Abstract

A novel chaos-based image encryption scheme has been proposed recently. In this scheme, redundancies of the Fridrich’s structure were reduced significantly via a new circular inter-intra-pixels bit-level permutation strategy. However, we proved that the original encryption scheme is vulnerable to the known/chosen-plaintext attacks. Both the permutation and diffusion phases have been improved to enhance the security of the original scheme. By shifting each row of the plain image randomly, known-plaintext attacks could be resisted. Furthermore, by appending double crossover diffusion to the end of the original scheme, chosen-plaintext attacks lost their efficacies. Simulation results demonstrated that the improved encryption scheme outperforms the original one.

1. Introduction

With the development of Internet technology, image data has been widely applied in many fields, such as military systems, government agencies, medical imaging systems, and online trade and business. However, digital images are also vulnerable to security risks; that is, sensitive information can be destroyed in the case of unauthorized access, such as interception, tampering, illegal copy, and dissemination. Encryption is a widely employed tool to minimize the potential security risks. However, in most cases, traditional encryption techniques, such as DES, RSA, AES, and IDEA, are specifically made for text data. For image data with different intrinsic characteristics, such as large data storage requirements, high redundancy, and strong correlation among adjacent pixels [1, 2], traditional encryption techniques demonstrate limited performance at best. Therefore, chaos-based image encryption schemes have been developed specifically for images. Benefiting from the inherent properties of chaotic sequences, such as ergodicity, pseudo-randomness, and sensitivity to initial conditions and control parameters [3], these chaos-based image encryption schemes have exhibited excellent properties, including complexity, security, and computational efficiency.

To date, a variety of chaos-based schemes have been proposed. However, most [4–6] are based on Fridrich’s permutation-substitution model [7] and demonstrate statistical correlations among the plain image, the cipher image, and the key. Previous studies [8, 9] proved that 96.7% of the bit values were unchanged using Fridrich’s encryption structure. To reduce redundancy and statistical links, many bit-level-based techniques have been proposed [10–16]. However, these techniques also have some limitations. For example, the permutation phase has repetitive patterns [14] and the operations require significant computation time [15, 16]. In 2016, Diaconu proposed a circular inter-intra-pixels bit-level permutation-confusion strategy [17]. This strategy takes advantage of Fridrich’s structure; however, employing the confusion strategy reduces the redundancy significantly. Bit-level circular shifting of each row demonstrates three strong characteristics, that is, no repetitive patterns, uniform bits distribution, and reduced correlation between adjacent higher bit-planes.

To improve the security of existing cryptosystems, many cryptanalytic methods have been proposed [18, 19]. Such processes can render the existing cryptographic mechanisms insecure. In this study, we assessed Diaconu’s strategy [17] and found a dangerous vulnerability in the circular shift procedure. In addition, the secret matrix, that is, the equivalent of the keys, can be revealed through known-plaintext attacks. To overcome these security problems, we propose two improvements/changes to the scheme; that is, we improve the permutation phase to resist known-plaintext attacks and improve the diffusion phase to resist chosen-plaintext and differential attacks [20], respectively.

The remainder of this paper is organized as follows. Section 2 presents an overview of Diaconu’s encryption scheme [17]. Section 3 discusses cryptanalysis using a known-plaintext attack. Improvements to the original algorithm are described in Section 4. Simulation results are provided and they are evaluated in Section 5, and the conclusions are presented in Section 6.

2. Original Encryption Scheme

In this section, we describe the original scheme, which is composed of permutation and diffusion phases. The permutation phase scrambles pixels by bit-level circular shift, which updates the pixel positions and generates new pixel values. In the diffusion phase, the permutated image is encrypted using two ciphering matrices.

2.1. Permutation

Here, let denote a grayscale plain image, and let be the th row of .

The permutation phase is performed as follows.

Step 1. Decompose into a vector as follows:where the function dec2bin converts the decimal number to a binary number.

Step 2. Compute the circular shift steps and direction of each row.where is the number of 1s of each row.Each vector is right circular-shifted with steps if equals 0 and left circular-shifted if equals 1.

Step 3. Each group of 8 bits of vector is converted to a decimal number step by step; thus, the permuted image can be obtained:where denotes the th row of the permuted image and the function bin2dec converts the binary number to a decimal number.

2.2. Diffusion

The final cipher image is obtained as follows.

For each row ,and for each column , where symbol represents a bitwise XOR operation, and and are two ciphering matrices.

2.3. Computing Ciphering Matrices

Two ciphering matrices are computed by the pseudorandom number generator PRNG (8), which has been proven to have attractor’s fractal structure, ergodicity, and an enormous key space [24]. where , are the control parameters, , are the initial values, and , can be generated by the following equation:A chaotic sequence of size can be generated using (8) and (9). Then, the sequence is discretized into dibits by using four thresholds. The high and low bits of all dibits are arranged in two vectors and , respectively.

In [17], , , , and ; thus, the key is denoted as .

Based on the definition above, two ciphering matrices are obtained as follows.

Step 1. Initialize

Step 2. For and (a)take eight consecutive bits separately from and in turn, (b)get the element of the th row and th column,(c)update the variable ,

3. Cryptanalysis of the Original Scheme

The original algorithm proposed circular inter-intra-pixels bit-level permutation. Within this algorithm, the chaotic map is highly sensitive to the four parameters and a large key space can be obtained. However, the circular shift process has a dangerous vulnerability.

Equations (6) and (7) can be transformed into the following expressions:

According to Kerckhoff’s principle, the security of a cryptosystem should only depend on the secrecy of the key; that is, everything else in the system can be public knowledge. In other words, the original scheme is assumed to be known, but the key is unknown. Obviously, it is nearly impossible to obtain the key used in Section 2.3. Fortunately, the chaotic secret matrix in (14) is unchanged if the key is fixed. Thus, our goal is to obtain this matrix, which can be realized by a known-plaintext attack.

Known-plaintext attacks assume that the plaintext and corresponding cipher are known. If a known-plaintext attack is used to break the original scheme, we must first obtain the scrambled image of a known plain image. Fortunately, the scrambled image can be computed easily by circular shifting.

Here, consider a known plain image , whose corresponding scrambled image and cipher image are and , respectively. The scrambled image can be computed easily using the procedure described in Section 2.1. With the cipher image and the computed , the secret matrix can be obtained using because

If the secret matrix is available, any given cipher image to be decrypted can be restored into the scrambled image . Since the number of 1s in each row of the scrambled image is the same as that of the plain image, the permutation can be reversed easily, and the deciphering image can be obtained.

The steps of a known-plaintext attack are as follows.

Step 1. Obtain the secret matrix.

Step  1.1. Calculate (Section 2.1) with the known plain image .

Step  1.2. Obtain the secret matrix using (16).

Step 2. Decrypt the given cipher image.

Step  2.1. With the given cipher image , calculate the scrambled image using (17).

Step  2.2. Obtain the deciphering image by applying the opposite circular shift to ; that is, if , then each row of should be left circular-shifted, and if , then each row of should be right circular-shifted.

To further demonstrate this idea, experimental results are shown in Figures 1 and 2. Figure 1 illustrates how to obtain the secret matrix. Assume that a known plain image is Lena (Figure 1(a)). The cipher image corresponding to Figure 1(a) is shown in Figure 1(b). The circular-shifted image, that is, the permutated image , is shown in Figure 1(c). The secret matrix computed by (16) is shown in Figure 1(d). The deciphering process of the given cipher image is shown in Figure 2. Here, Figure 2(a) is the plain image and its corresponding cipher image to be deciphered is shown in Figure 2(b). The scrambled image, which is obtained by an XOR operation between the secret matrix (Figure 1(d)) and the cipher image (Figure 2(b)), is shown in Figure 2(c). Then, after inverse circular shifting, the deciphering image is obtained which is shown in Figure 2(d). Note that the deciphering image is the same as the plain image.

(a)

(b)

(c)

(d)

(a)
(b)
(c)
(d)

Figure 1 

Step of a known-plaintext attack: (a) known plain image; (b) cipher image corresponding to (a); (c) scrambled image corresponding to (a); and (d) secret matrix.

(a)

(b)

(c)

(d)

(a)
(b)
(c)
(d)

Figure 2 

Step of a known-plaintext attack: (a) plain image; (b) cipher image corresponding to (a); (c) scrambled image retrieved from (b); and (d) deciphering image of (b).

4. Analysis, Discussion, and Improvement

4.1. Improving Permutation

4.1.1. Vulnerability to Known-Plaintext Attack

In the original scheme, the shift steps and direction are decided by the number of 1s of each row. After permutation, the number of 1s of each row remains unchanged. Therefore, the scrambled image for any known plain image can be computed, which is the primary vulnerability of the original encryption scheme.

4.1.2. Improvement

Randomizing the shift steps and direction of each row can remove this vulnerability. Here, a secret sequence must be introduced to satisfy this requirement. For simplicity, the chaos map based on (8) and (9) is used. If the plain image has rows, the number of pairs of steps and directions is . The permutation phase is improved as follows.

First, a random sequence of length is generated by iterations, where the parameter is computed by (18) and is the bits of each row of the plain image.

Then, the sequence is discretized into dibits using four thresholds. The high and low bits of the dibits are arranged into vectors and , separately.

Assume that denotes the shift direction (left or right) and denotes the steps of shift. Based on the definition above, the two vectors can be computed as follows.

Step 1. Initialize the vectors and and the counter variable ,

Step 2. (a) Take consecutive bits separately from and in turn,(b) Obtain the th pair of elements of the vectors and , (c) Update the variable ,

The permutation process is similar to the process described in Section 2.1. Here, vector is right circular-shifted with steps if equals 0 and left circular-shifted if equals 1.

Since the scrambled image cannot be computed directly from the plain image, the known-plaintext attack would not break the original encryption scheme. However, the following analysis shows that it is insufficient to improve the permutation phase solely.

4.2. Improving Diffusion

4.2.1. Vulnerability to Chosen-Plaintext Attack

After improving permutation, there are two secret sequences. One sequence generates the matrix used in the diffusion phase and the other generates and used in the permutation phase. Compared to the original algorithm, security is increased; however, the improved encryption scheme can still be broken by a chosen-plaintext attack.

If is a matrix where all elements are zero, the permutation phase has no influence on the . Then, the encrypted image can be expressed as follows:

Here, we find that the secret matrix is equal to the encryption output . Next, random vectors and used in the permutation phase can be computed by using a matrix , which is defined as follows:

The cipher and scrambled images corresponding to are denoted as in (25) and , respectively:The secret matrix is calculated based on (23). Then, we obtain the scrambled image by applying an XOR operation between the cipher image and the secret matrix .

By transforming each element of into an 8-bit binary number, we can obtain a matrix of size , which has only one “1” in each row. Note that we must obtain the column position of “1.” For example, if the element “1” in the th row is located at the th column, we can conclude that the th row of has been right circular-shifted with steps. Assume that all the shift steps are saved in a vector , where can be obtained easily.

The deciphering steps are described as follows.

Step 1. Obtain via the chosen plain image .

Step 2. Obtain the scrambled image by an XOR operation between and based on (17).

Step 3. Obtain the permutation steps vector using the chosen plain image .

Step 4. Perform opposite circular shift on ; that is, the th row of the scrambled image is circularly shifted towards the left direction with steps.

4.2.2. Improvement

The deciphering algorithm (Section 4.2.1) is performed successfully because it is easy to calculate the secret matrix . If we design a method to prevent an attacker from obtaining this matrix, the encryption would be secure. Therefore, the diffusion phase should also be improved. An operation, called double crossover diffusion (DCD) [20], is added to the end of the original scheme.

Assume that is a stretched vector of cipher image . The DCD mechanism requires a random sequence, which is generated by the logistic map.If parameter is chosen in the range and the initial value is in the range , the system is in a chaotic state. We can run the logistic map from to generate a chaotic sequence . Then, by sorting this vector, a vector is obtained, where is the th largest element of the chaotic sequence .

The general structure of the improved procedure is presented in Algorithms 1 and 2. As shown in Algorithm 1, the cipher image is first reshaped to a vector and ordered by random sequence . As shown in Algorithm 2, the sorted vector is divided into two blocks and encrypted sequentially by the left and right parts. The key vector in one block (Algorithm 2) is connected to the vector and the prior encrypted pixels of the other block.

5. Performance of the Improved Cryptosystem

This section presents experimental results and analyzes the performance of the improved cryptosystem. Here, we obtained plain images from the USC-SIPI image database [25]. Note that images of other sizes can also be encrypted effectively by the proposed algorithm. The PRNG parameters are , , , and . The logistic map parameters are and . However, the parameter in crossover diffusion is 52, which is not considered as the key in this paper. Thus, there are six parameters in the key vector , where , , are the control parameters and , , are the initial parameters. All experiments were implemented by using MATLAB R2010b and were executed on a personal computer (Intel Core i5-5300U 2.3 GHz CPU, 4 GB memory).

5.1. Security

5.1.1. Key Space

Key space is a significant index to measure the ability to resist brute-force attacks and an effective key space must contain very large and unique keys. Considering the type of PRNG and the logistic map, the six parameters can be expressed by double-real precision (15 decimals). Thus, the key space can achieve , which is nearly 299 bits. As a result, the size of the key space in the improved algorithm is sufficient to resist exhaustive attacks.

5.1.2. Key Sensitivity

An important security indicator for an image encryption system is the sensitivity to the key; that is, small changes to the key lead to significant changes in the cipher image. Assume that a new key can be obtained by transforming (adding 10⁻¹⁵ to and leaving the other parameters unchanged). Figures 3 and 4 represent the improved algorithm’s sensitivity to the key. The contrasts before and after adding 10⁻¹⁵ to are presented in Figure 3, and it shows that small changes to the key generate an entirely different cipher images. Figure 4 shows that a correct secret key can achieve a completely accurate decryption, while a key with a small change cannot.

(a)

(b)

(c)

(a)
(b)
(c)

Figure 3 

Sensitivity to small changes in the key: (a) image encrypted by key ; (b) image encrypted by key ; and (c) difference image between (a) and (b).

(a)

(b)

(c)

(a)
(b)
(c)

Figure 4 

Image decryption using correct and incorrect keys: (a) image encrypted by key ; (b) deciphering image by correct key ; and (c) deciphering image by incorrect key .

Likewise, let and represent two cipher images using different keys (the initial key) and (adding 10⁻¹⁵ to ). To evaluate quantitatively the sensitivity to the key, the percentage of different pixels of the two cipher images is computed. Simulation results are shown in Table 1. As shown in Table 1, over 99.5% of the pixels of one encrypted image differ from the pixels of the other image. Thus, the improved encryption scheme is highly sensitive to the secret key.

5.1.3. Differential Attack Analysis

The ability to resist differential attacks depends on the “sensitivity to the changes” in plain image. Stronger sensitivity affords greater resistance to differential attacks. Let denote a plain image. After selecting a pixel of this plain image randomly and flipping its least significant bit, we can obtain a new plain image . The corresponding cipher images are and , respectively. To represent the sensitivity of the encryption scheme to plain image, two parameters, the Number of Pixels Change Rate (NPCR) and the Unified Average Changing Intensity (UACI), are introduced and defined by where is the bits of the pixels and and represent the width and height of the test images, respectively. If is equal to , then ; otherwise, . Ideal NPCR and UACI values can be calculated by the following equations, respectively.