1. Introduction

Information security of wireless networks is becoming a serious and urgent concern as diversified wireless devices, automotive cars, unmanned aerial vehicles, and low-cost satellites are connected, producing large amounts of critical and valuable data. The inherent broadcast nature of radio frequency (RF) wireless communications allows transmitted data to be easily eavesdropped. An eavesdropper (Eve) can store data now, and decrypt them later on when powerful computers are available. Cryptographic schemes based on the computational hardness of mathematical problems cannot be provably secure against such a “store now, decrypt later” attack [1].

Cryptographic schemes secure even against Eve who has unbounded computational resources have been known for a long time. The first example is Vernam’s one-time pad proposed in 1926 [2], which is based on a symmetric secret key no shorter than the size of a message to be sent. The perfect secrecy of this scheme was proven by Shannon based upon information theory [3], and hence is referred to as information-theoretic security.

Since then the notion of information-theoretic security has been extended into many scenarios. Wyner considered in 1975 secure message transmission over a wiretap channel (WTC), i.e. a channel between a sender (Alice) and a legitimate receiver (Bob) in the presence of Eve, and formulated the secrecy capacity when Eve can tap the channel only via its physically degraded version [4]. Csiszár and Körner soon extended Wyner’s model to relax the degradedness assumption on Eve, and derived generalized secrecy capacity formula [5]. This secure message transmission scheme is referred to as WTC coding.

Quantum key distribution (QKD) proposed by Bennett and Brassard in 1984 [6] and by Ekert in 1991 [7] allows one to share symmetric secret keys even when Eve eavesdrops the channel with any physically implementable attacks and has unbounded computational ability. The laws of quantum mechanics are employed to detect any attempts on the quantum channel launched by Eve.

In 1993, Maurer [8] and Ahlswede and Csiszár [9] formulated theories of secret key agreement (SKA) from common randomness over a WTC to share symmetric secret keys. In this model, by virtue of an error-free authenticated classical channel (public channel), Alice and Bob can generate secret keys even if Eve enjoys better channel conditions than Bob in the WTC.

WTC coding and SKA are referred to as physical layer security (PLS) schemes [10, 11], attracting much attention in wireless communications. In particular, SKA has been investigated experimentally in the RF domain during the last decade [12, 13]. RF-SKA exploits common randomness acquired by probing the channel subject to multipath scattering and fading. The key rate of RF-SKA is very low, e.g. at about 100 bps (bits per second) even in a short range [13].

QKD has been studied extensively since the 1990s [14], and deployed in metropolitan-scale [15,16] and continental-scale fiber networks [17]. QKD has been commercialized [18], and found a new application to long-term storage solutions [19]. QKD-related technologies have been studied and tested in free space optical (FSO) links [20–35]. Recently, QKD was successfully demonstrated in space over an intercontinental scale [36, 37], in which a key rate at around 1 kbps over a distance of up to 1200 km was reported.

A next important challenge is to increase the key rate. Unfortunately, however, recent theoretical studies clarify an upper bound of the maximum achievable key rate of QKD, which is just a few times larger than the theoretical key rates of known QKD protocols [38,39]. Even if it would be reached, it is insufficient to protect increasing confidential data traffic in wireless networks.

One attractive option to overcome this difficulty is SKA in a FSO channel. FSO communication is a promising scheme to realize high-capacity wireless links [40–45], which cannot be possible using RF communications only. FSO quantum communication was also demonstrated over a geostationary-orbit-ground link recently [46]. The highly directional nature of laser beam in FSO communications yields a greater security advantage over RF counterparts. A FSO channel must be in the line-of-sight (LoS) from Alice and Bob. This makes Eve much harder to eavesdrop the signals. This situation can be contrasted to the case of optical fibers, in which even Alice and Bob can hardly know precise details of installation routes and environment, and hence the channel is completely out of their control. In the case of LoS links, on the other hand, it is too much to assume that the whole channel is at Eve’s hand and any changes of channel characteristics are attributed to Eve’s attempts. It is reasonable to restrict Eve’s physical ability to access the FSO channel, and to model it as a FSO-WTC [47–50]. In return one can explore a possibility to improve the key rate and the distance.

Mathematically, a WTC is described by the joint probability distribution P(y, z|x) of observations at Bob and Eve, y and z, respectively, given Alice’s input x. The secret key rate is then expressed in terms of the mutual information based on this probability distribution. One then immediately faces the non-trivial question of how one can know such a distribution which includes the observation z of malicious Eve, whose attempts are usually hard to know. There have been tremendous amounts of theoretical studies on SKA. However, almost all literatures simply assumed that P(y, z|x) is just given, but did not ask how the model can be certified. In practical applications, however, some method to certify the model is indispensable. Although there have been many experimental works on RF-SKA [51–54], this issue has not been solved yet. As for FSO-SKA, it was only recently, to our best knowledge, that a first step experiment was reported in the specific case of nearly atmospheric-turbulence-free condition [55]. Thorough investigations under various atmospheric conditions are left open.

In this paper, we demonstrate the full-field implementation of FSO-SKA with WTC certifications by using a terrestrial 7.8 km FSO link testbed (Tokyo FSO Testbed), which consists of one sender terminal and two receiver terminals, one for Bob and the other for a probing station to evaluate WTC characteristics. Using this practical configuration, we demonstrate high-speed FSO-SKA for various channel realizations.

2. Concept of FSO-SKA

2.1. Secret key rate of SKA

The fundamental metric of SKA is the secret key capacity C_K, i.e., the maximum achievable rate of secret key generation [8, 9]. To derive an explicit expression of C_K is generally very hard. Instead, an achievable lower bound is known as [10,56]

The mutual information are given by

Thus, the secret key rate R_K directly depends on Eve’s random variable Z and related probability distributions, which are hard to know in practice. This is in sharp contrast to QKD. In QKD, one can estimate the leaked information to Eve solely from the measured quantum bit error rate at Bob along with a prescribed theoretical formula based on the laws of quantum mechanics — the no-cloning theorem. In SKA, on the other hand, no single principle exists, but one should employ elaborate measurement on the WTC characteristics to estimate the leaked information to Eve.

2.2. Case-by-case risk analysis on FSO communications

Because a FSO channel is in the LoS between Alice and Bob, if Eve gets into the channel or is located around them, they have a stronger chance to become aware of the presence of Eve. This aspect should be fully employed for FSO-SKA. In the case of short-distance inter-building links, such as the last one-mile link from the fiber backbone to the client premises, surveillance cameras suffice to monitor the channel [57], however, channel probing with surveillance cameras becomes more difficult (detailed analysis is presented in Section 3.1 later on). In that case, one should introduce other means. Today, space debris surveillance systems with radar and lidar (light detection and ranging) can detect and monitor flying objects as small as 10-cm long [58]. Although implementing such systems is out of scope of this paper, it is understood that it is quite hard for Eve to tap the main lobe of the channel in the middle of Alice and Bob in principle.

If in the future, stealth drones against both radar and lidar were available, the Eve-in-the-middle attack could be likely risks. In that case, PLS schemes based on the laws of classical physics cannot provide mechanisms to detect stealth drones, and hence only the option is QKD. In the following, we restrict ourselves to more realistic scenarios of the two kinds;

In any case, we can reasonably assume that Eve’s capability to access the channel is physically limited. However, certifying her physical capability in a quantitative way is an involved task. So, we give further consideration on these two scenarios for typical use cases of FSO communications.

Satellite-to-ground/drone-to-ground links

It is reasonable to assume that the ground station and the beam footprint can be within a physically protected area against Eve. Obviously, the Eve-behind-Bob scenario is not the case. The problem is actually to evaluate the characteristics of the WTC in the Eve-in-the-far-side scenario.

Satellite-to-drone/drone-to-drone/car-to-car/car-to-infrastructure/inter-building links

In these cases, the Eve-behind-Bob scenario is very likely. It is not easy to detect Eve by radar, lidar, and surveillance cameras because in a sight from Bob in the opposite direction to Alice there are usually various objects and atmospheric structures, and hence Eve can slip away in such a complex background and receive comparable beam power with that at Bob by using a large telescope. Only the exception may be inter-building links on a rooftop in which a shielding wall twice as wide as the diameter of the FSO beam can be installed ensuring that the entire FSO signal will be absorbed and cannot be intercepted beyond Bob’s building [59]. This countermeasure will not work well for FSO links between mobile terminals. In this Eve-behind-Bob scenario, the options may include both SKA and QKD. If FSO-SKA can be applicable, then the key rate and the transmission distance can be greatly improved with lower-cost devices than those of QKD.

Satellite-to-satellite links

In space, there are no atmospheric effects, the LoS is very clear, and every satellite flies in a predictable orbit. In addition, a narrow and collimated laser beam is employed with precise pointing, acquisition, and tracking techniques [60]. Therefore, the Eve-in-the-far-side scenario is most unlikely. On the other hand, Eve may be able to acquire and track the optical beam behind Bob if she launches her satellites into an appropriate orbit, or employs drones or ground terminals to detect the beam footprint. Thus the Eve-behind-Bob scenario is still very likely [61].

Thus the likely use cases of FSO-SKA are the Eve-in-the-far-side scenario in satellite-to-ground or drone-to-ground links, and the Eve-behind-Bob scenario in mobile FSO communications or terrestrial inter-building FSO communications in which installing the shield wall at Bob is not easy by some reasons. To characterize the FSO-WTC in these scenarios, a FSO-SKA system should have some probing mechanisms to know information related to Eve’s observation z, which appears in the joint probability distribution P(y, z|x). So, in our experiment, we implemented a probing station near Bob’s receiver [55].

2.3. Configuration and protocol of FSO-SKA

In FSO-SKA, Alice generates initial random bit sequences (RBSs) $x_0^{n+l}$ of length n + l by a physical random number generator (PRNG), and transmits them to Bob by a highly directional laser beam (the main channel). Here, l is a length of test bits used for the WTC characterization and n is a length of remaining random bits from which the secret key is distilled (Fig. 1(a)). Bob receives the sequence from Alice, $y_0^{n+l}$, which may contain transmission errors. Hence, $x_0^{n+l}$ and $y_0^{n+l}$ are not generally identical. Eve can tap a part of FSO beam to get an observed sequence $z_0^{n+l}$. We call the corresponding channel the wiretapper channel. The sequence $z_0^{n+l}$ at Eve is unknown to Alice and Bob, but they have to estimate the upper bound on the leaked information to Eve somehow. To this end, we introduce a probing station near Bob’s receiver. Hereafter, we call the probing station virtual Eve (v-Eve). Alice and v-Eve constitute the probing channel which is located in the side lobe of the FSO beam. The outputs from the probing channel are denoted as ${\widehat{z}}_0^{n+l}$. Bob and v-Eve are connected to Alice via the public channel to carry out the key-distillation processing, which consists of information reconciliation and privacy amplification (Fig. 1(b)).

 

Fig. 1 (a) Schematic diagram of the configuration of FSO-SKA. (b) Key-distillation processing conducted over the public channel.

Download Full Size | PDF

In information reconciliation [62,63], Alice and Bob randomly select length-l test bits $x_{\text{test}}^l$ and $y_{\text{test}}^l$ from $x_0^{n+l}$ and $y_0^{n+l}$, evaluate bit error rate (BER) to select an appropriate error-correction code, and correct errors by communicating necessary information via the public channel to share the common sequence of length n. In particular, we adopt the reverse reconciliation (RR) scheme [64] rather than the direct reconciliation one, because the RR can realize larger key rate, which is given by R_K = I(X; Y) − I(Y; Z) (see Appendix A). Eve has the observed sequence $z_0^{n+l}$ and can listen to all the information communicated over the public channel. Therefore, Eve may have partial information on the reconciled sequence of Alice and Bob.

In privacy amplification [63,65], to extract a sequence uncorrelated with Eve, Alice and Bob compress the reconciled sequence into a shorter sequence — the secret key. The compression rate of privacy amplification is determined by the estimated upper bound on the leaked information to Eve via v-Eve’s observation ${\widehat{z}}_0^{n+l}$, which is actually I(Y; Ẑ) in the RR scheme.

3. Experimental setup

3.1. Tokyo FSO Testbed

Figure 2(a) presents pictures of our experimental setup with Tokyo FSO Testbed [48, 49, 55]. Alice’s transmitter is an all-weather telescope dome on a building in the University of Electro-Communications (UEC: 35°39′28.8″N, 139°32′39.5″E) at Chofu. In the transmitter, the initial RBSs from the PRNG are encoded into the 1550-nm-wavelength optical signals by non-return to zero on-off keying at a rate of 10 Mbps, and are then transmitted to Bob. Bob’s receiver is located in the sixth floor of a building of the National Institute of Information and Communications Technology (NICT: 35°42′24.2″N, 139°29′19.3″E) at Koganei. On the rooftop of the NICT building, a container-type terminal is setup as v-Eve, which is 10-m away from Bob’s receiver.

 

Fig. 2 (a) Geographical configuration of Tokyo FSO Testbed. (b) Beam footprint at Bob’s site (the NICT building). (c) Photographs of Skytower West Tokyo at 4.5-km distance from NICT. The right picture is the enlarged view for the antenna and its supporting poles located on the Skytower West Tokyo. (d) Photographs of Alice’s site taken from NICT at 7.8-km distance from NICT.

Download Full Size | PDF

Figure 2(b) indicates contour circles of beam footprint at Bob’s site for several different intensity ratios to the peak power at the beam center. For the 20dB- and 30dB-intensity circles, the upper-right-diagonal part propagates further into free space behind Bob’s building, and hence could potentially be received by Eve. When the beam direction wanders due to atmospheric turbulence, such a wiretapping risk increases. V-Eve located on the rooftop can monitor a fraction of the signal beam to estimate the WTC characteristics and to assess eavesdropping risks. The details of this WTC configuration and specifications of the terminals are described in [48] and [49].

To examine the possibility to detect suspicious objects around the middle point of the link, we developed surveillance camera systems in NICT and UEC. However, in the optical link between Alice and Bob, there is no building structure which can serve as a good reference. Instead, we used the Skytower West Tokyo at 4.5-km distance from Alice in a different direction with the link (see Fig. 2(a)) for this purpose.

Figure 2(c) shows photographs of the antenna and its supporting poles of the Skytower West Tokyo taken with our surveillance camera system consisting of a camera sensor with a pixel pitch d_pix of 3.9 μm and a field-scope with a focal length f_tele of 1.75 m. The spatial resolution of the camera system is quantified with the angle subtended by a single camera pixel — the instantaneous field of view (IFoV) θ_IFoV — which is calculated as

Figure 2(d) shows photographs of Alice’s site taken from Bob (7.8 km apart). For such a long distance, the surveillance camera cannot resolve the target, especially when wind velocity is fast, disenabling channel probing.

3.2. WTC characterization

The WTC is characterized by evaluating the conditional probability distributions P_AB(y|x), P_AE(ẑ|x), and P_BE(ẑ|y) using the test bits. The test-bit length l must be sufficiently long such that the length dependence disappears in statistical metrics such as the mutual information I(Y; Ẑ) while keeping the block length n of privacy amplification relatively long. In our experiment, we set l to be 64 kbits and n to be roughly 1 Mbits (precisely, 2²⁰ = 1048576 bits). For these lengths, the length dependence in the experimentally observed I(Y; Ẑ) becomes very small (see Appendix B). Thus the length of the initial RBS sent from Alice is n + l = 1112576 bits.

To establish synchronization between Alice and Bob/v-Eve, a pseudo-random noise-15 (so-called PN15) sequence of length 2¹⁵ − 1 = 32767 bits and an ID sequence of length 1024 bits are added to the TRBS generated by Alice. The PN15 sequence is generated by a linear feedback shift register and employed to establish frame synchronization. The ID is uniquely assigned to each TRBS in order to identify it in the key-distillation processing. If the ID alters due to transmission errors, the key-distillation processing would fail. Therefore, we concatenate the 64 copies of the ID for error correction. The probability of ID recognition error can reduce to about 10⁻⁶ when the BER is 20%. Even in clear atmospheric conditions, FSO links may often experience fading of 20–30dB lasting up to ∼ 1–100 ms due to atmospheric turbulence (scattering, absorption, and scintillation), which could often result in burst error — a loss of long consecutive bits. Therefore, if these sequences are added to the head of the payload, they may be lost due to the burst errors induced by atmospheric fading. Hence, we interleave these sequences into the payload to mitigate such burst errors. The schematic diagram of the frame structure is given in [55].

Photocurrents from Bob’s and v-Eve’s diodes are acquired by an oscilloscope at a sampling rate of 50 MHz, In each acquisition, a recorded waveform with a duration of 1.28 s is sent to the PC via the USB link. The recorded waveform is divided into 230-ms partial waveforms which contain at least one transmitted frame with a duration of 115 ms. The partial waveform is referred to as the output waveform w_y(t) (for Bob) or w_ẑ(t) (for v-Eve), which is processed by a PC in the following way.

First, clock data corresponding to the 10-MHz repetition rate at Alice is recovered at Bob’s and v-Eve’s sites. This processing is called clock data recovery (CDR) and its detail is presented in [41]. CDR determines the sampling times t_i to resample the output waveform w_y(t) into a sequence synchronizing with the 10-MHz input symbols. The values w_y(t_i) and w_ẑ(t_i) are recorded as demodulated sequences, denoted as a_y(i) and a_ẑ(i), respectively. Figs. 3(a) and 3(d) show examples of them.

 

Fig. 3 Channel characterization for the data acquired at 14:50 on 23 May 2017. (a) Demodulated sequence a_y(i) at Bob, where the index i runs from 1 to 2300000 to over at least one frame in the sequence. Also shown is the threshold based on the two-sided moving average. (b) Diagram of the main channel. Edges represent the conditional probabilities P_AB(y|x). (c) Experimentally characterized P_AB(y|x) of the main channel. (d) Demodulated sequence a_ẑ(i) at v-Eve. (e) Diagram of the probing channel. Edges represent the conditional probabilities P_AE(ẑ|x). (f) Experimentally characterized P_AE(ẑ|x). For soft decision, bin width Δ is chosen so that the leaked information is appropriately estimated with finite-size data in practical experiment (see Appendix B). In this figure, the total bin number K is taken to be 763.

Download Full Size | PDF

Second, Bob binarizes the demodulated sequences by assigning ‘0’ (‘1’) if a_y(i) is lower (higher) than the certain threshold. To adapt to atmospheric fading, we set the threshold ā_y(i) for a_y(i) based on the two-sided moving average

Third, frame synchronization is carried out to identify the position of the initial RBS from Alice in b_y(i) and b_ẑ(i). To this end, Bob and v-Eve calculate the cross-correlation function between the bit sequence and the PN15 sequence. This procedure fails when the BER is over 47%. If the frame synchronization fails at v-Eve, information leaked to Eve is considered to be 0.01 bit/symbol, which corresponds to the mutual information of the binary symmetric channel with a crossover probability of 45%.

Bob extracts the received RBS $y_0^{n+l}$ from b_y(i) by removing the PN15 sequence and the ID sequence in the reverse way to form the frame. This procedure is called de-interleave. Then, length-l test bits $x_{\text{test}}^l$ and $y_{\text{test}}^l$ are randomly selected from $x_0^{n+l}$ and $y_0^{n+l}$, respectively, at the same bit positions. Finally, the number of events in $y_{\text{test}}^l$ detecting y given input x, N_AB(y|x), and the number $N_{\text{A}}(x)={\sum }_{y=0,1}$ N_AB(y|x) are counted. The main channel can be experimentally characterized as

At v-Eve, on the other hand, we further exploit another decision rule with multiple output symbols, often referred to as soft decision, because more information can be extracted than by binary decision (hard decision), and hence the leaked information can be estimated more strictly. So, in the de-interleave, we move back to the demodulated sequence again, divide its value range into K bins with an equal width Δ, and decide which of the symbols 1, · · · , K the value a_ẑ(i) takes. Through the procedure, we obtain the K-valued random number sequence (RNS) ${\widehat{z}}_0^{n+l}$. We characterize the probing channel P_AE(ẑ|x) by a 2-by-K matrix based on length-l test bits $x_{\text{test}}^l$ and test samples ${\widehat{z}}_{\text{test}}^l$ as shown in Figs. 3(e) and 3(f).

Once the main and probing channels have been characterized as P_AB(y|x) and P_AE(ẑ|x), the other probability distribution P_BE(ẑ|y) can be straightforwardly derived. Then the mutual information I(X; Y), I(X; Ẑ), and the estimate for the leaked information I(Y; Ẑ) can also be obtained experimentally.

4. Asymptotic key rate $R_{\text{K}}^{\text{A}}$

4.1. Theoretical calculation of mutual information

Before presenting experimental results of FSO-SKA, we first see how I(X; Y), I(X; Ẑ), and I(Y; Ẑ) behave as functions of the average received signal powers (ARSPs) at Bob, S̄_B, and at v-Eve, S̄_E. To find a rough theoretical fitting for the overall performance seen in experimental campaigns under various conditions, we adopt an idealized additive white Gaussian noise (AWGN) model for the demodulated sequences a_y(i) and a_ẑ(i). We further assume that the noise variance in each distribution can be specified by a quadratic function in terms of S̄_B or S̄_E, whose coefficients are derived by fitting with experimental data of a_y(i) and a_ẑ(i) (see Appendix C).

Figures 4(a) and 4(b) illustrate I(X; Y) and I(X; Ẑ) which depend only on S̄_B and S̄_E, respectively. Their behaviors are very similar; two regions can be clearly identified, i.e., the loss-independent region where the mutual information is unchanged for S̄_B or S̄_E, and the noise-limited region where the mutual information monotonically decreases as S̄_B or S̄_E decreases. In the loss-independent region, the received signal power is enough for the signal to be well discriminated without errors, not limited by the noises. Hence, I(X; Y) and I(X; Ẑ) are unchanged even S̄_B and S̄_E decrease such as due to channel losses, respectively. In the noise-limited region, on the other hand, the ARSP becomes comparable with or less than the noise power. Hence, the discrimination of x = 0 or 1 suffers from errors due to the noises.

 

Fig. 4 Theoretical calculations of mutual information (a) I(X; Y), (b) I(X; Ẑ), and (c) I(Y; Ẑ). The repetition rate and the laser wave length are assumed to be 10 MHz and 1550 nm, respectively. The detailed description of the calculation is given in Appendix C.

Download Full Size | PDF

Figure 4(c) illustrates an estimate for an upper-bound on the leaked information I(Y; Ẑ) which depends on both S̄_B and S̄_E, because the bit discrepancies between yⁿ and ẑⁿ are the superposition of the errors occurring in the main and probing channels. This quantity can be again characterized by the loss-independent and noise-limited regions along each axis of S̄_B and S̄_E.

The theoretical asymptotic key rate $R_{\text{K}}^{\text{A}}=I(X;Y)-I(Y;\widehat{Z})$ as a function of S̄_B and S̄_E is shown in Figure 5(a). Its behavior can be understood based on the features mentioned above. For a fixed value of S̄_E, the asymptotic key rate $R_{\text{K}}^{\text{A}}$ monotonically decreases as S̄_B decreases. For a fixed value of S̄_B, $R_{\text{K}}^{\text{A}}$ shows the opposite behavior with I(X; Ẑ); $R_{\text{K}}^{\text{A}}$ starts to drastically decrease for larger S̄_E, resulting in the outage of key generation.

 

Fig. 5 (a) Theoretical curve of the asymptotic key rate $R_{\text{K}}^{\text{A}}$. (b) Plot of the experimental $R_{\text{K}}^{\text{A}}$. The data points of outage, for which $R_{\text{K}}^{\text{A}}\le 0$, are indicated by x-marks. (c) Contour plot of the theoretical and experimental $R_{\text{K}}^{\text{A}}$.

Download Full Size | PDF

4.2. Experimental results of $R_{\text{K}}^{\text{A}}$

We performed FSO-SKA experiments in various conditions as summarized in Table 1. In the first and fourth campaigns, the transmission power and the beam center position were set to several values to collect the transmission data under several WTC conditions. Noting that we succeeded to consistently generate the final keys even in the daytime during these campaigns by maintaining the beam direction. In the second and third campaigns, we fixed the transmission power and the beam center position to investigate the long-term behavior of the performance of FSO-SKA protocol.

Table 1. Summary of experimental configurations of FSO transmission campaigns

View Table

Figure 5(b) plots experimentally evaluated $R_{\text{K}}^{\text{A}}$ for various ARSPs at Bob and v-Eve. These data points were acquired in the four campaigns summarized in Table 1, and include 20550 frames. The experimental data can reproduce the fundamental properties shown in Fig. 5(a). It is worth noting that $R_{\text{K}}^{\text{A}}$ could remain finite even when v-Eve received much larger power than Bob (S̄_E > S̄_B), thanks to the RR scheme.

Figure 5(c) summarizes a contour plot of the theoretical and experimental $R_{\text{K}}^{\text{A}}$. Three insets at the top show the S̄_B-dependence of $R_{\text{K}}^{\text{A}}$ for S̄_E = 2, 5, and 11 nW. Similarly, the right three insets illustrate the S̄_E-dependence of $R_{\text{K}}^{\text{A}}$ for S̄_B = 10, 50, and 100 nW. Each inset includes experimental data within the range of ±10% of corresponding S̄_B and S̄_E.

It can be confirmed again that the overall features of experimental $R_{\text{K}}^{\text{A}}$ could be roughly fitted by the theoretical curves. Precisely speaking, however, the experimental $R_{\text{K}}^{\text{A}}$ for smaller S̄_B and S̄_E deviate downward from the theoretical curve as seen in the left of the three top insets and bottom of the three right insets. In this case, atmospheric turbulence degrades only the main channel since the leaked information to Eve is negligibly small. On the other hand, the experimental $R_{\text{K}}^{\text{A}}$ for larger S̄_B and S̄_E deviate upward from the theoretical curve as seen in the right of three top insets. In this case, atmospheric fading affects more the probing channel than the main channel. This result suggests that the deterioration of key rate due to atmospheric fading can be compensated by increasing transmission power in an appropriate way.

4.3. Effects of the atmospheric turbulence

To understand the effects of the atmospheric turbulence on the performance of FSO-SKA, we compare ten typical cases; A ∼ E for S̄_E = 1.8 ∼ 2.1 nW and F ∼ J for S̄_E =10.3 ∼ 11.7 nW. The histograms of the demodulated sequences a_y(i) and a_ẑ(i) conditioned on input bit symbol x = 0 or 1 are shown as probability density functions (PDFs) in Fig. 6 for cases A ∼ E, and Fig. 7 for cases F ∼ J with meteorological wind velocity and experimental $R_{\text{K}}^{\text{A}}$.

 

Fig. 6 Histograms of the demodulated sequences for cases A to E. These cases are shown in the upper left inset of Fig. 5(c). For each case, ARPSs S̄_B and S̄_E, wind velocity (w.v.), and experimental $R_{\text{K}}^{\text{A}}$ are shown as well as the time and date.

Download Full Size | PDF

 

Fig. 7 Histograms of the demodulated sequences for cases F to J. These cases are shown in the upper right inset of Fig. 5(c). For each case, ARPSs S̄_B and S̄_E, wind velocity (w.v.), and experimental $R_{\text{K}}^{\text{A}}$ are shown as well as the time and date.

Download Full Size | PDF

In cases A and B (both S̄_B and S̄_E are small), the PDFs are Gaussian even under atmospheric turbulence — wind velocity was 4.8 m/s in case A. The effects of atmospheric turbulence cannot be resolved in the histograms when the ARSP is small, because it is masked by the receiver noises whose distribution corresponds to the PDF for x = 0. In cases C and D, S̄_B becomes larger (∼27 nW). Then atmospheric fading can be identified as Bob’s non-Gaussian PDF with a large variance as seen in case D. Actually, case D is windier than case C. So in case D, BER gets larger and experimental $R_{\text{K}}^{\text{A}}$ is degraded below the theoretical curve. In case E, Bob’s PDF suffers from strong atmospheric fading, but experimental $R_{\text{K}}^{\text{A}}$ attains as high as about 9 Mbps thanks to sufficient ARSP.

For cases F ∼ J, S̄_E gets larger (S̄_E ∼ 10 nW), more information is leaked to v-Eve, and the rates become lower in general. Case H, however, show higher experimental $R_{\text{K}}^{\text{A}}$ than case G even though they have the same S̄_B and S̄_E. This is attributed to the degradation of v-Eve’s probing channel by atmospheric fading (faster wind velocity in case H than case G) as seen in the right middle histogram in Fig. 7. The difference between cases I and J is due to the same reason.

5. Final key rate $R_{\text{K}}^{\text{F}}$

5.1. Key-distillation processing

After having the experimental BER P_e and estimate for leaked information I(Y; Ẑ), we carry out the key-distillation processing. A flow chart of the processing is shown in Fig. 8.

 

Fig. 8 Flow chart of the key-distillation processing.

Download Full Size | PDF

First, the length-n sequences xⁿ and yⁿ, generated by removing the test bits from $x_0^{n+l}$ and $y_0^{n+l}$, are input into the processing. The block shuffling is applied on them to mitigate the burst errors occurring in transmission. The resulting sequences are denoted as x′ⁿ and y′ⁿ.

Second, the RR is performed using low density parity check (LDPC) code. The code rate R_LDPC is chosen depending on P_e as follows:

Third, hash value of the message digest, MD5, with a length of n_MD5 (=128) bits is calculated for the reconciled code word at Alice, and is sent to Bob to check whether it coincides with that of $c_{\text{LDPC}}^n$. If the hash values are the same, the RR is successfully completed. Otherwise the key-distillation processing for this block is aborted.

Fourth and finally, Alice and Bob perform the privacy amplification. They compress the reconciled code word $c_{\text{LDPC}}^n$ into the secret key s^k with a length of k = n[R_LDPC − I(Y; Ẑ)] − n_MD5 with a Toeplitz matrix [66]. The ratio k/n_f of the secret key length k to the frame length n_f (=1146367) is referred to as the final key rate $R_{\text{K}}^{\text{F}}$.

The theoretical curve of $R_{\text{K}}^{\text{F}}$ is shown in Fig. 9(a). The curve rapidly falls down to zero when S̄_B or S̄_E exceeds certain threshold. The cut-off along S̄_B, which is not seen in the theoretical asymptotic key rate $R_{\text{K}}^{\text{A}}$, occurs at around S̄_B =20 nW. This is caused by the limitation of our LDPC code; error correction fails when the BER is over 6.7% (see Eq. (8)). The cut-off along S̄_E occurs at around S̄_E =10 nW, which is much steeper than that of $R_{\text{K}}^{\text{A}}$ shown in Fig. 5(a). This is due to the fact that R_LDPC can be smaller than not only I(X; Y) but also I(Y; Ẑ). For the same reason, $R_{\text{K}}^{\text{F}}$ can no longer be non-zero finite for S̄_E ≥ S̄_B.

 

Fig. 9 (a) Theoretical characteristics of the final key rate $R_{\text{K}}^{\text{F}}$. (b) Plot of the experimental $R_{\text{K}}^{\text{F}}$. The data points of outage, for which $R_{\text{K}}^{\text{F}}\le 0$, are indicated by x-marks. (c) Contour plot of the theoretical and experimental $R_{\text{K}}^{\text{F}}$.

Download Full Size | PDF

5.2. Experimental results of $R_{\text{K}}^{\text{F}}$

Figure 9(b) shows a plot of experimental $R_{\text{K}}^{\text{F}}$. Although the number of black x-marks indicating the outage of key distillation increases compared with Fig. 5(b), the experimental $R_{\text{K}}^{\text{F}}$ can stay larger than 1 Mbps in the region of S̄_B > 20 nW and S̄_E < 10 nW, and reach 7.77 Mbps at higher S̄_B even under total channel-loss of 55dB.

Figure 9(c) summarizes a contour plot of the theoretical and experimental $R_{\text{K}}^{\text{F}}$. As with Fig. 5(c), three insets at the top show the S̄_B-dependence of $R_{\text{K}}^{\text{F}}$ for S̄_E = 2, 5, and 11 nW, and right three insets illustrate the S̄_E-dependence of $R_{\text{K}}^{\text{F}}$ for S̄_B = 10, 50, and 100 nW. The experimental key rates in most cases can be fitted by the theoretical model, except in the region of S̄_E ≥ 10 nW and S̄_B ≥ 20 nW (the right of three top insets), in which the experimental $R_{\text{K}}^{\text{F}}$ attain 100 kbps–5 Mbps for larger S̄_B while the theoretical rates result in the outage. This discrepancy is due to the same reason as in Fig. 5(c).

To see how meteorological conditions affect the SKA performance, we conducted a transmission campaign for about a week, fixing the transmission power and the beam pointing (Campaign No. 3 in Table 1), once the beaming from Alice to Bob was optimized at the evening time. Figure 10 shows temporal variations of the one-hour averaged final key rate, the failure rate (the ratio of the number of frames for which key generation fails to the total number of frames transmitted per hour), Bob’s and v-Eve’s ARSPs, the solar radiation, and the cloud ceiling. The one-hour averaged final key rate and the failure rate vary periodically day by day (Fig. 10(a)). The key rate reaches about 7 Mbps or higher in the night time, whereas it becomes zero almost during the day time.

 

Fig. 10 Summary of Campaign No. 3. (a) Variations of the one-hour averaged final key rate $R_{\text{K}}^{\text{F}}$ (blue solid line) and the failure rate (red chain line). During experiment, 10 frames were recorded every 5 minutes. Thus, 120 frames were transmitted in each one hour. Gray shades indicate the night time between sunset and sunrise and dashed lines show the 00:00 AM in JST. (b) Variations of the one-hour averaged S̄_B (solid line) and S̄_E (chain line). (c) Variations of the one-hour averaged solar radiation and cloud ceiling. These meteorological data were provided by OBSOC [67], the compound meteorological sensor at NICT premises. For the interested reader, we provide Data File 1 [68] which includes the original data sets for this figure ($R_{\text{K}}^{\text{F}}$, S̄_B, and S̄_E) as well as the histograms of the demodulated sequences. In Visualization 1, we present a movie of the variations of $R_{\text{K}}^{\text{F}}$ and the histograms of the demodulated sequences during 27 hours from 18:00 on 11 June.

Download Full Size | PDF

The final key rate correlates with Bob’s and v-Eve’s ARSPs as seen in Fig. 10(b), and, more remarkably, directly anti-correlates with the solar radiation as seen in Fig. 10(c). These periodic changes may stem from the thermal drifts of the buildings and instruments. Empirically these drifts deviate the beam direction with a rate of 0.2 mrad/hour in the daytime [47]. The deterioration of key rate in the day time is not the defect of the protocol but due to the misalignment. If the beam alignment is made in the day time, we can generate the final keys even in the daytime. The periodic behaviors observed for about a week prove the stability of our instruments. In the midnight on 12 June to the early morning on 13 June, the key rate drastically dropped even in the night time. In the same time, the decrease of the cloud ceiling was observed, implying that the rainfall shut the FSO link.

Finally, the 15-test battery proposed by NIST [69] was applied on the generated key. Our keys successfully passed all the tests as shown in Fig. 11.

 

Fig. 11 Summary of the NIST randomness test suites [69] for keys generated on 9 June 2017. We applied the tests on 1000 instances with a length of 10⁶ bits. The acceptable uniformity should be larger than 10⁻⁴. As shown by the black dotted lines, the acceptable success rate range for excluding Random Excursions (Variant) test is 0.99 ± 0.00943: The acceptable success rate range is 0.99 ± 0.0121 for Random Excursions (Variant) test. For the items with multiple tests (Cumulative Sums, Non Overlapping Template, Random Excursions, and Random Excursions Variant), we show the range of the lowest and highest scores by the black solid lines.

Download Full Size | PDF

6. Conclusion

We demonstrated high-speed generation of information-theoretically secure keys over the FSO-WTC. The final key rates from 100 kbps to the maximum of 7.77 Mbps were attained for the 10-MHz repetition rate even under the main channel losses of 55dB or higher, in which known QKD schemes attain impractically low key rates. If the repetition rate is increased, the final key rate would increase further. Our results show that a FSO communication system, if supplemented with an appropriate probing station, promises secure high-speed key establishment for wireless networks. Several important challenges remain. Efficient WTC probing methods need to be investigated further, and their data should be accumulated for practical security certification. Information reconciliation performance should be improved to get close to the asymptotic performance shown in Fig. 5, such as by revising error-correction code and by introducing appropriate filtering for the input sequence into the key distillation processing. Key distillation performances should be investigated with various block sizes to study finite size effects.

Appendix

A. Secret key rates for reverse reconciliation

In information reconciliation, the one-way transmission over the public channel suffices to achieve the lower bound (1) [8, 9]. Then, we have two options; direct reconciliation (DR) and reverse reconciliation (RR). In DR, Alice sends the correction information to Bob, and Bob reconstructs xⁿ. The leaked information to Eve is I(X; Z) if the process is perfect. In RR, Bob sends Alice the correction information to share yⁿ between them. The leaked information to Eve is I(Y; Z). Because the bit discrepancies between yⁿ and zⁿ are the superposition of the errors occurred in the main and wiretapper channels if they are statistically independent, the following inequalities

(9)$$I(X;Z)\ge I(Y;Z),\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}I(X;Y)\ge I(Y;Z)$$

hold. Consequently,

(10)$$I(X;Y)-I(Y;Z)\ge \text{max}\left[I(X;Y)-I(X;Z),0\right],$$

implying that even if Eve enjoys a better channel condition than Bob, RR allows SKA. Therefore, in the present experiment, we adopt RR and simply set R_K = I(X; Y) − I(Y; Z) where the mutual information between Bob and v-Eve, I(Y; Ẑ), is substituted for I(Y; Z).

We can experimentally confirm this point as well. Figure 12(a) shows a comparison of the mutual information I(X; Ẑ) and I(Y; Ẑ) leaked to Eve in DR and RR, respectively, which are evaluated from the experimental data presented in Fig. 5(b). Every point locates below the dashed line of the boundary I(X; Ẑ) = I(Y; Ẑ), meaning I(X; Ẑ) ≥ I(Y; Ẑ). This result yields the superiority of RR over DR. The difference of I(X; Ẑ) and I(Y; Ẑ) becomes larger as the BER in the main channel increases, because the error in the main channel influences the v-Eve’s observation in the RR.

 

Fig. 12 (a) Comparison between I(X; Ẑ) and I(Y; Ẑ). The color of each point corresponds to the BER in the main channel. (b) Comparison between I(X; Y)−I(X; Ẑ) and I(X; Y)−I(Y; Ẑ). The color of each point corresponds to the BER in the probing channel.

Download Full Size | PDF

Figure 12(b) shows a comparison of I(X; Y) − I(X; Ẑ) and I(X; Y) − I(Y; Ẑ) corresponding to the secret key rates based on DR and RR, respectively. Every point locates above the dashed line of the boundary I(X; Y) − I(X; Ẑ) = I(X; Y) − I(Y; Ẑ), also yielding the superiority of RR over DR. Since v-Eve employs soft decision, I(X; Y) − I(Y; Ẑ) can be lower than 0.

B. Sample-size dependences of statistical metrics

Ideally, the block length n for key-distillation and the test-bit length l should be as long as possible. In practice, however, they remain finite. Theories on finite length analysis on SKA are quite lacking at present. As for the block length, a standard often adopted in fiber-based QKD systems is n ∼ 1 Mbits. In the case of FSO-SKA, a longer length would be preferred because the channels are affected by atmospheric fading. Unfortunately, however, our current setup with the repetition rate of 10 MHz and the interface specification of the 50-MHz oscilloscope limits the block length at around 1 Mbits. Therefore we investigate test-bit length dependences of statistical metrics by varying its length l for an experimental data of fixed length n + l = 1112576 bits. More precisely, we randomly select the length-l test bits from the RBS/RNS of length n + l obtained in a certain FSO transmission campaign (actually the one for 14:28:30 on 22 May), and see the changes of BER and mutual information for various random selections of the RBS/RNS by simulation.

First, we investigate the length dependence of BER, by evaluating the difference P_e,l − P_e,n, where the BER P_e,l is calculated based on the test bits $y_{\text{test}}^l$ and the BER P_e,n is calculated based on the remaining RBS yⁿ. The random selection of $y_{\text{test}}^l$ is repeated 10000 times.

Figure 13 shows a result of the simulation. The average — E[P_e,l − P_e,n], where E[x] denotes the sample average — shown in Fig. 13(a) is independent of the test-bit length l and remains at the value 0. On the other hand, the standard deviation — $\sqrt{\text{var}\left[P_{\text{e},l}-P_{\text{e},n}\right]}$, where var[x] = E[x²] − (E[x])² denotes the sample variance— shown in Fig. 13(b) decreases as the test-bit length increases. Fig. 13(c) shows the histogram of P_e,l − P_e,n for l = 10000 bits. The histogram is well fitted with the Gaussian distribution with an average of 4.79 × 10⁵% and a standard deviation of 0.0964%. Hence, the 99.7% confident interval (or 3σ-interval, where σ denotes the standard deviation) is between ± 0.289%, which reaches one third of the BER interval (1%) for the LDPC code selection rule of Eq. (8). Thus, the probability to fail in the RR due to the estimation error cannot be negligible, and l should be longer. The same analysis is done for l = 64000 bits as shown in Fig. 13(d). Since the standard deviation becomes three times smaller than that for l = 10000 bits, the 99.7% confident area also shrinks in one third, between ± 0.118%. In this case, the failure probability of RR are suppressed to a much smaller value. Therefore, the test-bit length of 64000 bits is sufficient to estimate the BER.

 

Fig. 13 (a) Average E[P_e,l − P_e,n] for 10000 trials. (b) Standard deviation $\sqrt{\text{var}\left[P_{\text{e},l}-P_{\text{e},n}\right]}$ for 10000 trials. (c) Histogram of P_e,l − P_e,n for l = 10000 bits. The solid line represents the PDF of the Gaussian distribution with an average of 4.79 × 10⁻⁵% and a standard deviation of 0.0964%. (d) Histogram of P_e,l − P_e,n for l = 64000 bits. The solid line is the PDF of the Gaussian distribution with an average of 1.39 × 10⁻⁴% and a standard deviation of 0.0392%.

Download Full Size | PDF

The estimation of the leaked information is more directly related to the security certification of FSO-SKA. In our key-distillation processing, the estimation of I_l(Y; Ẑ) also depends on the bin width Δ of soft decision made by v-Eve. So we next show a bin-width dependence of I_l(Y; Ẑ) in Fig. 14(a) for l = 64000. The characteristics of the curve is the same as that shown in our previous work [48]. If Δ is too large, soft decision is completely equivalent to hard decision. If Δ is too small, on the other hand, the mutual information is overestimated due to the short of sample size against bin number, as shown above. Therefore, Δ should carefully be chosen not to over- and underestimate the leaked information. This curve has a flat region within a range of Δ = 0.08 mV to Δ = 1 mV. In the present experiment, we adopted Δ = 0.08 mV at the left end of the flat region because we are to estimate the leaked information I_l(Y; Ẑ) in the worst case. We note that the optimum bin width changes according to the dynamic range of the oscilloscope which is adjusted to cover the whole range of the waveform, which varies depending on the atmospheric conditions.

 

Fig. 14 (a) Bin-width dependence of I_l(Y; Ẑ) when test-sample length l is 64000 bits. (b) Average E[I_l(Y; Ẑ)−I_n(Y; Ẑ)] for 10000 trials. (c) Standard deviation $\sqrt{\text{var}\left[I_l(Y;\widehat{Z})-I_n(Y;\widehat{Z})\right]}$ for 10000 trials. (d) Histogram of I_l(Y; Ẑ) − I_n(Y; Ẑ) for 10000 test samples. The solid line represents the PDF of the Gaussian distribution with an average of 2.78 × 10⁻² bits/symbol and a standard deviation of 6.61 × 10⁻³ bits/symbol. (e) Histogram of I_l(Y; Ẑ) − I_n(Y; Ẑ) for 64000 test samples. The solid line represents the PDF of the Gaussian distribution with an average of 6.57 × 10⁻³ bits/symbol and a standard deviation of 2.86 × 10⁻³ bits/symbol. For these two histograms, the bin width Δ is 0.08 mV.

Download Full Size | PDF

Subsequently, we evaluate the test-sample-length dependence of I_l(Y; Ẑ) − I_n(Y; Ẑ), where the mutual information I_l(Y; Ẑ) is calculated based on the test samples ${\widehat{z}}_{\text{test}}^l$ and the mutual information I_n(Y; Ẑ) is calculated based on the remaining RNS ẑⁿ. The test-sample length l should be chosen such that the average E[I_l(Y; Ẑ) − I_n(Y; Ẑ)] is as close to 0 as possible, and does not change as the test-sample length l varies. As shown in Fig. 14(b), the average decreases as l increases. At the point of l = 64000, the three curves get close to 0, and l-dependence becomes small.

The standard deviation $\sqrt{\text{var}\left[I_l(Y;\widehat{Z})-I_n(Y;\widehat{Z})\right]}$ shown in Fig. 14(c) behaves similarly among the different Δ. To evaluate the 99.7% confident interval, the histogram of I_l(Y; Ẑ) − I_n(Y; Ẑ) for l = 10000 bits and Δ = 0.08 mV is fitted by the Gaussian PDF as shown in Fig. 14(d). If the test-bit length l increases to 64000 bits, the 99.7% confident interval shrinks by almost one third, in which the probability of fatal estimation error is very small.

C. Theoretical calculation of mutual information

The theoretical calculation of mutual information shown in Fig. 4 was done as follows.

First, as shown in (2), the mutual information I(X; Y) between Alice and Bob is evaluated as

(11)$$I(X;Y)=\sum _{x=0,1}\sum _{y=0,1}{P}_{\text{A}}(x)P_{\text{AB}}(y|x){\text{log}}_2\left[\frac{P_{\text{AB}}(y|x)}{{\sum }_{x^{\prime }}{P}_{\text{A}}(x^{\prime })P_{\text{AB}}(y|x^{\prime })}\right].$$

In the OOK scheme, bits x = 0 and x = 1 are generated with equal probability, P_A(x = 0) = P_A(x = 1) = 1/2. In hard decision, Bob decides that y = 1 is received when the signal intensity v_B exceeds a certain threshold v_th, otherwise y = 0 is received. Hence, the conditional probability distribution P_AB(y|x) is described as

(12)$$P_{\text{AB}}(y=1|x)={\int }_{v_{\text{th}}}^0{Q}_{\text{AB}}(v_{\text{B}}|x)d{v}_{\text{B}},\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}\hspace{0.17em}{P}_{\text{AB}}(y=0|x)={\int }_{-\infty }^{v_{\text{th}}}{Q}_{\text{AB}}(v_{\text{B}}|x)d{v}_{\text{B}},$$

where Q_AB(v_B|x) is the conditional PDF of Bob’s signal intensity v_B given x. We assume that the signal intensity v_B can be represented with infinite precision and the signal suffers only from AWGN. Thus, v_B for x = 1 and x = 0 follow the Gaussian PDF of means 2 S̄_B and 0, respectively, where S̄_B is the ARSP at Bob with the unit of nW. We further assume that the noise variance is the function of S̄_B. Precise characterization of the AWGN which may include the thermal noise, the background noise, the electrical noise and so on, is generally difficult. So, we estimated the noise variance as a function of given received power S from the experimental data as

(13)$${\sigma }_{\text{B}}^2(S)=1.57\times {10}^{-2}{S}^2+7.75\times {10}^{-19}S+1.44\times {10}^2,$$

by using the least square method. Therefore, the conditional PDF Q_AB(v_B|x) is given as

(14)$$Q_{\text{AB}}(v_{\text{B}}|x)=\frac{1}{\sqrt{2\pi {\sigma }_{\text{B}}^2(2x{\overline{S}}_{\text{B}})}}\text{exp}\left(-\frac{{\left(v_{\text{B}}-2x{\overline{S}}_{\text{B}}\right)}^2}{{\sigma }_{\text{B}}^2\left(2x{\overline{S}}_{\text{B}}\right)}\right).$$

Substituting (14) into (12), we obtain the conditional probability distribution as

(15)$$P_{\text{AB}}(1|0)={\int }_{{\overline{S}}_{\text{B}}}^{\infty }{Q}_{\text{AB}}(v_{\text{B}}|0)d{v}_{\text{B}}=\frac{1}{2}\text{erfc}\left(\frac{{\overline{S}}_{\text{B}}}{2\sqrt{{\sigma }_{\text{B}}^2(0)}}\right),$$

(16)$$P_{\text{AB}}(0|1)={\int }_{-\infty }^{{\overline{S}}_{\text{B}}}{Q}_{\text{AB}}(v_{\text{B}}|1)d{v}_{\text{B}}=\frac{1}{2}\text{erfc}\left(\frac{{\overline{S}}_{\text{B}}}{2\sqrt{{\sigma }_{\text{B}}^2(2{\overline{S}}_{\text{B}})}}\right),$$

where the threshold is set to be S̄_B and erfc(·) is the complementary error function.

Next, for the mutual information I(X; Ẑ) between Alice and v-Eve, we assume that the PDF of signal intensity v̂_E at v-Eve can be estimated with infinite precision. Thus, I(X; Ẑ) is calculated as

(17)$$I(X;\widehat{Z})=\sum _{x=0,1}{\int }_{-\infty }^{\infty }{P}_{\text{A}}(x)Q_{\text{AE}}({\widehat{v}}_{\text{E}}|x){\text{log}}_2\left[\frac{Q_{\text{AE}}({\widehat{v}}_{\text{E}}|x)}{{\sum }_{x^{\prime }}{P}_{\text{A}}(x^{\prime })Q_{\text{AE}}({\widehat{v}}_{\text{E}}|x^{\prime })}\right]d{\widehat{v}}_{\text{E}},$$

where Q_AE(v̂_E|x) is the conditional PDF of v̂_E given x. Assuming that the signal intensity v̂_E can be represented with infinite precision and the signal suffers only from the AWGN, like I(X; Y), Q_AE(v̂_E|x) is given as

(18)$$Q_{\text{AE}}({\widehat{v}}_{\text{E}}|x)=\frac{1}{\sqrt{2\pi {\sigma }_{\text{E}}^2(2x{\overline{S}}_{\text{E}})}}\text{exp}\left(-\frac{{\left({\widehat{v}}_{\text{E}}-2x{\overline{S}}_{\text{E}}\right)}^2}{{\sigma }_{\text{E}}^2\left(2x{\overline{S}}_{\text{E}}\right)}\right),$$

where S̄_E denotes the ARSP at v-Eve and the variance ${\sigma }_{\text{E}}^2(S)$ as a function of given received power S is determined from the experimental data as

(19)$${\sigma }_{\text{E}}^2(S)=1.92\times {10}^{-2}{S}^2+1.65\times {10}^{-19}S+2.68\times {10}^1.$$

Since deriving a closed form expression of this integral is difficult, we evaluated I(X; Ẑ) by numerical integration.

Finally, the mutual information I(Y; Ẑ) between Bob and v-Eve is calculated as

(20)$$I(Y;\widehat{Z})=\sum _{x=0,1}{\int }_{-\infty }^{\infty }{P}_{\text{B}}(y)Q_{\text{BE}}({\widehat{v}}_{\text{E}}|y){\text{log}}_2\left[\frac{Q_{\text{BE}}({\widehat{v}}_{\text{E}}|y)}{{\sum }_{y^{\prime }}{P}_{\text{B}}(y^{\prime })Q_{\text{BE}}({\widehat{v}}_{\text{E}}|y^{\prime })}\right]d{\widehat{v}}_{\text{B}},$$

where P_B(y) is the input probability of bit y and Q_BE(v̂_E| y) is the conditional PDF of v̂_E given y. These probabilities can be evaluated using the probabilities already derived. The probability P_B(y) is calculated as

(21)$$P_{\text{B}}(y)=\sum _{x=0,1}{P}_{\text{A}}(x)P_{\text{AB}}(y|x)=\frac{1}{2}\sum _{x=0,1}{P}_{\text{AB}}(y|x).$$

The conditional PDF Q_BE(v̂_E|y) is also calculated as

(22)$$Q_{\text{BE}}({\widehat{v}}_{\text{E}}|y)=\sum _{x=0,1}{Q}_{\text{AE}}({\widehat{v}}_{\text{E}}|x)P_{\text{BA}}(x|y)$$

(23)$$=\sum _{x=0,1}{Q}_{\text{AE}}({\widehat{v}}_{\text{E}}|x)\frac{P_{\text{AB}}(y|x)P_{\text{A}}(x)}{P_{\text{B}}(y)}$$

(24)$$=\frac{P_{\text{AB}}(y|0)Q_{\text{AE}}({\widehat{v}}_{\text{E}}|0)+P_{\text{AB}}(y|1)Q_{\text{AE}}({\widehat{v}}_{\text{E}}|1)}{2P_{\text{B}}(y)},$$

where P_BA(x|y) is the conditional probability distribution of x given y. In the second equality, we use the Bayes rule

(25)$$P_{\text{BA}}(x|y)P_{\text{B}}(y)=P_{\text{AB}}(y|x)P_{\text{A}}(x).$$

Like I(X; Ẑ), we evaluated I(Y; Ẑ) by numerical integration.

Funding

ImPACT Program of Council for Science, Technology and Innovation (Cabinet Office, Government of Japan).

Acknowledgments

The authors thank R. Matsumoto for theoretical discussion. They also thank K. Suzuki for providing meteorological data from OBSOC.

References

1. J. Braun, J. Buchmann, D. Demirel, M. Geihs, M. Fujiwara, S. Moriai, M. Sasaki, and A. Waseda, “LINCOS: A storage system providing long-term integrity, authenticity, and confidentiality,” in Proceedings on Asia Conference on Computer and Communications Security, (ACM, 2017), pp. 461–468.

2. G. S. Vernam, “Cipher printing telegraph systems for secret wire and radio telegraphic communications,” Trans. Am. Inst. Electr. Eng XLV, 295–301 (1926). [CrossRef]  

3. C. E. Shannon, “Communication theory of secrecy systems,” Bell Labs Tech. J. 28(4), 656–715 (1949). [CrossRef]  

4. A. D. Shannon, “The wire-tap channel,” Bell Syst. Tech. J. 54(8), 1355–1387 (1975). [CrossRef]  

5. I. Csiszár and J. Körner, “Broadcast channels with confidential messages,” IEEE Trans. Inf. Theory 24(3), 339–348 (1978). [CrossRef]  

6. C. H. Bennett and G. Brassard, “Quantum cryptography: public-key distribution and coin tossing,” in Proceedings of IEEE International Conference on Computers, Systems and Signal Processing, (IEEE, 1984), pp. 175–179.

7. A. K. Ekert, “Quantum cryptography based on Bell’s theorem,” Phys. Rev. Lett. 67(6), 661–663 (1991). [CrossRef]   [PubMed]  

8. U. M. Maurer, “Secret key agreement by public discussion from common information,” IEEE Trans. Inf. Theory 39(3), 733–742 (1993). [CrossRef]  

9. R. Ahlswede and I. Csiszar, “Common randomness in information theory and cryptography. I. secret sharing,” IEEE Trans. Inf. Theory 39(4), 1121–1132 (1993). [CrossRef]  

10. M. Bloch and J. Barros, Physical-Layer Security: From Information Theory to Security Engineering (Cambridge University, 2011). [CrossRef]  

11. X. Zhou, Z. Yan, and S. Lingyang, Physical Layer Security in Wireless Communications (CRC, 2016).

12. K. Zeng, “Physical layer key generation in wireless networks: challenges and opportunities,” IEEE Commun. Mag. 53(6), 33–39 (2015). [CrossRef]  

13. J. Zhang, T. Q. Duong, A. Marshall, and R. Woods, “Key generation from wireless channels: A review,” IEEE Access 4, 614–626 (2016). [CrossRef]  

14. N. Gisin, G. Ribordy, W. Tittel, and H. Zbinden, “Quantum cryptography,” Rev. Mod. Phys. 74(1), 145–195 (2002). [CrossRef]  

15. M. Peev, C. Pacher, R. Alléaume, C. Barreiro, J. Bouda, W. Boxleitner, T. Debuisschert, E. Diamanti, M. Dianati, J. F. Dynes, S. Fasel, S. Fossier, M. Fürst, J.-D. Gautier, O. Gay, N. Gisin, P. Grangier, A. Happe, Y. Hasani, M. Hentschel, H. Hübel, G. Humer, T. Länger, M. Legré, R. Lieger, J. Lodewyck, T. Lorünser, N. Lütkenhaus, A. Marhold, T. Matyus, O. Maurhart, L. Monat, S. Nauerth, J.-B. Page, A. Poppe, E. Querasser, G. Ribordy, S. Robyr, L. Salvail, A. W. Sharpe, A. J. Shields, D. Stucki, M. Suda, C. Tamas, T. Themel, R. T. Thew, Y. Thoma, A. Treiber, P. Trinkler, R. Tualle-Brouri, F. Vannel, N. Walenta, H. Weier, H. Weinfurter, I. Wimberger, Z. L. Yuan, H. Zbinden, and A. Zeilinger, “The SECOQC quantum key distribution network in Vienna,” New J. Phys. 11, 075001 (2009). [CrossRef]  

16. M. Sasaki, M. Fujiwara, H. Ishizuka, W. Klaus, K. Wakui, M. Takeoka, S. Miki, T. Yamashita, Z. Wang, A. Tanaka, K. Yoshino, Y. Nambu, S. Takahashi, A. Tajima, A. Tomita, T. Domeki, T. Hasegawa, Y. Sakai, H. Kobayashi, T. Asai, K. Shimizu, T. Tokura, T. Tsurumaru, M. Matsui, T. Honjo, K. Tamaki, H. Takesue, Y. Tokura, J. F. Dynes, A. R. Dixon, A. W. Sharpe, Z. L. Yuan, A. J. Shields, S. Uchikoga, M. Legré, S. Robyr, P. Trinkler, L. Monat, J.-B. Page, G. Ribordy, A. Poppe, A. Allacher, O. Maurhart, T. Länger, M. Peev, and A. Zeilinger, “Field test of quantum key distribution in the Tokyo QKD Network,” Opt. Express 19(11), 10387–10409 (2011). [CrossRef]   [PubMed]  

17. R. Courtland, “China’s 2,000-km quantum link is almost complete [news],” IEEE Spectr. 53(11), 11–12 (2016).

18. ID Quantique (2001), http://www.idquantique.com/; MagiQ Technologies, Inc. (1999), http://www.magiqtech.com/MagiQ/Home.html; QuintessenceLabs Pty Ltd. (2006), http://www.quintessencelabs.com/; QuantumCTek Co., Ltd. (2009), http://www.quantum-info.com.

19. M. Fujiwara, A. Waseda, R. Nojima, S. Moriai, W. Ogata, and M. Sasaki, “Unbreakable distributed storage with quantum key distribution network and password-authenticated secret sharing,” Sci. Rep. 6, 28988 (2016). [CrossRef]   [PubMed]  

20. J. E. Nordholt, R. J. Hughes, G. L. Morgan, C. G. Peterson, and C. C. Wipf, “Present and future free-space quantum key distribution,” Proc. SPIE 4635, 116–126 (2002). [CrossRef]  

21. R. J. Hughes, J. E. Nordholt, D. Derkacs, and C. G. Peterson, “Practical free-space quantum key distribution over 10 km in daylight and at night,” New J. Phys. 4, 43 (2002). [CrossRef]  

22. C.-Z. Peng, T. Yang, X.-H. Bao, J. Zhang, X.-M. Jin, F.-Y. Feng, B. Yang, J. Yang, J. Yin, Q. Zhang, N. Li, B.-L. Tian, and J.-W. Pan, “Experimental free-space distribution of entangled photon pairs over 13 km: Towards satellite-based global quantum communication,” Phys. Rev. Lett. 94(15), 150501 (2005). [CrossRef]   [PubMed]  

23. R. Ursin, F. Tiefenbacher, T. Schmitt-Manderbach, H. Weier, T. Scheidl, M. Lindenthal, B. Blauensteiner, T. Jennewein, J. Perdigues, P. Trojek, B. Ömer, M. Fürst, M. Meyenburg, J. Rarity, Z. Sodnik, C. Barbieri, H. Weinfurter, and A. Zeilinger, “Entanglement-based quantum communication over 144 km,” Nat. Phys. 3, 481 (2007). [CrossRef]  

24. T. Schmitt-Manderbach, H. Weier, M. Fürst, R. Ursin, F. Tiefenbacher, T. Scheidl, J. Perdigues, Z. Sodnik, C. Kurtsiefer, J. G. Rarity, A. Zeilinger, and H. Weinfurter, “Experimental demonstration of free-space decoy-state quantum key distribution over 144 km,” Phys. Rev. Lett. 98(1), 010504 (2007). [CrossRef]   [PubMed]  

25. P. Villoresi, T. Jennewein, F. Tamburini, M. Aspelmeyer, C. Bonato, R. Ursin, C. Pernechele, V. Luceri, G. Bianco, A. Zeilinger, and C. Barbieri, “Experimental verification of the feasibility of a quantum channel between space and earth,” New J. Phys. 10(3), 033038 (2008). [CrossRef]  

26. J. Yin, J.-G. Ren, H. Lu, Y. Cao, H.-L. Yong, Y.-P. Wu, C. Liu, S.-K. Liao, F. Zhou, Y. Jiang, X.-D. Cai, P. Xu, G.-S. Pan, J.-J. Jia, Y.-M. Huang, H. Yin, J.-Y. Wang, Y.-A. Chen, C.-Z. Peng, and J.-W. Pan, “Quantum teleportation and entanglement distribution over 100-kilometre free-space channels,” Nature 488, 185 (2012). [CrossRef]   [PubMed]  

27. J. Yin, Y. Cao, S.-B. Liu, G.-S. Pan, J.-H. Wang, T. Yang, Z.-P. Zhang, F.-M. Yang, Y.-A. Chen, C.-Z. Peng, and J.-W. Pan, “Experimental quasi-single-photon transmission from satellite to earth,” Opt. Express 21(17), 20032–20040 (2013). [CrossRef]   [PubMed]  

28. J.-Y. Wang, B. Yang, S.-K. Liao, L. Zhang, Q. Shen, X.-F. Hu, J.-C. Wu, S.-J. Yang, H. Jiang, Y.-L. Tang, B. Zhong, H. Liang, W.-Y. Liu, Y.-H. Hu, Y.-M. Huang, B. Qi, J.-G. Ren, G.-S. Pan, J. Yin, J.-J. Jia, Y.-A. Chen, K. Chen, C.-Z. Peng, and J.-W. Pan, “Direct and full-scale experimental verifications towards ground-satellite quantum key distribution,” Nat. Photon. 7, 387 (2013). [CrossRef]  

29. S. Nauerth, F. Moll, M. Rau, C. Fuchs, J. Horwath, S. Frick, and H. Weinfurter, “Air-to-ground quantum communication,” Nat. Photon. 7, 382 (2013). [CrossRef]  

30. J.-P. Bourgoin, B. L. Higgins, N. Gigov, C. Holloway, C. J. Pugh, S. Kaiser, M. Cranmer, and T. Jennewein, “Free-space quantum key distribution to a moving receiver,” Opt. Express 23(26), 33437–33447 (2015). [CrossRef]  

31. G. Vallone, D. Bacco, D. Dequal, S. Gaiarin, V. Luceri, G. Bianco, and P. Villoresi, “Experimental satellite quantum communications,” Phys. Rev. Lett. 115(4), 040502 (2015). [CrossRef]   [PubMed]  

32. C. J. Pugh, S. Kaiser, J.-P. Bourgoin, J. Jin, N. Sultana, S. Agne, E. Anisimova, V. Makarov, E. Choi, B. L. Higgins, and T. Jennewein, “Airborne demonstration of a quantum key distribution receiver payload,” Quantum Sci. Technol. 2(2), 024009 (2017). [CrossRef]  

33. J. Yin, Y. Cao, Y.-H. Li, S.-K. Liao, L. Zhang, J.-G. Ren, W.-Q. Cai, W.-Y. Liu, B. Li, H. Dai, G.-B. Li, Q.-M. Lu, Y.-H. Gong, Y. Xu, S.-L. Li, F.-Z. Li, Y.-Y. Yin, Z.-Q. Jiang, M. Li, J.-J. Jia, G. Ren, D. He, Y.-L. Zhou, X.-X. Zhang, N. Wang, X. Chang, Z.-C. Zhu, N.-L. Liu, Y.-A. Chen, C.-Y. Lu, R. Shu, C.-Z. Peng, J.-Y. Wang, and J.-W. Pan, “Satellite-based entanglement distribution over 1200 kilometers,” Science 356(6343), 1140–1144 (2017). [CrossRef]   [PubMed]  

34. S.-K. Liao, H.-L. Yong, C. Liu, G.-L. Shentu, D.-D. Li, J. Lin, H. Dai, S.-Q. Zhao, B. Li, J.-Y. Guan, W. Chen, Y.-H. Gong, Y. Li, Z.-H. Lin, G.-S. Pan, J. S. Pelc, M. M. Fejer, W.-Z. Zhang, W.-Y. Liu, J. Yin, J.-G. Ren, X.-B. Wang, Q. Zhang, C.-Z. Peng, and J.-W. Pan, “Long-distance free-space quantum key distribution in daylight towards inter-satellite communication,” Nat. Photon. 11, 509 (2017). [CrossRef]  

35. J. Yin, Y. Cao, Y.-H. Li, J.-G. Ren, S.-K. Liao, L. Zhang, W.-Q. Cai, W.-Y. Liu, B. Li, H. Dai, M. Li, Y.-M. Huang, L. Deng, L. Li, Q. Zhang, N.-L. Liu, Y.-A. Chen, C.-Y. Lu, R. Shu, C.-Z. Peng, J.-Y. Wang, and J.-W. Pan, “Satellite-to-ground entanglement-based quantum key distribution,” Phys. Rev. Lett. 119(20), 200501 (2017). [CrossRef]   [PubMed]  

36. S.-K. Liao, W.-Q. Cai, W.-Y. Liu, L. Zhang, Y. Li, J.-G. Ren, J. Yin, Q. Shen, Y. Cao, Z.-P. Li, F.-Z. Li, X.-W. Chen, L.-H. Sun, J.-J. Jia, J.-C. Wu, X.-J. Jiang, J.-F. Wang, Y.-M. Huang, Q. Wang, Y.-L. Zhou, L. Deng, T. Xi, L. Ma, T. Hu, Q. Zhang, Y.-A. Chen, N.-L. Liu, X.-B. Wang, Z.-C. Zhu, C.-Y. Lu, R. Shu, C.-Z. Peng, J.-Y. Wang, and J.-W. Pan, “Satellite-to-ground quantum key distribution,” Nature 549, 43 (2017). [CrossRef]   [PubMed]  

37. S.-K. Liao, W.-Q. Cai, J. Handsteiner, B. Liu, J. Yin, L. Zhang, D. Rauch, M. Fink, J.-G. Ren, W.-Y. Liu, Y. Li, Q. Shen, Y. Cao, F.-Z. Li, J.-F. Wang, Y.-M. Huang, L. Deng, T. Xi, L. Ma, T. Hu, L. Li, N.-L. Liu, F. Koidl, P. Wang, Y.-A. Chen, X.-B. Wang, M. Steindorfer, G. Kirchner, C.-Y. Lu, R. Shu, R. Ursin, T. Scheidl, C.-Z. Peng, J.-Y. Wang, A. Zeilinger, and J.-W. Pan, “Satellite-relayed intercontinental quantum network,” Phys. Rev. Lett. 120(3), 030501 (2018). [CrossRef]   [PubMed]  

38. M. Takeoka, S. Guha, and M. M. Wilde, “Fundamental rate-loss tradeoff for optical quantum key distribution,” Nat. Commun. 5, 5235 (2014). [CrossRef]   [PubMed]  

39. S. Pirandola, R. Laurenza, C. Ottaviani, and L. Banchi, “Fundamental limits of repeaterless quantum communications,” Nat. Commun. 8, 15043 (2017). [CrossRef]   [PubMed]  

40. M. Toyoshima, H. Takenaka, Y. Shoji, Y. Takayama, Y. Koyama, and H. Kunimori, “Results of Kirari optical communication demonstration experiments with NICT optical ground station (KODEN) aiming for future classical and quantum communications in space,” Acta. Astronaut. 74, 40–49 (2012). [CrossRef]  

41. H. Takenaka, A. Carrasco-Casado, M. Fujiwara, M. Kitamura, M. Sasaki, and M. Toyoshima, “Satellite-to-ground quantum-limited communication using a 50-kg-class microsatellite,” Nat. Photon. 11502 (2017). [CrossRef]  

42. C. Chen, A. Grier, M. Malfa, E. Booen, H. Harding, C. Xia, M. Hunwardsen, J. Demers, K. Kudinov, G. Mak, B. Smith, A. Sahasrabudhe, F. Patawaran, T. Wang, A. Wang, C. Zhao, D. Leang, J. Gin, M. Lewis, B. Zhang, D. Nguyen, D. Jandrain, F. Haque, and K. Quirk, “Demonstration of a bidirectional coherent air-to-ground optical link,” Proc. SPIE 10524, 105240G (2018).

43. L. Li, R. Zhang, Z. Zhao, G. Xie, P. Liao, K. Pang, H. Song, C. Liu, Y. Ren, G. Labroille, P. Jian, D. Starodubov, B. Lynn, R. Bock, M. Tur, and A. E. Willner, “High-capacity free-space optical communications between a ground transmitter and a ground receiver via a UAV using multiplexing of multiple orbital-angular-momentum beams,” Sci. Rep. 7(1), 17427 (2017). [CrossRef]   [PubMed]  

44. A. Acampora, “Last mile by laser,” Sci. Am. 287(1), 32–37 (2002). [CrossRef]  

45. W. S. Rabinovich, C. I. Moore, R. Mahon, P. G. Goetz, H. R. Burris, M. S. Ferraro, J. L. Murphy, L. M. Thomas, G. C. Gilbreath, M. Vilcheck, and M. R. Suite, “Free-space optical communications research and demonstrations at the U.S Naval Research Laboratory,” Appl. Opt. 54(31), F189–F200 (2015). [CrossRef]   [PubMed]  

46. K. Günthner, I. Khan, D. Elser, B. Stiller, Ömer Bayraktar, C. R. Müller, K. Saucke, D. Tröndle, F. Heine, S. Seel, P. Greulich, H. Zech, B. Gütlich, S. Philipp-May, C. Marquardt, and G. Leuchs, “Quantum-limited measurements of optical signals from a geostationary satellite,” Optica 4(6), 611–616 (2017). [CrossRef]  

47. H. Endo, T. S. Han, T. Aoki, and M. Sasaki, “Numerical study on secrecy capacity and code length dependence of the performances in optical wiretap channels,” IEEE Photon. J. 7(5), 7903418 (2015). [CrossRef]  

48. H. Endo, M. Fujiwara, M. Kitamura, T. Ito, M. Toyoshima, Y. Takayama, H. Takenaka, R. Shimizu, N. Laurenti, G. Vallone, P. Villoresi, T. Aoki, and M. Sasaki, “Free-space optical channel estimation for physical layer security,” Opt. Express 24(8), 8940–8955 (2016). [CrossRef]   [PubMed]  

49. M. Sasaki, H. Endo, M. Fujiwara, M. Kitamura, T. Ito, R. Shimizu, and M. Toyoshima, “Quantum photonic network and physical layer security,” Philos. Trans. R. Soc. Lond. A 375(2099), 20160243 (2017). [CrossRef]  

50. M. Legre and B. Huttner, “Quantum-enhanced physical layer cryptography: A new paradigm for free-space key distribution,” in 7th International Conference on Quantum Cryptography (QCRYPT), (2017).

51. T. Aono, K. Higuchi, T. Ohira, B. Komiyama, and H. Sasaoka, “Wireless secret key generation exploiting reactance-domain scalar response of multipath fading channels,” IEEE Trans. Antennas Propag. 53(11), 3776–3784 (2005). [CrossRef]  

52. S. Mathur, W. Trappe, C. Mandayam, Na, Ye, and A. Reznik, “Radio-telepathy: extracting a secret key from an unauthenticated wireless channel,” in Proceedings of Annual International Conference on Mobile Computing and Networking, (ACM, 2008), pp. 128–139.

53. S. N. Premnath, S. Jana, J. Croft, P. L. Gowda, M. Clark, S. K. Kasera, N. Patwari, and S. V. Krishnamurthy, “Secret key extraction from wireless signal strength in real environments,” IEEE Trans. Mob. Comput. 12(5), 917–930 (2013). [CrossRef]  

54. J. Zhang, R. Woods, T. Q. Duong, A. Marshall, Y. Ding, Y. Huang, and Q. Xu, “Experimental study on key generation for physical layer security in wireless communications,” IEEE Access 4, 4464–4477 (2016). [CrossRef]  

55. M. Fujiwara, T. Ito, M. Kitamura, H. Endo, O. Tsuzuki, M. Toyoshima, H. Takenaka, Y. Takayama, R. Shimizu, M. Takeoka, R. Matsumoto, and M. Sasaki, “Free-space optical wiretap channel and experimental secret key agreement in 7.8 km terrestrial link,” Opt. Express 26(15), 19513–19523 (2018). [CrossRef]  

56. A. A. El Gamal and Y.-H. Kim, Network Information Theory (Cambridge University, 2012).

57. V. Ramasarma, “Free space optics: A viable last-mile solution,” Bechtel Telecommun. Tech. J. 1, 22–30 (2002).

58. R. Sridharan and A. F. Pa, “U. S. space surveillance network capabilities,” Proc. SPIE 3434, 88–100 (1998). [CrossRef]  

59. fSONA Networks Corp., “Application note - security of a free space optical transmission,” http://htcbn.com/HTC_Profile_CD/fSONA/APPNOTE-Security.pdf.

60. T. Jono, Y. Takayama, K. Shiratama, I. Mase, B. Demelenne, Z. Sodnik, A. Bird, M. Toyoshima, H. Kunimori, D. Giggenbach, N. Perlot, M. Knapek, and K. Arai, “Overview of the inter-orbit and the orbit-to-ground laser communication demonstration by OICETS,” Proc. SPIE 6457, 645702 (2007). [CrossRef]  

61. F. J. Lopez-Martinez, G. Gomez, and J. M. Garrido-Balsells, “Physical-layer security in free-space optical communications,” IEEE Photon. J. 7(2), 7901014 (2015). [CrossRef]  

62. G. Brassard and L. Salvail, “Secret key reconciliation by public discussion,” Lect. Notes Comput. Sci. 765, 410–423 (1994). [CrossRef]  

63. C. H. Bennett, G. Brassard, and J. M. Robert, “Privacy amplification by public discussion,” SIAM J. Comput. 17(2), 210–229 (1988). [CrossRef]  

64. F. Grosshans, G. Van Assche, J. Wenger, R. Brouri, N. J. Cerf, and P. Grangier, “Quantum key distribution using gaussian-modulated coherent states,” Nature 421, 238–242 (2003). [CrossRef]   [PubMed]  

65. C. H. Bennett, G. Brassard, C. Crepeau, and U. M. Maurer, “Generalized privacy amplification,” IEEE Trans. Inf. Theory 41(6), 1915–1923 (1995). [CrossRef]  

66. J. L. Carter and M. N. Wegman, “Universal classes of hash functions,” J. Comput. Syst. Sci. 18(2), 143–154 (1979). [CrossRef]  

67. K. Suzuki, D. Kolev, A. C. Casado, and M. Toyoshima, “Environmental-data collection system for satellite-to-ground optical communications,” Trans. JSASS Aerosp. Tech. Jpn. 16(1), 35–39 (2018). The data from OBSOC are available on http://sstg.nict.go.jp/OBSOC/?lang=e. [CrossRef]  

68. H. Endo, M. Fujiwara, M. Kitamura, O. Tsuzuki, T. Ito, R. Shimizu, M. Takeoka, and M. Sasaki, “Dataset 1: Free space optical secret key agreement,” figshare (2014) [retrieved 25 July 2018], , “https://figshare.com/s/e8b79fa7ec9a5b8d4992”.

69. L. E. Bassham, A. L. Rukhin, J. Soto, J. R. Nechvatal, M. E. Smid, S. D. Leigh, M. Levenson, M. Vangel, N. A. Heckert, and D. L. Banks, “A statistical test suite for random and pseudorandom number generators for cryptographic applications,” NIST Special Publication 800-22 Rev. 1a.