Modified Gerchberg–Saxton (G-S) Algorithm and Its Application

The Gerchberg–Saxton (G-S) algorithm is a phase retrieval algorithm that is widely used in beam shaping and optical information processing. However, the G-S algorithm has difficulty obtaining the exact solution after iterating, and an approximate solution is often obtained. In this paper, we propose a series of modified G-S algorithms based on the Fresnel transform domain, including the single-phase retrieval (SPR) algorithm, the double-phase retrieval (DPR) algorithm, and the multiple-phase retrieval (MPR) algorithm. The analysis results show that the convergence of the SPR algorithm is better than that of the G-S algorithm, but the exact solution is not obtained. The DPR and MPR algorithms have good convergence and can obtain exact solutions; that is, the information is recovered losslessly. We discuss the security advantages and verification reliability of the proposed algorithms in image encryption. A multiple-image encryption scheme is proposed, in which n plaintexts can be recovered from n ciphertexts, which greatly improves the efficiency of the system. Finally, the proposed algorithms are compared with the current phase retrieval algorithms, and future applications are discussed. We hope that our research can provide new ideas for the application of the G-S algorithm.


Introduction
Phase retrieval was first proposed to solve the imaging problem of an electron microscope. Gerchberg and Saxton addressed the issue of the wavefront phase of the light field via numerical iteration using the intensity of the image plane and the diffraction plane [1,2]. Since the successful solution of this problem, phase retrieval has aroused significant research interest and has been extended to many engineering fields, such as X-ray imaging, astronomical imaging, adaptive optics, and binary optical design [3][4][5][6][7][8][9]. Gerchberg and Saxton first proposed a numerical algorithm in 1972, known as the G-S algorithm [2]. The G-S algorithm has groundbreaking significance in addition to a number of shortcomings. Some of these shortcomings are inherent to the solution of inverse problems. For example, the Fourier transform amplitude of a function to a function is a many-to-one mapping, and finding a function from the Fourier transform amplitude will inevitably have multiple solutions. The other issue arises from the algorithm itself. For example, after the first few iterations, the convergence speed of the G-S algorithm slows down or even stagnates. Two important improvements to the G-S algorithm were made by Misell and Fienup. In 1973, Misell proposed that iterating between two images with different levels of defocus can improve the accuracy and convergence of the algorithm [10]. Misell's algorithm is more practical, and provides a reference for the improvement of the G-S algorithm. In 1982, Fienup noted that G-S is an error descent algorithm, and its essence is the same as the fastest descent algorithm [11]. To solve the problem of stagnation of the G-S algorithm, Fienup proposed a hybrid In the given initial phase distribution, the amplitude distributions of the input and the output are successively iterated, which can determine the phase distribution of the input. The G-S algorithm can be implemented using Equations (1)- (4). The iterations of the algorithm can be controlled using the mean squared error (MSE) or the correlation coefficient (CC). The main principle is to control the iterative process by calculating the difference between the amplitude of the spectrum surface and the preset amplitude. The iteration stops when the MSE or CC satisfies a certain preset condition; otherwise, the next iteration starts.
Next, we conducted a comparative analysis with a two-dimensional function graph. The function graph of the Gaussian beam is shown in Figure 2a, and Figure 2b is the function graph of the target light intensity. In the simulation experiment, the G-S algorithm performed 200 iterations in total, and the comparison results are shown in Figure 2c. The red curve is obtained again, and the green curve is the target function curve. Figure 2d is the CC curve. The closer the CC is to 1, the better the convergence effect of the algorithm. Figure 2d shows that the initial convergence speed is relatively fast. After 50 iterations, the convergence speed is very slow, and the phenomenon of stagnation occurs.
(a) (b) relative intensity /a.u. relative intensity /a.u. In the given initial phase distribution, the amplitude distributions of the input and the output are successively iterated, which can determine the phase distribution of the input. The G-S algorithm can be implemented using Equations (1)- (4).
g k (x, y) = IFT G k (u, v) = g k (x, y) e iφ k (x,y) , g k (x, y) = g(x, y) e iφ k (x,y) . (4) k = 1, 2, · · · , n The iterations of the algorithm can be controlled using the mean squared error (MSE) or the correlation coefficient (CC). The main principle is to control the iterative process by calculating the difference between the amplitude of the spectrum surface and the preset amplitude. The iteration stops when the MSE or CC satisfies a certain preset condition; otherwise, the next iteration starts.
Next, we conducted a comparative analysis with a two-dimensional function graph. The function graph of the Gaussian beam is shown in Figure 2a, and Figure 2b is the function graph of the target light intensity. In the simulation experiment, the G-S algorithm performed 200 iterations in total, and the comparison results are shown in Figure 2c. The red curve is obtained again, and the green curve is the target function curve. Figure 2d is the CC curve. The closer the CC is to 1, the better the convergence effect of the algorithm. Figure 2d shows that the initial convergence speed is relatively fast. After 50 iterations, the convergence speed is very slow, and the phenomenon of stagnation occurs. In the given initial phase distribution, the amplitude distributions of the input and the output are successively iterated, which can determine the phase distribution of the input. The G-S algorithm can be implemented using Equations (1)- (4). The iterations of the algorithm can be controlled using the mean squared error (MSE) or the correlation coefficient (CC). The main principle is to control the iterative process by calculating the difference between the amplitude of the spectrum surface and the preset amplitude. The iteration stops when the MSE or CC satisfies a certain preset condition; otherwise, the next iteration starts.
Next, we conducted a comparative analysis with a two-dimensional function graph. The function graph of the Gaussian beam is shown in Figure 2a, and Figure 2b is the function graph of the target light intensity. In the simulation experiment, the G-S algorithm performed 200 iterations in total, and the comparison results are shown in Figure 2c. The red curve is obtained again, and the green curve is the target function curve. Figure 2d is the CC curve. The closer the CC is to 1, the better the convergence effect of the algorithm. Figure 2d shows that the initial convergence speed is relatively fast. After 50 iterations, the convergence speed is very slow, and the phenomenon of stagnation occurs.  As in the above analysis, when the G-S algorithm is applied to beam shaping, the problem arises that the convergence stagnates.

Application of G-S Algorithm in Image Encryption
The G-S algorithm is widely used in image encryption. Due to the correlation between the pixels of an image, a plaintext image can be recovered well. Here, we introduce the most common and simplest encryption scheme. In the encryption process, the optical attributes involved usually include the wavelength, focal length, diffraction distance, phase, etc., which can be used as the keys.
The principle of image encryption based on the G-S algorithm is shown in Figure 3. Here, g is a known amplitude image, assuming there is phase i e φ ⋅ (ciphertext). Then, the light intensity detector at the receiving end can obtain the image q (plaintext). Next, we used the G-S algorithm to obtain the phase i e φ ⋅ (ciphertext). In the encryption process, we used the G-S algorithm for 200 iterations, and the numerical simulation results are shown in Figure 4. Figure 4a,b are a known input amplitude image and a target amplitude image, respectively. The CC was selected as the criterion for judging the convergence of the iterations. The value of CC was 0.9984 after 200 iterations. The transformation curve of CC is shown in Figure 4c. As in the above analysis, when the G-S algorithm is applied to beam shaping, the problem arises that the convergence stagnates.

Application of G-S Algorithm in Image Encryption
The G-S algorithm is widely used in image encryption. Due to the correlation between the pixels of an image, a plaintext image can be recovered well. Here, we introduce the most common and simplest encryption scheme. In the encryption process, the optical attributes involved usually include the wavelength, focal length, diffraction distance, phase, etc., which can be used as the keys.
The principle of image encryption based on the G-S algorithm is shown in Figure 3. Here, g is a known amplitude image, assuming there is phase e i·φ (ciphertext). Then, the light intensity detector at the receiving end can obtain the image q (plaintext).  As in the above analysis, when the G-S algorithm is applied to beam shaping, the problem arises that the convergence stagnates.

Application of G-S Algorithm in Image Encryption
The G-S algorithm is widely used in image encryption. Due to the correlation between the pixels of an image, a plaintext image can be recovered well. Here, we introduce the most common and simplest encryption scheme. In the encryption process, the optical attributes involved usually include the wavelength, focal length, diffraction distance, phase, etc., which can be used as the keys.
The principle of image encryption based on the G-S algorithm is shown in Figure 3. Here, g is a known amplitude image, assuming there is phase i e φ ⋅ (ciphertext). Then, the light intensity detector at the receiving end can obtain the image q (plaintext). Next, we used the G-S algorithm to obtain the phase i e φ ⋅ (ciphertext). In the encryption process, we used the G-S algorithm for 200 iterations, and the numerical simulation results are shown in Figure 4. Figure 4a,b are a known input amplitude image and a target amplitude image, respectively. The CC was selected as the criterion for judging the convergence of the iterations. The value of CC was 0.9984 after 200 iterations. The transformation curve of CC is shown in Figure 4c. Next, we used the G-S algorithm to obtain the phase e i·φ (ciphertext). In the encryption process, we used the G-S algorithm for 200 iterations, and the numerical simulation results are shown in Figure 4. Figure 4a,b are a known input amplitude image and a target amplitude image, respectively. The CC was selected as the criterion for judging the convergence of the iterations. The value of CC was 0.9984 after 200 iterations. The transformation curve of CC is shown in Figure 4c.  The phase i e φ ⋅ obtained is shown in Figure 4d, which is also ciphertext. The decryption process can be completed either by an optical system or by a computer. The phase i e φ ⋅ was placed in the optical system of Figure 3, and the plaintext can be obtained directly at the receiver. In the computer, the receiver can obtain the plaintext image via the operation . The recovered plaintext image is shown in Figure 4e. It is well-known that the G-S algorithm has difficulty obtaining an exact solution, but the recovered image is no different from the original image visually. We attempted to recover the plaintext using the operation ( ) i FT e φ (only phase), and the result is shown in Figure 4f. The result shows that we can still recognize the plaintext image information, which indicates that the phase is dominant in image reconstruction.

The Importance of the Phase
The phase is very important in signal processing due to its ability to reconstruct a signal completely [40,41]. Similarly, the phase is also very important in image processing, as shown in Figure 5. The phase and the amplitude were extracted by applying the Fourier transform to the images. We combined the phase of one image with the amplitude of another. Then, the new image was obtained using the inverse Fourier transform, and we can recognize the image information. This shows the importance of the phase in image processing. Here, PT and PR denote the phase truncation and phase reservation operations, respectively. For any complex amplitude The phase e i·φ obtained is shown in Figure 4d, which is also ciphertext. The decryption process can be completed either by an optical system or by a computer. The phase e i·φ was placed in the optical system of Figure 3, and the plaintext can be obtained directly at the receiver. In the computer, the receiver can obtain the plaintext image via the operation FT g·e iφ . The recovered plaintext image is shown in Figure 4e.
It is well-known that the G-S algorithm has difficulty obtaining an exact solution, but the recovered image is no different from the original image visually. We attempted to recover the plaintext using the operation FT e iφ (only phase), and the result is shown in Figure 4f. The result shows that we can still recognize the plaintext image information, which indicates that the phase is dominant in image reconstruction.

The Importance of the Phase
The phase is very important in signal processing due to its ability to reconstruct a signal completely [40,41]. Similarly, the phase is also very important in image processing, as shown in Figure 5. The phase and the amplitude were extracted by applying the Fourier transform to the images. We combined the phase of one image with the amplitude of another. Then, the new image was obtained using the inverse Fourier transform, and we can recognize the image information. This shows the importance of the phase in image processing. Here, PT and PR denote the phase truncation and phase reservation operations, respectively. For any complex amplitude F = |F|e i·φ ,  This analysis shows that the phase is dominant in image reconstruction. Inspired by this, we attempted to use the phase for image reconstruction, and then propose the modified G-S algorithm.

Modified G-S Algorithm
In this section, we propose three modified G-S algorithms in a progressive relationship. They are the single-phase retrieval (SPR) algorithm, the double-phase retrieval (DPR) algorithm, and the multiple-phase retrieval (MPR) algorithm.

Single-Phase Retrieval Algorithm
Our idea is shown in Figure 6. The modified G-S algorithm is applied to the Fresnel transform domain, which is more flexible; and the diffraction distance can be used as a key to improve security. We try to recover the target image using only a single phase during the iteration. Obtaining the phase i e φ ⋅ is the core problem of our research. Therefore, we refer to the idea of the G-S algorithm to propose an SPR algorithm based on the Fresnel transform domain.
For the initial random phase mask  This analysis shows that the phase is dominant in image reconstruction. Inspired by this, we attempted to use the phase for image reconstruction, and then propose the modified G-S algorithm.

Modified G-S Algorithm
In this section, we propose three modified G-S algorithms in a progressive relationship. They are the single-phase retrieval (SPR) algorithm, the double-phase retrieval (DPR) algorithm, and the multiple-phase retrieval (MPR) algorithm.

Single-Phase Retrieval Algorithm
Our idea is shown in Figure 6. The modified G-S algorithm is applied to the Fresnel transform domain, which is more flexible; and the diffraction distance can be used as a key to improve security. We try to recover the target image using only a single phase during the iteration. This analysis shows that the phase is dominant in image reconstruction. Inspired by this, we attempted to use the phase for image reconstruction, and then propose the modified G-S algorithm.

Modified G-S Algorithm
In this section, we propose three modified G-S algorithms in a progressive relationship. They are the single-phase retrieval (SPR) algorithm, the double-phase retrieval (DPR) algorithm, and the multiple-phase retrieval (MPR) algorithm.

Single-Phase Retrieval Algorithm
Our idea is shown in Figure 6. The modified G-S algorithm is applied to the Fresnel transform domain, which is more flexible; and the diffraction distance can be used as a key to improve security. We try to recover the target image using only a single phase during the iteration. Obtaining the phase i e φ ⋅ is the core problem of our research. Therefore, we refer to the idea of the G-S algorithm to propose an SPR algorithm based on the Fresnel transform domain.
For the initial random phase mask  Obtaining the phase e i·φ is the core problem of our research. Therefore, we refer to the idea of the G-S algorithm to propose an SPR algorithm based on the Fresnel transform domain.
For the initial random phase mask e i·φ 0 with φ 0 ∈ (−π, π), the complex amplitude S 0 = S 0 ·e i·arg(S 0 ) is obtained after the Fresnel transform. Then, the amplitude S 0 is replaced to obtain a new complex amplitude S 1 = f ·e i·arg(S 0 ) . Next, the function F 1 = F 1 ·e i·arg(F 1 ) is obtained after the inverse Fresnel transform. The extracted phase e i·arg(F 1 ) replaces the initial phase e i·φ 0 and enters the next iteration. The iterations continue until the iterative result meets the preset requirements. The SPR algorithm is shown in Equations (7)-(10): Here, FrT z 1 (·) denotes the Fresnel transform with distance z 1 , f denotes a known image, |·| is the modulus operation, and arg(·) is the argument function. It is known that image f is transformed into a phase encoding e i·φ through the above iterative process. When the phase encoding e i·φ passes through the optical system, the image can be directly captured by the light intensity detector, as shown in Figure 6. In addition, the image can also be obtained by the operation f = FrT z 1 e iφ | . The flowchart of the SPR algorithm is shown in Figure 7. passes through the optical system, the image can be directly captured by the light intensity detector, as shown in Figure 6. In addition, the image can also be obtained by the operation The flowchart of the SPR algorithm is shown in Figure 7. Figure 7. The flowchart of the single-phase retrieval (SPR) algorithm.
We use the CC as a criterion for judging the iterative convergence. ( , ) f x y denotes the known image, and ˆ( , ) f x y denotes the recovered image. Then, the CC can be expressed as follows: Here, COV is the covariance, and σ is the variance. The closer the value of the correlation coefficient to 1, the better the convergence.
The simulation results are shown in Figure 8. Figure 8a is the target image. The phase obtained after the iterations is shown in Figure 8b. Figure 8c is the recovered image, and the reconstruction process can be completed using the optical system of Figure   We use the CC as a criterion for judging the iterative convergence. f (x, y) denotes the known image, andf (x, y) denotes the recovered image. Then, the CC can be expressed as follows: Here, COV is the covariance, and σ is the variance. The closer the value of the correlation coefficient to 1, the better the convergence.
The simulation results are shown in Figure 8. Figure 8a is the target image. The phase obtained after the iterations is shown in Figure 8b. Figure 8c is the recovered image, and the reconstruction process can be completed using the optical system of Figure 6 or the operation FrT z 1 e iφ . Similar to the G-S algorithm, the SPR algorithm converges quickly in the early stages of the iterative process, but is slow in the later stages. The CC after 200 iterations is 0.9988.

Double-Phase Retrieval Algorithm
Here, we try to iterate using two phases, and our idea is shown in Figure 9. When the two phase encodings are arranged in order, the light intensity detector at the output can directly acquire the recovered image. Based on the research in Section 3.1, we present the DPR algorithm. The mathematical expression of its detailed process is as follows.
The initial random phases are are the random matrices.
Then, the wavefront function of the CCD can be expressed as: Assuming that there is a phase

Double-Phase Retrieval Algorithm
Here, we try to iterate using two phases, and our idea is shown in Figure 9. When the two phase encodings are arranged in order, the light intensity detector at the output can directly acquire the recovered image. the G-S algorithm, the SPR algorithm converges quickly in the early stages of the iterative process, but is slow in the later stages. The CC after 200 iterations is 0.9988.

Double-Phase Retrieval Algorithm
Here, we try to iterate using two phases, and our idea is shown in Figure 9. When the two phase encodings are arranged in order, the light intensity detector at the output can directly acquire the recovered image. Based on the research in Section 3.1, we present the DPR algorithm. The mathematical expression of its detailed process is as follows.
The initial random phases are φ φ π π ∈ − are the random matrices.
Then, the wavefront function of the CCD can be expressed as: Based on the research in Section 3.1, we present the DPR algorithm. The mathematical expression of its detailed process is as follows.
The initial random phases are e i·φ 0 1 and e i·φ 0 2 , where φ 0 1 , φ 0 2 ∈ (−π, π) are the random matrices. Then, the wavefront function of the CCD can be expressed as: Assuming that there is a phase e i·φ 1 2 , it satisfies Equation (13): where f is a target image. We can further obtain: where FrT −z 2 denotes the inverse Fresnel transform with the distance z 2 . Next, assuming that there is a phase e i·φ 1 1 , it satisfies Equation (15): Therefore, we can obtain: where * is complex conjugate. Substituting the obtained e i·φ 1 2 and e i·φ 1 1 into Equation (12), we obtain: Then, the above operation can be repeated to obtain e i·φ 2 2 , e i·φ 2 1 , S 2 · · · · · · . When the k-th iteration stops, we can obtain e i·φ k 1 = e i·φ 1 and e i·φ k 2 = e i·φ 2 . Then, the target image can be obtained by Equation (18): Through the above mathematical derivation, we give the general mathematical expression of the DPR algorithm in Equations (19)-(21): where e i·φ 0 1 and e i·φ 0 2 are the initial random matrices. The flowchart of the DPR algorithm is shown in Figure 10.
Entropy 2020, 22, x FOR PEER REVIEW 10 of 26 FrT − Figure 10. The flowchart of the double-phase retrieval (DPR) algorithm.  The simulation results of the DPR algorithm are shown in Figure 11. Figure 11a is the target image. Figure 11b,c are the obtained phases, respectively. The recovered image is shown in Figure 11d. After 15 iterations, the value of CC is 1, as shown in Figure 11e. The results show that the DPR algorithm has good convergence, can obtain the exact solution, and can recover the image losslessly. We will further analyze the convergence in Section 4.

Multiple-Phase Retrieval Algorithm
Further, we present the MPR algorithm, and its principle is shown in Figure 12. When n phase encodings are arranged in a certain order, the output can directly obtain the recovered image using parallel light illumination. For image encryption, an image is encrypted into n phase encodings.

Multiple-Phase Retrieval Algorithm
Further, we present the MPR algorithm, and its principle is shown in Figure 12. When n phase encodings are arranged in a certain order, the output can directly obtain the recovered image using parallel light illumination. For image encryption, an image is encrypted into n phase encodings. With the help of the derivation in Section 3.2, we present the mathematical expressions for the MPR algorithm: are the initial random phase encodings. The flowchart of the MPR algorithm is shown in Figure 13.
The SPR and DRP algorithms are special examples of the algorithm proposed in this section. The convergence of these algorithms and the comparison with the G-S algorithm is analyzed in Section 4. With the help of the derivation in Section 3.2, we present the mathematical expressions for the MPR algorithm: . . .
where e i·φ 0 1 , e i·φ 0 2 , · · · , e i·φ 0 n−1 and e i·φ 0 n are the initial random phase encodings. The flowchart of the MPR algorithm is shown in Figure 13.
The SPR and DRP algorithms are special examples of the algorithm proposed in this section. The convergence of these algorithms and the comparison with the G-S algorithm is analyzed in Section 4. Entropy 2020, 22, x FOR PEER REVIEW 12 of 26

G-S Algorithm and Single-Phase Retrieval Algorithm
The convergence of the G-S algorithm often stagnates, and the obtained solution is an approximate solution [11]. Next, we will perform an experiment by selecting two matrices A and B (both are 16 × 16). Here, matrix A is the magic matrix, and the corresponding imaging is shown in Figure 14a. The imaging corresponding to matrix B is shown in Figure 14b. We use Figure 14a as the input image and Figure 14b as the target image. The G-S algorithm performs 1000 iterations, and the obtained phase information is shown in Figure 14c. Figure 14d is the recovered image, and its corresponding pixel matrix is C. Figure 14e is the curve of the CC, which is closer to 1 as the number of iterations increases. However, the convergence is slow or even stagnant in the later stages of the iterative process. Our analysis shows that the G-S can recover the image well, but the exact solution is not obtained.

Double-Phase Retrieval Algorithm and Multiple-Phase Retrieval Algorithm
The DPR algorithm is used to encrypt an image into two phase encodings. Figure 16a is a known image (matrix B). The obtained phase encodings are shown in Figure 16b,c. Figure 16d is the recovered image, and its pixel matrix is E. It can be clearly seen that the image is recovered losslessly. The CC curve is shown in Figure 16e, and the value is 1 for 13 iterations, which again verifies that the algorithm can restore information losslessly.  The CC curve of the MPR algorithm is shown in Figure 17. The MPR algorithm can also recover information losslessly (the CC is 1), and its convergence is better than that of the DPR algorithm. Moreover, as the phase increases, the convergence speed is faster. The G-S algorithm and the SPR algorithm are error reduction algorithms. One simply transforms back and forth between the two domains, satisfying the constraints in one before returning to the other. During the iterations, nonlinear operations are used to enforce the constraints on the amplitude to obtain the phase. It is difficult to obtain the exact solution for this kind of nonlinear operation, and the Fourier transform from one function to another is a many-to-one mapping. The DPR algorithm and the MPR algorithm proposed are linear operations in the iterative process, and the exact solution can be obtained. We take the DPR algorithm as example since it is the simplest form of MPR algorithm.
In the DPR algorithm, we finally determine the phases  (14) and (15). In Equation (14), only the phase The phase 1 k i e φ ⋅ can also be obtained via the linear operation of Equations (16) and (17). In this way, we finally obtained the exact solution by means of this linear operation. The MPR algorithm is an The CC curve of the MPR algorithm is shown in Figure 17. The MPR algorithm can also recover information losslessly (the CC is 1), and its convergence is better than that of the DPR algorithm. Moreover, as the phase increases, the convergence speed is faster. The CC curve of the MPR algorithm is shown in Figure 17. The MPR algorithm can also recover information losslessly (the CC is 1), and its convergence is better than that of the DPR algorithm. Moreover, as the phase increases, the convergence speed is faster. The G-S algorithm and the SPR algorithm are error reduction algorithms. One simply transforms back and forth between the two domains, satisfying the constraints in one before returning to the other. During the iterations, nonlinear operations are used to enforce the constraints on the amplitude to obtain the phase. It is difficult to obtain the exact solution for this kind of nonlinear operation, and the Fourier transform from one function to another is a many-to-one mapping. The DPR algorithm and the MPR algorithm proposed are linear operations in the iterative process, and the exact solution can be obtained. We take the DPR algorithm as example since it is the simplest form of MPR algorithm.
In the DPR algorithm, we finally determine the phases  (14) and (15). In Equation (14), only the phase The phase 1 k i e φ ⋅ can also be obtained via the linear operation of Equations (16) and (17). In this way, we finally obtained the exact solution by means of this linear operation. The MPR algorithm is an The G-S algorithm and the SPR algorithm are error reduction algorithms. One simply transforms back and forth between the two domains, satisfying the constraints in one before returning to the other. During the iterations, nonlinear operations are used to enforce the constraints on the amplitude to obtain the phase. It is difficult to obtain the exact solution for this kind of nonlinear operation, and the Fourier transform from one function to another is a many-to-one mapping. The DPR algorithm and the MPR algorithm proposed are linear operations in the iterative process, and the exact solution can be obtained. We take the DPR algorithm as example since it is the simplest form of MPR algorithm.
In the DPR algorithm, we finally determine the phases e i·φ 1 and e i·φ 2 . The k-th iteration stops to obtain the phases e i·φ 1 = e i·φ k 1 and e i·φ 2 = e i·φ k 2 , which satisfy Equation (18). In the iteration, the phase e i·φ k 2 is determined by Equations (14) and (15). In Equation (14), only the phase e i·φ k 2 is unknown, and all other terms are known. Thus, we can obtain the phase e i·φ k 2 in Equation (15) via a linear operation. The phase e i·φ k 1 can also be obtained via the linear operation of Equations (16) and (17). In this way, we finally obtained the exact solution by means of this linear operation. The MPR algorithm is an extension of the DPR algorithm, which can also obtain exact solutions. However, such a solution is not unique, and is related to the selection of the initial random phase encoding. When the initial phase encodings selected each time are different, the determined solutions are also different. This property can improve image encryption security.

Security and Reliability
It is well-known that the existing attack schemes can be divided into chosen ciphertext attacks, chosen plaintext attacks, known plaintext attacks, and ciphertext only attacks. In Section 4, we noted that the solution of the proposed algorithm is not unique, and this property can effectively improve the security of the system. That is, even for the same image, the ciphertexts obtained by each encryption are different. Figure 18 shows the simulation results of two encryptions. The ciphertexts P1, P2, and P3 are obtained by the first encryption. During the second encryption, we select a new set of initial phase encodings, and obtain ciphertexts P11, P22, and P33. Our research shows that only the combination of ciphertexts (P1, P2, P3) and (P11, P22, P33) can recover the plaintext while other combinations, such as (P1, P22, P3) and (P11, P2, P33), cannot recover the plaintext information.
Entropy 2020, 22, x FOR PEER REVIEW 17 of 26 extension of the DPR algorithm, which can also obtain exact solutions. However, such a solution is not unique, and is related to the selection of the initial random phase encoding. When the initial phase encodings selected each time are different, the determined solutions are also different. This property can improve image encryption security.

Security and Reliability
It is well-known that the existing attack schemes can be divided into chosen ciphertext attacks, chosen plaintext attacks, known plaintext attacks, and ciphertext only attacks. In Section 4, we noted that the solution of the proposed algorithm is not unique, and this property can effectively improve the security of the system. That is, even for the same image, the ciphertexts obtained by each encryption are different. Figure 18 shows the simulation results of two encryptions. The ciphertexts P1, P2, and P3 are obtained by the first encryption. During the second encryption, we select a new set of initial phase encodings, and obtain ciphertexts P11, P22, and P33. Our research shows that only the combination of ciphertexts (P1, P2, P3) and (P11, P22, P33) can recover the plaintext while other combinations, such as (P1, P22, P3) and (P11, P2, P33), cannot recover the plaintext information. A histogram is a function of the distribution of image pixels, and reflects the frequency of each pixel. The histogram of the ciphertext tends to be evenly distributed, which means that the frequency of each pixel in the ciphertext is very close, which can better cover the distribution law of the image pixels, and ensure that the algorithm can effectively resist statistical attacks. The histograms of Figure  18b-d are shown in Figure 19. The pixels of the ciphertext are evenly distributed, which means that they can resist statistical attacks. A histogram is a function of the distribution of image pixels, and reflects the frequency of each pixel. The histogram of the ciphertext tends to be evenly distributed, which means that the frequency of each pixel in the ciphertext is very close, which can better cover the distribution law of the image pixels, and ensure that the algorithm can effectively resist statistical attacks. The histograms of Figure 18b-d are shown in Figure 19. The pixels of the ciphertext are evenly distributed, which means that they can resist statistical attacks. extension of the DPR algorithm, which can also obtain exact solutions. However, such a solution is not unique, and is related to the selection of the initial random phase encoding. When the initial phase encodings selected each time are different, the determined solutions are also different. This property can improve image encryption security.

Security and Reliability
It is well-known that the existing attack schemes can be divided into chosen ciphertext attacks, chosen plaintext attacks, known plaintext attacks, and ciphertext only attacks. In Section 4, we noted that the solution of the proposed algorithm is not unique, and this property can effectively improve the security of the system. That is, even for the same image, the ciphertexts obtained by each encryption are different. Figure 18 shows the simulation results of two encryptions. The ciphertexts P1, P2, and P3 are obtained by the first encryption. During the second encryption, we select a new set of initial phase encodings, and obtain ciphertexts P11, P22, and P33. Our research shows that only the combination of ciphertexts (P1, P2, P3) and (P11, P22, P33) can recover the plaintext while other combinations, such as (P1, P22, P3) and (P11, P2, P33), cannot recover the plaintext information. A histogram is a function of the distribution of image pixels, and reflects the frequency of each pixel. The histogram of the ciphertext tends to be evenly distributed, which means that the frequency of each pixel in the ciphertext is very close, which can better cover the distribution law of the image pixels, and ensure that the algorithm can effectively resist statistical attacks. The histograms of Figure  18b-d are shown in Figure 19. The pixels of the ciphertext are evenly distributed, which means that they can resist statistical attacks. Ciphertexts are often disturbed and lost during storage and transmission, thus, the reliability of the algorithm is particularly important. In Figure 20, we damage the ciphertexts, and then tried to recover the plaintext information from them. The recovery result is shown in Figure 20d. Even if the ciphertexts are damaged, the plaintext information can still be recovered by the proposed algorithm. Ciphertexts are often disturbed and lost during storage and transmission, thus, the reliability of the algorithm is particularly important. In Figure 20, we damage the ciphertexts, and then tried to recover the plaintext information from them. The recovery result is shown in Figure 20d. Even if the ciphertexts are damaged, the plaintext information can still be recovered by the proposed algorithm. As unnecessary or redundant interference information in image data, noise seriously affects the image quality. In Figure 21  As unnecessary or redundant interference information in image data, noise seriously affects the image quality. In Figure 21, we added Gaussian noise (mean m = 0, variance var = 0.01) to the original image (Figure 21a), and the result is shown in Figure 21b. We add salt and pepper noise (noise density d = 0.05) to the original image, and the result is shown in Figure 21c. After the original image is encrypted, the ciphertexts are shown in Figure 21d-f. When the three ciphertexts are interfered by Gaussian noise, the decryption result can identify the information of the original image, as shown in Figure 21g. When the three ciphertexts are interfered by salt and pepper noise, the decryption result is shown in Figure 21h. We can still identify the original image information from the decryption result. Ciphertexts are often disturbed and lost during storage and transmission, thus, the reliability of the algorithm is particularly important. In Figure 20, we damage the ciphertexts, and then tried to recover the plaintext information from them. The recovery result is shown in Figure 20d. Even if the ciphertexts are damaged, the plaintext information can still be recovered by the proposed algorithm. As unnecessary or redundant interference information in image data, noise seriously affects the image quality. In Figure 21

Multiple-Image Encryption
With the increasing speed of information exchange, single-image encryption has gradually become unable to meet practical needs. Therefore, multiple-image encryption technology has begun to attract attention. The traditional multiple-image encryption technology generally compresses multiple plaintexts into an image or superimposes multiple plaintexts into a composite image and then encrypts them. However, these methods have difficulties achieving optical system decryption. Here, we present a novel multiple-image encryption technology using the proposed algorithm. Our idea is shown in Figure 22. When the phase e i·φ 1 is placed separately in the system, the plaintext f 1 can be recovered. When phase e i·φ 1 and phase e i·φ 2 are placed in the system, the plaintext f 2 can be recovered. That is, as the phase increases, the recovered plaintext also increases. Finally, we can recover n plaintext images from n phase encodings.

Multiple-Image Encryption
With the increasing speed of information exchange, single-image encryption has gradually become unable to meet practical needs. Therefore, multiple-image encryption technology has begun to attract attention. The traditional multiple-image encryption technology generally compresses multiple plaintexts into an image or superimposes multiple plaintexts into a composite image and then encrypts them. However, these methods have difficulties achieving optical system decryption.
Here, we present a novel multiple-image encryption technology using the proposed algorithm. Our idea is shown in Figure 22. When the phase are placed in the system, the plaintext 2 f can be recovered. That is, as the phase increases, the recovered plaintext also increases. Finally, we can recover n plaintext images from n phase encodings. The CC is used to control the iteration process. When the k-th iteration meets certain conditions, the iteration stops and the system outputs the phase To encrypt n images, it is necessary to perform N-stage iterations, and the detailed flow chart is shown in Figure 23. In the first stage, the initial random phase e i·φ 0 1 is input and the plaintext image f 1 is encrypted.
The CC is used to control the iteration process. When the k-th iteration meets certain conditions, the iteration stops and the system outputs the phase e i·φ 1 = e i·φ k 1 (ciphertext). Then, the plaintext image f 1 can be obtained by Equation (26) as: In the second stage, the plaintext image f 2 is encrypted. The phase e i·φ 1 and phase e i·φ 0 2 (random phase encoding) are used as the initial inputs. The phase e i·φ 1 remains unchanged in the iteration process, and the phase e i·φ 2 = e i·φ k 2 is obtained when the iteration stops. The plaintext image f 2 can be obtained by Equation (27) as: In stage N, the plaintext image f n is encrypted. The phases e i·φ 1 , e i·φ 2 , · · · , e i·φ n−1 obtained in the previous N-1 stages remain unchanged as the initial phase while the initial random phase e i·φ 0 n is added. When the k-th iteration stops, the phase e i·φ n = e i·φ k n is obtained. Thus, the plaintext image f n can be obtained by Equation (28). f n = FrT z n FrT z n−1 · · · FrT z 2 FrT z 1 e i·φ 1 ·e i·φ 2 · · · ·e i·φ n .  The simulation verification of multiple-image encryption is shown in Figure 24. Four ciphertext images are obtained as shown in Figure 24a-d. We decrypt the ciphertext image (Figure 24a) to obtain the plaintext, as shown in Figure 24e. Figure 24f can be recovered from the ciphertexts of Figure 24a We have successfully recovered four plaintexts from the four ciphertexts. The numerical simulation verifies that the proposed multiple-image encryption scheme is feasible, which will allow it to provide new ideas for the application of phase retrieval algorithms.
The multiple-image encryption scheme proposed in this paper avoids the problem of crosstalk because each encryption process is carried out in succession, and each plaintext in the decryption process is obtained successively.

Discussion and Prospect
The G-S algorithm is also widely used in beam shaping and binary optical element design. To improve the diffraction efficiency, many improved G-S algorithms have been proposed [42][43][44]. The main principle is to change the Gaussian beam into the desired ideal beam. Our algorithm does not need input amplitude in image encryption, so it is applied to beam shaping without a wavefront function. For our algorithm, it can be understood as turning a parallel light into an ideal beam. The waveform function we want to obtain is shown in Figure 25a. After 200 iterations with the G-S algorithm, the result is shown in Figure 25b. There is still a certain gap between this result and our objective function. The SPR algorithm is applied to 200 iterations, and the result is shown in Figure  25c, which is better than that of the G-S algorithm. Compared with the modified G-S algorithms [45,46], the SPR algorithm also improves the convergence effect. Unfortunately, these algorithms are based on a nonlinear operation, so cannot obtain accurate solutions. Our DPR and MPR algorithms We have successfully recovered four plaintexts from the four ciphertexts. The numerical simulation verifies that the proposed multiple-image encryption scheme is feasible, which will allow it to provide new ideas for the application of phase retrieval algorithms.
The multiple-image encryption scheme proposed in this paper avoids the problem of crosstalk because each encryption process is carried out in succession, and each plaintext in the decryption process is obtained successively.

Discussion and Prospect
The G-S algorithm is also widely used in beam shaping and binary optical element design. To improve the diffraction efficiency, many improved G-S algorithms have been proposed [42][43][44]. The main principle is to change the Gaussian beam into the desired ideal beam. Our algorithm does not need input amplitude in image encryption, so it is applied to beam shaping without a wavefront function. For our algorithm, it can be understood as turning a parallel light into an ideal beam. The waveform function we want to obtain is shown in Figure 25a. After 200 iterations with the G-S algorithm, the result is shown in Figure 25b. There is still a certain gap between this result and our objective function. The SPR algorithm is applied to 200 iterations, and the result is shown in Figure 25c, which is better than that of the G-S algorithm. Compared with the modified G-S algorithms [45,46], the SPR algorithm also improves the convergence effect. Unfortunately, these algorithms are based on a nonlinear operation, so cannot obtain accurate solutions. Our DPR and MPR algorithms are linear iterative methods based on the G-S algorithm, which can obtain accurate solutions. When the DPR algorithm is applied, the result is shown in Figure 25d, which can accurately obtain the objective function. Figure 25e shows the comparison results of the G-S, SPR, and DPR algorithms.
are linear iterative methods based on the G-S algorithm, which can obtain accurate solutions. When the DPR algorithm is applied, the result is shown in Figure 25d, which can accurately obtain the objective function. Figure 25e shows the comparison results of the G-S, SPR, and DPR algorithms. The G-S algorithm is sensitive to the initial value, that is, the different initial phase selection has a significant impact on the results. When the initial phase is given a fixed value, the iterative results are shown in Figure 26a,b. Figure 26c,d shows the results obtained by selecting random initial phase iterations. Compared with the results in Figure 26, it can be clearly seen that the G-S algorithm is extremely sensitive to the initial phase, which directly affects the convergence effect. We use the same method to test the SPR algorithm, and the results are shown in Figure 27. It is found that the sensitivity of SPR algorithm to the initial phase is weaker.
relative intensity /a.u. The G-S algorithm is sensitive to the initial value, that is, the different initial phase selection has a significant impact on the results. When the initial phase is given a fixed value, the iterative results are shown in Figure 26a,b. Figure 26c,d shows the results obtained by selecting random initial phase iterations. Compared with the results in Figure 26, it can be clearly seen that the G-S algorithm is extremely sensitive to the initial phase, which directly affects the convergence effect. We use the same method to test the SPR algorithm, and the results are shown in Figure 27. It is found that the sensitivity of SPR algorithm to the initial phase is weaker. The G-S algorithm is applied to optical image encryption because its attributes can provide good security [47,48]. The initial phase is not used as the key of the system, so different initial phases can be selected for each encryption process, and different ciphertexts can be obtained. That is, a plaintext can have many different ciphertexts, which creates difficulties in cipher decoding. Our algorithm also has such a security property. relative intensity /a.u.
relative intensity /a.u. relative intensity /a.u.  The G-S algorithm is applied to optical image encryption because its attributes can provide good security [47,48]. The initial phase is not used as the key of the system, so different initial phases can be selected for each encryption process, and different ciphertexts can be obtained. That is, a plaintext can have many different ciphertexts, which creates difficulties in cipher decoding. Our algorithm also has such a security property. relative intensity /a.u.
relative intensity /a.u. relative intensity /a.u. The G-S algorithm is applied to optical image encryption because its attributes can provide good security [47,48]. The initial phase is not used as the key of the system, so different initial phases can be selected for each encryption process, and different ciphertexts can be obtained. That is, a plaintext can have many different ciphertexts, which creates difficulties in cipher decoding. Our algorithm also has such a security property.
The G-S algorithm has been used in optical cryptanalysis [49][50][51][52], but the result is not ideal because it cannot obtain the exact solution. The DPR and MPR algorithms proposed in this paper can obtain the exact solution, which clearly provides a powerful tool for optical cryptanalysis.
We have previously proposed a key distribution scheme for optical cryptography, which is also restricted by the convergence of the algorithm, and thus makes the result unsatisfactory [27]. The algorithm proposed in this paper provides an idea for key distribution.
At present, for secret image sharing, the resolution of the restored image is reduced due to sharing and the large size of the recovery image. This problem has been considered by researchers. However, the algorithms proposed in this paper can overcome this problem, which provides a new idea for secret image sharing. This is a topic that we will study next.

Conclusions
In this paper, we modify the G-S algorithm to propose the SPR, DPR, and MPR algorithms. We analyze the convergence of the proposed algorithms, and the results show that the SPR algorithm also has the same problem as the G-S algorithm. The convergence is slow in later iterations, its convergence stagnates, and only an approximate solution can be obtained. However, our analysis shows that the DPR and MPR algorithms have good convergence, can recover the plaintext without loss, and can obtain exact solutions. Furthermore, we analyzed the security and reliability of the proposed image encryption algorithm. Because different initial phase encodings can be selected for each encryption, different ciphertexts can be obtained, which improves the security of the algorithm. The reliability analysis shows that the plaintext can be recovered even if the ciphertexts are damaged. Finally, we present the multiple-image encryption scheme based on the proposed algorithm. The n plaintexts can be recovered from n ciphertexts, which greatly improves the efficiency of the system. The proposed DPR and MPR algorithms can obtain exact solutions, that is, they can recover information losslessly, which means they have an important reference value for the application of the algorithms.