2007 International Symposium on Nonlinear Theory and itsApplications
NOLTA'07, Vancouver, Canada, September 16-19, 2007

A Cryptosystem Using Expansion of Chaotic MapShuichi Aono and Yoshifumi Nishio
Department of Electrical and Electronic Engineering
Tokushima University
2-1 Minami-Josanjima, Tokushima 770-8506, Japan
Phone:+81-88-656-7470, Fax:+81-88-656-7471
Email: {aoichi, nishio}@ee.tokushima-u.ac.jp

Abstract— A chaotic map has sensitivity to a change in initialconditions and parameters, and a long-term forecast becomes
impossible by iterations of a chaotic map. These features looksimilar to the properties of the cryptology. For that reason, it iseffective to use chaotic maps for cryptosystems.
In this research, we propose a cryptosystem using iterationsof a chaotic map. This cryptosystem uses expansion map forencryption and decryption. This cryptosystem is a symmetrickey cryptography that has a public key. We investigate thevulnerability of this cryptosystem.

I. I NTRODUCTION
A chaotic map has sensitivity to a change in initial conditions and parameters, and a long-term forecast becomes
impossible by the iterations of a chaotic map. These features
look similar to the properties of the cryptology. For that reason,
it is effective to use chaotic maps for cryptosystems. The
chaotic cryptosystem is researched as an application of chaosin an engineering ﬁeld [1-4].
A lot of chaotic cryptosystems that use the expansion
and the reduction of the chaotic map for the encryption
and decryption are reported [5][6]. On the other hand, many
researchers are reported about the disadvantages of cryptosystems using the chaotic map [7][8]. There is a possibility to belinearly attacked when the piecewise-linear map is used in thecryptosystem. In addition, the advantages of the chaotic map
is demonstrated when the direction of the expansion is usedfor the encryption. It is undesirable to use reduced map forcryptosystem.
Moreover, a symmetric-key cryptography has the problemof the delivery of the key distribution. This problem can besolved by using a public-key cryptography. However, there
are two problems in the application of the chaotic map to
the public-key cryptography. One is that the trap door isnecessary to realize the public key cryptosystem. It is difﬁcult
to develop trap door in the chaotic map. The other is thatthe system equation is opened to the public. If the equationof the chaotic map and its parameters are opened to thepublic, the behavior of the sequences is known. Recently someresearchers proposed a public-key cryptography based on thechaotic map [9].
In this research, we propose a cryptosystem using iterationsof a chaotic map. And we investigate the vulnerability of thiscryptosystem. This cryptosystem uses expansion map for encryption and decryption. The decryptor and the encryptor haveeach private key, and they encrypts to ciphertext and decrypts
to plaintext with each private key and a common private key.
This cryptosystem is a symmetric-key cryptography that has
characteristic of a public-key cryptography.
II. C HAOTIC M AP
In this research, we use a modiﬁed logistic map. The
modiﬁed logistic map is one of the simplest chaotic maps. The
modiﬁed logistic map is expressed as the following equation:
Xn2)Xn+1 = Xn (1 −α2α(0 ≤ Xn ≤ α)

Xn + 1 − 2α
Xn + 1 − 2αXn+1 = ()(2 −)
1−α1−α(α < Xn ≤ 1)
(1)
where α is a parameter changing the top of the map. Thismap is shown in Fig. 1. The generated sequences look like
uniform random numbers. Figure 2 shows an example ofchaotic sequences generated by the modiﬁed logistic map. The
behavior like the uniform random number is seen in α = 0.5.

Fig. 1.

Modiﬁed logistic map F . (α = 0.5)

This map has sensitivity to a change in parameter α. Therefore, a long-term forecast becomes impossible by iterations ofa map. However, the modiﬁed logistic map is based on an- 220 -iterations A. This value A is a private key for the decryptor.
The decryptor keep a private key A to himself.
Calculate XA = F A (X0 ), namely A-time iterations of themodiﬁed logistic map F .
The decryptor can obtain X0 , XA as public keys, α as acommon private key and A as a private key.
X0 , XA : public keys.
α : common private key.
• A : private key.

••Fig. 2.

Chaotic sequence. (α = 0.5)

B. Encryption Processeasy equation. If the number of iterations n and values of Xnand Xn+1 are known, it is easy to calculate the value of α. In
other words, it is necessary to know the number of iterations
to obtain the correct value α. If the number of iterations n isunknown, it is difﬁcult to calculate correct α from the valueof X0 and Xn . We propose the chaotic cryptosystem using
this feature.
III. C RYPTOSYSTEM
We propose a cryptosystem by using iteration of a modiﬁed
logistic map. The simpliﬁed block diagram of the cryptosystem
is shown in Fig. 3. This cryptosysytem is composed of thefollowing three parts. Key generation, encryption process anddecryption process.

We explain an encryption process of this cryptosystem. Aencryptor chooses the value B as a number of iterations, where
B is an arbitrary value. The encryptor encrypts by using aprivate key B.
The encryption functions are described as follows :C1 = M + F B (XA ) = M + XA+B
C2 = F B (X0 ) = XB

(2)

where, M is a plaintext.
Send these values (C1 , C2 ) as a ciphertext to the receiver.
••C1 , C2 : ciphertexts.
B : private key.

C. Decryption Process
In the decryption process, a decryptor calculates C1 −F A (C2 ) by using a private key A.
C1 − F A (C2 ) = M + XA+B − F A (XB )= M + XA+B − XB+A=M(3)And decrypt the plaintext M . An important thing is that
there is no need to calculates the value of B. The decryptor
uses only a common private key α and a private key A fordecryption.
IV. R EQUIREMENTS FOR C RYPTOSYSTEM
A. Key and Plaintext Sizes
Fig. 3.

Block diagram of the cryptosystem.

A. Key Generation
This cryptosystem uses three kind of keys, a public key,a private key and a common private key. A common privatekey means shared secret key between the decryptor and theencryptor. And, the keys are decided by the decryptor. The
process of key generation is as follows.
A decryptor set an initial point X0 and a parameter α.
Here α is a common private key. In addition, set a number ofThe key space size and plaintext size are required over128 bits (40 digits) for the defense against brute force attack.
We use a GNU Multiple Precision Arithmetic Library (GMP)[10] to implement. GMP is a library for arbitrary precision
arithmetic, operating on signed integers, rational numbers, andﬂoating point numbers.
In this cryptosystem, a public key, a common key and aplaintext size are deﬁned as follows :- 221 -••α 40 digits.
X0 , XA ∈ [0, 1] and M 40 digits.

B. Ciphertext Size3) Calculate

In this cryptosystem, it is not necessary to consider the effectof rounding error of the sequences generated by the modiﬁed
logistic map. Because only the direction of the expansion isused. Therefore, we truncate a number to 40 decimal placesby the iteration of the map. The ciphertext sizes are deﬁned
the same as the plaintext.
•C1 and C2 40 digits.

χ2 =l
2
∑
(fi − f ′ )i=1fi′i(4)where fi′ is an ideal value.
The upper 5% of this χ2 test is 16.9. If the value of χ2
test is 16.9 or less, the uniformity of the generated sequenceis guaranteed. The simulated results for different keys and thenumber of iterations are shown in Table 1.
TABLE I
χ2 TEST FOR THE UNIFORMITY.

C. Range of Parameter α
Next, we consider the range of the parameter α. There isa possibility that the distribution of generated sequences has
bias for some chosen value of the key and the initial value.
Figure 4 and 5 show the distribution of the value of XN inchanging α for the case of N = 10 and the case of N = 100.

Range of α N = 10 N = 100
0 ∼ 0.1
82.1
35.7
0.1 ∼ 0.2
15.6
13.5
0.2 ∼ 0.3
14.2
15.8
0.3 ∼ 0.4
16.4
6.8
0.4 ∼ 0.5
13.5
16.2
0.5 ∼ 0.6
11.9
16.8
0.6 ∼ 0.7
4.8
12.0
0.7 ∼ 0.8
10.5
9.8
0.8 ∼ 0.9
9.6
15.2
0.9 ∼ 1.0
21.2
23.4

From this table, we determined that the range of thecommon private key is α ∈ [0.1, 0.9].
•α ∈ [0.1, 0.9] 40 digits.

D. Number of Iterations

Fig. 4.

Distribution of XN for N = 10 .

Fig. 5.

Distribution of XN for N = 100 .

We investigate numbers of iterations A and B. A and B arearbitrary value as private keys. The cipher-breaking becomes
difﬁcult by increasing this value. The calculation time of theproposed cryptosystem depends on the number of iterations.
In order to determine the number of iterations, we simulated
the sequences with slightly different keys. Figure 6 shows thedifference of the generated value XN between the case of
α = 0.49 and the case of α = 0.49 + 10−40 . The horizontal
axis shows the number of iterations N , and the vertical axis
shows the difference between the generated sequences.

From Fig. 4, we can see that the bias is caused at the valueof α close to 0 and 1.
We use χ2 test for the uniformity to determine the range ofα. χ2 test for the uniformity is expressed as follows.
1) Divide the interval [0, 1] into l class intervals.
2) Calculate Xn with the different key α. Here, X0 is aﬁxed value, and make l × l contingency table fi .

Fig. 6.

Difference of two values.

From this ﬁgure, there are no large differences of two values
until the iteration exceeds 150 times. It is undesirable to use- 222 -the range of N < 150 as the key. We can see the differenceof two values that have changed nonuniformity for N > 150.
Therefore, we determine that the number of iterations arearbitrary value over 150 times.
•A and B > 150 times.
V. S ECURITY A NALYSIS

A. Public Key
This cryptosystem uses the public-key cryptography for apart of the cryptosystem, and the number of the deliveryof keys are decreased. It is very difﬁcult for eavesdroppers
to obtain correct α and A from the value of X0 and Xn .
Therefore, we open the X0 and the XA to the public as publickeys.
We investigate the security of the proposed cryptosystemthat the public keys X0 = 0.41234 and XA = 0.24739 are
attacked by the eavesdroppers with the brute force attack.
Table 2 shows results of the brute force attack for the limitedcase of N < 50 and α = 5 digits.

which presumes that the attacker has the capability to choose
arbitrary plaintexts to be encrypted and obtain the corresponding ciphertexts.
This proposed cryptosystem is a simple but effective systemagainst the CPA. If the proposed cryptosystem is attacked
by the CPA, and the encryptor selects the same value B,
the eavesdroppers can easily obtain two values XA+B andXB . Because, the value of the plaintext is not changed andexpanded it in this cryptosystem. However, it is difﬁcult foreavesdroppers to obtain correct A, B and α from the valueof X0 , XA , XB and XA+B . Even if a discrete-valued of
the chaotic sequences are known to the eavesdroppers, theeavesdroppers have to detect two successive numbers or thenumber of iterations to calculate the parameter α.
In addition, the encryptor can easily change the numberof iterations B at the every encryption, also same for thedecryptor. The security of the cryptosytem becomes more
safety by setting the different key at the encryption.
VI. C ONCLUSIONSIn this research, we have proposed a cryptosystem using
iterations of a modiﬁed chaotic map. And we have investigatedvulnerability of this cryptosystem. This cryptosystem is asymmetric-key cryptography that has a characteristic of apublic-key cryptography. The number of the delivery of thekeys has decreased to using this cryptosystem.
As the future subject, we investigate security of the proposed
cryptosystem in more detail. And we apply the cryptosytem byusing iterations of a chaotic map to the system of the personalauthentication.

TABLE IIR ESULTS OF THE BRUTE FORCE ATTACK .
Private key α Iterations A Private key α Iterations A
0.10328
20.51144
80.13988
210.51929
450.15702
170.52547
250.15839
240.54957
190.18736
460.55229
270.19175
400.62369
90.24723
210.64520
120.30044
470.64959
350.33086
30.67215
240.37352
350.74644
460.43097
170.74863
220.44703
390.79956
450.45617
70.82766
340.47851
230.83572
380.48088
270.85982
340.50042
360.88199
49

R EFERENCES

This results are solutions of keys in limited case, however
the eavesdropper can detect a lots of values. An important
thing is that the all of values are correct keys for the eavesdroppers who knows only X0 = 0.41234 and XA = 0.24739.
If the eavesdroppers chooses a really correct key in Table 2,
it is necessary to know the value of the α or the value ofthe A. Those parameters are known to only the decryptor
and the encryptor. Moreover, there is a possibility that allof the parameter α generates the value of XA after N -times
iterations. Because the generated sequences by the modiﬁed
logistic map are a long-term sequences.
For that reason, we thought that the value of α and the valueof A did not be calculated even if the value of X0 and thevalue of XA were opened to the public. And we used X0 andXA as public keys.

[1] L. Kocarev, “Chaos-Based Cryptography : A Brief Overview, ” IEEE
Circuits and Systems Magazine, vol. 1, pp. 6-21, 2001.
[2] G. Jakimoski, L. Kocarev, “Chaos and Cryptography : Block Encryption
Ciphers Based on Chaotic Maps,” IEEE Trans. Circuits and Systems I,
vol. 48, no. 2, pp. 163-169, 2001.
[3] X. Yi, “Hash Function Based on Chaotic Tent Maps,” IEEE Trans.
Circuits and Systems II, vol. 52, no. 6, pp. 354-357, 2005.
[4] N. Masuda, G. Jakimoski, K. Aihara and L. Kocarev, “Chaotic Block
Ciphers : From Theory to Practical Algorithms,” IEEE Trans. Circuitsand Systems I, vol. 53, no. 6, pp. 1341-1352, 2006.
[5] T. Habutsu, Y. Nishio, I. Sasase and S. Mori, “A Secret Key ChaoticMap,” Trans. IEICE, vol. E73, no. 7, pp. 1041-1044, 1990.
[6] M. Harada, Y. Nishio and A. Ushida, “A Cryptosystem Using Two ChaoticMaps,” Proceedings of NOLTA’99, vol. 2, pp. 609-611, 1999.
[7] E. Biham, “Cryptanalysis of the chaotic-map cryptosystem suggested at
EUROCRYPT’91,” Proc. Eurocrypt ’91, pp. 532-534, 1991.
[8] N. Masuda, K. Aihara, “Cryptosystems with discretized chaotic maps,”
IEEE Trans. Circuits and Systems I, vol. 49, pp. 28-40, 2002.
[9] L. Kocarev, Z. Tasev, “Public-key encryption based on Chebyshev maps,” Proceedings of ISCAS’03, vol. 3, pp. 28-31, 2003.
[10] “The GNU MP Bignum Library,” http://gmplib. org/B. Chosen Plaintext Attack
Next, we consider a chosen plaintext attack (CPA) for thiscryptosystem. A CPA is an attack model for cryptanalysis- 223 -