The 15th IEEE International Workshop on Nonlinear Dynamics of Electronic Systems
NDES'07, Tokushima, Japan, July 23-26, 2007

A Chaotic Cryptosystem Using Lyapunov Exponent
Shuichi Aono† , Yoshifumi Nishio††

Department of Electrical and Electronic Engineering, Tokushima University
2-1 Minami-Josanjima, Tokushima 770-8506, Japan
Phone:+81-88-656-7470, Fax:+81-88-656-7471
Email: {aoichi, nishio}@ee.tokushima-u.ac.jp

Abstract

is opened to the public. If the equation of the chaotic
map and its parameters are opened to the public, theA chaotic map has sensitivity to a change in initial condi- behavior of the sequences is known. Recently some retions and parameters, and a long-term forecast becomes searchers proposed a public-key cryptography based on
impossible by the iterations of a chaotic map. These the chaotic map [9].
features look similar to the properties of the cryptology.
In this research, we propose a cryptosystem using theFor that reason, it is eﬀective to use chaotic maps for Lyapunov exponent of a chaotic map. And we investicryptosystems.
gate the vulnerability of this cryptosystem. This crypIn this research, we propose a cryptosystem using Lya- tosystem uses the Lyapunov exponent until convergencepunov exponent of a chaotic map. This cryptosystem is for encryption and decryption. The decryptor and thea symmetric-key cryptography that has a public key. We encryptor have each private key, and they encrypts toinvestigate the vulnerability of this cryptosystem.
ciphertext and decrypts to plaintext with each private
key and a common private key. This cryptosystem is asymmetric-key cryptography that has characteristic of a1. Introduction
public-key cryptography.
A chaotic map has sensitivity to a change in initialconditions and parameters, and a long-term forecast becomes impossible by the iterations of a chaotic map. 2. A Chaotic Map
These features look similar to the properties of the crypIn this research, we use a modiﬁed logistic map. The
tology. For that reason, it is eﬀective to use chaotic
modiﬁedlogistic map is one of the simplest chaotic maps.
maps for cryptosystems. The chaotic cryptosystem isThe
modiﬁedlogistic map is expressed as the following
researched as an application of chaos in an engineering
equation:
ﬁeld [1-4].
A lot of chaotic cryptosystems that use the expansion
and the reduction of the chaotic map for the encryption Xk2(0 ≤ Xk ≤ α)and decryption are reported [5][6]. On the other hand,  Xk+1 = α Xk (1 − 2α )many researchers are reported about the disadvantages +1−2α+1−2α)(2 − Xk1−α)(α < Xk ≤ 1)
Xk+1 = ( Xk1−αof cryptosystems using the chaotic map [7][8]. There is(1)a possibility to be linearly attacked when the piecewiselinear map is used in the cryptosystem. In addition, the where α is a parameter changing the top of the map.
advantages of the chaotic map is demonstrated when the This map is shown in Fig. 1. The generated sequences
direction of the expansion is used for the encryption. It looks like the uniform random numbers. Figure 2 shows
an example of chaotic sequences generated by the modiis undesirable to use reduced map for cryptosystem.
Moreover, a symmetric-key cryptography has the ﬁed logistic map. The behavior like the uniform random
problem of the delivery of the key distribution. This number is seen in α = 0.5.
problem can be solved by using a public-key cryptograThis map has sensitivity to a change in parameter α.
phy. However, there are two problems in the application Therefore, a long-term forecast becomes impossible byof the chaotic map to the public-key cryptography. One the iterations of a map. However, the modiﬁed logistic
is that the trap door is necessary to realize the public map is based on an easy equation. Even if eavesdropkey cryptosystem. It is diﬃcult to develop trap door in pers does not know the value of α, parameter α can bethe chaotic map. The other is that the system equation obtained from the relation of two successive numbers. In- 98 -

Figure 1: Modiﬁed logistic map F . (α = 0.5)

Figure 3: Lyapunov exponent of the modiﬁed logisticmap.
1 ∑log |F ′ (Xk )|L
L−1

λL (Xk ) =(3)k=0This function has sensitivity to a change in initialvalue X0 and a value of L. Figure 4 shows the relation between λL and L. We can see that the range ofthe value of λL is changing with the values of L.

Figure 2: Chaotic sequence. (α = 0.5)

other words, it is necessary to know the number of iterations of the modiﬁed logistic map to obtain α. If thenumber of iterations k is an unknowns, it is very diﬃcult
to obtain correct α from the value of X0 and Xk . We
propose the chaotic cryptosystem using this feature.
The Lyapunov exponent of this map is expressed as
the following equation.
N −1

1 ∑log |F ′ (Xk )|N →∞ N

λ = lim(2)Figure 4: Relation between λL and L.

k=0

Figure 3 shows the Lyapunov exponent generated by
the modiﬁed logistic map. Horizontal axis shows thevalue of α, vertical axis shows the value of the Lyapunov
exponent. We can see that the Lyapunov exponent depends on the value of α.
The Lyapunov exponent converges to a constant value
without depending on an initial value. In this research,
we use the Lyapunov exponent until convergence. Theﬁnite Lyapunov exponent is expressed as the followingequation.

3. A Chaotic Cryptosystem
We propose a cryptosystem by using the Lyapunov exponent of a modiﬁed logistic map. The simpliﬁed block
diagram of the cryptosystem is shown in Fig. 5. This
cryptosysytem is composed of the following three parts.
Key generation, encryption process and decryption process.

- 99 -

Send this value (C1 , C2 ) as a ciphertext to the receiver.
• C1 , C2 : ciphertexts.
• B : private key.
3.3. Decryption Process
In the decryption process, decryptor calculates C1 −λL (F A (C2 )) by using a private key A.
C1 − λL (F A (C2 )) = M + λL (XA+B ) − λL (F A (XB ))= M + λL (XA+B ) − λL (XB+A )=M(5)And decrypt the plaintext M . An important thing isthat there is no need to calculates the value of B. The
decryptor uses only common private keys and private
key A for the decryption.

Figure 5: Block diagram of the cryptosystem.
3.1. Key Generation

3.4. Requirements for Cryptosystem

This cryptosystem uses three kind of keys, a publickey, a private key and a common private key. A common private key means shared secret key between thedecryptor and the encryptor. And, the keys are decided
by the decryptor. The process of key generation is asfollows.
The decryptor set an initial point X0 , parameters αand L, here α and L are common private keys. In addition, set a number of iterations A. This value A isa private key of the decryptor. The decryptor keep aprivate key A to himself.
Calculate XA = F A (X0 ), namely A-time iterations ofa modiﬁed logistic map F .
The decryptor can obtain X0 , XA as public keys, α,L as common private keys and A as a private key.

The key space size and plaintext size are required over
128 bits (40 digits) for the defense against brute force attack. It is not necessary to consider the eﬀect of rounding
error of the sequences generated by the modiﬁed logistic maps. Because only the direction of the expansion
is used. Therefore, we truncate a number to 40 decimal
places by the iteration of the maps. And the ciphertext
sizes are deﬁned the same as the plaintext.
In this cryptosystem, a public key, a common key andtext size are deﬁned as follows :• α 40 digits.
• X0 , XA (∈ 0, 1) and M 40 digits.
• C1 and C2 40 digits.

Next, we investigate the numbers of iterations A andB. The cipher-breaking becomes diﬃcult by increasing
this value. The calculation time of the cryptosystem• α, L : common private keys.
depends on the number of iterations.
• A : private key.
In order to determine the number of iterations, we simulated the sequences with slightly diﬀerent keys. Figure
6 shows the diﬀerence of the generated value Xn between
3.2. Encryption Process
the case of X0 = 0.2 and the case of X0 = 0.2 + 10−40 .
We explain an encryption process of this cryptosys- The horizontal axis shows the number of the iterations,tem. The encryptor chooses the value B as a number and the vertical axis shows the diﬀerence between theof iterations, where B is an arbitrary value. Encryptor generated sequences.
encrypts by using a private key B.
From this ﬁgure, there are no large diﬀerences of two
The encryption functions are described as follows :values until the iteration exceeds 150 times. It is undesirable to use the range of N < 150 as the keys. We
can see the diﬀerence of two values that have changed
C1 = M + λL (F B (XA )) = M + λL (XA+B )(4) nonuniformity for N > 150. Therefore, we determine
C2 = F B (X0 ) = XB
that the number of iterations are arbitrary value over
here, M is a plaintext.
150 times.
• X0 , XA : public keys.

- 100 -5. Conclusions

Figure 6: Diﬀerence of two values for X0 = 0.2 andX0 = 0.2 + 10−40 .

In this research, we have proposed a cryptosystem using the Lyapunov exponent of a modiﬁed chaotic map.
And we have investigated vulnerability of this cryptosystem. The proposed cryptosystem is a symmetric-key
cryptography that looks like a public-key cryptographythat has both of a private key and a common private key.
The number of the delivery of the keys has decreased tousing this cryptosystem.
As the future subject, we investigate security of theproposed cryptosystem in more detail. And we apply
the proposed cryptosytem to the system of the personalauthentication.
References

4. Security Analysis[1] L. Kocarev, “Chaos-Based Cryptography : A Brief
Overview, ” IEEE Circuits and Systems Magazine,
This cryptosystem uses the public-key cryptography
vol. 1, pp. 6-21, 2001.
for a part of the cryptosystem, and the number of thedelivery of the keys are decreased. It is very diﬃcult [2] G. Jakimoski, L. Kocarev, “Chaos and Cryptografor eavesdroppers to obtain correct α and A from thephy : Block Encryption Ciphers Based on Chaotic
value of X0 and XA . Therefore, we open X0 and XA
Maps,” IEEE Trans. Circuits and Systems I, vol. 48,
to the public as public keys. Moreover, there is a possino. 2, pp. 163-169, 2001.
bility that all of the parameter α generates the value ofXA after the N -times iterations. Because the generated [3] X. Yi, “Hash Function Based on Chaotic Tent
sequences by the modiﬁed logistic map are a long-term
Maps,” IEEE Trans. Circuits and Systems II, vol.
sequences. For that reason, we thought that the value
52, no. 6, pp. 354-357, 2005.
of α and the value of A did not be calculated even if
the value of X0 and the value of XA were opened to the [4] N. Masuda, G. Jakimoski, K. Aihara and L. Kocarev,“Chaotic Block Ciphers : From Theory to Practical
public. And we used X0 and XA as public keys.
Algorithms,” IEEE Trans. Circuits and Systems I,
Next, we consider a chosen plaintext attack (CPA)
vol. 53, no. 6, pp. 1341-1352, 2006.
for this cryptosystem. A CPA is an attack model for
cryptanalysis which presumes that the attacker has the [5] T. Habutsu, Y. Nishio, I. Sasase and S. Mori, “Acapability to choose arbitrary plaintexts to be encrypted
Secret Key Chaotic Map,” Trans. IEICE, vol. E73,and obtain the corresponding ciphertexts.
no. 7, pp. 1041-1044, 1990.
This proposed cryptosystem is a simple but eﬀective[6] M. Harada, Y. Nishio and A. Ushida, “A Crypsystem against the CPA. When this cryptosystem is attosystem Using Two Chaotic Maps,” Proceedings oftacked by a CPA, and encryptor selects the same value
NOLTA’99, vol. 2, pp. 609-611, 1999.
B, the eavesdroppers can easily obtain two values as
λL (XA+B ) and XB . However, it is diﬃcult for eaves- [7] E. Biham, “Cryptanalysis of the chaotic-map crypdroppers to obtain correct A, B and α from the value oftosystem suggested at EUROCRYPT’91,” Proc. EuX0 , XA , XB and λL (XA+B ). Even if a discrete-valued
rocrypt ’91, pp. 532-534, 1991.
of the chaotic sequences are known to the eavesdroppers,
the eavesdroppers have to detect two successive numbers [8] N. Masuda, K. Aihara, “Cryptosystems with discretized chaotic maps,” IEEE Trans. Circuits andor the number of iterations to calculate the parameter
Systems I, vol. 49, pp. 28-40, 2002.
α.
In addition, the encryptor can easily change the num- [9] L. Kocarev, Z. Tasev, “Public-key encryption based
ber of iterations B at the every encryption, also same foron Chebyshev maps, ” Proceedings of ISCAS’03, vol.
the decryptor. The security of the cryptosytem becomes
3, pp. 28-31, 2003.
more safety by setting the diﬀerent private key at theencryption.

- 101 -