## 2 System Model of the Proposed Scheme
### Codeword Embedding  
Using the codewords of RS codes, a data-hider can embed \(N_{\mathrm{c}}\) codewords into the encrypted image. Let \(\mathbf{c}_{v}\) be the \(v\)-th codeword \((c_{v}(0),c_{v}(1),\cdots c_{v}(n-1))\) for \(v=0,1,\cdots,N_{\mathrm{c}}-1\), where \(c_{v}(l)\) is an element of \(GF(2^{q})\). There exists a bijection mapping \(B\) between an element in GF(\(2^{q}\)) and \(q\) elements in GF(\(2\)) according to a primitive polynomial of GF(\(2^{q}\)). Therefore, the binary bit can be determined from an element of GF(\(2^{q}\)) by the bijection function \(B_{\mathrm{F2B}}\) as:  
\[B_{\mathrm{F2B}}(c_{v}(l))=\left(c_{v,l}(0),c_{v,l}(1),\cdots,c_{v,l}(q-1) \right), \tag{1}\]  
where \(c_{v}(l)\in\mathrm{GF}(2^{q})\) for \(l=0,1,\cdots,n-1\) and \(c_{v,l}(t)\in\mathrm{GF}(2)\) for \(t=0,1,\cdots,q-1\). The mapping \(B_{\mathrm{C}}\) can be applied to codeword \(\mathbf{c}_{v}\) as:  
\[B_{\mathrm{C}}(\mathbf{c}_{v})=\left(B_{\mathrm{F2B}}(c_{v}(0)),B_{\mathrm{ F2B}}(c_{v}(1)),\cdots,B_{\mathrm{F2B}}(c_{v}(n-1))\right). \tag{2}\]  
Then, the total concatenation of all binary codeword bit is expressed as:  
\[\mathbf{z}=\left(B_{\mathrm{C}}(\mathbf{c}_{0}),B_{\mathrm{C}}(\mathbf{c}_{1 }),\cdots,B_{\mathrm{C}}(\mathbf{c}_{N_{\mathrm{c}}-1})\right). \tag{3}\]  
The \((nqN_{\mathrm{c}})\)-bit sequence \(\mathbf{z}^{\prime}\) can be defined as:  
\[\mathbf{z}^{\prime}=\pi(\mathbf{z}), \tag{4}\]  
where \(\pi\) is a permutation function. To apply \(\mathbf{z}^{\prime}\) to the block array, \(y(a,b)\), an element of the \(a\)-th row and the \(b\)-th column in \(\mathbf{y}\) is mapped from the \(\left(a\lfloor\frac{M}{s}\rfloor+b\right)\)-th element of \(\mathbf{z}^{\prime}\) as:  
\[y(a,b)=z^{\prime}\left(a\left\lfloor\frac{M}{s}\right\rfloor+b\right), \tag{5}\]  
where \(0\leq a<\lfloor\frac{L}{s}\rfloor\) and \(0\leq b<\lfloor\frac{M}{s}\rfloor\).  
In Figure 2, an example of codeword embedding is shown. The size of the image and \(s\) is assumed as \(512\times 512\) and \(26\), respectively. The length of RS codes is assumed as \(n=15\). Then, \(N_{\mathrm{b}}\) and \(N_{\mathrm{c}}\) are determined as \(361\) and six, respectively. The gray rectangles denote the region that does not contain embedded codeword bits in the image. A square in Figure 2 denotes one block with \(26\times 26\) pixels. The square in the \(a\)-th row and \(b\)-th column array can embed one bit denoted as \(y(a,b)\). The permutation function \(\pi\) in (4) is considered as the simple rearrangement of codeword bits of \(\mathbf{z}\) in (3) according to incremental orders of \(v\), \(t\) and \(l\) in (1)-(3).  
In the \((a,b)\) block, the encrypted pixel \(E_{i,j}\), which satisfies \(as\leq i<(a+1)s\), \(bs\leq j<(b+1)s\), exists within the same block, where \(a,b\) are non-negative integers. For each \((a,b)\) block, the \(s^{2}\) pixels are pseudo-randomly divided into two sets, \(S_{0}(a,b)\) and \(S_{1}(a,b)\), uniformly distributed according to a data-hiding key. The \(y(a,b)\) is embedded into the \((a,b)\) block by flipping \(w\) LSBs in the group, which are determined by the value of the codeword bit. If the \(y(a,b)\) is zero, the \(w\) LSBs of each encrypted pixel in \(S_{0}(a,b)\) are flipped. Similarly, if the \(y(a,b)\) is one, the \(w\) LSBs of pixel in \(S_{1}(a,b)\) are flipped. Let \(h_{w}\) be a function for flipping \(w\) LSBs of an encrypted pixel. For example, the function for flipping three LSBs, \(h_{3}\), is expressed as:  
\[h_{3}=00000111_{(2)}. \tag{6}\]  
The encrypted pixel with embedded codeword bits, \(E^{\prime}_{i,j}\), can be represented as:  
\[E^{\prime}_{i,j}=\begin{cases}\overline{E_{i,j}}&\text{for $(i,j)\in S_{0}(a,b)$ and $y(a,b)=0$}\\ \overline{E_{i,j}}&\text{for $(i,j)\in S_{1}(a,b)$ and $y(a,b)=1$}\\ \overline{E_{i,j}}&\text{otherwise,}\end{cases} \tag{7}\]  
where \(\overline{E_{i,j}}=E_{i,j}\oplus h_{w}\).