1.

Introduction

Complex photonic systems, such as scattering media, chaotic cavities, aperiodic photonic crystals, and biological tissue, are composed of a large number of spatial, spectral, temporal, and polarization degrees of freedom. The strong coupling of these degrees of freedom provides exceptional opportunities for numerous applications. For example, spatial–temporal coupling was utilized for dynamic light scattering and diffusive wave spectroscopy,^1,2 spatial–spectral coupling for spectroscopy^3,4 and imaging,^5,6 and spatial-polarization coupling for polarimetry.⁷ For optical cryptography, complex random media have been utilized for several cryptographic functions, including authentication,^8,9 identification,¹⁰ encryption,¹¹ random number generation,^12,13 and secure key storage.¹⁴ An optical fiber that supports hundreds or thousands of guided modes can also be considered as a complex photonic system. Random mode mixing arises naturally due to local index inhomogeneities and cross section variations, producing speckle patterns at the output of the fiber. Since the mixing depends on ambient temperature fluctuations and mechanical strains,¹⁵ the output speckle pattern is extremely sensitive to environmental perturbations and therefore constantly changes in time. This poses a serious challenge for many applications such as telecommunication and imaging, as the transmitted information quickly gets scrambled. Here, we take advantage of the random fluctuations in a long multimode fiber to generate and distribute random keys. Most importantly, the remote users at the two ends of the fiber can share identical copies of the keys, by virtue of the optical reciprocity principle. The keys, which are constantly updated due to intrinsic fluctuations of the fiber, can then be used to encode and decode information being sent over a standard unsecure communication channel.

Our method of distributing keys at the physical-layer of communication networks can only be hacked in real-time, in contrast to the computational keys that are widely used in today’s telecommunications. Compared to quantum key distribution (QKD), our scheme does not provide an unconditional security. However, since it uses classical light and off-the-shelf fiber components, it is much simpler and can be easily integrated with current communication networks, potentially at Gb/s rates. While other classical key distribution (CKD) approaches, e.g., the ones using chaotic lasers,¹⁶ require a precise tuning of system parameters, ours is alignment-free and naturally robust, making it especially attractive for real-world applications. Recently, several key distribution methods based on single-mode fibers have been developed,^17,18 including CKD at rates of 100 bits per second over a distance of 500 km.¹⁹ In our approach, the complexity of a multimode fiber forces an adversary to simultaneously probe all fiber modes to extract information, and the measurements must be done quickly to track the rapid fluctuations of the fiber. The additional noise introduced by such exhaustive measurements sets the security of the key.

2.

Proof of Principle Demonstration

Let us consider two users, Alice and Bob, who simultaneously couple laser light of identical frequency into both ends of a multimode fiber (Fig. 1). As an example, we assume that the input beam from Alice (Bob) has a well-defined wavevector ${\overrightarrow{k}}_A$ (${\overrightarrow{k}}_B$). In the presence of strong mode mixing, by the time the light exits the fiber all the guided modes are excited. Thus, at the far-field of the output facet a speckle pattern emerges, with no trace of the input wavevector [Fig. 1(a)]. The patterns Alice and Bob observe result from exactly the same mode mixing and phase shifts across the fiber but in a reversed order. Since the order of the coupling events is not interchangeable, the output patterns at the opposite ends are different even when the input channels of Alice and Bob are the same (${\overrightarrow{k}}_A={\overrightarrow{k}}_B$). Nevertheless, there is a unique pair of output channels that will be perfectly correlated. Optical reciprocity guarantees that the intensity measured by Alice at the output channel $-{\overrightarrow{k}}_A$ is identical to the intensity measured by Bob in the output channel $-{\overrightarrow{k}}_B$ [Fig. 1(b)]. Remarkably, not only does this hold even when the two input channels are not identical (${\overrightarrow{k}}_A\ne {\overrightarrow{k}}_B$), but Alice and Bob do not need to know which channel the other user couples light into at the opposite end of the fiber. All they need to do is to measure the output intensity from the same channel that they have coupled light into. As the environmental conditions of the fiber change, the speckle patterns and the intensities measured in the $-{\overrightarrow{k}}_A$ and $-{\overrightarrow{k}}_B$ channels will fluctuate. However, since reciprocity holds for any configuration of the fiber, the intensities measured in the $-{\overrightarrow{k}}_A$ and $-{\overrightarrow{k}}_B$ channels will remain perfectly correlated [Fig. 1(c)], as long as the fiber remains static during the time it takes the light to traverse it. This is demonstrated experimentally in Fig. 1(d). Since the input and output channels are specified not only by the wavevector but also by the polarization, we have placed linear polarizers at both ends of the fiber. Note, however, that the two polarizers do not need to select the same polarization state but can be oriented at any arbitrary angle. To emulate changes in the environmental conditions of long fibers, the fiber was constantly shaken while speckle patterns were recorded. The synchronized fluctuations of the intensities measured by Alice and Bob allow them to share a common random signal from which they can extract a key.

Fig. 1

A proof of principle demonstration of classical key establishment with a multimode fiber. (a) Alice and Bob couple a laser beam into the multimode fiber with wavevectors ${\overrightarrow{k}}_A$ and ${\overrightarrow{k}}_B$, respectively. Due to mode mixing in the fiber, speckle patterns appear at the output. (b) According to the optical reciprocity theorem, when the positions of a detector and a source are interchanged, the intensity measured by the detector in the two different configurations ($I_A$ and $I_B$) is identical. Thus, at the channels that correspond to $-{\overrightarrow{k}}_A$ and $-{\overrightarrow{k}}_B$, Alice and Bob measure exactly the same intensities. (c) Due to changes in the environmental conditions of the fiber, the output speckles constantly fluctuate. Nevertheless, at channel $-{\overrightarrow{k}}_A$ (blue circle) and $-{\overrightarrow{k}}_B$ (green circle) the intensities are always correlated, as verified experimentally in (d) with a 6-m long step-index fiber (core diameter = 105 m, numerical aperture = 0.22) that supports $M\approx 4000$ guided modes. The probe laser wavelength is $\lambda =640\mathrm{nm}$.

While the above demonstration is performed in the wavevector ($k$) space, the reciprocity principle is not restricted to the wavevector space, and Alice and Bob can use channels in other spaces, e.g., the guided-mode space or the position space. Moreover, either of them can use a channel in a different space without knowing which space is used by the other. The position space is convenient for fiber-network applications, because Alice and Bob can simply couple light to each end of the multimode fiber via single-mode fibers. The single-mode fibers, together with an in-line fiber polarizer, automatically guarantee that the illumination and detection are conducted in the same channels, enabling an all-fiber, alignment-free configuration that is compatible with optical fiber networks. Furthermore, in contrast to QKD, our method does not have to operate at the single photon level and can easily be implemented using standard telecommunication lasers. Figure 2(a) is a schematic of an all-fiber setup we built with off-the-shelf elements. Using this setup, we demonstrated that the intensities measured by Alice and Bob exhibit a correlation of 0.99 [Fig. 2(b)]. Such a high degree of correlation allows digitization of the analog signal, by associating a bit value “1” to all the intensities above the median, and “0” to all the intensities below the median. After digitization, the correlation between the stream of bits Alice and Bob obtained is 0.90, and the bit error rate is 0.05 [Fig. 2(c)], which can be further reduced with error correction protocols.²⁰ The key rate is determined by the rate of the fiber fluctuations, which in our case was only 20 Hz since we perturbed just 5 m out of a 1-km long fiber. However, the reported fluctuation rates of long-haul fibers in optical networks are much higher, typically in the range of 1 to 100 KHz,^21,22 enabling high key generation rates. The key rates can be further increased via parallelization, for example, using wavelength division multiplexing (WDM), as two spectral channels separated by the spectral correlation width of the fiber yield two uncorrelated speckle patterns at the output of the fiber. The spectral correlation width, determined by the modal dispersion in the fiber, scales inversely with the fiber length, and a merely 100-m long standard step-index multimode fiber has the spectral correlation width well below the frequency spacing required for WDM (see Sec. 5.3).

Fig. 2

Telecommunication-compatible implementation of remote key distribution. (a) Each node contains a laser source, a photodetector, a $2\times 2$ splitter (S), and an in-line fiber polarizer ($P$). In our experiment, a single laser source operating at the telecommunication C-band ($\lambda =1550\mathrm{nm}$) is used with a splitter (not shown) to mimic two sources at both ends of the fiber. The laser light is coupled into the multimode fiber (black) via a single-mode fiber (orange) to ensure that the illumination and detection channels are identical at each end of the fiber. The multimode fiber is a 1-km long graded-index fiber with a core diameter of 62.5 m, supporting about $M\approx 100$ guided modes. The environmental changes on the fiber are induced by shaking a 5-m portion of the fiber (out of the 1 km spool). (b) Scatter plot of the intensity measured by Alice versus the intensity measured by Bob, exhibiting a correlation of 0.99 (red dots). To verify that the high level of correlation does not result from fluctuations in the total transmitted light, we added a free-space beamsplitter between the single-mode fiber and the multimode fiber at Bob’s end (not shown), and measured the intensity at an arbitrary position across the beam, yielding a correlation of 0.01 (blue dots). (c) A fraction of the digitized key, showing a raw bit rate of 20 Hz, and a bit error rate of 0.05.

The contrast of the speckle pattern is determined by the laser linewidth and the spectral correlation width of the fiber. It is maximal for linewidths that are smaller than the spectral correlation width, and scales such as one over the square root of the linewidth for linewidths larger than the spectral correlation width. Since even under these circumstances reciprocity is not broken, Alice and Bob will still measure two correlated signals, yet with a lower level of fluctuations.

3.

Eavesdropping and Security Analysis

Next, we analyze possible attacks by an eavesdropper, Eve. The attacks fall under two categories, passive ones where Eve only probes the light that is transmitted between the users, and active ones where Eve can also inject light into the system and use additional modulators to deceive Alice and Bob. In this section, we focus on passive attacks and briefly discuss active attacks at the end. We specifically consider the so-called beamsplitter attack, in which Eve places a beamsplitter at some intermediate point along the fiber. Eve can then measure the speckle intensity patterns incident at the beamsplitter, traveling from Alice to Bob and from Bob to Alice [Fig. 3(a)]. These two patterns are uncorrelated since they have traveled through two different sections of the multimode fiber and experienced different mode mixing. Hence, none of the spatial channels measured by Eve will be correlated with the signals Alice and Bob measure. We experimentally emulated a beamsplitter attack and confirmed that the intensities in all the channels measured by Eve are uncorrelated with the intensity measured by Alice and Bob [Fig. 3(b)]. Note that, as in any cryptographic system, we assume the nodes of Alice and Bob are in a secure area which Eve cannot access. Alice and Bob can therefore make sure that the sufficient mode mixing is introduced to the portion of the multimode fiber within the secure area so that when the light exits the secure area, all channels are excited and the intensity measured by Eve in any channel will be uncorrelated with the signal sent by Alice and Bob.

Fig. 3

Experimental emulation of a direct beamsplitter attack on the system shown in Fig. 1. (a) Eve picks up a fraction of the light propagating between Alice and Bob by intersecting the fiber with beamsplitter. The light which arrives to $E_A$ and $E_B$ passes through different parts of the fiber and therefore experiences completely different mode mixing. (b) The cross-correlations of measured intensities between the speckle grains from the four patterns A, B, ${\mathrm{E}}_{\mathrm{A}}$, and ${\mathrm{E}}_{\mathrm{B}}$. The cross-correlation between $A$ and $B$ corresponds to the input modes. Due to strong mode mixing, all the speckles in patterns $E_A$ and $E_B$ are equivalent, and two of them are selected from $E_A$ and $E_B$ for the other five cross-correlations. (c) Secure key fraction $K$ as a function of the beamsplitter reflectivity $R$, for a simulated full-field attack by Eve. For $R<0.8$, a secure key is established.

The random mode mixing along the fiber prevents Eve from extracting the key via direct intensity measurements. However, even in the presence of strong mode mixing, the complex fields at the output ports of Eve’s beamsplitter carry information about the key. To illustrate this, let us denote the complex field distribution at the output port of Eve’s beamsplitter from Alice by $E_{A,p}(x,y)$, where $p=H$, and $V$ denotes the polarization state. Since at a single frequency phase conjugation corresponds to the time-reversal operation, a complex conjugate field $E_{A,p}^{*}(x,y)$ will send the light back to Alice’s channel. Thus, the projection of field distribution that Eve measures at the output port from Bob $E_{B,p}(x,y)$ onto $E_{A,p}^{*}(x,y)$, gives the fraction of the light that actually reaches Alice’s channel. Hence, Eve can extract the key by computing the complex overlap of the field distributions:

While it is theoretically possible that Eve directly measures the fields $E_{A,p}(x,y)$ and $E_{B,p}(x,y)$, and numerically computes the signal using Eq. (1), such a full-field beamsplitter attack requires a complex measurement apparatus. First, it is extremely challenging to accurately measure the amplitude and phase of all the modes inside a multimode fiber without being detected. In contrast to single-mode fibers that can be tapped by simply bending the fiber and collecting the scattered light, or via evanescently coupling an additional fiber to the single-mode fiber, for multimode fibers these methods do not work. The reason is that the scattering strength and the evanescent coupling lengths are very sensitive to the spatial field distributions of the modes close to the boundary of the core. Such distributions depend not only on the local index inhomogeneities and cross-section variations of the fiber but also on the external perturbations such as bending and temperature fluctuations. Thus, different modes will acquire very different amplitudes and phases as they couple out of the core, and thus it will be practically impossible to measure the exact amplitude and phase of each mode. The only practical way to measure the field inside the core of a multimode fiber is to splice into the fiber a multimode fiber coupler, or to cut the fiber and insert a bulk beamsplitter. Both methods require shutting down the data traffic and, more importantly, will induce a reflection back into the fiber that can easily be detected by standard optical time-domain reflectometer testing.²³ Second, for every spatial channel, Eve needs a local oscillator to coherently detect the two quadratures of the field, at two orthogonal polarizations, for the two counter propagating fields. These can add up to thousands of channels that need to be measured faster than the fluctuation rate of the field. Despite of recent advances in the spatial division multiplexing (SDM) in multimode fibers,²⁴ such a measurement is still out of reach of current technology.

We next show that the multimode fiber not only imposes a technical challenge on the attacker, Eve, but it also guarantees security under the passive beam splitter attack. By analyzing the fundamental noise that is associated with such an attack, we extract system parameters that will guarantee security. In our analysis, we assume that Eve cannot intrude the secure areas of Alice and Bob, and that the only information that leaks out of the secure areas are the fields propagating through the multimode fiber. We also assume Alice and Bob have access to an authenticated public communication channel for performing, privacy amplification and error correction protocols, and for eliminating the so-called man-in-the-middle attack.

To prove security under the beamsplitter attack, we analyze the fundamental noise associated with the measurements of Alice, Bob, and Eve. We assume the laser light is in a coherent state with a large mean photon number. In this limit, Alice and Bob can perform a direct intensity measurement, which is limited only by shot-noise.²⁵ Eve, however, needs to first coherently detect the fields $E_{A,p}(x,y)$ and $E_{B,p}(x,y)$, and then compute the intensity $I_E$ according to Eq. (1). Noise is added to her signal at two levels (see Sec. 5.2). First, for coherent states, the standard deviation in the simultaneous measurement of the two field quadratures is $\sqrt{2}$ larger than that of a single quadrature measurement.²⁶ Thus, the standard deviation of the intensity computed from the sum of the squares of the quadratures is $\sqrt{2}$ larger than that of a direct, shot-noise limited, intensity measurement. A second source of noise in Eve’s signal is the multiplication of the fields $E_{A,p}(x,y)$ and $E_{B,p}(x,y)$ in the right-hand side of Eq. (1). Due to error propagation, multiplication of two random variables increases the standard deviation of the product by another factor of $\sqrt{2}$. Thus, if Eve detects $N_E$ photons per channel, her signal-to-noise ratio (SNR) is $\sqrt{N_E/4}$, whereas the SNR of Alice and Bob for a shot-noise limited detection of $N$ photons per channel is $\sqrt{N}$. We therefore conclude that as long as the number of photons per channel that Eve measures is a factor of 4 (6 dB) lower than the number of photons that Alice or Bob measure, Eve’s SNR will be lower than that of Alice and Bob.

Our security claims are based on SNR analysis. Previous information theoretic security analysis has proven that the security of key distribution at the physical-layer is guaranteed as long as the legitimate users (Alice, Bob) have access to a common source of randomness, through channels that are less noisy than the channel of the eavesdropper (Eve). Thus, the superior SNR of their measurements enables Alice and Bob to generate a secure key, provided that they also have access to an unsecure yet authenticated public channel for privacy amplification protocols. For example, Alice and Bob can reveal a fraction of their bits and compare them over the public channel. In this way, they can estimate their error rate and compare it to the expected error rate of the system. In a conservative approach, any increase in the error rate is attributed to photons that Eve extracts from the channel, as the reduction in the number of photons that Alice and Bob measure increases their shot-noise and thus increases their bit error rate. Eve cannot compensate for this by using an amplifier, because shot-noise limited signals amplification cannot improve the SNR.²⁷ Alice and Bob can therefore get an upper bound on the ratio between the number of photons per channel that Eve measures and the number of photons they measure. If this upper bound is higher than 3 dB, they stop the communication since they know the fiber might have been hacked. If the ratio is lower than 3 dB, they can use a standard privacy amplification protocol to extract a secure key from the raw bits³³. We conduct a quantitative analysis based on mutual information and numerically calculate the secure key fraction ($K$), defined by the ratio of the secure bit rate and the raw bit rate (See Sec. 5.2 for further details). Figure 3(c) shows the secure key fraction $K$ as a function of the fraction of the beamsplitter reflectivity $R$. The simulations confirm that for the beamsplitter attack, as long as Eve measures less than 80% of the photons in the fiber, security is guaranteed.

Thus far we analyzed the SNR and the security of the system as a function of the number of photons that arrive to Alice, Bob, and Eve. Since this number depends on the transmission loss in the fiber, the security of the system depends on the fiber length. Transmission loss benefits Eve since we assume she has the capability to transmit light from her location to Alice and Bob without any loss. Specifically, the error rate that Alice and Bob expect already takes into account that there is loss in the fiber all along the link between the two of them. If Eve replaces parts of this fiber by a loss-less fiber, she can use all the photons that would have otherwise been lost in the lossy fiber, without Alice and Bob noticing an increase in the error rate. The mutual information analysis illustrates that the optimal position for Eve to place the beamsplitter is at the midpoint of the fiber. Then, Alice and Bob can establish a secure key only if the transmission from the midpoint of the fiber to its ends is higher than $-6\mathrm{dB}$. For typical fibers with transmission loss of $0.2\mathrm{dB}/\mathrm{km}$,²⁸ this corresponds to a maximum fiber length of 60 km.

Finally, we briefly discuss a few potential active attacks. An active Eve can try to perform the so-called man-in-the-middle attack, where she blocks the light that Alice and Bob send, and couples her own light into the fiber. However, by comparing part of the keys they obtain over a public channel, Alice and Bob can immediately notice that their keys are no longer correlated and stop the communication. If Eve tries to inject light to the fiber without blocking the light that Alice and Bob send, they can notice a reduction in the contrast of the intensity fluctuations they measure. To prevent Eve from inducing correlations by modulating the total intensity of the light passing through the fiber, Alice and Bob can measure the total intensity that arrives to their end of the fiber and verify that it is not modulated.

4.

Discussion and Conclusions

Below, we briefly compare our approach to the ones developed previously based on reciprocity (more comparisons are given in Sec. 5.1). Our approach to spread the transmitted signal over multiple spatial channels bares similarity with key distribution methods in the wireless domain, which rely on the scattering and fading of radio-frequency waves.²⁹ In the optical domain, a recent work demonstrated key distribution by free-space propagation through turbulent media, but in this configuration the legitimate users measure the reciprocal phase using a complex detection apparatus.³⁰ Our scheme is much simpler and more robust as it relies on a direct intensity measurement. Compared to the previous key-distribution schemes based on single-mode fibers,^17,18 the complexity of the multimode fiber forces the hacker to use a significantly more complex detection apparatus and perform additional computational processing. The asymmetry between the complex detection of the adversary and the simple direct detection of the legitimate users imposes excess noise in the adversary’s measurements, which the legitimate users can utilize via privacy amplification protocols to distil a secure key.³¹

In this work, we used the natural fluctuations of the fiber as the source of randomness required for generating secure keys. Since the fiber fluctuations are inherent to the system, the implementation of our method in real world applications is greatly simplified. However, since the fiber has to be static during the time it takes the light to traverse the fiber, the key rate is limited by the length of the fiber. To overcome this limitation, we are currently developing a configuration in which Alice (or Bob) can add fast modulators at one end of the multimode fiber.

In conclusion, we have developed a key establishment protocol that relies on classical light and off-the-shelf telecommunication components. We experimentally demonstrated the method using an all-fiber and alignment-free system, which is compatible with optical fiber networks. The method is readily available for applications that are based on multimode fibers, such as local area networks. This method is also compatible with long-distance SDM networks, which has experienced rapid advances in recent years in the optical communication research community. The security of our method is based on the complexity of multimode fibers and on the fundamental noise limits of coherent laser light. Our method currently relies on the standard privacy amplification protocols to reduce uncertainties in the correlation measurements between Alice and Bob, yet it would be interesting to explore in the future advanced protocol tailored for our specific application. While this work has focused on classical light and does not provide unconditional security, we notice an analogy between our method and continuous variable quantum key distribution (CVQKD), as described in Sec. 5.2. This analogy may allow a future extension of our security analysis to more general security proofs that were recently developed for CVQKD.³² The analogy to CVQKD may also help developing a new protocol for overcoming the maximal distance limit discussed above, similar to the way CVQKD has been extended beyond the 3-dB loss limit using postselection.³³ In addition, spreading quantum light over multiple spatial channels may open new opportunities for QKD in the spirit of the recent proposals to utilize multiple temporal channels for advanced QKD protocols.³⁴

5.

Appendix A

5.3.

Increasing the Key Rate Using Wavelength Division Multiplexing

The key rate can be further increased via parallelization, using WDM. Due to modal dispersion in multimode fibers, the field at the output of long fibers is wavelength dependent. In order to increase the key rates, it is critical that fields at wavelengths that are separated by the WDM spectral spacing will yield uncorrelated keys. Thus, the bandwidth over which the fields at the output of the fiber are correlated (the spectral correlation width $\mathrm{\Delta }$) must be smaller than the WDM spectral spacing. Since the spectral correlation width scales inversely with the fiber length, for long enough fibers this is indeed the case. We have recently shown experimentally that the spectral correlation width of a 100-m long standard step-index multimode fiber is 3 pm.⁴ Graded index (GRIN) fibers, which are more commonly used in fiber communication networks, exhibit wider spectral correlation widths, typically in the range of 5 to 250 pm for 100 m long fiber (corresponding to a bandwidth-distance product in the range of 0.1 to $5\mathrm{GHz}·\mathrm{km}$). These widths are well below the spacing required for dense WDM (800 pm for the ITU frequency grid with 100 GHz spacing).

To quantify the amount of information Eve can extract from different spectral channels, we simulate numerically the fields measured by Eve at different wavelengths. We use the concatenated waveguide model to simulate the propagation through a GRIN fiber with a core diameter of $50\mu \mathrm{m}$ and a 0.19-numerical aperture, supporting 110 modes.⁴² The fiber we simulate is 1 km long and is composed of 200 segments. Mode coupling is introduced by modeling random bending and orientations for each segment.⁴² Figure 4 shows two speckle patterns at the output of the fiber at two different wavelengths that are separated by $\delta \lambda =200\mathrm{pm}$. The patterns are clearly uncorrelated. To quantify the degree of spectral correlation, we compute the spectral correlation function of the fields, defined as

Eq. (6)

$$\rho (\delta \lambda )\equiv \frac{|⟨E(x,y,{\lambda }_0)E^{*}(x,y,{\lambda }_0+\delta \lambda )⟩|}{\sqrt{⟨{|E(x,y,{\lambda }_0)|}^2⟩}\sqrt{⟨{|E(x,y,{\lambda }_0+\delta \lambda )|}^2⟩}}.$$

Fig. 4

(a) Numerical simulation of the wavelength dependence of the fields at the output a 1-km long multimode fiber. Due to modal dispersion, two speckle patterns at wavelengths separated by $\delta \lambda =200\mathrm{pm}$ are completely uncorrelated. (b) The degree of spectral correlation between the speckle field at ${\lambda }_0=1550\mathrm{nm}$ and the field at wavelength $\lambda$ (blue solid line), and a Gaussian fit (red dashed line). (c) The mutual information $I_{\mathrm{WDM}}$ as a function of the spectral correlation width of the multimode fiber. $I_{\mathrm{WDM}}$ sets an upper bound on the amount of information that Eve can extract by measuring all the spectral channels in a standard WDM frequency grid. The amount of information Eve can extract is negligible for spectral correlation widths that are smaller than 300 pm, which correspond to fibers that are longer than just a few centimeters.

Here $⟨⟩$ denotes spatial and ensemble averaging. Figure 4 shows the spectral correlation function $\rho (\delta \lambda )$ (dashed blue line), where the spectral correlation width, which is defined by the full width half maximum of $\rho (\delta \lambda )$, is in this example $\mathrm{\Delta }=105\mathrm{pm}$.

To relate the spectral correlation width to the amount of information Eve can extract on the key from different spectral channels, we compute the mutual information between speckle fields at different wavelengths. Since speckle fields follow Gaussian statistics, we can use the results from information theory which quantify the mutual information between two circular complex random variables with a degree of correlation $(\delta \lambda )$: $I(\rho )=-{\log }_2(1-{\rho }^2)$.⁴³ For long multimode fibers $\rho (\delta \lambda )$ can be approximated by a Gaussian function (dashed red line in Fig. 4). Assuming the multimode fiber supports $N$ guided modes, the fields arriving to Eve from Alice and Bob [$E_A(x,y,\lambda )$ and $E_B(x,y,\lambda )$] can be decomposed into $2N$ independent spatial channels. Hence, the amount of information on the fields at ${\lambda }_0$ that Eve can extract from measuring the fields at ${\lambda }_0+\delta \lambda$ is given by $I({\lambda }_0,{\lambda }_0+\delta \lambda )=-2N{\log }_2[1-\rho {(\delta \lambda )}^2]$. Thus, if Alice and Bob decide to use WDM with $M$ spectral channels with a frequency spacing $\delta \lambda$, the amount of information Eve can extract on the key at wavelength ${\lambda }_0$ is bounded as

Eq. (7)

$$I_{\mathrm{WDM}}(\delta \lambda )=-2N\sum _{m=1}^M{\log }_2[1-e^{-{(m\delta \lambda )}^2/(2\ln 2{\mathrm{\Delta }}^2)}].$$

Figure 4 plots the mutual information $I_{\mathrm{WDM}}$ as a function of the spectral correlation width of the fiber $\mathrm{\Delta }$, for a typical WDM frequency grid with $M=72$ channels and $\delta \lambda =800\mathrm{pm}$. These grid parameters correspond to the ITU frequency grid with a 100-GHz spacing. It is clear that for spectral correlation widths smaller than $\mathrm{\Delta }=300\mathrm{pm}$, the amount of information that Eve can extract from all the spectral channels of the WDM grid is negligible. A spectral correlation width of 300 pm corresponds to GRIN fibers that are hundreds of meters or shorter. We therefore conclude that WDM can be safely used with multimode fibers that are longer than hundreds of meters without compromising the security of the key.

We note that principle measurements at different wavelengths could have added some information on the instantaneous configuration of the fiber. But the critical point is that Eve’s attack cannot be based on figuring out the fiber’s instantaneous configuration. The reason is that the number of instantaneous configurations of a long multimode fiber is innumerable. For example, let us assume that for every 1-m long segment of the fiber there are $N$ configurations that yield uncorrelated fields at the output (here by configuration we mean geometrical setting and temperature profile across the fiber), then for a 1-km long fiber there would be $N^{1000}$ different configurations, which are obviously intractable. Hence, an attack that is based on learning the fiber configuration is unrealistic.