Cracking chaos-based encryption systems ruled by nonlinear time delay differential equations

We report that signal encoding with high-dimensional chaos produced by delayed feedback systems with a strong nonlinearity can be broken. We describe the procedure and illustrate the method with chaotic waveforms obtained from a strongly nonlinear optical system that we used previously to demonstrate signal encryption/decryption with chaos in wavelength. The method can be extended to any systems ruled by nonlinear time-delayed differential equations


Introduction
Since it was found that chaotic waveforms can be used to encrypt signals for secure communications [1], many attempts to break the key of chaotic cryptosystems and to retrieve the information have been reported.A wide class of breaking methods is based on phase space reconstruction of the emitter dynamics through the return map analysis or the use of nonlinear dynamical forecasting (NLDF) [2,3].Most of those methods have been applied for breaking com-munication schemes of low dimensionality, ruled by Lorenz and Rossler equations [2,4].If primarily it was thought that chaotic waveforms with a high dimensionality (hyperchaos) could make it more difficult to extract the message [5], Short and Parker have shown later that increasing the dimension does not necessarily achieve a significant improvement in the security of the system [4].
This Letter considers a specific class of chaotic systems, the delayed nonlinear feedback (DNLF) systems, i.e., systems ruled by nonlinear time-delay differential equation (DDE) whose dynamics can exhibit high-dimensional attractors with many positive Lyapunov exponents.Those few last years, researchers have focused on the use of synchronized chaos to achieve secure communication systems.In these systems, identical laser transmitter and receiver chaotic setups are self-synchronized by sending a chaoticencrypted message signal from the transmitter to the receiver.These systems may represent a significant breakthrough for secure communications since they can provide signal encryption rates that are greater than 1 GHz.One such laser system was developed in our group, using a wavelength tunable laser diode with a nonlinear feedback and a specific open-loop receiver [6].This experiment was novel in two important aspects: the dynamics appeared to be of high dimensionality (∼ 500) and the feedback function was highly nonlinear (with up to 5 extrema) with the hope of enhancing the privacy of the transmission.The same features were also used in another system we reported later in the radiofrequency domain [7,8] to enhance the security level.However security of these systems is still an open issue although chaotic communications based on simpler encryption schemes have been shown to be susceptible to be cracked mainly in two cases: (i) it was shown that the information transmitted by a DNLF-system with a weak nonlinearity introduced by an erbium optical amplifier in the feedback loop [9] could be successfully unmasked by considering the chaotic waveform as a convolution of the original laser pulses with an "echo"-function associated with the delayed feedback loop [10]; (ii) a second type of attacks was proposed from time-series analysis in the case of Mackey-Glass systems, which feature a nonlinear function with only one extremum [11][12][13].
In this Letter we report on our investigations of the security features of systems that exhibit a stronger nonlinearity and a more complex encryption process.In order to evaluate the security we used experimental data sets obtained from the setup reported in [6].

The method used
A delay feedback system representative of those of concern and used in the experiments reported in [6] is shown in Fig. 1.The transmitter consists of a source (a wavelength tunable laser diode with center wavelength Λ 0 = 1550 nm), a nonlinear element (a birefringent plate with an optical path-difference D = 11 mm between its ordinary and extraordinary axes), a detector with a time response τ = 8.6 µs (the latter being schemed as a low-pass filter in Fig. 1) and a feedback loop with a delay time T = 510 µs.The message signal m(t) is added to the feedback signal in the transmitter to produce the chaotic transmitted signal, which takes the form of chaos in wavelength.The wavelength fluctuations λ(t) around Λ 0 in the transmitted beam can be expressed in the general form [14]: (1) with the output signal x(t) = Kλ(t), K = πD/Λ 2 0 .The coefficient β is the bifurcation parameter, F (x) = sin 2 [x(t)−Φ] is the feedback nonlinear function (with multiple extrema) attached to the birefringent plate, with Φ = πD/Λ 0 .The message m(t) is embedded in the trajectories of x(t) via the function f (t) = γ [m(t) + τ dm(t)/dt] with γ = 10 −2 being an attenuation parameter related to the transmitter.The message is mixed with the chaotic signal inside the feedback loop, and not just added outside the transmitter to the chaotic carrier.The message m(t) changes the dynamics of the entire transmitter; thus the transmitted signal x(t) represents more than simply the superposition of a chaotic signal and the message.Because of this situ-ation, a high degree of security may be expected.The receiver consists of elements identical to those in the transmitter.The laser diode at the receiver emits light with chaotic fluctuations λ (t) of its wavelength, ruled by [6] (2) with y(t) = Kλ (t).For the authorized receiver, proper delay time T R = T , response time τ R = τ , bifurcation parameter β R = β, and nonlinear function F R = F allow recovery of the message by subtracting y(t) from x(t), yielding a difference signal This is the algorithm we adopted in our experiments [6][7][8].In contrast, for an unauthorized receiver, the difference signal ∆(t) is a chaotic error signal, which can be expressed as  1).Estimates of the dimensionality of the wavelength dynamics have been made, suggesting a Lyapunov dimension of 500 in previous experiments.The encryption scheme described by Eq. ( 1) has been suspected to produce secure encryption compared with methods where the message is directly added to the chaotic carrier [15], because the message and the chaotic signal couple with each other through a more sophisticated process and a strongly nonlinear function.Assuming, however, that the eavesdropper knows that our encryption algorithm relies on a DDE, then only τ , T and the nonlinear function βF [•] are required at most to recover the message from the transmitted signal (note that changing the nonlinear function F [•] used in [6] can be easily put in practice by using an electro-optic crystal instead of a birefringent plate).
To test the breaking method that will be explained hereafter, we adopted a message m(t) formed by the sum of two sine-signals with frequencies of 8 and 12 kHz (Fig. 2(a)).The amplitude of this composite message signal was equal approximately to 0.5% of that of the chaotic signal in the feedback loop in order to have a high masking efficiency.The output transmitter signal thus obtained and that we used in our simulations, is shown in Fig. 2(b).It was approximately 1 ms in duration and was sampled at 86 ns intervals to yield N = 12 000 points.
We start with the assumption that parameters τ and T can be recovered relatively easily.The value of the time response τ can be estimated by analyzing the spectrum of the tapped signal x(t) and measuring its bandwidth (for example, using the least-squares method), which is inversely proportional to τ .Previous results obtained in our experiments have shown that the mismatch of τ in the transmitter and the receiver can reach the value of 4-5% without incurring dramatic problems in the recovery of the message signal at the receiver, so the value of τ can be known with an accuracy of the order of a few percents.By analyzing the spectrum of the tapped signal x(t), we found τ = 9 µs, a value which is in agreement with the original one within a 5% accuracy.A value of the time-delay T can be also obtained.A few methods can be applied here: (i) the analysis of the autocorrelation function (ACF) of the time series x(t); (ii) the average mutual information technique (AMI) [16]; (iii) the 3D-reconstruction of the derivative of x(t) [13]; (iv) the reconstruction of the return map of x(t) [17].The example of the calculated ACF of x(t) is shown in Fig. 2(c).A narrow peak can be obtained if the sampling step is small enough (for out setup it must be less than 0.001 T ); the location of the peak gives the value of the time-delay T , with an accuracy that is higher as the sampling step is smaller.The peak corresponding to the time-delay T can be found also observing the AMI of x(t) (Fig. 2(d)).The value of T was found to be T = 514 µs with an accuracy higher than 1% (see also, for example, [13]).
Recovering the type of nonlinearity used in the transmitter is more difficult and can pose problems when the nonlinear function F [•] features a high complexity such as a high number of extrema.This can be understood from Fig. 3.The return map of the transmitter output λ(t) vs. λ(t − T ) was plotted in Fig. 3(a) to be compared with the nonlinear function F used in the feedback, shown in Fig. 3(b).(As another example, we also show in Fig. 3(c) and (d) the return map and the nonlinear function of the radiofrequency transmitter reported in [7] where the nonlinearity was formed by a set of three oscillating resonant circuits.)It can be seen that only a rough prediction of the type of the nonlinearity used in the transmitter can be obtained using data in Fig. 3(a) and (c).Another method is thus required to extract the information on the nonlinearity used in the transmitter, as we explain below.
The usual operating condition of the chaos-based transmitter is that the amplitude of the message signal is much smaller than the amplitude of the chaotic carrier oscillations, i.e., m(t) x(t) to ensure a high masking efficiency.We also assume that |dx(t)/dt| |dm(t)/dt|, that is usually fulfilled in practice, and assume that the dynamics of the variable x(t) can then be approximately described by the expression ( 5) Eq. ( 5) is similar to Eq. ( 1) when the message signal is not injected in the feedback loop [f (t) = 0], i.e., this approximation means physically that the local dynamics of the system (during a short time interval less than τ ) with and without a message are assumed to be the same.That assumption allows one to apply the analysis of the local dynamics described by Eq. ( 5) for recovering of Eq. ( 1).We applied F -forecasting within very small neighborhood {x i } of every point x i of the transmitted signal by analyzing the dynamics exhibited by the neighboring points.(If the size of {x i } is not small enough the trajectories of the systems described by Eqs. ( 1) and ( 5) become significantly different with the time evolution of the message.)Therefore having the series of the sampled signal x(t) and delayed signal x(t − T ), one can calculate the function X(t) = x(t) + τ dx(t)/dt, and finally, estimate a forecasting of the function F that can be reconstructed using, for example, an expansion in polynomials (up to degree 2 in [4]) with the leastsquares minimization.
Practically the procedure for key breaking that we applied includes the following steps: (1) We choose the arbitrary series of the sampled output signal x(t) over a time interval approximately a few T -cycles, and the corresponding series of the delayed signal x(t − T ).
(2) We calculate the derivative of the transmitted signal at every point x i as a vector dx i /dt = (x i+1 − x i−1 )/2h, where h is the sampling step, and next the vector X i = x i + τ dx i /dt.It is obvious that the sampling step must be at least a few times smaller than τ .
(3) For a more accurate approximation we choose the points of the series x T = x(t − T ) surrounded by the set of neighbor points {x i T } that represents small monotonic (in the time domain) pieces.The size of {x i T } is arbitrary chosen equal to 5% from the value of the difference: max(x T ) − min(x T ), where max(x T ) and min(x T ) stand for the maximum and minimum values of the series of x T .In our case the number of points in the neighborhood is typically between 3 and 5. (4) Next we estimate the interpolation of the function βF i at every chosen point x i T surrounded by a monotonic set {x i T }, using the equation X i = βF i (x i T ).Doing that we applied three types of a data interpolation: a spline linear interpolation, a spline parabolic interpolation, and a spline cubic interpolation.An example of the latter interpolation, corresponding to a 2000-point sampled series of λ T = λ(t − T ), is shown in Fig. 4(a).The projections of βF i on the plane {βF i , λ T } are shown in Fig. 4(b).After averaging a number of time series λ T we get the forecast of βF (λ) shown in Fig. 4(c) (solid curve) with the original function βF (λ) (dashed curve).We obtained qualitatively similar results applying the other noted types of interpolations.
(5) However the results of [βF (•)]-forecasting shown in Fig. 4(c) cannot be introduced directly in Eq. ( 1) to recover the message, due to the resulting errors that reach 25% of the original values of βF (•).The attempts to use these results lead to a chaotic error signal ∆(t) expressed by Eq. ( 4), with an amplitude at least 3 times higher than of the message signal.A possible way to overcome that problem is to analyze the signal through a series with much longer duration, but it would take hours of calculations using a PC.We used a faster way to recover the message.The data represented in Fig. 4(b) and (c) show qualitatively that the function βF (λ) is a periodic function of the sin 2 (•)-type.We then assume that βF (λ) can be approximated by the expression: βF (λ) ≈ A sin 2 (Bλ + C), where A, B, and C are the parameters that have to be determined.Then we calculate the 3D-matrix of the fitting error: where N is the number of points in Fig.  1) is then reconstructed.
The existence of the minimum of the 3D-matrix E i,j,k is illustrated in Fig. 5. Fig. 5(a) and (b) show a 2D-section E i,k , and the corresponding lines of the equal potentials of the surface E i,k , respectively.The surface E i,k shown in Fig. 5(a) is calculated within a wide range of the parameters A, B, and C. For example, the parameter C is varied from 0 to π .Having the data shown in Fig. 4(b) and (c), the errormatrix E i,j,k is calculated within a small volume of parameters {A i , B j , C k } surrounding the point of the minimum.Practically it takes only a few minutes of calculation.
(6) As the last step the numerical modeling of the receiver can be applied for message recovery.We solved Eq. ( 2) for the receiver with the obtained values of the parameters A, B, and C. Then we calculated the difference signal ∆(t) using Eq. ( 3).The difference signal ∆(t) thus obtained is shown in Fig. 6(a).It  can be compared with the original message signal (Fig. 2(a)).The spectrum of ∆(t) is also shown in Fig. 6(b).One can see the peaks corresponding to the two components of the original transmitted message, showing that the encrypted message is recovered.

Conclusion
Finally we have shown that our DNLF-system is not completely safe.The key represented by the five parameters of the system can be broken despite of the very high dimensionality of the chaotic carrier, of the strong nonlinearity involved in the feedback loop, and also despite that, in the experimental method used, the message participates to the chaotic dynamics of the transmitter through a complicated encoding scheme.In the example presented here, we made however explicit use of some a priori knowledge of the sin 2 -type of nonlinearity used experimentally.This had the result of recovering the message through a fitting method, with three parameters (A, B and C) only to be calculated, but we should comment that the procedure would be much more complex and would take hours of computing if the analytical function describing the nonlinearity was completely unknown by the intruder.This situation is not unrealistic in the experiments on chaos in wavelength [6] since the birefringent plate used can be replaced by a spectral filter featuring any spectral transmission curve nonlinear in wavelength.In that case, the number of parameters to be calculated can be much greater than 3.A more complicated situation can be met if the nonlinear function cannot be expressed analytically since chaotic regimes produced by nonanalytical nonlinear functions are still unsolved mathematically.From that point of view, the possibility to generate more complicated nonlinear functions by using random (and, for example, dynam-ical) spectral filters in the feedback loop might be a solution to increase key complexity and to make cryptoanalysis of such systems extremely difficult.
and direct access to m(t) is clearly impossible without knowing τ , T and the nonlinear function βF [•].Let us now consider an intruder taping the transmission line.The wavelength fluctuations detected by the eavesdropper in the transmitted light beam are expressed by Eq. (

Fig. 2 .
Fig. 2. Examples of signals: (a) the message signal m(t), (b) the transmitted signal λ(t), (c) the ACF of transmitted signal, (d) the AMI of transmitted signal.

Fig. 4 .
Fig. 4. The reconstruction of the function βF (λ).(a) The spline cubic approximation as a matrix βF i (λ i T ), (b) the projection of βF i (λ i T ) on the plane {βF i , λ T (t)}, (c) the averaged values of the βF i (the dashed curve is the original function describing the nonlinearity involved in the experimental feedback loop).
4(c) used for [βF (λ)]-forecasting.The matrix is calculated for values within a volume {A i , B j , C k } centered on the expected values A, B, and C of the parameters.These values can be obtained in advance using the data shown in Fig. 4(b) and (c).Next we determine the minimum of the error matrix E i,j,k .Finally we obtain: A = 3.44 nm, B = 14.2 nm −1 , and C = 0.78π + nπ (the corresponding values for the parameters of Eq. (1) are: β = 3.5 nm, K = πD/Λ 2 0 = 14.4 nm −1 , Φ 0 = πD/Λ 0 = 2.43).Eq. (

Fig. 5 .
Fig. 5. Minimization of the error matrix E i,j,k .(a) The section E i,k of the matrix E i,j,k and (b) the projection of the lines of an equal potential of the surface E i,k on the horizontal plane.

Fig. 6 .
Fig. 6.Recovery of the information signal.(a) The difference signal ∆(t) and (b) the spectrum of ∆(t).The dashed line is the spectrum of the original message signal m(t) shown in Fig. 2(a).