# Cryptanalysis of Permutation-Diffusion-Based Lightweight Chaotic Image Encryption Scheme Using CPA
## 3 Cryptanalysis of the Original Scheme
### Obtain the Equivalent Secret Key \(R\)  
In this section, we discuss how to obtain the secret key \(R\) of the original diffusion phase in detail. For the original diffusion process, even if it employs the superiority, such as larger key space and key sensitivity of the 2D Baker's map to diffuse the permuted image, the key equivalent that is functionally equal to the secret key of the diffusion phase can be easily obtained with a CPA attack (called the zero image \(\mathbf{I}_{0}\) as the chosen plaintext), as shown in the flowchart of Figure 3. Furthermore, the cipher image \(\mathbf{C}_{0}\) generated by encrypting the full zero image \(\mathbf{I}_{0}\) is exactly the key equivalent of the original diffusion phase, which will be discussed in detail next. With the help of the known constant value matrix \(\mathbf{T}\), the correct secret key \(R\) can be revealed completely. According to the assumption of chosen-plaintext that the plaintext is chosen in advance and its corresponding ciphertext can be generated from the chosen-plaintext, let a full zero image act as the chosen-plaintext image \(\mathbf{I}_{0}\). Note: all of the existing permutation algorithms will lose their efficacies if a full zero image is used to act as the plaintext image. Therefore, after the original permutation phase, the permuted image of the chosen-plaintext image \(\mathbf{I}_{0}\) is still itself. For the diffusion phase, although we do not know the secret key used in the diffusion phase, the diffusion algorithm is public and available. Thus, according to (3), (4) and the permuted image \(\mathbf{I}_{0}\), we have  
\[\mathbf{r}=\text{mod}((\mathbf{I}_{0}+R),\;256)=\text{mod}(R,\;256). \tag{6}\]  
Based on the above (6), the matrix \(\mathbf{r}\) has become a matrix in which all element values equal to the random number \(R\) generated by [PERSON]'s map or its equivalent; in other word, the plaintext-related process of the original scheme has become invalid. Then, with the assistance of (5), the matrix \(\mathbf{r}\) and the permuted plaintext image \(\mathbf{I}_{0}\), the ciphertext image \(\mathbf{C}_{0}\) can be obtained as  
\[\mathbf{C}_{0}=\text{mod}((\mathbf{r}\oplus\mathbf{I}_{0}\oplus T(i,j)),\;256 )=\text{mod}((\mathbf{r}\oplus T(i,j)),\;256), \tag{7}\]  
Figure 3: Flowchart on obtaining the secret key \(R\). Figure 2: A framework of the proposed attack strategy. where \(T(i,\ j)=((M/i)+(N/j))\) is a constant value matrix relying on an image size and its pixel position; or rather, it can be available by anyone who wants to know the content of the matrix. The obtained ciphertext image \(\mathbf{C}_{0}\) is the final encryption resultant of the chosen-plaintext image \(\mathbf{I}_{0}\), and it is known and available according to the assumption of chosen-plaintext. Apparently, the ciphertext image \(\mathbf{C}_{0}\) only relies on the matrix \(\mathbf{r}\); also, the matrix \(\mathbf{r}\) is exactly decided by the random number \(R\) or its equivalent. Thus, ciphertext image \(\mathbf{C}_{0}\) is the key equivalent of the diffusion phase. By further XORing the known constant value matrix \(T(i,\ j)=((M/i)+(N/j))\), as show in (8), the correct diffusion key \(R\) of the original diffusion phase can be completely revealed. \[\mathbf{C}_{0}\oplus T(i,\ j)=\text{mod}((\mathbf{r}\oplus T(i,\ j)),\ 256) \oplus T(i,\ j)=\mathbf{r} \tag{8}\]  
For clarity, we also provide the process of revealing the diffusion key \(R\). As depicted in Algorithm 1, the diffusion key \(R\) can be easily obtained by using the full zero plain image \(\mathbf{I}_{0}\) and the constant value matrix \(\mathbf{T}\), which also provides the indicator of a large loophole existing in the original cryptosystem.