# Image Encryption Algorithms: A Survey of Design and Evaluation Metrics
## 2 Image Encryption Algorithms
### Traditional Ciphers  
At the moment, traditional ciphers are the most commonly used algorithms to encrypt images over networks. The images are converted into bit streams and then encrypted using one of the traditional encryption methods.  
The advanced encryption standard (AES) [3] is a widely adopted and recommended encryption algorithm. AES is a symmetric key encryption with variable key lengths and round numbers. It uses 10 rounds of encryption for 128-bit keys, 12 rounds for 192-bit keys, and 14 rounds for 256-bit keys. AES works on blocks with 128 bits, and each round involves a series of SPN-based (substitution-permutation network-based) operations on each block of data, that is, SubBytes, ShiftRows, MixColumns, and AddRoundKey. The AES can be used in various modes, but the electronic codebook (ECB) mode is not suitable for image encryption as it produces cipher images with noticeable patterns, where identical blocks of the image will result in producing identical blocks in the cipher image. To avoid this problem it is recommended to use AES in a cipher block chaining (CBC) mode.  
Towfish [4] is another symmetric key block cipher that has 16 rounds and uses variable key lengths of 128, 192, and 256 bits. Twofish uses a Feistel network structure and works on 128-bit blocks. Each round involves a series of operations on each block of data, that is, substitution boxes, linear transform based on a maximum distance separable (MDS) code, pseudo-Hadamard transform (PHT), and a key addition function.  
Stream ciphers have also been used in image encryption. They produce a pseudo-random keystream from a key and an initialization vector (IV) or nonce; this keystream is then combined with the plaintext image in a bitwise operation (usually XOR) to produce the cipher image. Trivium [5] is a synchronous stream cipher that is based on a nonlinear-feedback shift register (NLFSR), which generates a keystream of up to \(2^{64}\) bits using an 80-bit secret key and an 80-bit IV. Trivium cipher has three phases: an initialization phase, a warm-up phase, and an encryption phase. In the initialization phase, the key and the IV are loaded into the 288-bit state register and all remaining bits are set to 0 (except for 3 specific bits, which are set to 1). In the warm-up phase, the cipher is clocked 1152 times without generating an output. In the encryption phase, all bits produced after the 1152\({}^{\text{th}}\) cycle are used to generate the keystream. To produce the cipher image, a keystream equal to the size of the plaintext image is XORed with the plaintext image. ChaCha20 [6] is another stream cipher that generates a keystream of up to \(2^{64}\) bits using a 256-bit secret key, 64-bit nonce, and a 64-bit counter. In the ChaCha20 cipher, the 512-bit state is divided into a 4-by-4-word matrix containing 8 keywords, 4 constant words, and 4 words for the nonce and counter. ChaCha20 has 20 rounds; each round has 16 additions, 16 XORs, and 16 constant-distance rotations of 32-bit words. After 20 rounds, a 512-bit keystream is produced. To produce a cipher image, a keystream equal to the size of the plaintext image is XORed with the plaintext image.