Cryptanalysis and Improvement of a Block Cipher Based on Multiple Chaotic Systems

Abstract

Wang and Yu proposed a block cipher scheme based on dynamic sequences generated by multiple chaotic systems, which overcomes the problem of periodical degradation on random sequences due to computational precision. Their scheme has a feature that a plaintext is encrypted by a keystream created from several one-dimensional chaotic maps. However, this feature results in some weaknesses of the encryption algorithm. We show three kinds of attacks in this paper, through which one can recover the plaintext from a given ciphertext without the secret key. We also present an improvement on their scheme, which prevents the three attacks mentioned above. Security of the enhanced cipher is presented and analyzed, which shows that our improved scheme is secure under the current attacks.

1. Introduction

Thechaos-based encryption scheme was first proposed in 1989 [1]. Following the work, a lot of cryptography researchers haveproposed many chaos-based encryption schemes (some of them are the improvements on the previous ones) [2–6]. Security of all these schemes relies on the properties of chaotic systems: the sensitive dependence on initial conditions and system parameters, pseudorandom property, nonperiodicity and topological transitivity.

There are two types of cipher schemes in the chaos-based cryptosystems: stream ciphers and block ciphers. In the chaotic stream ciphers [2, 7–9], a pseudorandom sequence is generated by chaotic sequence generator to encrypt the plaintext. However, the limited computational precision degrades the pseudorandom sequence to a periodic sequence eventually. The chaotic block ciphers adopt chaotic maps to generate parameters used in encryption and decryption procedures. Pareek has proposed two block ciphers based on external keys [10, 11]. But too much time consumption in computation makes them hard to implement in the real-time telecommunication.

Wang and Yu proposed a new block encryption scheme in [12] (the Wang-Yu scheme) by combining these two methods of chaotic cryptography. Their scheme provides not only good randomness but also high computational efficiency. In their scheme, several one-dimensional chaotic maps are used to generate pseudorandom sequences with independent and uniform distribution. Through a series of transformations, the sequences constitute a keystream randomly distributed in the key space. The keysteam is used to encrypt the plaintext by executing simple operations such as Exclusive-OR (XOR) and shifting repeatedly with sufficient rounds.

Generally speaking, a secure cipher is supposed to resist the following attacks: the chosen plaintext attacks (CPAs), the chosen ciphertext attacks (CCAs) and the known plaintext attacks (KPAs). Unfortunately, the Wang-Yu cipher cannot resist any of the above attacks because the keystream remains unchanged during the execution of the encryption procedure each time. Thus, for an attacker, knowing the keystream is equivalent to knowing the secret key.

Our Contributions
We point out the drawbacks of the Wang-Yu block cipher based on dynamic sequences generated by multiple chaotic systems. Their scheme is vulnerable to the following three kinds of attacks: the chosen plaintext attacks, the chosen ciphertext attacks, and the known plaintext attacks. In order to obtain a secure block cipher from chaotic systems, we make efforts to improve the Wang-Yu block cipher. We design a new block cipher which makes the keystream sensitive to any change of the plaintext and the ciphertext. Therefore, our new block cipher is able to resist the above attacks. On the other hand, our scheme preserves the high computational efficiency of the original one.

In Section 2, some essential notations and security definitions are introduced. In Section 3, the Wang-Yu block cipher is reviewed. In Section 4, we analyze the Wang-Yu scheme and show three different attacks to the scheme. In Section 5, an improved block cipher scheme is proposed. We analyze security and discuss the efficiency of the new scheme in Section 6. Finally, we conclude the paper in Section 7.

2. Preliminaries

2.1. Notations

We use the following notations: 𝑃: Plaintext,𝑃_𝑖:𝑖th plaintext block,𝐶: Ciphertext,𝐶_𝑖:ith ciphertext block,𝐿: Number of plaintext blocks,𝑟: Number of transformation rounds,𝑐(𝑙): Index of a chosen chaotic map,𝐵_𝑖^(𝑙): 64-bit temporary value in encryption/decryption transformation,𝑆_𝑖^𝑐(𝑙): 64-bit value generated by a chaotic map in the Wang-Yu scheme,𝑆_𝑖: Keystream of ith plaintext block in the Wang-Yu scheme,𝑆𝐾_𝑖^𝑐(𝑙): 64-bit value generated by a chaotic map in the improved scheme,𝑆𝐾_𝑖: Key stream of ith plaintext block in the improved scheme,𝑥_𝑗: A real number in (0,1) indexed by 𝑗.

2.2. Definitions and Security Notions

We review the definition of chaos and security notions for block cipher as follows.

Definition 2.1 (Chaos). Chaos is aperiodic time-asymptotic behaviour in a deterministic system which exhibits sensitive dependence on initial conditions.
This definition contains three main elements.
(1)Aperiodic time-asymptotic behaviour: this implies the existence of phase-space trajectories which do not settle down to fixed points or periodic orbits. For practical reasons, we insist that these trajectories are not too rare. We also require the trajectories to be bounded, that is, they should not go off to infinity. (2)Deterministic: this implies that the equations of motion of the system possess no random inputs. In other words, the irregular behaviour of the system arises from nonlinear dynamics and not from noisy driving forces. (3)Sensitive dependence on initial conditions: this implies that nearby trajectories in phase-space separate exponentially fast in time; that is, the system has a positive Lyapunov exponent.

Definition 2.2 (One-way function). A function 𝑓∶{0,1}^∗→{0,1}^∗ is one-way if 𝑓(⋅) can be computed by a polynomial time algorithm, but for every randomized polynomial time algorithm 𝒜, 1Pr[𝑓(𝒜(𝑓(𝑥)))=𝑓(𝑥)]<,𝑝(𝑛) (2.1) for every polynomial 𝑝(𝑛) and sufficiently large 𝑛, assuming that 𝑥 is chosen from the uniform distribution on {0,1}^𝑛.

Definition 2.3 (Block cipher). A symmetric key block cipher consists of two PPT algorithms (𝐸_𝑘(⋅),𝐷_𝑘(⋅)) with the following properties: for any random 𝑘∈_𝑅{0,1}^𝜅, the encryption algorithm on input 𝑚∈{0,1}^𝑛 and 𝑘, outputs a ciphertext 𝑐=𝐸_𝑘(𝑚); the decryption algorithm on input 𝑐 and 𝑘, outputs a plaintext 𝑚 if 𝑐=𝐸_𝑘(𝑚). For any 𝑘∈_𝑅{0,1}^𝜅 and 𝑚∈{0,1}^𝑛, correctness requires the following to be hold: 𝑚=𝐷_𝑘(𝐸_𝑘(𝑚)). (2.2)

Definition 2.4 (One-way CPA). Let 𝐸_𝑘(⋅) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is allowed to obtain the ciphertext of any message, cannot extract the plaintext from a challenge ciphertext, we say that 𝐸_𝑘(⋅) is one-way under the chosen plaintext attacks.

Definition 2.5 (One-way CCA). Let 𝐸_𝑘(⋅) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is allowed to obtain the plaintext of any ciphertext (except for the challenge ciphertext), cannot extract the plaintext from a challenge ciphertext, we say that 𝐸_𝑘(⋅) is one-way under the chosen ciphertext attacks.

Definition 2.6 (One-way KPA). Let 𝐸_𝑘(⋅) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is given a set of random plaintexts and corresponding ciphertexts (except for the challenge ciphertext), cannot extract the plaintext from a challenge ciphertext. We say that 𝐸_𝑘(⋅) is one-way under the known plaintext attacks.

3. Review of the Wang-Yu Block Cipher

3.1. Algorithm Description

In this section, we briefly review the block cipher proposed by Wang and Yu [12]. In their scheme, plaintext blocks are converted into ciphertext blocks after several round transformations with XOR and shift operations. A number of 64-bit binary strings as the keystreams are generated in such transformations.

Let us see how the keystream is generated. There are two tables in the Wang-Yu scheme. One table consists of four one-dimensional chaotic maps. The other called chaotic map set (CMS) includes initial values between 0 and 1, which are produced through a random number generator from a given secret key. At the beginning, one map is randomly chosen from the first table. An initial value is also chosen from the CMS table by certain rules. The chosen map is then iterated with the initial value for 64 times. Each time the map generates a new real number. If the new number is bigger than 0.5, we get 1 for the corresponding digit. Otherwise, we get 0. Eventually, we get a 64-bit binary string after 64 iterations.

3.2. Procedure in Detail

The Wang-Yu scheme is described as follows.(i)Encryption of 𝑃_𝑖∈{0,1}⁶⁴: 𝐶_𝑖=𝐸_𝑘(𝑃_𝑖).(1)Initialization: 𝐵_𝑖⁽⁰⁾=𝑃_𝑖; 𝑙=1; 𝑑=1; 𝑟∈_𝑅{0,1}^∗; CMS table←𝑘. Here, 𝑘∈_𝑅{0,1}⁶⁴ is the secret key of the block cipher.(2)𝑐(𝑙)∈_𝑅[0,3], 𝑥₀← value of 𝑐th column, 𝑑th row in the CMS table.(3)For 𝑗=1 to 64: (a)if 𝑐(𝑙)=0: 𝑥_𝑗=𝜇𝑥_𝑗−1(1−𝑥_𝑗−1);(b)if 𝑐(𝑙)=1: 𝑥_𝑗=𝜇sin(𝜋𝑥_𝑗−1); (c)if 𝑐(𝑙)=2: 𝑥_𝑗=𝜇cos(𝜋|𝑥_𝑗−1−0.5|); (d)if 𝑐(𝑙)=3: 𝑥_𝑗=1−𝜇|𝑥_𝑗−1−0.5|. (4)For 𝑗=1 to 64: 𝑠_𝑗=1,𝑥_𝑗⩾𝑥,0,𝑥_𝑗<𝑥, (3.1) where 𝑥=0.5. The keystream is 𝑆_𝑖^𝑐(𝑙)=𝑠₁𝑠₂⋯𝑠₆₄. (5)Encryption transformation: 𝐵_𝑖^(2𝑙−1)=𝐵_𝑖^(2𝑙−2)⊕𝑆_𝑖^𝑐(𝑙),𝐵_𝑖^(2𝑙)=𝐵_𝑖^(2𝑙−1)≪16bits. (3.2)(6)If 𝑙=𝑟, go to step (7); else 𝑙←𝑙+1; 𝑑←𝑑+1; goto step (2). (7)𝐶_𝑖=𝐵_𝑖^(2𝑙). Here, the operation “𝑥≪𝑦” represents a cyclic left shift of 𝑥 by 𝑦 bits.(ii)Decryption of 𝐶_𝑖∈{0,1}⁶⁴: 𝑃_𝑖=𝐷_𝑘(𝐶_𝑖).

Parameter and keystream generations here are the same as those in the encryption. The only difference is that the equations in step (5) should be replaced by 𝐵_𝑖^(2𝑙−1)=𝐵_𝑖^(2𝑙)𝐵≫16bits,_{𝑖(2𝑙−2)}=𝐵_𝑖^(2𝑙−1)⊕𝑆_𝑖^𝑐(𝑙). (3.3) Here, the operation “𝑥≫𝑦” represents a cyclic right shift of 𝑥 by 𝑦 bits.

3.3. Weaknesses of the Scheme

A keystream 𝑆_𝑖=(𝑆_𝑖^𝑐(1),𝑆_𝑖^𝑐(2),…,𝑆_𝑖^𝑐(𝑟)) in the Wang-Yu scheme is generated by a certain secret key 𝑘. Then it is used to encrypt the plaintext according to the following rule: 𝐶_𝑖=𝐸_𝑆𝑖(𝑃_𝑖),for𝑖=1,…,𝐿. (3.4) Decryption of a ciphertext block 𝐶_𝑖 can be accomplished by calculating the corresponding keystream 𝑆_𝑖 if the key is given and doing the reverse operations of encryption 𝐸_𝑆𝑖(⋅). However, the block cipher is not secure because some problems occur in their keystream generation and the encryption algorithm. Exactly, if we know the keystream 𝑆_𝑖, we can recover the plaintext of a given ciphertext without the secret key.

In the next section we will show how to recover the keystream under the chosen plaintext attack, the chosen ciphertext attack and the known plaintext attack, respectively. We note that knowing the keystream 𝑆_𝑖 generated by a certain secret key is equivalent to knowing the key indeed [3].

4. Cryptanalysis of the Wang-Yu Block Cipher

With the help of the keystream 𝑆_𝑖, we can recover the plaintext from a given ciphertext. Therefore, the following attacks focus on recovering the keystream 𝑆_𝑖. Suppose that we have a challenge ciphertext 𝐶 composed by 𝐶_𝑖 (𝑖=1,2,…,𝐿) to “decrypt” without the secret key. We shall calculate the keystream 𝑆_𝑖 by launching one of the attacks described later.

The encryption transformation can be described as follows: 𝐵_𝑖⁽⁰⁾=𝑃_𝑖,𝐵_𝑖⁽¹⁾=𝐵_𝑖⁽⁰⁾⊕𝑆_𝑖^𝑐(1),𝐵_𝑖⁽²⁾=𝐵_𝑖⁽¹⁾𝐵≪16bits,_𝑖(3)=𝐵_𝑖⁽²⁾⊕𝑆_𝑖^𝑐(2),𝐵_𝑖⁽⁴⁾=𝐵_𝑖⁽³⁾⋮𝐵≪16bits,_{𝑖(2𝑟−1)}=𝐵_𝑖^(2𝑟−2)⊕𝑆_𝑖^𝑐(𝑟),𝐵_𝑖^(2𝑟)=𝐵_𝑖^(2𝑟−1)𝐵≪16bits,_𝑖(2𝑟)=𝐶_𝑖. (4.1) For simplicity, the encryption procedure is described as follows:𝐶_𝑖=𝐸_𝑆𝑖(𝑃_𝑖)=(𝑃_𝑖≪16bits)^𝑟⊕𝑆_𝑖,for𝑖=1,…,𝐿, (4.2) where 𝑆_𝑖=((((𝑆_𝑖^𝑐(1)≪16bits)⊕𝑆_𝑖^𝑐(2))≪16bits)⋯⊕𝑆_𝑖^𝑐(𝑟))≪16bits. The operation (𝑓)^𝑟 represents that the action of 𝑓 is repeated 𝑟 times.

Since the keystream does not change for every plaintext blocks, we can get it from a given plaintext block and a corresponding ciphertext block. Then we can use it to recover the plaintexts from other ciphertexts. A plaintext block 𝑃_𝑖 can be recovered by using the known keystream 𝑆_𝑖 and a given ciphertext block 𝐶_𝑖 as follows:𝑃_𝑖=𝐷_𝑆𝑖(𝐶_𝑖)=((𝑆_𝑖⊕𝐶_𝑖)≫16bits)^𝑟,for𝑖=1,…,𝐿. (4.3) Then, we can recover the plaintexts without the secret key. The following explains how to recover the plaintexts under three different attacks.

4.1. How to Recover the Plaintext under CPA

Suppose that we have obtained temporary access to the encryption machine. Given index 𝑖 and a special plaintext block 𝑀_𝑖, where 𝑀_𝑖=(000⋯0)₆₄(the ciphertext block also consists of 64 bits), we can obtain the ciphertext block 𝐷_𝑖 of the plaintext block 𝑀_𝑖=(000⋯0)₆₄ from the encryption machine.

So, the keystream 𝑆_𝑖 can be generated from 𝑀_𝑖 and 𝐷_𝑖:𝑆_𝑖=𝐷_𝑖⊕(𝑀_𝑖≪16bits)^𝑟=𝐷_𝑖,for𝑖=1,2,…,𝐿. (4.4)

The recovered plaintext block can be obtained using the keystream 𝑆_𝑖 and the ciphertext block 𝐶_𝑖 as follows:𝑃_𝑖=((𝑆_𝑖⊕𝐶_𝑖)≫16bits)^𝑟,for𝑖=1,2,…,𝐿. (4.5)

The flowchart of this attack is given in Figure 1, and Figure 2 shows the simulation results of the chosen plaintext attack on a ciphered image of size 256×256.

Figure 1 

Flowchart of chosen plaintext attacks.

(a)

(b)

(c)

(d)

Figure 2 

Results of the CPA: (a) the original image $P$; (b) ciphered image $C$ of $P$; (c) ciphered image of $M$ = 0000; (d) recovered image.

4.2. How to Recover the Plaintext under CCA

Assume that we have obtained temporary access to the decryption machine. Given index 𝑖 and a special ciphertext block 𝐷_𝑖, where 𝐷_𝑖=(000⋯0)₆₄(the challenge ciphertext block also consists of 64 bits), we can obtain the plaintext block 𝑀_𝑖 of the ciphertext block 𝐷_𝑖=(000⋯0)₆₄ from the decryption machine. The keystream 𝑆_𝑖 can be generated from 𝑀_𝑖 and 𝐷_𝑖 by𝑆_𝑖=𝐷_𝑖⊕(𝑀_𝑖≪16bits)^𝑟=(𝑀_𝑖≪16bits)^𝑟,for𝑖=1,2,…,𝐿. (4.6)

The recovered plaintext block can be obtained by using the keystream 𝑆_𝑖 and the ciphertext block 𝐶_𝑖 as follows:𝑃_𝑖=((𝑆_𝑖⊕𝐶_𝑖)≫16bits)^𝑟,for𝑖=1,2,…,𝐿. (4.7)

The flowchart of this attack is given in Figure 3. Simulation results of a chosen ciphertext attack on a ciphered image of size 512×512 are given in Figure 4.

Figure 3 

Flowchart of chosen ciphertext attacks.

(a)

(b)

(c)

(d)

Figure 4 

Results of the CCA: (a) the original image $P$; (b) ciphered image $C$ of $P$; (c) plain image of the ciphered image $D$ = 0000; (d) recovered image.

4.3. How to Recover the Plaintext under KPA

The knowledge of one plaintext block and its corresponding ciphertext block with the same length leads to potential damage of privacy for the cryptosystems. We know that given a plaintext block 𝑀_𝑖 and its corresponding ciphertext block 𝐷_𝑖, the keystream can be computed as follows:𝑆_𝑖=(𝑀_𝑖≪16bits)^𝑟⊕𝐷_𝑖,for𝑖=1,2,…,𝐿. (4.8)

The recovered plaintext block can be obtained by using the keystream 𝑆_𝑖 and the ciphertext block 𝐶_𝑖 as follows:𝑃_𝑖=((𝑆_𝑖⊕𝐶_𝑖)≫16bits)^𝑟,for𝑖=1,2,…,𝐿. (4.9)

The flowchart of this attack is given in Figure 5 and Figure 6 shows a recovered Lena image from the ciphertext by the known plaintext attack using a known pair of plaintext/ciphertext of Jet.

Figure 5 

Flowchart of known plaintext attacks.

(a)

(b)

(c)

(d)

(e)

Figure 6 

Results of the KPA: (a) the original image $P$; (b) ciphered image $C$ of $P$; (c) plain image $M$; (d) ciphered image $D$ of $M$; (e) recovered image from $C$.

Therefore, we can draw the following conclusion from the above three attacks.

Theorem 4.1. The Wang-Yu block cipher is not secure (i.e., not one-way) under any of the following attacks: the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks.

5. Improvement

The ciphertext is independent from the keystream, which makes the encryption algorithm presented in [12] vulnerable to the above attacks. To enable the block cipher to be secure against the above attacks, a reasonable solution is shown. Actually, the ciphertext is sensitive to the change of the keystream and the plaintext in our improvement, which results in a cipher with enhanced security. In this section, we present the modification as follows. (i)Encryption of 𝑃_𝑖∈{0,1}⁶⁴: 𝐶_𝑖=𝐸_𝑘(𝑃_𝑖).(1)Initialization: 𝐵_𝑖⁽⁰⁾=𝑃_𝑖; 𝑙=1; 𝑟∈_𝑅{0,1}^∗; CMS table←𝑘; 𝑃₀=1; 𝐶₀=1. Here, 𝑘∈_𝑅{0,1}⁶⁴ is the secret key of the block cipher.(2)𝑐(𝑙)∈_𝑅[0,3], 𝑑=(𝑃_𝑖−1⊕𝐶_𝑖−1)mod128, 𝑥₀← value of 𝑐th column, 𝑑th row in the CMS table.(3)For 𝑗=1 to 64: (a)if 𝑐(𝑙)=0: 𝑥_𝑗=𝜇𝑥_𝑗−1(1−𝑥_𝑗−1); (b)if 𝑐(𝑙)=1: 𝑥_𝑗=𝜇sin(𝜋𝑥_𝑗−1); (c)if 𝑐(𝑙)=2: 𝑥_𝑗=𝜇cos(𝜋|𝑥_𝑗−1−0.5|);(d)if 𝑐(𝑙)=3: 𝑥_𝑗=1−𝜇|𝑥_𝑗−1−0.5|. (4)For 𝑗=1 to 64: 𝑠_𝑗=1,𝑥_𝑗⩾𝑥,0,𝑥_𝑗<𝑥, (5.1) where 𝑥=0.5. The keystream is 𝑆𝐾_𝑖^𝑐(𝑙)=𝑠₁𝑠₂⋯𝑠₆₄. (5)Encryption transformation: 𝐵_𝑖^(2𝑙−1)=𝐵_𝑖^(2𝑙−2)⊕𝑆𝐾_𝑖^𝑐(𝑙),𝐵_𝑖^(2𝑙)=𝐵_𝑖^(2𝑙−1)≪16bits. (5.2)(6)If 𝑙=𝑟, goto step (7); else 𝑙←𝑙+1; 𝑑←𝑑+1; goto step (2). (7)𝐶_𝑖=𝐵_𝑖^(2𝑙).(ii)Decryption of 𝐶_𝑖∈{0,1}⁶⁴: 𝑃_𝑖=𝐷_𝑘(𝐶_𝑖)

Parameter and keystream generations here are the same as those in the encryption. The only difference is that the equations in step (5) should be replaced by 𝐵_𝑖^(2𝑙−1)=𝐵_𝑖^(2𝑙)𝐵≫16bits,_{𝑖(2𝑙−2)}=𝐵_𝑖^(2𝑙−1)⊕𝑆𝐾_𝑖^𝑐(𝑙). (5.3)

6. Security and Efficiency of the Improved Scheme

The block cipher algorithm in [12] is not secure since its keystream is reused each time, which makes the keystream easy to recover. Our proposed version of the scheme is designed in a PCBC (Propagating Cipher Block Chaining) mode [13]. Through this mode, an attacker cannot discover the relationship among the keystream, the plaintext and the ciphertext. In order to show that our improved cipher is secure, we consider the three kinds of attacks described previously to recover the keystream in our scheme. As a result, we find that the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks all fail if the encryption algorithm and the decryption algorithm follow our proposal.

Moreover, the described attacks are harmless for the enhanced scheme. We assume that 𝑆𝐾_𝑖 is the keystream used in the encryption of 𝑖th block. The keystream 𝑆𝐾_𝑖 is computed as follows:𝑆𝐾_𝑖=H_𝑘(𝑃_𝑖−1,𝐶_𝑖−1),for𝑖=1,2,…,𝐿. (6.1) Here, 𝑃_𝑖−1 and 𝐶_𝑖−1 are the plaintext block and the ciphertext block with index 𝑖−1, respectively; H_𝑘() is a one-way function from chaotic map iterations. Obviously, even if an attacker knows 𝑃_𝑖−1 and 𝐶_𝑖−1, he cannot get 𝑆𝐾_𝑖 without the secret key.

Meanwhile, the above attacks cannot break our scheme since breaking the cipher is equivalent to knowing 𝑆𝐾_𝑖. However, knowing 𝑆𝐾_𝑖 is impossible in our proposal. Thus, the algorithm is secure against the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks.

In our scheme, one XOR and one MOD operations are added in the encryption of a plaintext block. The overload of the improved scheme does not influence the efficiency, compared with the Wang-Yu scheme. But our improved scheme achieves a high level of security.

The simulation for the proposed scheme is implemented in Matlab 7.0. Performance is measured on a 2.0 GHz Pentium Dual-Core with 1 GB RAM running Windows XP. The simulation results show that the average running speed of the Wang-Yu cipher and that of our improved cipher are 20.46 MB/s and 19.54 MB/s, respectively.

7. Conclusions

In this paper, three kinds of attacks are presented to break a recently proposed block cipher based on multiple chaotic systems. We show that the reuse of the keystream during the encryption iteration makes the Wang-Yu scheme insecure against the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks. To enhance the security, we introduce a new method by updating the keystream in a way sensitive to the plaintext and the ciphertext.

Chaotic system is distinguished by its ergodicity and sensitivity to initial conditions and system parameters. These attributes allow the chaotic time series to be a promising alternative to the conventional cryptographic algorithms and image processing [14–21]. Fractal time series is distributed in a more random pattern than chaos time series does, due to the nondeterministic characteristic. Fractal time series differs from the conventional time series in the statistic properties [22–24]. Many open problems exist in this research area such as stationarity test problem [25], power spectrum problem [26, 27] and bound problem [28]. We are looking for possible ways to apply fractal time series to stochastic number simulation in cryptographic research.

Acknowledgment

This work has been supported by the Major Research plan of the National Natural Science Foundation of China (Grant no. 90718041), the National Natural Science Foundation of China (Grant nos. 10771072, 60703004 and 60873217), and the Research Fund for the Doctoral Program of Higher Education of China (Grant no. 20070269005).