Cryptography with chaos at the physical level

In this work, we devise a chaos-based secret key cryptography scheme for digital communication where the encryption is realized at the physical level, that is, the encrypting transformations are applied to the wave signal instead to the symbolic sequence. The encryption process consists of transformations applied to a two-dimensional signal composed of the message carrying signal and an encrypting signal that has to be a chaotic one. The secret key, in this case, is related to the number of times the transformations are applied. Furthermore, we show that due to its chaotic nature, the encrypting signal is able to hide the statistics of the original signal. 2004 Elsevier Ltd. All rights reserved. In this letter, we present a chaos-based cryptography scheme designed for digital communication. We depart from the traditional approach where encrypting transformations are applied to the binary sequence (the symbolic sequence) into which the wave signal is encoded [1]. In this work, we devise a scheme where the encryption is realized at the physical level, that is, a scheme that encrypts the wave signal itself. Our chaos-based cryptographic scheme takes advantage of the complexity of a chaotic transformation. This complexity is very desirable for cryptographic schemes, since security increases with the number of possibilities of encryption for a given text unit (a letter for example). One advantage of using a chaotic transformation is that it can be implemented at the physical level by means of a low power deterministic electronic circuit which can be easily etched on a chip. Another advantage is that, contrary to a stochastic transformation, a chaotic one allows an straightforward decryption. Moreover, as has been shown elsewhere [2], chaotic transformations for cryptography, enables one to introduce powerful analytical methods to analyze the method performance, besides satisfying the design axioms that guarantees security. In order to clarify our goal and the scheme devised, in what follows, we initially outline the basic ideas of our method. Given a message represented by a sequence fy i g l i1⁄41, and a chaotic encrypting signal fxi g l i1⁄41, with yi and xi 2 R and xiþ1 1⁄4 GðxiÞ, where G is a chaotic transformation, we construct an ordered pair ðxi ; y i Þ. The ith element of the sequence representing the encrypted message is the y component of the ordered pair ðxi ; yn i Þ, obtained from F n c ðxi ; y i Þ. The function Fc : R 2 ! R is a chaotic transformation and n is the number of times we apply it to the ordered pair. The nth iteration of ðxi ; y i Þ, has no inverse if n and x0i are unknown, that is, y i can not be recovered if one knows only F n c ðxi; yiÞ. As it will be clear further, this changing of initial condition is one of the factors responsible for the security of the method. Now we describe how to obtain the sequence fyigli1⁄41 by means of the sampling and quantization methods. These methods play an essential role in the field of digital communication, since they allow us to treat signals varying continuously in time as discrete signals. One instance of the use of continuous in time signals is the encoding of music or * Corresponding author. E-mail address: romuelm@iceb.ufop.br (R.F. Machado). 0960-0779/$ see front matter 2004 Elsevier Ltd. All rights reserved. doi:10.1016/j.chaos.2003.12.094 1266 R.F. Machado et al. / Chaos, Solitons and Fractals 21 (2004) 1265–1269 speech where variations in the pressure of the air are represented by a continuous signal such as the voltage in an electric circuit. In the sampling process, a signal varying continuously in time is replaced by a set of measurements (samples) taken at instants separated by a suitable time interval provided by the sampling theorem [3,4]. The signals to which the sampling theorem applies are the band limited ones. By a band limited signal, we mean a function of time whose Fourier transform is null for frequencies f such that jf jPW . According to the sampling theorem, it is possible to reconstruct the original signal from samples taken at times multiple of the sampling interval TS 6 1=2W . Thus, at the end of the sampling process, the signal is converted to a sequence fs1; s02; . . . ; slg of real values, which we refer to as the s sequence. After being sampled the signal is quantized. In this process, the amplitude range of the signal, say the interval 1⁄2a; b , is divided into N subintervals Rk 1⁄4 1⁄2ak ; akþ1Þ, 16 k6N , with a1 1⁄4 a, akþ1 1⁄4 ak þ dk , aNþ1 1⁄4 b, where dk is the length of the kth subinterval. To each Rk one assigns an appropriate real amplitude value qk 2 Rk , its middle point for example. A new sequence, the y sequence, is generated by replacing each s0i by the qk associated to the Rk region to which it belongs. So, the y sequence fy 1 ; y 2 ; . . . ; y l g is a sequence where each y i 2 R takes on values from the set fq1; . . . ; qNg. In traditional digital communication, each member of the y sequence is encoded into a binary sequence of length log2 N . Thus, traditional cryptographic schemes, and even recent proposed chaotic ones [1], transforms this binary sequence (or any other discrete alphabet) into another binary sequence, which is then modulated and transmitted. In our proposed scheme, we transform the real y into another real value, and then modulate this new y value in order to transmit it. This scheme deals with signals rather than with symbols, which implies that the required transformations are performed at the hardware or physical level. Instead of applying the encrypting transformations to the binary sequence, we apply them to the y sequence, the sequence obtained by sampling and quantizing the original wave signal. Suppose, now, that the amplitude of the wave signal is restricted to the interval [0,1]. The first step of the process is to obtain the encrypting signal, a sequence fx1; x02; . . . ; xlg, 0 < x0i < 1. As we will show, this signal is obtained by either sampling a chaotic one or by a chaotic mapping. The pair ðxi ; y i Þ localizes a point in the unit square. In order to encrypt y i , we apply the baker map to the point ðxi ; y i Þ to obtain ðxi ; y i Þ 1⁄4 ð2xi b2xi c; 0:5ðy i þ b2xi cÞÞ, where b2xi c is the largest integer equal to or less than 2x0i . The encrypted signal is given by y 1 i , that is, 0:5ðy i þ b2xi cÞ. It is important to notice that y i can take 2N different values instead of N , since each y 0 i may be encoded as either 0:5 ðy i Þ < 0:5 or 0:5 ðy i þ 1Þ > 0:5, depending on whether x0i falls below or above 0:5. So, in order to digitally modulate the encrypted signal for transmission, 2N pulse amplitudes are necessary, with each binary block being encoded by two different pulses. Therefore, our method has an output format that can be straightforwardly used in digital transmissions. Suppose, for example, that N 1⁄4 2, and we have q1 1⁄4 0:25 and q2 1⁄4 0:75. If s0i < 0:5 then y i 1⁄4 0:25 and if we use n 1⁄4 1, we have y i 1⁄4 0:125 if x0i < 0:5 or y i 1⁄4 0:625 if x0i P 0:5. On the other hand, if s0i > 0:5, then y i 1⁄4 0:75 and we have y i 1⁄4 0:375, if x0i < 0:5 or y i 1⁄4 0:875 if x0i P 0:5. So, the encrypted signal takes on values from the set f0:125; 0:375; 0:625; 0:875g, where the first and third values can be decrypted as 0.25 in the non-encrypted signal while the second and the forth as 0.75. In a general case, where we apply n iterations of the mapping, y i can assume 2nN different values. In this case, if one wants to digitally transmit the cipher text, one can encode every cipher text unit using a binary block of length log2ð2NÞ and then modulate this binary stream using 2nN pulse amplitudes. Thus, the decryption is straightforward if one knows how many times the baker map was applied during the encryption. If the baker transformation (function Fc) is applied n times, there are, for each plain text unit, 2nN possible cipher text units. In this case, the complexity of the ciphertext, that is, its security, can have its upper bound estimated by the Shannon complexity Hs which is the logarithm of the possible number of ciphertext units, produced after the baker’s map have been applied n times. So, Hs 1⁄4 n logð2Þ þ logðNÞ. We see that n is much more important for security reasons than N . So, if one wishes to improve security, one could implement a dynamical secret key schedule for n. By this we mean that, based on some information of the encrypted trajectory ðxi ; y i Þ, the value of n could be changed whenever a plain text unit is encrypted. If one allows only m values for n, the number of possible cipher text units would be given by Nm Qm j1⁄41 2 nj and the complexity of the cipher text would be Pm j1⁄41 nj log 2þ m logN , which can be very high, even for small m. Thus, without knowing the number n of applications of the baker map during the encryption, the decryption renders highly improbable. In fact, n is the secret key of our cryptographic scheme and we can think of the sequence fxi g as a dynamical secret key schedule for the x-component in the initial condition represented by the ordered pair ðxi ; y i Þ. The tools necessary to perform the security analysis are provided by the information theory. In this context, information sources are modelled by random processes whose outcome may be either discrete or continuous in time. Since major interest, and ours too, is in band limited signals, we restrict ourselves to the discrete case, where the source is modelled by a discrete time random process. This is a sequence fy i g l i1⁄41 in which each y 0 i assumes values within the set A 1⁄4 fq1; q2; . . . ; qNg. This set is called the alphabet and its elements are the letters. To each letter is assigned a probability mass function pðqjÞ 1⁄4 P ðy i 1⁄4 qjÞ, that gives the probability with which the letter is selected for transmission. R.F. Machado et al. / Chaos, Solitons and Fractals 21 (2004) 1265–1269 1267 In cryptography, one deals with two messages: the plai