Source-linked AI summary
On the security defects of an image encryption scheme
Chengqing Li, Shujun Li, Muhammad Asim, Juana Nunez, Gonzalo Alvarez, Guanrong Chen
TL;DR
The paper investigates whether a recently proposed chaos-based image encryption scheme is secure. Through theoretical and experimental cryptanalysis, it identifies key-space defects and attacks that recover subkeys or visual information under limited plaintext exposure. The scheme is particularly vulnerable in several settings involving small or not-too-large K10.
Problem
The paper addresses security weaknesses in a chaos-based image encryption scheme, including defective keys and vulnerability to plaintext-based attacks.
Method
The paper performs comprehensive theoretical and experimental cryptanalysis of the scheme, examining its key structure and chosen- and known-plaintext attack surfaces.
Results
The analysis finds invalid, weak, and partially equivalent keys; K10 can be guessed with reduced complexity; up to 128 chosen plain-images may recover part of the key; and one known plain-image can reveal visual information when K10 is small.
Takeaways & Limitations
The scheme is insecure under the paper’s analyzed chosen-plaintext and known-plaintext conditions, especially when K10 is small or not too large.
Takeaways & Limitations
The chosen-plaintext attack is especially feasible when K10 is not too large, while the experimental estimation may fail when K10 is relatively large.
Abstract
from arXiv · showhide
This paper studies the security of a recently-proposed chaos-based image encryption scheme, and points out the following problems: 1) there exist a number of invalid keys and weak keys, and some keys are partially equivalent for encryption/decryption; 2) given one chosen plain-image, a subkey $K_{10}$ can be guessed with a smaller computational complexity than that of the simple brute-force attack; 3) given at most 128 chosen plain-images, a chosen-plaintext attack can possibly break the following part of the secret key: $\{K_i\bmod 128\}_{i=4}^{10}$, which works very well when $K_{10}$ is not too large; 4) when $K_{10}$ is relatively small, a known-plaintext attack can be carried out with only one known plain-image to recover some visual information of any other plain-images encrypted by the same key.
1. Introduction
The paper analyzes the security of a chaos-based image encryption scheme motivated by growing multimedia protection needs. It reports weaknesses in the secret-key space and attacks that recover subkeys or visual information under chosen- or known-plaintext settings.
- The paper focuses on the security of a previously proposed chaos-based image encryption scheme.
- The scheme has invalid, weak, and partially equivalent keys that reduce effective key-space security.
- A single chosen plain-image can enable separate guessing of K10 with lower complexity than simple brute force.
- At most 128 chosen plain-images may recover part of the secret key, especially when K10 is not too large.
- With one known plain-image and relatively small K10, an attack can reveal visual information from other ciphertexts encrypted under the same key.
2. The image encryption scheme under study
The scheme encrypts color images blockwise using an 80-bit key, two Logistic-map-based chaotic systems, and keyed compositions applied separately to RGB values. A global chaotic process initializes local block encryption, while subkeys are updated during processing.
- The plaintext is a color image with separate RGB channels, scanned in raster order and divided into 16-pixel blocks.
- The secret key is an 80-bit integer represented by ten subkeys K1 through K10, each ranging from 0 to 255.
- Two chaotic systems use the Logistic map: one runs globally, while another runs locally for each 16-pixel block.
- The global chaotic map produces 24 states that determine the initial condition of the local chaotic map for each block.
- Each RGB component is encrypted through a composition of keyed functions driven by K10 consecutive local chaotic states.
- After block encryption, the scheme updates subkeys K1 through K9 for subsequent processing.
3. Cryptanalysis
The cryptanalysis examines key defects and attacks against the image encryption scheme. Its scope includes invalid, weak, and partially equivalent keys, attacks on K10 and {Ki mod 128} for i=4 through 10, and a known-plaintext attack.
- The cryptanalysis comprehensively analyzes invalid keys, weak keys, and partially equivalent keys.
- It includes a chosen-plaintext attack targeting K10.
- It includes a chosen-plaintext attack targeting {Ki mod 128} for i=4 through 10.
- The analysis also includes a known-plaintext attack and other minor security problems.
- The paper changes an interval-handling step from the original scheme because the endpoint event would make Pj nonuniform, without affecting encryption performance.
3.1. Two properties of the scheme
The scheme’s finite-state key updates are periodic, allowing blocks with identical updated subkeys to be treated as fixed-key subsets. Its encryption functions also reduce to compositions of alternating XOR and modular-addition subfunctions, whose effective length is at most K10.
- Because subkey updates occur in a finite-state field, each updated-subkey sequence and the resulting dynamic-key sequence is periodic.
- Blocks separated by the update period have identical updated subkeys and can be grouped into sets with a fixed effective key.
- Only one period-defined subset of the image may be sufficient to reveal essential visual information, enabling analysis without the update mechanism.
- Each encryption subfunction is either an XOR transformation or modular addition modulo 256.
- Consecutive subfunctions of the same type combine, and zero-effect functions can be omitted, so each encryption function has len ≤ K10 effective subfunctions.
- The possible encryption-function formats depend on whether the first and last subfunctions are XOR or modular addition.
- Under a uniform-state assumption, the probability of shorter compositions decreases exponentially as K10 increases.
3.2. Analysis of the key space
The scheme’s effective key space is reduced by invalid, weak, and partially equivalent keys, with several defects causing encryption failure or visual leakage. The analysis identifies invalid-key conditions, weak K10 values, equivalent-key reductions, and an estimated remaining key space of 2^75.
- 3.2.1. Invalid keys with respect to K4 ∼ K9: 5592406 invalid subkeys (K4, …, K9) can force the global chaotic state X0 to zero and disable encryption.These keys satisfy the conditions leading to X0 = 0.
- 3.2.3. Weak keys with respect to K10: K10 = 128 yields an updated-subkey period of two, while K10 = 1 leaves a pixel unchanged with probability 1/8; K10 ≥ 8 is suggested.The update mechanism’s maximal period is 256, requiring K10 to be odd from the most conservative perspective.
- 3.2.4. Weak keys with respect to K4 ∼ K9: About half of pixels in affected sub-images may remain unencrypted, with one experiment reporting 49.9% unchanged pixels.This leakage can reveal visual information about the plaintext.
- 3.2.6. Partially equivalent keys with respect to K7 ∼ K9: Partially equivalent keys can reduce the (K7, K8, K9) subkey space from 256^3 to 4 · 128^3 = 256^3/2.More than half of ciphertext pixel values are identical for the paired keys, and other differences are always XOR-equal to 128.
- 3.2. Analysis of the key space: After accounting for invalid, weak, and equivalent keys, the effective key-space size is roughly 2^75 rather than the claimed 2^80.Invalid and weak keys are excluded, while partially equivalent keys are counted as one key.
3.3. Guessing K10 and {Ki}9 i=1 separately
The first plaintext block depends only on Y0 and K10, enabling a separate search for K10. This reduces the enhanced brute-force attack to O(2^72), below the scheme’s expected O(2^80) complexity.
- 3.3. Guessing K10 and {Ki}9 i=1 separately: The first block depends only on Y0 and K10, making (Y0, K10) equivalent to the original key for that block.This dependency enables K10 to be searched independently.
- 3.3. Guessing K10 and {Ki}9 i=1 separately: O(2^72) is the total complexity of the enhanced brute-force attack, below the O(2^80) complexity of simple brute force.K10 requires O(2^32), while the other subkeys require O(2^72); their sum remains O(2^72).
3.4. Guessing K 10 with a chosen plain-image
A chosen plain-image can exploit repeated 16-pixel blocks and equivalent encryption functions to narrow the search for K10. The attack uses block-distance constraints, bitwise properties, and candidate filtering, reducing the search substantially in favorable cases.
- Repeated identical cipher-blocks can reveal an upper bound on T and narrow the search space for K10.The attack uses block distances that satisfy a multiple-of-T condition and identical Y0 values.
- The probability of identical cipher-blocks is estimated from the number of 1-bits in B2 and can be large when min(m, 24 −m) and T are small.The paper verifies the estimation experimentally using exhaustive B2 values for min(m, 24 −m) ≤4 and random keys otherwise.
- The attack derives XOR behavior from composite encryption functions built from alternating XOR and modular-addition subfunctions.The analysis starts at the least significant bit, tracks carry bits, and reduces equivalence checking to 127 equalities.
- The procedure filters K10 candidates by testing sets of XOR-equivalent functions across the three color channels.Values such as 0 and 127 are always retained in A∗ and therefore need not be stored.
- The worst-case remaining search has at most 3,538,944 ≈ 2^21.6 candidate combinations, far below the 2^50 possibilities for K∗.In the best case, only 16 candidate values remain according to Fact 5.
- Using 13 selected chosen plain-images, experiments found r∗ ≈ 0.825 on average, rising to 0.9826 for keys with N(n) ≥1000; about O(20) images are expected to suffice in most cases.The reported averages are approximate and become less accurate when N∗ is too small.
3.6. Known-plaintext attack based on a masking image
The known-plaintext attack constructs a masking image by XORing a known plaintext with its ciphertext, then uses it to decrypt other ciphertexts. When K10 is relatively small, this can reveal important visual information.
- Attack principle: Many encryption functions are equivalent to XOR operations, enabling a masking image to serve as an equivalent of the secret key.The masking image is obtained by XORing a known plain-image and corresponding cipher-image pixel by pixel.
- Attack principle: Using the masking image to decrypt other cipher-images correctly recovers pixels encrypted by real XOR-equivalent functions.Sufficiently many correctly recovered pixels may expose visual information about the plaintext.
- Attack feasibility: The attack is expected to work well when K10 is relatively small.Examples with K10 = 6 and K10 = 30 show that some important visual information is revealed.
4. Conclusion
The paper analyzes the security of a recently proposed image encryption scheme and identifies key-space weaknesses and practical attacks. Its attacks recover subkey information with chosen plaintexts and reveal visual information with one known plaintext when K10 is small.
- Key weaknesses: The scheme contains invalid, weak, and partially equivalent keys, reducing the effective key-space size.The paper states that each subkey is involved in at least one security problem.
- Chosen-plaintext attacks: With one chosen plain-image, K10 can be guessed with complexity less than 2^8.This attack targets K10 separately rather than the full secret key.
- Chosen-plaintext attacks: At most 128 chosen plain-images may recover part of the secret key.The conclusion reports this as a chosen-plaintext attack against the scheme.
- Known-plaintext attack: With one known plain-image, the scheme can be broken when K10 is small.The paper also reports that some visual information can be recovered from other encrypted plain-images.
- Implications: The cryptanalysis offers insight into attacks on other schemes composed of multi-round encryption functions.The paper identifies this broader topic as difficult and important for future investigation.