## 3 Simulation and Experimental Results  
Some numerical simulations were conducted to validate the feasibility of this protocol. As we all know, the QR code can encode string information into a 2D binary image by some rules, and its pixel-size increases with the string length. The string information to be encoded can be a link address (which can directly jump to a hyperlink after scanning the QR code and then present the images, videos, texts, web pages, etc.) or a sequence of pure characters. Here, for simplicity and without loss of generality, we directly set the encoding information of the QR code to an 18-byte disk address--\"G:\(\cup\)01\(\setminus\)001\(\setminus\)001\(\setminus\)012\"--which can be regarded as the actual CK to be distributed or the retrieval code of the CK. If it is a retrieval code, the legitimate user can go to the actual disk address on his/her flash disk (or U shield) where his/her CK library is stored in advance to extract the corresponding CK. By this means, it actually realizes the expansion of CKs. After encoding, we obtained a QR code of 25 \(\times\) 25 pixel-units. To our knowledge, a QR code image of Version 2 consists of function patterns and encoding regions, as shown in Figure 2. We segmented the encoding region following the principle of cascade ablation. Taking \(t=4\) as an example, five FPs of the same 25 \(\times\) 25 pixel-units would be generated. In the upper left corner of each FP, we embedded an unique watermark for each legitimate user (for simplicity and without loss of generality, here we set the watermarks to be the users' numbers), as shown in Figures 2e-i and 3a-e. To reduce the influence of inevitable noise fluctuations, here we took an upsampling strategy (i.e., upsampling a low-resolution image to a higher resolution): we assumed that each pixel-unit of the FP was sampled by a 0-1 random matrix of \(\
u\times\
u\) pixels in each modulation. Here, \(\
u\) was set to 8; thus, the real sizes of both FPs and random binary modulated patterns \(IK_{j}\) were \(200\times 200\) pixels. Then, the server would encrypt each FP (regarded as an original object image) into a bucket value sequence \(\{S_{B_{j}}\}_{j}\) (\(j=1,2,3,4,5\)) via a CGI setup, which used \(IK_{j}\) as random binary modulated patterns. The measured five sequences \(\{S_{B_{j}}\}_{j}\) (\(j=1,2,3,4,5\)) were then sent to four legitimate users and an intermediary by public channels. After that, the legitimate users and the intermediary reconstructed their corresponding FPs according to the received bucket value sequences and pre-shared initial key \(IK_{j}\). After performing binarization on these FPs, the legitimate users could extract their watermarks for the sake of identity authentication. If the self-authentication succeeded and the extracted watermark showed no abnormalities, then the user would remove the watermark content from the region of function patterns, as shown in Figure 3k-n, and sent the result to the intermediary through a private channel (e.g., a LAN). The intermediary then synthesized four received FPs with the watermarks being deleted and its own FP (see Figure 3o) to obtain a composite image by using the cascade ablation strategy. By adding the function patterns (see Figure 3q) to this composite image (Figure 3p), the final FSP (recovered QR code, as shown in Figure 3r) could be generated successfully. In the end, the intermediary sent this FSP back to each legitimate user also through the foregoing private channel (e.g., LAN). The experimental setup of CGI is given in Figure 4a. The thermal light emitted from a stabilized tungsten-halogen lamp was amplified, collimated and attenuated to form a parallel beam with a diameter close to the diagonal length of the first digital micromirror device's (DMD) working plane. The light beam illuminated the first DMD, which was encoded with \(N\) random binary patterns of \(200\times 200\) pixels (also with \(\
u=8\)).