During the past decade, a lot of effort has been made to develop the techniques of optical cryptography owing to the inherent nature of parallel and multidimensional capability of optical signal processing.^{1, 2, 3} Most of those optical cryptosystems employ random phase masks (RPMs) as secret keys due to the advantage of huge key space. They always contribute to resistance of an encryption scheme against brute force attacks. However, RPMs are not sufficiently sensitive as expected. This may result in another security worry. It has been recently demonstrated that the double random phase encoding scheme is vulnerable to known-plaintext attacks.^{4, 5, 6} With phase retrieval techniques, an attacker can easily find the estimates of RPM keys, with which the attacker can recover the plaintext from the corresponding ciphertext. Nevertheless, using phase retrieval strategy to access estimates of RPM keys is only available for linear systems. From another perspective, if employing an appropriate nonlinear transform for encryption, we find out that the insensitivity of RPM will not only avoid suffering a potential crack, but also may allow a cryptosystem possessing other unique features, as introduced later.

From the cryptography point of view, a symmetric cryptosystem would suffer from several problems in practical use, in particular, under the network environment such as key distribution and management.^{7, 8} Asymmetric scheme is the solution. In this paper, we design a novel asymmetric optical encryption system, in which two different types of decryption keys are particularly involved, named universal key K_u, and special key K_s respectively. The decryption keys differ from the encryption key. Each decryption key has its own function and applicable region in the process of decryption. One universal key corresponds to one encryption key (K_e). K_u can be used to decrypt any ciphertext encoded by K_e, but with poor legibility. On the contrary, K_s is adequate for legible decryption but only valid for one ciphertext corresponding to the specified plaintext.

Now let us discuss the detail about this asymmetric cryptosystem. Phase-truncated Fourier transform (PTFT), which is proposed in our earlier work for the construction of optical asymmetric cryptosystem,⁹ is used again here to build a multifunctional scheme. PTFT is a process of Fourier transform with an operation of phase truncation, which means only the amplitude (modular part) of Fourier spectrum is retained, while the phase part of the spectrum is truncated. For the sake of simplicity, one-dimensional notation is used to illustrate this concept. Let f(x) denote the image to be encoded, FT( · ) the operator of Fourier transform, PT( · ) the operator of phase truncation, and PR( · ) the operator of phase reservation. Given a Fourier transformation F(u) = FT[f(x)] = |F(u)|exp [i2πφ(u)], the phase truncation and the phase reservation can be respectively expressed as follows:

By implementing the phase-truncated Fourier transform, one can encrypt a plaintext into a noise-like cipher. The encryption process is illustrated in Fig. 1. Let P₁ denote an image plaintext and C₁ the corresponding ciphertext. The encoded image C₁ can be obtained by the following equation:

Although simple, the encryption should hold a higher security level than the classic double random phase encoding scheme, because the operation of phase truncation is nonlinear. From this point of view, the technique of phase retrieval will be invalid for estimating the phase key. Moreover, the most noticeable point of this optical cryptosystem does not lay in the improvement of security strength but in the existence of a universal key and special key. Figure 1 depicts how to generate a universal key. Performing a Fourier transformation on the encryption key and retaining the phase part, we obtain the universal key as follows: The special key is recorded in the process of encryption [as shown in Fig. 1] by the following equation: It is interesting to note that both K_s and K_u can be used for the purpose of decryption, as shown in Fig. 1. When employing K_s, the decryption is just a reverse operation of the encryption. Under an ideal circumstance, the decryption is lossless because the truncated information is compensated completely. Mathematically it can be written as where IFT(·) denotes the inverse Fourier transform. However, K_s is only applicable to decode C₁ because K_s is generated from P₁, whereas K_u is applicable to decrypt any ciphertext encoded by K_e. If substituting K_u for K_s in Eq. 6, one can still retrieve P₁ except for being blurred as where B(u) is a blurring function given by where ⊗ means convolution. If the plain image has only low frequency content, FT(P₁(x)) will be narrow and B(u) will be close to 1, leading to a good decryption. Therefore, the blurring degree of the decryption result depends on the frequency content of the plaintext. It should be noted that the proposed encryption strategy is only suitable for phase-only keys and real-value plaintexts. If either of them is complex-valued, the decryption function [Eq. 6] will be invalid.

Now we perform a proof-of-concept study with the aid of computer simulation in the environment of MATLAB. Consider images P₁ (Lena, 256×256 pixels) and P₂ (Baboon, 256×256 pixels) as two plaintexts. The ciphertexts, obtained with PTFT strategy, are two noise-like images, C₁ and C₂ (they are not shown here for saving space). The encryption key K_e is a random phase mask with the same size as the plaintexts. By using Eq. 4, we can obtain the universal decryption key K_u. Two special decryption keys, K_s1 and K_s2, corresponding to plaintexts, P₁ and P₂, respectively, are generated in each encryption process, according to Eq. 5. Now let us verify the effectiveness of decryption using the universal key and the special keys, respectively. When the special key K_s1 corresponding to the first plaintext P₁ was used to decrypt C₁, the Lena image can be clearly recovered, as shown in Fig. 2, whereas when K_s1 was used to decrypt C₂, Baboon cannot be retrieved, as shown in Fig. 2. Similarly, the special key K_s2 corresponding to plaintexts P₂ also can only be used to effectively decode C₂ [see Fig. 2], and cannot be used to recover Lena [see Fig. 2]. These results proved that special keys are only legal for decryptions of the specified ciphertexts. With the right special key, it is lossless to decode the specified cipher but incapable of decoding others. In another case, when the universal key is used in the process of decryptions, both P₁ and P₂ can be approximately retrieved although being corrupted by noise, as shown in Figs. 2, 2.

The computer simulation results demonstrate that the proposed optical cryptosystem can possess two independent decryption keys. This is quite a different case from that in traditional cryptology. This unique property of the proposed approach may allow the PTFT-based scheme to be used for envisaged application cases. As an example, case 1 would be to secure communications of simple messages (such as binary letters) between the members of a large group. In this case, the decryption effect of a universal key is adequate for the identification of plain messages. Thus, the PTFT scheme could serve as an ordinary asymmetric cryptosystem, regardless of the existence of special keys. As another example, case 2 would be high-security-level communication of delicate messages between two nodes in a network. In this case, the universal key would be irrelevant for the process of decryption, whereas the special key could be used to retrieve the messages precisely. Meanwhile, the security level could be guaranteed in virtue of the one-time pad manner. Some other possible cases may include setting up the security levels for different users, identification and authentication with different security levels, etc.