us harder than AES alone which does not have the decoding in noise problem. In particular, it is easily seen that if the Y-00 in the configuration of Fig. 2 can be broken, then each $AES_i$ itself can be broken.

\[htbp\]

[ ![image](newfigs1.eps){width="4.5in" height="2in"}]{}

The question arises as to what constitutes a fair comparison between a given stream cipher ENC versus Y-00 on top of ENC. A different configuration was given for ENC in [@nair06], where a single classical stream cipher (say AES) is used without parallelization but is adjusted to give the same clock rate for encrypting each data bit. The present scheme appears simpler in principle and more secure in practice when AES is used in ENC, because the functionality of multiple AES in parallel cannot be replaced by a single AES. However, with such parallelization for maintaining the same clock rate as AES (or ENC alone), the question arises as to whether the added security from Y-00 can be obtained from, say, nonlinearly combining the parallel AES’s. This question cannot be answered until security is precisely defined and quantified. However, it may be observed in this connection that there is no known attack developed for AES observed *in noise*, and the intrinsic nonlinearity of AES renders all known decoding attacks inapplicable.

The major qualitative advantage of Y-00 [@yuen05qph; @nair06] compared to a standard nonrandom cipher is that the quantum noise automatically provides high speed true randomization not available otherwise, thus giving it a different kind of protection from nonrandom ciphers. Furthermore, one has to attack such physics-based cryptosystem at the communication line with physical (measurement) equipment, which is not available to everyone at every place, whereas one only needs to sit at a computer terminal to attack conventional ciphers. In this connection, it may be mentioned that the high rate heterodyne attack needed on Y-00 is currently not quite technologically feasible, though it may be in the not-too-far future.