Orthogonal frequency-division multiple passive optical network (OFDM-PON) has emerged as one of the most promising solutions to meet the requirements for the next-generation wide-band optical access network with high capacity, strong fiber dispersion tolerance, and flexible resource allocation. However, like other optical access network in which the downstream signal is broadcasted to all the optical network units (ONUs), OFDM-PON is vulnerable to being eavesdropped. Thus the security of OFDM-PON should be taken seriously into consideration. Recently, some chaos based encryption methods, including chaotic scrambling and permutation, hyper-chaotic system and fractional Fourier transformation, chaos based IQ encryption method and chaos based two-dimensional scrambling, have been proposed to enhance the physical layer security of OFDM-PON system. Owing to the special chaos-related characteristics, such as ergodicity, pseudo randomness, and high sensitivity to the initial values, etc., these encryption methods are of high physical layer security. However, in most of these schemes, key distribution is not considered. In this paper, we propose a three-dimensional encryption OFDM-PON based on dynamic chaos-iteration. The key distribution is implemented through the dynamic chaos synchronization between the transmitter and receiver. The receiver tries to synchronize his chaos system with the transmitters' by calculating the correlation index of the synchronization sequence, which comes from the transmitter and is controlled by dynamic parameters in the parameter sets. The calculation is not very complex because the transmitter and receiver are acquainted with the parameter sets. The synchronized chaos system is used to generate keys for both encryption and decryption. In the proposed encryption scheme, one ONU is connected with four users, and the message is irrelevant to the users. Quadrature amplitude modulation (QAM) symbols from the users are mapped randomly onto the subcarriers in a flame based on the chaotic matrix M1. For the M1 is changeable, the number and position of subcarriers for different users are dynamically varying. Then the matrix M2 generated from chaos system is utilized to mask all QAM symbols. Finally the QAM symbol matrix is multiplied by an invertible chaotic matrix M3 to realize subcarrier perturbation. These three key matrixes are generated from the two-dimension logistic iteration chaos system, to which the initial sensitivity increases up to 10-15. The output sequence of the chaos system after quantification process is of good self-correlation and cross-correlation characteristic and can pass all NIST SP800-22 randomness tests. The key space of the encryption scheme is over 1086, which would be against exhaustive attack effectively. Specifically, a proof-of-principle experiment is conducted to demonstrate the aforementioned proposed scheme. In the experiment, a 13.3 Gb/s encrypted 64QAM OFDM signal transmits over 25 km standard single mode fiber in an OFDM-PON and successfully decrypts at the legal receiver. For an eavesdropper lacking correct keys, the received QAM constellation is totally in disorder and the bit error rate increases up to 0.46, which indicates that not any useful message is eavesdropped. The proposed scheme provides a promising candidate for the next-generation secure optical access networks.