# Cryptanalysis of Permutation-Diffusion-Based Lightweight Chaotic Image Encryption Scheme Using CPA
## 3 Cryptanalysis of the Original Scheme
### Obtain the Permutation Rule \(l_{p}\)  
Having attacked the diffusion phase of the original scheme, the final encrypted resultant generated by the original cryptosystem could be restored into permutation-only phase. In this section, we further analyze and attack the permutation phase of the original scheme so as to retrieve the original plaintext image. The flowchart structure of revealing the permutation rule \(\mathbf{l}_{p}\) is presented in Figure 4. First, \(n\) pairs of plain images \(\mathbf{I}_{1}\), \(\mathbf{I}_{2}\), \(\cdots\), \(\mathbf{I}_{n}\) are chosen as the \(n\) chosen-plaintext images. Based on the original cryptosystem, we can easily obtain their corresponding final cipher images \(\mathbf{C}_{1}\), \(\mathbf{C}_{2}\), \(\cdots\), \(\mathbf{C}_{n}\). With the help of the diffusion key \(R\) revealed in the previous section, we can obtain the permutation rule \(l_{p}\), which is composed of \(\mathbf{P}_{1}\), \(\mathbf{P}_{2}\), \(\cdots\), \(\mathbf{P}_{n}\). Next, the detailed analysis process of revealing the permutation rule will be described. For the permutation process of the original cryptosystem, both the key space and key sensitivity are reliable and effective; it is almost impossible to obtain the key directly from the permutation phase. Nevertheless, the map matrix which is equivalent to the secret key of the permutation phase can be revealed by using the state-of-the-art work [18], which will be discussed in the following. Note that for any of the existing scrambling algorithms, they cannot modify the pixel values of an image, but merely scramble the pixel positions. Therefore, if one can utilize some possible means to uniquely identify a pixel position, the permutation rules of all permutation-only cryptosystems will be revealed accurately and efficiently under any conditions (regardless of the cryptosystem structures). The assumption has been successfully implemented in recent proposed the state-of-the-art work [18], which can completely determine the correct plaintext elements by utilizing a deterministic method. For a plain image \(\mathbf{I}\) of size \(M\times N\), which acts as the test image in original cryptosystem, the position of each pixel row by row in the plaintext image can be determined by a dimension vector \(\mathbf{pos}_{p}=\big{\{}\mathit{pos}_{p}(i)\big{\}}_{i=0}^{M\times N-1}\). According to the Lemma 1 of [PERSON] et al. 's work [18], the number of the chosen-plaintext images to break any of the existing permutation-only cryptosystems is \(n\), which can be formulized as follows. \[n\geq\lceil\log_{L}(M\times N)\rceil, \tag{9}\]  
where \(M\times N\) denotes the number of locations, i.e., the size of an image; \(L\) denotes the number of all entries, and there will be 256 entries for an image of 8 bit in depth. In the following, we will discuss two concrete cases to completely determine the correct plaintext elements of the permutation-only cryptosystem on the basis of (9). Case 1: If the size of a plaintext image \(\mathbf{I}\) is \(256\times 256\), only two chosen plaintext images--\(\mathbf{I}_{1}\) and \(\mathbf{I}_{2}\)--will be chosen to obtain the permutation rule. The following will give some related analyses. For the plaintext image \(\mathbf{I}\) of size \(256\times 256\) which will be restored using the two chosen plaintext images \(\mathbf{I}_{1}\) and \(\mathbf{I}_{2}\), the position vector \(\mathbf{pos}_{p}=\big{\{}\mathit{pos}_{p}(i)\big{\}}_{i=0}^{M\times N-1}\) of all pixels in the plaintext image can be  
Figure 4: Flowchart on obtaining the permutation rule \(l_{p}\). rearranged row by row in the matrix \(\mathbf{A}\), as shown in (10), where each element includes two digits in base 256 across the character set \([0,\;1,\;2,\;\cdots,\;255]\) to express the position of \([0,\;1,\;2,\;\cdots,\;256\times 256-1]\). \[\mathbf{A}=\left[