on a single chaotic semiconductor ring laser,” Opt. Exp., vol. 20, no. 27, pp. 28603–28613, Dec. 2012. [30] A. Argyris, S. Deligiannidis, E. Pikasis, A. Bogris, and D. Syvridis, “Implementation of 140 Gb/s true random bit generator based on a chaotic photonic integrated circuit,” Opt. Exp., vol. 18, no. 18, pp. 18763–18768, Aug. 2010. [31] X.-Z. Li and S.-C. Chan, “Heterodyne random bit generation using an optically injected semiconductor laser in chaos,” IEEE J. Quantum Electron., vol. 49, no. 10, pp. 829–838, Oct. 2013. [32] J. G. Wu, X. Tang, Z. M. Wu, G. Q. Xia, and G. Y. Feng, “Parallel generation of 10 Gbits/s physical random number streams using chaotic semiconductor lasers,” Laser Phys., vol. 22, no. 10, pp. 1476–1480, Sep. 2012. [33] N. Li, W. Pan, S. Xiang, Q. Zhao, and L. Zhang, “Simulation of multibit extraction for fast random bit generation using a chaotic laser,” IEEE Photon. Technol. Lett., vol. 26, no. 18, pp. 1886–1889, Sep. 15, 2014. [34] A. Wang, P. Li, J. Zhang, J. Zhang, L. Li, and Y. Wang, “4.5 Gbps high-speed real-time physical random bit generator,” Opt. Exp., vol. 21, no. 17, pp. 20452–20462, Aug. 2013. [35] S. Tang and J. M. Liu, “Synchronization of high-frequency chaotic optical pulses,” Opt. Lett., vol. 26, no. 9, pp. 596–598, May 2001. [36] G.-H. Li, W. An-Bang, F. Ye, and W. Yang, “Synchronization and bidirectional communication without delay line using strong mutually coupled semiconductor lasers,” Chin. Phys. B, vol. 19, no. 7, p. 070515, Dec. 2009.


[37] C. H. Bennett, F. Bessette, G. Brassard, L. Salvail, and J. Smolin, “Experimental quantum cryptography,” J. Cryptol., vol. 5, no. 1, pp. 3–28, Jan. 1992. [38] G. Brassard and L. Salvail, “Secret-key reconciliation by public discussion,” in Proc. Adv. Cryptol., EUROCRYPT, Berlin, Germany, Jul. 1994, pp. 410–423. [39] T. M. Cover and J. A. Thomas, Elements of Information Theory. New York, NY, USA: Wiley, 1991. [40] A. Wang, Y. Yang, B. Wang, B. Zhang, L. Li, and Y. Wang, “Generation of wideband chaos with suppressed time-delay signature by delayed selfinterference,” Opt. Exp., vol. 21, no. 7, pp. 8701–8710, Apr. 2013. [41] R. Hegger, M. J. Bünner, H. Kantz, and A. Giaquinta, “Identifying and modeling delay feedback systems,” Phys. Rev. Lett., vol. 81, no. 3, pp. 558–561, Jul. 1998. [42] J. G. Wu, Z. M. Wu, G. Q. Xia, and G. Y. Feng, “Evolution of time delay signature of chaos generated in a mutually delay-coupled semiconductor lasers system,” Opt. Exp., vol. 20, no. 2, pp. 1741–1753, Jan. 2012. Longsheng Wang received the M.S. degree in optical engineering from the Taiyuan University of Technology, Shanxi, China, in 2013, where he is currently pursuing the Ph.D. degree with the Key Laboratory of Advanced Transducers and Intelligent Control System, Ministry of Education and Shanxi Province of China. His research interests include network synchronization, secure communications, key distribution, and nonlinear dynamics of semiconductor lasers. Yanqiang Guo received the M.S. and Ph.D. degrees from Shanxi University, Shanxi, China, in 2007 and 2013, respectively. His research interests include interaction between light and matter, measurement of quantum states, and cavity quantum electrodynamics. Yuanyuan Sun received the M.S. degree in optical engineering from the Taiyuan University of Technology, Shanxi, China, in 2015. Her research interests include secure communication and information reconciliation. Qi Zhao is currently pursuing the M.S. degree in optical engineering with the Taiyuan University of Technology, Shanxi, China. Her research interests include secure communication and privacy amplification. Doudou Lan is currently pursuing the M.S. degree in optical engineering with the Taiyuan University of Technology, Shanxi, China. Her research interests include secure communication and quantum key distribution. Yuncai Wang received the B.S. degree in semiconductor physics from Nankai University, Tianjin, China, in 1986, and the M.S. and Ph.D. degrees in physics and optics from the Xi’an Institute of Optics and Precision Mechanics, Chinese Academy of Sciences, Beijing, China, in 1994 and 1997, respectively. He has been a Professor with the College of Physics and Optoelectronics, Taiyuan University of Technology, where he is also the Chair of the Key Laboratory of Advanced Transducers and Intelligent Control System, Ministry of Education and Shanxi Province of China. His current research interests include nonlinear dynamics of chaotic lasers and its applications, including optical communications, chaotic optical time-domain reflectometers, chaotic lidars, and random number generation based on chaotic lasers. Dr. Wang is a fellow of the Chinese Instrument and Control Society, and a Senior Member of the Chinese Optical Society and the Chinese Physical Society. He also serves as a Reviewer for journals of the IEEE, Optical Society of America, and Elsevier organizations. Anbang Wang received the B.S. degree in applied physics and the Ph.D. degree in electronic circuits and systems from the Taiyuan University of Technology, Taiyuan, China, in 2003 and 2014, respectively. In 2006, he joined the Taiyuan University of Technology, where he is currently an Assistant Professor with the College of Physics and Optoelectronics. He is also a Visiting Scholar with the School of Electronic Engineering, Bangor University, Bangor, U.K. His research interests include laser dynamics, wideband chaos generation, optical time-domain reflectometry, and random bit generation.