2006 RISP International Workshop
on Nonlinear Circuits and Signal Processing (NCSP'06)
Waikiki Beach Marriott, Honolulu,Hawaii, USA, March 3-5, 2006

Improvement of a Cryptosystem Using Two Chaotic Maps
Shuichi Aono† , Masahiro Wada∗ and Yoshifumi Nishio††

Department of Electrical and Electronic Engineering
Tokushima University
2-1 Minami-Josanjima, Tokushima 770-8506, Japan
Phone:+81-88-656-7470, Fax:+81-88-656-7471
Email: {aoichi, nishio}@ee.tokushima-u.ac.jp∗Konan University
8-9-1 Okamoto, Higashinada, Kobe 658-8501, Japan
Email: wada-m@konan-u.ac.jp

1. Introduction



A chaotic map has various features. A chaotic map has sensitivity to a change in initial conditions and parameters, anda long-term forecast becomes impossible by the iterations ofa chaotic map. These features looks similar to the properties of the cryptology. For that reason, it is effective to use
chaotic maps for cryptosystems. The chaotic cryptosystem isresearched as an application of chaos in an engineering field[1-4]. On the other hand, the security of the chaotic cryptosystem is not investigated in detail. It is necessary to investigate the security and to clarify the vulnerability of thechaotic cryptosystem.
A cryptosystem using the tent map has been proposed [5].
And a cryptosystem using two chaotic maps has been proposed [6]. This system performed encryption and decryption
by using two chaotic maps, a skew tent map and a logistic
map, and their inverse maps.
In this research, we consider a chosen plaintext attack(CPA) for this cryptosystem. And we investigate vulnerability of the cryptosystem using two chaotic maps to CPA. We
propose an effective method against this attack. The proposed
method repeats the encryption process twice. We confirm thateavesdroppers cannot select the intended plaintext in the second encryption process.

F :Xk+1 = Xαk(0 ≤ Xk ≤ α)k −1
(α < Xk ≤ 1)
Xk+1 = Xα−1
Xk = αXk+1

orF −1 :
Xk = (α − 1)Xk + 1

(1)

(2)

Figure 1 show the tent map and the inverse map. Thesemaps tranform an interval [0, 1] into itself and contain only
one parameter α, which presents the location of the top of thetent.
F is two to one map and F −1 is one to two map. Therefore, F n is 2n to one map and F −n is one to 2n map. Since
X = F (F −1 (X)) is always satisfied, X = F n (F −n (X)) isalways satisfied.

(a)

(b)

2. A Cryptosystem Using the Tent Map
A cryptosystem using the tent map has been proposed [5]. Figure 1: A cryptosystem using the tent map. (a) Tent map.
A tent map is one of the most popular and the simplest chaotic (b) Inverse tent map.
maps.
2.1. Encryption and decryption function

2.2. Cryptosystem

Encryption and decryption function are described as fol- 1. Secret Key
The parameter α is a secret key.
lows,- 349 -2. Encryption
Set an initial point X0 as a plaintext. Calculate n-times
k+1)
Xk = a2 Xk+1 (1 − X2acomposite of the inverse map, Xn = F −n (X0 ), in a re(a < Xk+1 ≤ 1)
cursive way, and send this value Xn to the receiver. On−1Y=bY
kk+1
each computation, select one of two equations of F inany arbitrary way. In short, one plaintext has 2n cipher- F −1 :texts and one of 2n ciphertexts is sent to the receiver.
+1−2a+1−2a
Xk = ( Xk+11−a)(2 − Xk+11−a)(0 ≤ Xk+1 ≤ a)
3. Decryption
Yk = (b − 1)Yk+1
Calculate n-times composite of the map, X0 =(4)F n (Xn ), in a recursive way and recover the plaintext−1
whereFis
anencryption
mapandF
isadecryption
map.
X0 . Note that only α is required for this computation.
The information about which of two equations are used α and β are a private key in this cryptosystem. These maps
for each encryption process (F −1 ), is not necessary for are shown in Figs. 2 and 3.
the decryption process.
The encryption and the decryption are achieved by repeating a simple calculation. They require n times multiplications.
2.3. Disadvantages of cryptosystem
In this cryptosystem, the tent map as a chaotic map wasused. However, it had two disadvantages. One is that the map
used in the system was piecewise-linear map, the other is thatthe ratio of the ciphertext size to plaintext size becomes varylarge. The former makes the linear attack be possible and thelatter makes the information efficiency be bad.
To improve these disadvantages, a cryptosystem using twochaotic maps has been proposed [6].

(a)

(b)

Figure 2: Encryption map F .

3. A Cryptosystem Using Two Chaotic Maps
This system performed encryption and decryption by using
two chaotic maps, a skew tent map and a logistic map, andtheir inverse maps.
(a)3.1. Encryption and decryption function(b)Figure 3: Decryption map F −1 .

In the system of this research, the encryption function andthe decryption function are described as follows,√
Xk+1 = a(1 − 1 − Xk )




Yk+1 = Yk /bF :3.2. Cryptosystem
1. Encryption
Set an initial point Y0 as a plaintext and X0 as a subtext,
where, Y0 , X0 ∈ (0, 1), and X0 is an arbitrary value.
Calculate (Xn , Yn ) = F n (X0 , Y0 ), namely n-times iterations of F . Send the value Xn as a ciphertext to thereceiver.

(0 ≤ Yk ≤ b)√ Xk+1 = a + 1 − Xk (1 − a)(b < Yk ≤ 1)
Yk+1 = (Yk − 1)/(b − 1)(3)

2. Decryption
Calculate (X0 , Y0 ) = F −n (Xn , S), namely n-times it-- 350 -erations of F −n , and decrypt the plaintext Y0 , whereS ∈ (0, 1) is an arbitrary value.
In the encryption process of this chaotic cryptosystem, aplaintext gives a binary sequence by the skew tent map in Fig.
2 (b). Here, the binary sequence corresponds to the branchof the skew tent map. The branch labeled 0 is used whenYk ∈ [0, b], and the branch labeled 1 is used when Yk ∈[b, 1]. Further, branches of the logistic map are selected bythis binary sequence. When the branch of Yk is 0, the branchof Xk selects 0, and when the branch of Yk is 1, the branchof Xk selects 1. Namely, Xk includes the binary informationon the value of Yk . Because subtext X0 is an arbitrary value,
ciphertext Xn becomes the value that depends only on thebinary sequence.
In the decryption process, the binary sequence given theencryption is obtained from Xk . Further, branches of the Yk
are selected by this binary sequence, where initial value of
Yk , S ∈ (0, 1), is an arbitrary value. If Xn keeps appropriate
level of precision, plaintext Y0 will be given by calculating
F −1 (Xn , S) because F −1 is the reduction map.
3.3. Reduction map
We explain why arbitrary value S is correctly decrypted.
In the encryption process, Yk gives a binary sequence. Further, branches of Xk are selected by this binary sequence. Sothat means Xk includes the binary information on the valueof Yk . If the value of Xn is sent correctly, iterating of F −1
extracts the binary sequence because of the property of theinverse map. If the binary sequences are completely identical, the difference between S and Y0 becomes small by using
reduction map as shown in Fig. 4.
Figure 4 shows the state that solutions of recursive calculation starting from two different points on the inverse skew
tent map. We can clearly see that the difference between S
and Y0 becomes small. If we choose number of iteration islarge, the value of Y0 becomes equal with the value of the S
regardless of an initial value.

Figure 4: Reduction map.
In the encryption process, there is a possibility that thebinary sequence becomes nonuniform for some plaintexts.
Namely, if the initial value as a plaintext is too small, theencryption process continues to select the same branch of theskew tent map. Figure 5 shows the binary sequence for thecase of Y0 = 10−40 . Horizontal axis shows the number of theiteration, vertical axis shows the value of the binary sequencecorresponding to Xk . In this simulation, two keys and thetexts sizes are defined as follows.
· keys a, b ∈ (0.4, 0.6) : 21digits.
· plaintext Y0 ∈ (0, 1) : 40digits.
· subtext X0 and S ∈ (0, 1) : 40digits.
· ciphertext Xn : 50digits.
where a and b are selected in the space that the distribution ofciphertext is uniform enough. And number of iteration is 144times.

4. Chosen Plaintext Attack
In this cryptosystem, eavesdroppers needs to know the private key a to extract the binary sequence of the ciphertext Xn .
It is difficult in real time for the eavesdropper who does notknow the private key a to solve this cryptosystem by a roundrobin method. Therefore, the security of this cryptosystem
was guaranteed.
In this research, we consider a chosen plaintext attack
Figure 5: The binary sequence of the Xk for Y0 = 10−40 .
(CPA) for this cryptosystem. A CPA is an attack model for
cryptanalysis which presumes that the attacker has the capaFrom the simulated result, the encryption process continbility to choose arbitrary plaintexts to be encrypted and obtainues to select the same branch until the iteration exceeds 137
the corresponding ciphertexts.

- 351 -

times. Hence, eavesdroppers could decrypt the ciphertext by 6. Conclusions
examining a limited number of combinations of the sequence,In this research, we have investigated vulnerability of theand the private key might be decrypt. This is a critical weakcryptosystemusing two chaotic maps to CPA. And we havepoint of this cryptosystem.
proposed an effective method against this attack. We confirmed that eavesdroppers cannot select the intended plaintext
5. Proposed Cryptosystem
by repeating the encryption process twice.
We propose a simple but effective method against the CPA
References
discussed in the previous section. The proposed method repeats the encryption process twice. We explain proposed [1] L. Kocarev, “Chaos-Based Cryptography : A Brief
method as follows.
Overview, ” IEEE Circuits and Systems Magazine, vol.
1, pp. 6-21, 2001.
1. 1st encryption process
Set an initial point Y0 as a plaintext and X0 as a subtext. [2] G. Jakimoski, L. Kocarev, “Chaos and Cryptography: Block Encryption Ciphers Based on Chaotic Maps,”
Calculate n-times F (X0 , Y0 ) as described in 3.2. WenIEEE Trans. Circuits and Systems I, vol. 48, no. 2, pp.
can obtain Xn from F (X0 , Y0 ) = (Xn , Yn ).
163-169, 2001.
2. 2nd encryption process
Set an initial point Y00 = Xn , and X00 , where Xn is ob- [3] X. Yi, “Hash Function Based on Chaotic Tent Maps,”
IEEE Trans. Circuits and Systems II, vol. 52, no. 6, pp.
tained by the first encryption process, and X00 is an arbi354-357, 2005.
trary value. Calculate n-times F (X00 , Y00 ), we can obtain
Xn0 from F n (X00 , Y00 ) = (Xn0 , Yn0 ) as a ciphertext. And[4] N. Masuda, K. Aihara, “Cryptosystems with discretized
send this value Xn0 to the receiver.
chaotic maps,” IEEE Trans. Circuits and Systems I, vol.
49, pp. 28-40, 2002.
Figure 6 shows the binary sequence for the case of Y =010−40 . Horizontal axis shows the number of the iteration, [5] T. Habutsu, Y. Nishio, I. Sasase and S. Mori, “A Secretvertical axis shows the value of the binary sequence of theKey Chaotic Map,” Trans. IEICE, vol. E73, no. 7, pp.
Xk0 . The simulation condition is the same as Fig. 5.
1041-1044, 1990.
[6] M. Harada, Y. Nishio and A. Ushida, “A Cryptosystem
Using Two Chaotic Maps,” Proceedings of NOLTA’99,
vol. 2, pp. 609-611, 1999.

Figure 6: The binary sequence of the Xk0 for Y0 = 10−40 .
By simulated result, we can observe that there is no bias
in binary sequences. An important thing is to replace X withY in the process of the encryption. We confirm that eavesdroppers cannot select the intended plaintext in the second
encryption process. Moreover, the volume of information of
ciphertext has not increased though the number of iteration
has increased.

- 352 -