2004 RISP International Workshop on Nonlinear
Circuit and Signal Processing (NCSP'04)
Hawaii, USA, Mar. 5-7, 2004.

Analysis of a Cryptosystem Using a Chaotic Map Extended to Two Dimensions
Toru Hiraoka and Yoshifumi Nishio
Dept. of Electrical and Electronics Engineering
Tokushima University
2-1 Minami-Josanjima, Tokushima, Japan
Phone:+81-88-656-7470, Fax:+81-88-656-7471
Email: hiraoka, nishio @ee.tokushima-u.ac.jp

1. Introduction
A cryptosystem using a simple one-dimensional chaoticmap has been proposed [1]. This system performed encryption and decryption by using a skew tent map and its inverse
map. However, the weaknesses of the system have been already reported, especially against a chosen ciphertext attack
or a linear attack [2]. In order to overcome the weaknesses, acryptosystem using two chaotic maps has been proposed by
the authors’ group [3].

21 (354  $ 67   $ 77
7  & 8*  $  9!' #:!';$  4       $    $   &  ! 3 /# 69 !  $ 0
In this research, we make clear the encryption and the decryption processes of the system and analyze the relation be 1 is a decryption map.
tween the key and digit of the recoveredtext. Further, we dis- Where# is an encryption map and and are parameters that are a private key in this system.
cuss the chosen plaintext attack.
These maps are shown in Figs. 1 and 2.

2. Construction of a Cryptosystem Using Two Chaotic
2.2. Cryptosystem
Maps
In this research, we use two chaotic maps, a skew tent map
and a logistic map, and their inverse maps.

2.1. Encryption and Decryption Function
In the system of this research, the encryption function andthe decryption function are described as follows.

      
 "!  "# !  $% ! '& #         ( )# *+!   ,!- $ )'!  . , & /# 0,

!9<!9<  <>=?A@ ,  < C   < @D! <   B C @D! C  (C<1. Encryption(i) Set an initial point as a plaintext andas a subtext,,
whereis an arbitrary value.
(ii) Calculate -times, we can obtainfrom.
is the ciphertext and is sent
to the receiver.

C 1  C @FE GE =?B HI@ ,
B@FK ) are used to explain the process of theTwo symbols ( Jmapping. In the encryption process, the branch labeled J is!  =?L I@D#)M , and the branch labeled K is used whenused when!  =/#D@  M . This decides
which branch is used in the map of  . Namely, when the label N=.  & I@  M
is J , the branch O=?L I@  & 9M
Kis used. While, when the label is , the branch!
< is mapped tois used. By this process the information ofK
the sequence of the labels J and and further the sequenceC .
of the labels is mapped to the value of
2. Decryption
Calculate -times
and decrypt the plaintext
whereis an arbitrary value. This value becomesthe plaintext after -times calucation.

!<- 73 -Q

1’AAA5.dat’

0.9

SUT V W

0.8
0.7
0.6

Xk 0.5X
RP S TY

0.40.3

Q

0.2
0.1
00(a)

Fig. 1: Encryption map  .
[0.2]/^ _a`

0.6

0.8

1

[(c)nFig. 2: Decryption map

 1 .

 C

1.4

1.6

1.82

  to parameter  .
mo(d)

1.2

aFig. 3: Distribution ofpq
pux twv]^ cZb\0.4(b)p,qHrHs pux twvnFig. 4: Reduction of difference between

E and ! C .

In the decryption process, the inverse process is perfomed.
The information ofis mapped to the sequence of the la- 3.2. Recover Process
bels and the sequence is mapped to the value of .
We explain why chosen arbitrarily becomes to the exact
plaintext after the decryption process. As we described in 2.2,in the encryption process, the information ofis mapped to3. Discussions
the sequence of the labels. Further, the sequence of the labels. If the value ofis sent
is mapped to the value of
3.1. Requirement for Parameters
correctly, the iteration ofgives the exact sequence of theThe key and the plaintext size are required over 64bit labels because of the propoerty of the inverse map. If the(about 20 digits) for the defense against a brute force attack. sequence of the labels is completely identical, the difference
becomes smaller as the mapping is iterated.
The ciphertext needs a sufficient size that it can be decrypted between andThis
isbecause
thepart ofis reduction map as shown
correctly. In this system, two keys and the texts sizes are dein
Fig.
4.
If
we
choosetheiteration
number as large enough,fined as follows.
the difference becomes smaller than the minimum precisionand the values are regarded as identical.
keysand: 21 digits
plaintext: 40 digits
subtext
and: 40 digits
3.3.
test for Uniformness
ciphertext : 50 digits
From a viewpoint of safety, when the same ciphertext is deWhere and are selected in the space that the distribution crypted with some different keys, there is a problem if the reof ciphertexts is uniform enough. Figure 3 shows the dis- covered texts are not uniform enough. We investigate whether
tribution ofto the parameter . Besides, deciding and the plaintext would be uniform or not for some different keys,
digits of the plaintext are explained in detail in 3.4. Accord- when a ciphertext is decrypted. We use
test for the uniing to [3], when more than 80 times mapping is satisfied in- formness. The consept of the method is as follows.
dependence oftest. However, in this research, we iterate
moreover 64 times against brute force attack and hence the(i) Divide the interval [0,1] into class intervals.
iteration number becomes 144.

!9<E

1E

 =?!9L I<ie fI=G@  HIe 9@ M #=GL Ie 4 @gAe h,M < E?=?9 A@ ,dddd



# 



!C!

!y< C1jzk#jzkjlk{- 74 - C!CE|F} ~  @gI@gA@FeDeFe;@ {(ii) Calculate plaintexts to a ciphertext with 1000 different reduction of the difference between andin the decrypkeys, count the frequencies () in the class tion process becomes slower.
intervals.
This can be explained theoretically as follows. If,
the choosing of the labels and of the mapin(iii) Compute
144 times is estimated asand, respectively.
Because# Ae 4 1 /!  KJ  f K  f9hJ
4hjzk  $ | } | } |I}  k 494 d    e h ,  4,4 d   f9hAe 4 .
This value approach jzk distribution of degree of freedom
E ! C  andthe relation between the reduction of  {  . If this value is smaller than the upper 5  point of Therefore,
Table 1 shows jzk test for the precision  is as follows.
jlk , the uniformness is not rejected.
some ciphertexts, where {  and | }  ,9 & {  , . The4  d h   d  1I
uniformness is satisfied because the upper  point of jzk indegree of freedom 9 is 16.9. Figure 5 shows the distribution  ' of the recovered texts when jlk
 Ie 4 h .
E ! C which must be
where  is the difference between andsmaller than 1. By taking a logarithm of the both sides.
 h  Table. 1: jzk test for uniformness.
49  d  ¡  4 Ae  h¢ £,   1ACiphertextzjk

12.46 4 Ie  h10.78
lk8.42
l
Similarly, the values for other cases are calculated and are
11.9# L Ae 4 @gIe h9M
l 11.48
summarized in Table 2. Hence, we define that is inl
and that the size of the plaintext is 40 digits.
7.86
l 10.82
l
9.56
l 13.68
 < 11.16
1000

success count

800

600

400

120
200

100
80

fi

00.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

#b60
40

Fig. 6: Success number versus .

20
000.2

0.4

-144

0.6

0.8

1

F (C)z   <  <   k                 Fig. 5: Histogram of the recovered texts for 1000 keys.
(.)#3.4. Key and Text Size

In order to investigate the range of the key , we carry out
computer simulations for different 1000 plaintexts. Figure 6
shows the number of the success which means that the plaintext is recovered correctly. Further, Fig. 7 shows the relation between the recovered digits and the value of . We cansay that when the value of is in, all plaintexts arerecovered correctly. However, as the key approaches to theedges, the success rate becomes smaller. This is bacause the#L Ie 4 @gAe h,M##Fig. 7: Recovered digit versus .

- 75 -#Table. 2: Relation between and the recovered digit.

#the recovering digit
1931
38
42
430.1, 0.90.2, 0.80.3, 0.70.4, 0.60.5[2] E. Biham, “Cryptanalysis of the Chaotic-map Cryptosystem Suggested at EUROCRYPT’91,” Proc. Eurocrypt’91, pp. 532-534, 1991.
[3] M. Harada, Y. Nishio and A. Ushida, “A Cryptosystem
Using Two chaotic Maps,” Proceedings of NOLTA’99,vol. 2, pp. 609-611, 1999.

3.5. Chosen Plaintext Attack!<  1 < /!  $ We consider a chosen plaintext attack. It is supposed that aplaintext with the value ofis chosen. In the encryption process, until the value ofexceed the valueof key , the value increases about twice by the iteration of themapping. However, because the initial value is too small, ittakes about 135 times as shown in Fig. 8. This means that thesequence of the labels mapped fromis.
Hence, eavesdroppers could decrypt the ciphertext by examining only a limited number of combinations of the sequence
after 135 times.
Though this could be the critical weakness of this cryptosystem, limiting the range of the plaintext is one of the easy
way to avoid this attack.

#!y< J¤J%J¤J%J%J¤J%J dFdDd

10.8

0.6

Yk
0.4

0.2

0020

4060

Fig. 8: Series of¥!  for !9<   1  < .
80

100

120

140

160

4. Conclusions
We have made clear the encryption process and the decryption process of the cryptosystem using a chaotic map extended to two dimensions. We have analyzed the relation between the key and the digit of the recovered text, and a chosen
plaintext attack has been investigated.
Acknowledgement
This work was partly supported by The Telecommunications
Advancement Foundation’s Research Grant.
References[1] T. Habutsu, Y. Nishio, I. Sasase and S. Mori, “A Secret
Key Chaotic Map,” Trans. IEICE, vol. E73, no. 7, pp.
1041-1044, 1990.

- 76 -