## 2 Preparation of FPs  
The QR code image encoded with secret information is regarded as the original image to be encrypted. As shown in Figure 1, the server first divides it into \(t+1\) fragment patterns (FPs) following a cascade ablation principle. One FP is for the intermediary and \(t\) FPs are for \(t\) legitimate users. **3. Watermark embedding. ** The server embeds corresponding \"watermark\" labels in the fixed pixel regions of FPs (here the upper left corner of the FP is selected as the watermark-embedding position). The watermarking technology used here can be treated as a kind of privacy protection. **4. Encrypted signal transmission over a public network. ** The above \(t+1\) 2D FPs will be encrypted into \(t+1\) one-dimensional (1D) measured bucket value vectors \(\{S_{B_{j}}\}_{j}\) (\(j=1,2,3,\cdots,t+1\)) via a CGI optical setup, and then be sent to legitimate users over a public network. The 2D FPs used here are all binary and can be generated numerically. An intuitive approach is to use the numerical model to calculate and generate the corresponding bucket values on a computer. However, a computer's numerical simulation cannot generate true random numbers, which cannot meet the requirement of the CGI-based CKD protocol for true randomness. Thereby, it is necessary to introduce true random variables, and the optical setup is the best choice. As we know, the optical setup involves the true random fluctuations of the light source, the true random stray light, the true random variation of the illumination, the true random electrical shot noise of the detector, etc. These are all very good true random physical sources, which can provide the CKD protocol excellent security guarantees. Hence, the physical setup is very essential for our CKD protocol. **Part II**: Watermark-based identity authentication and cascade-ablation-based cryptographic key extraction. **5. GI reconstructions and attack self-checking. ** By using intensity correlation functions [8], the legitimate users can quickly reconstruct ghost images of FPs from their received bucket values and pre-shared initial keys \(1K_{j}\). After image binarization (by using smoothing-based or sorting-based strategy), the legitimate users can extract their \"watermarks\" for identity authentication. If the content in the recovered \"watermark\" is clear and regular, then the legitimate user can determine that the received data are safe. **6. Watermark removal. ** After each user finishes authentication, he/she will remove the \"watermark\" in the aforesaid fixed pixel region to get the binary result of FP. **7. Cascade-ablation-based CK extraction. ** All users send their FPs to a trusted intermediary through private channels (e.g., local area network (LAN)). Generally, the transmission over private channels is less vulnerable to attacks. As we know, the LAN is a closed network with small coverage and is isolated from the external network. It has extremely high security and is very suitable for small-scale short-term secure communication between the intermediary and users. Here, the intermediary synthesizes the received FPs and its own FP together by cascade ablation, i.e., performing cascade exclusive- or (XOR) operations on the values that fall into the same pixel positions as these FPs--\(XOR(\cdots XOR(XOR(FP_{1},FP_{2}),FP_{3}),\cdots,FP_{t+1})\)--to acquire the final fragment synthesis pattern (FSP). This process plays an important role in affirming the legitimacy of all users. If this FSP turns out to be a readable QR code image, the joint authentication succeeds, and then this FSP (i.e., the recovered QR code) will be returned back to the legitimate users also through aforementioned private channels. Finally, the legitimate users can scan this QR code to obtain the CKs to be distributed. Differently from traditional CGI-based CKD schemes, this protocol can detect attacks occurring in public channels in real time via the users' watermark recognition.