# On the Security Analysis of a Hopfield Chaotic Neural Network-Based Image Encryption Algorithm

Authors: Yingchun Hu; Simin Yu; Zeqing Zhang
Journal: Complexity
 (2020)

---

## Abstract

In this paper, the security analysis of a color image encryption algorithm based on Hopfield chaotic neural network is given. The original chaotic image encryption algorithm includes permutation encryption and diffusion encryption. The result of cryptanalysis shows that the chaotic sequences generated by this algorithm are independent of plaintext image, and there exist equivalent permutation key and equivalent diffusion key. Therefore, according to chosen-plaintext attack, the equivalent diffusion key and the equivalent permutation key can be obtained by choosing two special plaintext images and the corresponding ciphertext images, respectively, and the plaintext image is further recovered from the ciphertext image. Theoretical analysis and numerical simulation experiment results verify the effectiveness of the analytical method. Finally, some improved suggestions for the original encryption algorithm are proposed to promote the security.


---

## Body

## 1. Introduction

With the rapid development of network technology, the security and privacy protection problems of multimedia information have become a hot subject. In order to promote the security of information transmission, scholars have proposed a large amount of image encryption algorithms based on different mechanisms and theories, such as chaotic map [1–13], neural network [14], DNA [15–18], and so on. The security performance of the image encryption algorithms mainly depends on statistical test indicators, such as key space, histogram, key sensitivity analysis, information entropy, differential attack, and so on. However, statistical test indicator is an essential condition and not a sufficient condition for measuring security presented in [19]; moreover, some of them are proven to be insecure due to their inherent pitfalls [20–30]. Therefore, it is necessary to perform cryptanalysis in order to improve the security of the image encryption algorithms.In recent years, many image encryption algorithms have been cryptanalyzed by the researchers. For example, in [20], the cryptanalysis of an image encryption cryptosystem based on binary bit planes extraction and multiple chaotic maps (IEC-BPMC) proposed in [1] is given; it is pointed out that IEC-BPMC is insecure against chosen-plaintext attack. In [21], the security analysis of an image chaotic encryption algorithm based on Latin cubes and bit cubes presented in [2] is proposed; it is reported that the generation of Latin cubes is independent of plain image, while in the diffusion stage, when any one bit in the plain image changes, the corresponding number of bits in the cipher image follows the change with obvious regularity. According to chosen-plaintext attack, only a maximum of 2.5×w×h3+6 plaintext images are needed to crack the ciphertext images of size w×h resolution. In [22], according to chosen-ciphertext attack, the security analysis for a self-synchronization and closed-loop feedback-based chaotic stream cipher proposed in [3] is given; it has shown that, under the condition that only one unknown key needs to be deciphered while the remaining keys are all known, most secret keys can be deciphered accurately. In addition, the attack complexity of the proposed method is lower than that of the exhaustive attack. In [23], the security performance for an 8D self-synchronous and feedback-based chaotic stream cipher with low 8 bits of state variables for encryption proposed in [4] is analysed, according to known-plaintext attack and divide-and-conquer attack, 49 secret keys can be obtained, and an improved chaotic stream cipher is proposed for improving the ability to resist divide-and-conquer attack and chosen-ciphertext attack. According to chosen-plaintext attack, in [24], the security analysis of an image encryption algorithm based on 3D bit matrix permutation presented in [5] is given and proposes some improved suggestions in order to enhance security performance. The cryptanalysis of the image encryption algorithm proposed in [7] is presented in [25]; it is reported that the equivalent secret keys can be obtained by utilizing chosen-plaintext attack and further recover the original plaintext image from the ciphertext image. In [26], the security analysis of an image encryption algorithm based on improved hyperchaotic sequence presented in [8] is given; it is shown that only 1-pair known plaintext-ciphertext image can crack the original encryption algorithm by using known-plaintext attack. In [27], the cryptanalysis of an image encryption algorithm with one round diffusion structure proposed in [9] is reported to find that the original encryption algorithm has equivalent secret keys, so that it can be deciphered by known-plaintext and chosen-plaintext attack. In [28], it is pointed out that permutation-only encryption structure presented in [10] is insecure against known-plaintext attack and chosen-plaintext attack, respectively; for given image of size MN, the original encryption algorithm is cracked by only using ⌈logLMN⌉ plaintext-ciphertext images. The image encryption algorithm based on DNA encoding and spatiotemporal chaos is proposed in [15]; nevertheless, it is broken in [29] by using chosen-plaintext attack and chosen-ciphertext attack with lower computation complexity and data complexity, respectively. In [30], the security analysis of an image encryption algorithm based on 2D Henon-Sine map and DNA proposed in [17] is given; it is found that cipher image can be cracked by utilizing chosen-plaintext attack without known keys, and its attack complexity is O18.In 2019, a color image encryption algorithm based on Hopfield chaotic neural network (CIEA-HCNN) is given in [14]. CIEA-HCNN adopts permutation encryption-diffusion encryption structure; in the permutation encryption phase, firstly, the parameters of Arnold cat map are generated by chaotic sequence and then Arnold cat map is used to scramble the pixel positions of plaintext image. In the diffusion encryption stage, diffusion matrix is generated by utilizing Hopfield chaotic neural network, and then bitwise XOR operation is performed by using diffusion matrix on the scrambled image to obtain the ciphertext image. Some statistical test results are proposed in CIEA-HCNN, and it is claimed that the encryption algorithm has a higher security performance against various attacks. However, CIEA-HCNN has the following inherent defects from the view of cryptanalysis:(1)
The chaotic sequences generated by key-streams are independent of plaintext image; for given secret key parameters and the size of the plaintext image, the chaotic sequences remain unchanged regardless of the plaintext image.(2)
The diffusion encryption structure is too simple, there is no ciphertext feedback mechanism, and there exists equivalent diffusion key. According to chosen-plaintext attack, the equivalent diffusion key is broken by choosing one special plaintext image and its corresponding ciphertext image without known keys.(3)
The permutation encryption structure is a permutation-only encryption process. After deciphering the diffusion encryption structure, the original encryption algorithm becomes a permutation-only encryption structure; in [28], it is pointed out that permutation-only is insecure and cannot resist chosen-plaintext attack and known-plaintext attack. Moreover, parameters of Arnold cat map generated by chaotic sequence depend solely on the secret keys, and the position 0,0 is always mapped into itself in Arnold cat map.According to the above shortcomings, one obtains that CIEA-HCNN is insecure, and it is vulnerable to chosen-plaintext attack or known-plaintext attack. An attacker can successfully crack the original encryption algorithm by using the equivalent diffusion key and the equivalent permutation key without knowing the secret keys.The rest of the paper is organized as follows. Section2 briefly introduces CIEA-HCNN under study. Section 3 analyses the security performance of CIEA-HCNN by using chosen-plaintext attack. Section 4 gives the numerical simulation experiments and the suggestions for improvement. Section 5 concludes the paper.


## 2. Chaotic Encryption Algorithm under Study

In this section, Hopfield chaotic neural network and Staged composite chaotic map proposed in [14] are first given, and then CIEA-HCNN is introduced in detail.


### 2.1. Hopfield Chaotic Neural Network

In 1982, American physicist Hopfield first proposed Hopfield chaotic neural network given in [31]. It is a fully connected neural network, mainly used providing model of simulation human memory. Simultaneously, Hopfield chaotic neural network is also a feedback neural network, and the output signal of each neuron in the network is usually fed back to itself by using other neurons. The iterative equation of Hopfield chaotic neural network is given by(1)x=−xi+∑i=13wijvi,(2)vi=tanhxi=exi−e−xiexi+e−xi,(3)w=2−101.71.711.1−2.5−2.90.56,where state variable xi∈0,1, i=1,2,3, j=1,2,3, v denotes a hyperbolic tangent function, and w represents a weight matrix.


### 2.2. Staged Composite Chaotic Map

Staged composite chaotic map is a novel phased chaotic map which combines Logistic map with Tent map, given by(4)xn+1=16μxn0.5−μxn,0≤xn<0.25,16μ0.5−xn0.5−μ0.5−xn,0.25≤xn<0.5,16μxn−0.50.5−μxn−0.5,0.5≤xn<0.75,16μ1−xn0.5−μ1−xn,0.75≤xn<1,where control parameter μ∈0,2, state variable xn∈0,1, n=0,1,2,…. The system is chaotic defined by equation (4) when μ∈0.33,2.


### 2.3. Description of CIEA-HCNN

In [14], CIEA-HCNN consists of secret keys selection, chaotic sequences generation, permutation encryption, and diffusion encryption, as shown in Figure 1, where x1′,x2′,μ1,μ2,m0,mr,mg,mb are secret key parameters, X,Y,Z,Ware chaotic sequences generated by Staged composite chaotic map, α and β are parameters of Arnold cat map, T is a permutation matrix, H1,H2,H3 are sequences generated by Hopfield chaotic neural network, D is a diffusion matrix, P is a color plaintext image, S is a temporary permutation encryption image of P, S′ is a permutation encryption image of P, C′ is a diffusion encryption image of S′, and C is a ciphertext image corresponding to the plaintext image P; the detailed encryption principles of CIEA-HCNN are presented as follows:Figure 1
Block diagram of CIEA-HCNN.(1)
Choose secret key parameters. CIEA-HCNN includes eight secret key parametersx1′,x2′,μ1,μ2,m0,mr,mg,mb, where x1′,x2′,μ1,μ2 are initial values and control parameters of Staged composite chaotic map and m0,mr,mg,mb are iterative numbers of Staged composite chaotic map.(2)
Generate chaotic sequencesX,Y,Z,W. From equation (4), iterate Staged composite chaotic map m0 times; one gets the chaotic sequence X=x1,x2,…,xm0. Simultaneously, one obtains three chaotic sequences Y=y1,y2,…,ymr, Z=z1,z2,…,zmg, and W=w1,w2,…,wmb. Actually, only four state variables xm0,ymr,zmg,wmb are used in the following encryption process.(3)
Encrypt image by the chaotic encryption algorithm. The encryption object of CIEA-HCNN is a color plaintext image of sizeM×N×3 denoted by P=Pi,j,ki=1,j=1,k=1M,N,3, where P∈0,1,…,255 [14], and hereinafter referred to as the plaintext image. The ciphertext image of P is represented by C=Ci,j,ki=1,j=1,k=1M,N,3, where C∈0,1,…,255. Besides, the plaintext image P has Red, Green, and Blue channels; for the sake of convenience of expression, one simplifies the three channels to R, G, and B channels. The steps for CIEA-HCNN are shown as follows:Step 1: Permutation Encryption. First, F transform xm0 of the chaotic sequence X; one obtains control parameters α andβ of Arnold cat map, given by(5)α=floormodxm0×224,N,β=floormodmodxm0×248,224,N,whereN is the width of the plaintext image P, mod represents a modular operation, and floor rounds a real number to the nearest integer.In Figure1, scramble R, G, B channels of P by utilizing Arnold cat map, respectively, and get the corresponding temporary permutation encryption image denoted by S=Si,j,ki=1,j=1,k=1M,N,3; the iterative equation of Arnold cat map is defined as(6)xn+1yn+1=1αβαβ+1xn+1yn+1modN,wherexn,yn and xn+1,yn+1 represent the before and after coordinate of permutation encryption through using Arnold cat map; moreover, the default number of Arnold cat map iterations is set as 1 [14]. According to Figure 1 and equation (6), one gets(7)T=1αβαβ+1=abδε.Finally, scan R, G, B three channels ofS in a raster order from left to right and up to down; one obtains the permutation encryption image S′=S′k,lk=1,l=13,MN with the size of 3×MN, given by(8)S′k,l=S′1,1S′1,2⋯S′1,MNS′2,1S′2,2⋯S′2,MNS′3,1S′3,2⋯S′3,MN.Step 2: Diffusion Encryption. First, set the chaotic sequences ymr, zmg, and wmb as the initial values of Hopfield chaotic neural network, substitute them into equations (1)-(2), iterate MN times, and get three sequences defined by H1ll=1MN,H2ll=1MN,H3ll=1MN. Let H=Hk,lk=1,l=13,MN be equal to H1ll=1MN,H2ll=1MN,H3ll=1MN, such that(9)Hk,l=H1,1H1,2⋯H1,MNH2,1H2,2⋯H2,MNH3,1H3,2⋯H3,MN.Then,Hk,l is quantified to obtain the diffusion matrix D=Dk,lk=1,l=13,MN given by(10)Dk,l=modroundabsHk,l−floorHk,l×1014,256,where round denotes a round-off function and abs is an absolute value function.In Figure1, perform bitwise XOR operation on the permutation encryption image S′ by utilizing diffusion matrix D, and then get the temporary ciphertext image C′=C′k,lk=1,l=13,MN defined as(11)C′k,l=Dk,l⊕S′k,l,where notation⊕ denotes a bitwise XOR operation. Finally, convert the temporary ciphertext image C′ into the ciphertext image C.(4)
Decrypt image by using chaotic decryption algorithm. Decryption is the inverse process of encryption. First, convert the ciphertext imageC into the temporary ciphertext image C′, then perform bitwise XOR operation by using C′ and the diffusion matrix D, and get the permutation encryption image S′. Second, transform S′ into the temporary permutation encryption image S. Finally, implement anti-scramble encryption for S by means of Arnold cat map, and further recover the plaintext image P from the encrypted image C.


## 2.1. Hopfield Chaotic Neural Network

In 1982, American physicist Hopfield first proposed Hopfield chaotic neural network given in [31]. It is a fully connected neural network, mainly used providing model of simulation human memory. Simultaneously, Hopfield chaotic neural network is also a feedback neural network, and the output signal of each neuron in the network is usually fed back to itself by using other neurons. The iterative equation of Hopfield chaotic neural network is given by(1)x=−xi+∑i=13wijvi,(2)vi=tanhxi=exi−e−xiexi+e−xi,(3)w=2−101.71.711.1−2.5−2.90.56,where state variable xi∈0,1, i=1,2,3, j=1,2,3, v denotes a hyperbolic tangent function, and w represents a weight matrix.


## 2.2. Staged Composite Chaotic Map

Staged composite chaotic map is a novel phased chaotic map which combines Logistic map with Tent map, given by(4)xn+1=16μxn0.5−μxn,0≤xn<0.25,16μ0.5−xn0.5−μ0.5−xn,0.25≤xn<0.5,16μxn−0.50.5−μxn−0.5,0.5≤xn<0.75,16μ1−xn0.5−μ1−xn,0.75≤xn<1,where control parameter μ∈0,2, state variable xn∈0,1, n=0,1,2,…. The system is chaotic defined by equation (4) when μ∈0.33,2.


## 2.3. Description of CIEA-HCNN

In [14], CIEA-HCNN consists of secret keys selection, chaotic sequences generation, permutation encryption, and diffusion encryption, as shown in Figure 1, where x1′,x2′,μ1,μ2,m0,mr,mg,mb are secret key parameters, X,Y,Z,Ware chaotic sequences generated by Staged composite chaotic map, α and β are parameters of Arnold cat map, T is a permutation matrix, H1,H2,H3 are sequences generated by Hopfield chaotic neural network, D is a diffusion matrix, P is a color plaintext image, S is a temporary permutation encryption image of P, S′ is a permutation encryption image of P, C′ is a diffusion encryption image of S′, and C is a ciphertext image corresponding to the plaintext image P; the detailed encryption principles of CIEA-HCNN are presented as follows:Figure 1
Block diagram of CIEA-HCNN.(1)
Choose secret key parameters. CIEA-HCNN includes eight secret key parametersx1′,x2′,μ1,μ2,m0,mr,mg,mb, where x1′,x2′,μ1,μ2 are initial values and control parameters of Staged composite chaotic map and m0,mr,mg,mb are iterative numbers of Staged composite chaotic map.(2)
Generate chaotic sequencesX,Y,Z,W. From equation (4), iterate Staged composite chaotic map m0 times; one gets the chaotic sequence X=x1,x2,…,xm0. Simultaneously, one obtains three chaotic sequences Y=y1,y2,…,ymr, Z=z1,z2,…,zmg, and W=w1,w2,…,wmb. Actually, only four state variables xm0,ymr,zmg,wmb are used in the following encryption process.(3)
Encrypt image by the chaotic encryption algorithm. The encryption object of CIEA-HCNN is a color plaintext image of sizeM×N×3 denoted by P=Pi,j,ki=1,j=1,k=1M,N,3, where P∈0,1,…,255 [14], and hereinafter referred to as the plaintext image. The ciphertext image of P is represented by C=Ci,j,ki=1,j=1,k=1M,N,3, where C∈0,1,…,255. Besides, the plaintext image P has Red, Green, and Blue channels; for the sake of convenience of expression, one simplifies the three channels to R, G, and B channels. The steps for CIEA-HCNN are shown as follows:Step 1: Permutation Encryption. First, F transform xm0 of the chaotic sequence X; one obtains control parameters α andβ of Arnold cat map, given by(5)α=floormodxm0×224,N,β=floormodmodxm0×248,224,N,whereN is the width of the plaintext image P, mod represents a modular operation, and floor rounds a real number to the nearest integer.In Figure1, scramble R, G, B channels of P by utilizing Arnold cat map, respectively, and get the corresponding temporary permutation encryption image denoted by S=Si,j,ki=1,j=1,k=1M,N,3; the iterative equation of Arnold cat map is defined as(6)xn+1yn+1=1αβαβ+1xn+1yn+1modN,wherexn,yn and xn+1,yn+1 represent the before and after coordinate of permutation encryption through using Arnold cat map; moreover, the default number of Arnold cat map iterations is set as 1 [14]. According to Figure 1 and equation (6), one gets(7)T=1αβαβ+1=abδε.Finally, scan R, G, B three channels ofS in a raster order from left to right and up to down; one obtains the permutation encryption image S′=S′k,lk=1,l=13,MN with the size of 3×MN, given by(8)S′k,l=S′1,1S′1,2⋯S′1,MNS′2,1S′2,2⋯S′2,MNS′3,1S′3,2⋯S′3,MN.Step 2: Diffusion Encryption. First, set the chaotic sequences ymr, zmg, and wmb as the initial values of Hopfield chaotic neural network, substitute them into equations (1)-(2), iterate MN times, and get three sequences defined by H1ll=1MN,H2ll=1MN,H3ll=1MN. Let H=Hk,lk=1,l=13,MN be equal to H1ll=1MN,H2ll=1MN,H3ll=1MN, such that(9)Hk,l=H1,1H1,2⋯H1,MNH2,1H2,2⋯H2,MNH3,1H3,2⋯H3,MN.Then,Hk,l is quantified to obtain the diffusion matrix D=Dk,lk=1,l=13,MN given by(10)Dk,l=modroundabsHk,l−floorHk,l×1014,256,where round denotes a round-off function and abs is an absolute value function.In Figure1, perform bitwise XOR operation on the permutation encryption image S′ by utilizing diffusion matrix D, and then get the temporary ciphertext image C′=C′k,lk=1,l=13,MN defined as(11)C′k,l=Dk,l⊕S′k,l,where notation⊕ denotes a bitwise XOR operation. Finally, convert the temporary ciphertext image C′ into the ciphertext image C.(4)
Decrypt image by using chaotic decryption algorithm. Decryption is the inverse process of encryption. First, convert the ciphertext imageC into the temporary ciphertext image C′, then perform bitwise XOR operation by using C′ and the diffusion matrix D, and get the permutation encryption image S′. Second, transform S′ into the temporary permutation encryption image S. Finally, implement anti-scramble encryption for S by means of Arnold cat map, and further recover the plaintext image P from the encrypted image C.


## 3. Cryptanalysis

### 3.1. Preliminary Analysis of CIEA-HCNN

According to Kerckhoff’s assumptions [32], one gets that the cryptosystem is open and its security depends solely on the secret keys rather than the cryptosystem itself; that is, the attacker knows everything about the cryptosystem except for the secret keys. If the cryptosystem cannot resist various attacks, it is insecure. There are generally four common attack types for cryptanalysis given in Table 1 from the hardest to the easiest types. In Table 1, ciphertext-only attack is the hardest type, and chosen-ciphertext attack is the easiest type. The adversary reveals secret keys or the equivalent keys to break the cryptosystem by using the four common attack types listed in Table 1.Table 1
Four common attack types for cryptanalysis.
Attack typesAvailable resourceCiphertext-only attackThe attacker only knows the ciphertextKnown-plaintext attackThe attacker knows any given plaintext and also knows the corresponding ciphertextChosen-plaintext attackThe attacker can obtain access to the encryption machinery, choose the plaintext that would be useful for deciphering, and also know the corresponding ciphertextChosen-ciphertext attackThe attacker can obtain access to the decryption machinery, choose the ciphertext that would be useful for deciphering, and also know the corresponding plaintextAccording to Figure1, one obtains that CIEA-HCNN adopts permutation encryption-diffusion encryption structure. First, the diffusion encryption structure of CIEA-HCNN is too simple, and the diffusion matrix D is independent of plaintext image or ciphertext image. Therefore, one gets that CIEA-HCNN has the equivalent diffusion key. According to chosen-plaintext attack, the equivalent diffusion key can be broken by just selecting one pure plaintext image and the corresponding ciphertext image.After cracking the equivalent diffusion key, CIEA-HCNN is simplified to a permutation-only encryption algorithm. In [28], it is pointed out that permutation-only encryption algorithm is insecure. For given secret key parameters and the size of the plaintext image, the generated chaotic sequences remain unchanged which are unrelated to the plaintext image and the corresponding ciphertext image; therefore, the values of α and β in Arnold cat map are fixed, and further the permutation matrix T also remains unchanged. Indeed, the permutation matrix T is the equivalent permutation key of CIEA-HCNN. An attacker can break the permutation-only encryption algorithm by using the permutation matrix T. In addition, the position 0,0 is always mapped into itself in Arnold cat map.According to the above analysis, one gets that the security performance of CIEA-HCNN depends only on the diffusion matrixD and the permutation matrix T; indeed, it means that the equivalent diffusion key and the equivalent permutation key exist in CIEA-HCNN. The adversary can reveal the equivalent keys by using chosen-plaintext attack and further successfully break the original encryption algorithm. Therefore, the problem of cracking secret key parameters x1′,x2′,μ1,μ2,m0,mr,mg,mb in the original encryption algorithm can be solved by chosen-plaintext attack and transforming it into solving the equivalent diffusion key and the equivalent permutation key. Moreover, according to Figure 1, one obtains the simplified block diagram of CIEA-HCNN, as shown in Figure 2. In Figure 2, ET denotes the equivalent permutation key, and ED represents the equivalent diffusion key.Figure 2
Simplified block diagram of CIEA-HCNN.


### 3.2. Cracking CIEA-HCNN by Using Chosen-Plaintext Attack

The basic method of cracking the permutation encryption and the diffusion encryption structure shown in Figure2 is that, according to chosen-plaintext attack, one adopts divide-and-conquer strategy to separate the permutation encryption from the diffusion encryption through choosing the plaintext that would be useful for breaking, on this basis, and further deciphering the equivalent permutation key ET and the equivalent diffusion key ED, respectively. The detailed procedures of cracking the equivalent permutation key ET and the equivalent diffusion key ED are presented as follows.


#### 3.2.1. Deciphering the Equivalent Diffusion KeyED

According to chosen-plaintext attack, choose a full zero image denoted byP1=P1i,j,ki=1,j=1,k=1M,N,3, and get the corresponding ciphertext image defined as C1=C1i,j,ki=1,j=1,k=1M,N,3. Next, using the obtained P1 and C1 as known conditions, one further gets the corresponding equivalent diffusion key ED.The specific approaches for cracking the equivalent diffusion keyED are given as follows.Step 1. Choose a full zero plaintext image asP1, according to chosen-plaintext attack, and get its corresponding ciphertext image as C1. From Figure 1, one obtains the temporary ciphertext image C1′=C1′k,lk=1,l=13,MN corresponding to C1.Step 2. According to equation (11) and Figure 2, one has(12)C1′k,l=S1′k,l⊕EDk,l.Since all pixels ofP1 are zero, after performing the permutation encryption operation for P1, S1i,j,ki=1,j=1,k=1M,N,3=S1′k,lk=1,l=13,MN=0 holds.Step 3. From equations (11)-(12) with S1′k,lk=1,l=13,MN=0, one obtains the equivalent diffusion key ED defined as(13)EDk,l=C1′k,l.


#### 3.2.2. Deciphering the Equivalent Permutation KeyET

After breaking the equivalent diffusion keyED, the original permutation encryption-diffusion encryption structure is simplified to permutation-only encryption structure. Besides, since the original image chaotic encryption algorithm adopts the same permutation matrix to the three channels of the plaintext image, the work of deciphering the equivalent permutation key ET sets the R channel of the plaintext image as an example as follows. First, choose a plaintext image defined as P2=P2i,j,ki=1,j=1,k=1M,N,3, and suppose the pixels of coordinates i1,j1 and i2,j2 in R channel are P2i1,j1,1=ζ≠0 and P2i2,j2,1=λ≠0, respectively. Moreover, i1,j1≠1,1, i2,j2≠1,1 and ζ≠λ, others are full zero, and let all pixels of G channel and B channel be full zero. One obtains the corresponding ciphertext image described by C2=C2i,j,ki=1,j=1,k=1M,N,3. Then using the obtained P2 and C2 as known conditions, one further gets the corresponding equivalent permutation key ET. Note that the equivalent permutation key ET is not affected by the number of Arnold cat map iterations.The specific steps for cracking the equivalent permutation keyET are presented as follows.Step 1. According to chosen-plaintext attack, choose one plaintext image as P2, and get its ciphertext image defined as C2. Then, the temporary ciphertext image as C2′=C2′k,lk=1,l=13,MN is obtained by using the ciphertext image C2.Step 2. Substitute C2′k,lk=1,l=13,MN and EDk,lk=1,l=13,MN with equation (11); the permutation encryption image denoted as S2′=S2′k,lk=1,l=13,MN is described by(14)S2′k,l=EDk,l⊕C2′k,l.Step 3. Convert the permutation encryption image S2′ of size 3×MN into the temporary permutation encryption image S2=S2i,j,ki=1,j=1,k=1M,N,3 of size M×N×3, and then compare S2:,:,1 with P2:,:,1 one by one; one gets(15)P2i1,j1,1=S2m1,n1,1=ζ,P2i2,j2,1=S2m2,n2,1=λ.According to equations (6)-(7), one obtains(16)m1−1n1−1=ETi1−1j1−1modN=abδεi1−1j1−1modN,(17)m2−1n2−1=ETi2−1j2−1modN=abδεi2−1j2−1modN.From equations (16)-(17), one sees that i1,j1, i2,j2, m1,n1, and m2,n2 are given, and only the equivalent permutation key ET is unknown; therefore, one can solve the equation by combining equations (16)-(17), defined as(18)a=m1−1−b×j1−1i1−1modN,b=m2−1×i1−1−m1−1×i2−1j2−1×i1−1−j1−1×i2−1modN,δ=n1−1−ε×j1−1i1−1modN,ε=n2−1×i1−1−n1−1×i2−1j2−1×i1−1−j1−1×i2−1modN.According to equation (18), one obtains the equivalent permutation key ET by adopting one special plaintext image and the corresponding ciphertext image.For the sake of understanding the above analysis, take the plaintext imageP3=P3i,j,ki=1,j=1,k=14,4,3 of size 4×4×3 as an example, given by(19)P3:,:,1=0000012000000000,P3:,:,2=0000000000000000,P3:,:,3=0000000000000000.After performing the permutation-only encryption onP3, one gets the temporary permutation encryption image denoted by S3=S3i,j,ki=1,j=1,k=14,4,3, such that(20)S3:,:,1=0000020000000010,S3:,:,2=0000000000000000,S3:,:,3=0000000000000000.According to equations (19)-(20), one has(21)i1,j1=2,2,i2,j2=2,3,m1,n1=4,3,m2,n2=2,2.Then substituting equation (21) into equation (18), according to N=4, one obtains a=1,b=2,δ=3,ε=3 and further gets the equivalent permutation key ET, defined as(22)ET=1233mod4.


#### 3.2.3. Recover the Plaintext Image by Using the Equivalent Diffusion KeyED and the Equivalent Permutation Key ET

First, convert the ciphertext imageC into the temporary ciphertext image C′. According to equation (11) and the equivalent diffusion key ED, the permutation encryption image denoted by S′ can be obtained from the temporary ciphertext image C′. Second, convert the permutation encryption image S′ into the temporary permutation encryption image denoted by S. Finally, recover the plaintext image defined by P from the ciphertext image C by utilizing the equivalent permutation key ET.According to the above security analysis, the process of cracking CIEA-HCNN by adopting chosen-plaintext attack is described in Algorithm1.Algorithm 1: Cracking CIEA-HCNN by using chosen-plaintext attack.
Input:P1,P2,COutput: Recover the plaintext imageP from the given ciphertext image C(1)
C1=EncryptionP1(2)
According to equation (11), ED=C1(3)
C2=EncryptionP2(4)
According to equation (11) and ED, S2′=bitxorC2,ED(5)
S2←S2′(6)
fori=1 to M do(7)
forj=1 to N do(8)
fork=1 to 1 do(9)
m1,n1=findS2:,:,1==1(10)
m2,n2=findS2:,:,1==2(11)
end for(12)
end for(13)
end for(14)
b=modm2−m1,N;a=modm1−1−b,N(15)
ε=modn2−n1,N;δ=modn1−1−ε,N(16)
ET=ab;δε(17)
S′=bitxorC′,ED;S←S′(18)
P=ET−1S(19)
returnP


## 3.1. Preliminary Analysis of CIEA-HCNN

According to Kerckhoff’s assumptions [32], one gets that the cryptosystem is open and its security depends solely on the secret keys rather than the cryptosystem itself; that is, the attacker knows everything about the cryptosystem except for the secret keys. If the cryptosystem cannot resist various attacks, it is insecure. There are generally four common attack types for cryptanalysis given in Table 1 from the hardest to the easiest types. In Table 1, ciphertext-only attack is the hardest type, and chosen-ciphertext attack is the easiest type. The adversary reveals secret keys or the equivalent keys to break the cryptosystem by using the four common attack types listed in Table 1.Table 1
Four common attack types for cryptanalysis.
Attack typesAvailable resourceCiphertext-only attackThe attacker only knows the ciphertextKnown-plaintext attackThe attacker knows any given plaintext and also knows the corresponding ciphertextChosen-plaintext attackThe attacker can obtain access to the encryption machinery, choose the plaintext that would be useful for deciphering, and also know the corresponding ciphertextChosen-ciphertext attackThe attacker can obtain access to the decryption machinery, choose the ciphertext that would be useful for deciphering, and also know the corresponding plaintextAccording to Figure1, one obtains that CIEA-HCNN adopts permutation encryption-diffusion encryption structure. First, the diffusion encryption structure of CIEA-HCNN is too simple, and the diffusion matrix D is independent of plaintext image or ciphertext image. Therefore, one gets that CIEA-HCNN has the equivalent diffusion key. According to chosen-plaintext attack, the equivalent diffusion key can be broken by just selecting one pure plaintext image and the corresponding ciphertext image.After cracking the equivalent diffusion key, CIEA-HCNN is simplified to a permutation-only encryption algorithm. In [28], it is pointed out that permutation-only encryption algorithm is insecure. For given secret key parameters and the size of the plaintext image, the generated chaotic sequences remain unchanged which are unrelated to the plaintext image and the corresponding ciphertext image; therefore, the values of α and β in Arnold cat map are fixed, and further the permutation matrix T also remains unchanged. Indeed, the permutation matrix T is the equivalent permutation key of CIEA-HCNN. An attacker can break the permutation-only encryption algorithm by using the permutation matrix T. In addition, the position 0,0 is always mapped into itself in Arnold cat map.According to the above analysis, one gets that the security performance of CIEA-HCNN depends only on the diffusion matrixD and the permutation matrix T; indeed, it means that the equivalent diffusion key and the equivalent permutation key exist in CIEA-HCNN. The adversary can reveal the equivalent keys by using chosen-plaintext attack and further successfully break the original encryption algorithm. Therefore, the problem of cracking secret key parameters x1′,x2′,μ1,μ2,m0,mr,mg,mb in the original encryption algorithm can be solved by chosen-plaintext attack and transforming it into solving the equivalent diffusion key and the equivalent permutation key. Moreover, according to Figure 1, one obtains the simplified block diagram of CIEA-HCNN, as shown in Figure 2. In Figure 2, ET denotes the equivalent permutation key, and ED represents the equivalent diffusion key.Figure 2
Simplified block diagram of CIEA-HCNN.


## 3.2. Cracking CIEA-HCNN by Using Chosen-Plaintext Attack

The basic method of cracking the permutation encryption and the diffusion encryption structure shown in Figure2 is that, according to chosen-plaintext attack, one adopts divide-and-conquer strategy to separate the permutation encryption from the diffusion encryption through choosing the plaintext that would be useful for breaking, on this basis, and further deciphering the equivalent permutation key ET and the equivalent diffusion key ED, respectively. The detailed procedures of cracking the equivalent permutation key ET and the equivalent diffusion key ED are presented as follows.


### 3.2.1. Deciphering the Equivalent Diffusion KeyED

According to chosen-plaintext attack, choose a full zero image denoted byP1=P1i,j,ki=1,j=1,k=1M,N,3, and get the corresponding ciphertext image defined as C1=C1i,j,ki=1,j=1,k=1M,N,3. Next, using the obtained P1 and C1 as known conditions, one further gets the corresponding equivalent diffusion key ED.The specific approaches for cracking the equivalent diffusion keyED are given as follows.Step 1. Choose a full zero plaintext image asP1, according to chosen-plaintext attack, and get its corresponding ciphertext image as C1. From Figure 1, one obtains the temporary ciphertext image C1′=C1′k,lk=1,l=13,MN corresponding to C1.Step 2. According to equation (11) and Figure 2, one has(12)C1′k,l=S1′k,l⊕EDk,l.Since all pixels ofP1 are zero, after performing the permutation encryption operation for P1, S1i,j,ki=1,j=1,k=1M,N,3=S1′k,lk=1,l=13,MN=0 holds.Step 3. From equations (11)-(12) with S1′k,lk=1,l=13,MN=0, one obtains the equivalent diffusion key ED defined as(13)EDk,l=C1′k,l.


### 3.2.2. Deciphering the Equivalent Permutation KeyET

After breaking the equivalent diffusion keyED, the original permutation encryption-diffusion encryption structure is simplified to permutation-only encryption structure. Besides, since the original image chaotic encryption algorithm adopts the same permutation matrix to the three channels of the plaintext image, the work of deciphering the equivalent permutation key ET sets the R channel of the plaintext image as an example as follows. First, choose a plaintext image defined as P2=P2i,j,ki=1,j=1,k=1M,N,3, and suppose the pixels of coordinates i1,j1 and i2,j2 in R channel are P2i1,j1,1=ζ≠0 and P2i2,j2,1=λ≠0, respectively. Moreover, i1,j1≠1,1, i2,j2≠1,1 and ζ≠λ, others are full zero, and let all pixels of G channel and B channel be full zero. One obtains the corresponding ciphertext image described by C2=C2i,j,ki=1,j=1,k=1M,N,3. Then using the obtained P2 and C2 as known conditions, one further gets the corresponding equivalent permutation key ET. Note that the equivalent permutation key ET is not affected by the number of Arnold cat map iterations.The specific steps for cracking the equivalent permutation keyET are presented as follows.Step 1. According to chosen-plaintext attack, choose one plaintext image as P2, and get its ciphertext image defined as C2. Then, the temporary ciphertext image as C2′=C2′k,lk=1,l=13,MN is obtained by using the ciphertext image C2.Step 2. Substitute C2′k,lk=1,l=13,MN and EDk,lk=1,l=13,MN with equation (11); the permutation encryption image denoted as S2′=S2′k,lk=1,l=13,MN is described by(14)S2′k,l=EDk,l⊕C2′k,l.Step 3. Convert the permutation encryption image S2′ of size 3×MN into the temporary permutation encryption image S2=S2i,j,ki=1,j=1,k=1M,N,3 of size M×N×3, and then compare S2:,:,1 with P2:,:,1 one by one; one gets(15)P2i1,j1,1=S2m1,n1,1=ζ,P2i2,j2,1=S2m2,n2,1=λ.According to equations (6)-(7), one obtains(16)m1−1n1−1=ETi1−1j1−1modN=abδεi1−1j1−1modN,(17)m2−1n2−1=ETi2−1j2−1modN=abδεi2−1j2−1modN.From equations (16)-(17), one sees that i1,j1, i2,j2, m1,n1, and m2,n2 are given, and only the equivalent permutation key ET is unknown; therefore, one can solve the equation by combining equations (16)-(17), defined as(18)a=m1−1−b×j1−1i1−1modN,b=m2−1×i1−1−m1−1×i2−1j2−1×i1−1−j1−1×i2−1modN,δ=n1−1−ε×j1−1i1−1modN,ε=n2−1×i1−1−n1−1×i2−1j2−1×i1−1−j1−1×i2−1modN.According to equation (18), one obtains the equivalent permutation key ET by adopting one special plaintext image and the corresponding ciphertext image.For the sake of understanding the above analysis, take the plaintext imageP3=P3i,j,ki=1,j=1,k=14,4,3 of size 4×4×3 as an example, given by(19)P3:,:,1=0000012000000000,P3:,:,2=0000000000000000,P3:,:,3=0000000000000000.After performing the permutation-only encryption onP3, one gets the temporary permutation encryption image denoted by S3=S3i,j,ki=1,j=1,k=14,4,3, such that(20)S3:,:,1=0000020000000010,S3:,:,2=0000000000000000,S3:,:,3=0000000000000000.According to equations (19)-(20), one has(21)i1,j1=2,2,i2,j2=2,3,m1,n1=4,3,m2,n2=2,2.Then substituting equation (21) into equation (18), according to N=4, one obtains a=1,b=2,δ=3,ε=3 and further gets the equivalent permutation key ET, defined as(22)ET=1233mod4.


### 3.2.3. Recover the Plaintext Image by Using the Equivalent Diffusion KeyED and the Equivalent Permutation Key ET

First, convert the ciphertext imageC into the temporary ciphertext image C′. According to equation (11) and the equivalent diffusion key ED, the permutation encryption image denoted by S′ can be obtained from the temporary ciphertext image C′. Second, convert the permutation encryption image S′ into the temporary permutation encryption image denoted by S. Finally, recover the plaintext image defined by P from the ciphertext image C by utilizing the equivalent permutation key ET.According to the above security analysis, the process of cracking CIEA-HCNN by adopting chosen-plaintext attack is described in Algorithm1.Algorithm 1: Cracking CIEA-HCNN by using chosen-plaintext attack.
Input:P1,P2,COutput: Recover the plaintext imageP from the given ciphertext image C(1)
C1=EncryptionP1(2)
According to equation (11), ED=C1(3)
C2=EncryptionP2(4)
According to equation (11) and ED, S2′=bitxorC2,ED(5)
S2←S2′(6)
fori=1 to M do(7)
forj=1 to N do(8)
fork=1 to 1 do(9)
m1,n1=findS2:,:,1==1(10)
m2,n2=findS2:,:,1==2(11)
end for(12)
end for(13)
end for(14)
b=modm2−m1,N;a=modm1−1−b,N(15)
ε=modn2−n1,N;δ=modn1−1−ε,N(16)
ET=ab;δε(17)
S′=bitxorC′,ED;S←S′(18)
P=ET−1S(19)
returnP


## 3.2.1. Deciphering the Equivalent Diffusion KeyED

According to chosen-plaintext attack, choose a full zero image denoted byP1=P1i,j,ki=1,j=1,k=1M,N,3, and get the corresponding ciphertext image defined as C1=C1i,j,ki=1,j=1,k=1M,N,3. Next, using the obtained P1 and C1 as known conditions, one further gets the corresponding equivalent diffusion key ED.The specific approaches for cracking the equivalent diffusion keyED are given as follows.Step 1. Choose a full zero plaintext image asP1, according to chosen-plaintext attack, and get its corresponding ciphertext image as C1. From Figure 1, one obtains the temporary ciphertext image C1′=C1′k,lk=1,l=13,MN corresponding to C1.Step 2. According to equation (11) and Figure 2, one has(12)C1′k,l=S1′k,l⊕EDk,l.Since all pixels ofP1 are zero, after performing the permutation encryption operation for P1, S1i,j,ki=1,j=1,k=1M,N,3=S1′k,lk=1,l=13,MN=0 holds.Step 3. From equations (11)-(12) with S1′k,lk=1,l=13,MN=0, one obtains the equivalent diffusion key ED defined as(13)EDk,l=C1′k,l.


## 3.2.2. Deciphering the Equivalent Permutation KeyET

After breaking the equivalent diffusion keyED, the original permutation encryption-diffusion encryption structure is simplified to permutation-only encryption structure. Besides, since the original image chaotic encryption algorithm adopts the same permutation matrix to the three channels of the plaintext image, the work of deciphering the equivalent permutation key ET sets the R channel of the plaintext image as an example as follows. First, choose a plaintext image defined as P2=P2i,j,ki=1,j=1,k=1M,N,3, and suppose the pixels of coordinates i1,j1 and i2,j2 in R channel are P2i1,j1,1=ζ≠0 and P2i2,j2,1=λ≠0, respectively. Moreover, i1,j1≠1,1, i2,j2≠1,1 and ζ≠λ, others are full zero, and let all pixels of G channel and B channel be full zero. One obtains the corresponding ciphertext image described by C2=C2i,j,ki=1,j=1,k=1M,N,3. Then using the obtained P2 and C2 as known conditions, one further gets the corresponding equivalent permutation key ET. Note that the equivalent permutation key ET is not affected by the number of Arnold cat map iterations.The specific steps for cracking the equivalent permutation keyET are presented as follows.Step 1. According to chosen-plaintext attack, choose one plaintext image as P2, and get its ciphertext image defined as C2. Then, the temporary ciphertext image as C2′=C2′k,lk=1,l=13,MN is obtained by using the ciphertext image C2.Step 2. Substitute C2′k,lk=1,l=13,MN and EDk,lk=1,l=13,MN with equation (11); the permutation encryption image denoted as S2′=S2′k,lk=1,l=13,MN is described by(14)S2′k,l=EDk,l⊕C2′k,l.Step 3. Convert the permutation encryption image S2′ of size 3×MN into the temporary permutation encryption image S2=S2i,j,ki=1,j=1,k=1M,N,3 of size M×N×3, and then compare S2:,:,1 with P2:,:,1 one by one; one gets(15)P2i1,j1,1=S2m1,n1,1=ζ,P2i2,j2,1=S2m2,n2,1=λ.According to equations (6)-(7), one obtains(16)m1−1n1−1=ETi1−1j1−1modN=abδεi1−1j1−1modN,(17)m2−1n2−1=ETi2−1j2−1modN=abδεi2−1j2−1modN.From equations (16)-(17), one sees that i1,j1, i2,j2, m1,n1, and m2,n2 are given, and only the equivalent permutation key ET is unknown; therefore, one can solve the equation by combining equations (16)-(17), defined as(18)a=m1−1−b×j1−1i1−1modN,b=m2−1×i1−1−m1−1×i2−1j2−1×i1−1−j1−1×i2−1modN,δ=n1−1−ε×j1−1i1−1modN,ε=n2−1×i1−1−n1−1×i2−1j2−1×i1−1−j1−1×i2−1modN.According to equation (18), one obtains the equivalent permutation key ET by adopting one special plaintext image and the corresponding ciphertext image.For the sake of understanding the above analysis, take the plaintext imageP3=P3i,j,ki=1,j=1,k=14,4,3 of size 4×4×3 as an example, given by(19)P3:,:,1=0000012000000000,P3:,:,2=0000000000000000,P3:,:,3=0000000000000000.After performing the permutation-only encryption onP3, one gets the temporary permutation encryption image denoted by S3=S3i,j,ki=1,j=1,k=14,4,3, such that(20)S3:,:,1=0000020000000010,S3:,:,2=0000000000000000,S3:,:,3=0000000000000000.According to equations (19)-(20), one has(21)i1,j1=2,2,i2,j2=2,3,m1,n1=4,3,m2,n2=2,2.Then substituting equation (21) into equation (18), according to N=4, one obtains a=1,b=2,δ=3,ε=3 and further gets the equivalent permutation key ET, defined as(22)ET=1233mod4.


## 3.2.3. Recover the Plaintext Image by Using the Equivalent Diffusion KeyED and the Equivalent Permutation Key ET

First, convert the ciphertext imageC into the temporary ciphertext image C′. According to equation (11) and the equivalent diffusion key ED, the permutation encryption image denoted by S′ can be obtained from the temporary ciphertext image C′. Second, convert the permutation encryption image S′ into the temporary permutation encryption image denoted by S. Finally, recover the plaintext image defined by P from the ciphertext image C by utilizing the equivalent permutation key ET.According to the above security analysis, the process of cracking CIEA-HCNN by adopting chosen-plaintext attack is described in Algorithm1.Algorithm 1: Cracking CIEA-HCNN by using chosen-plaintext attack.
Input:P1,P2,COutput: Recover the plaintext imageP from the given ciphertext image C(1)
C1=EncryptionP1(2)
According to equation (11), ED=C1(3)
C2=EncryptionP2(4)
According to equation (11) and ED, S2′=bitxorC2,ED(5)
S2←S2′(6)
fori=1 to M do(7)
forj=1 to N do(8)
fork=1 to 1 do(9)
m1,n1=findS2:,:,1==1(10)
m2,n2=findS2:,:,1==2(11)
end for(12)
end for(13)
end for(14)
b=modm2−m1,N;a=modm1−1−b,N(15)
ε=modn2−n1,N;δ=modn1−1−ε,N(16)
ET=ab;δε(17)
S′=bitxorC′,ED;S←S′(18)
P=ET−1S(19)
returnP


## 4. The Numerical Simulation Experiments for Breaking CIEA-HCNN

In the numerical simulation experiments, color images Lena, Baboon, and Pepper are taken as three examples, where the size of the image is512×512. The secret keys are set as x1′=0.6, x2′=0.7, μ1=1.46, μ2=1.5, m0=1740, mr=150, mg=160, and mb=180. The numerical simulation experiments are operated under MATLAB R2017a running on desktop computer with Intel (R) Core (TM) i7-7700 CPU 3.6 GHz, 16 G memory RAM, and 1 TB hard drive; the operation system is Microsoft Windows 7.


### 4.1. The Experiments for Breaking CIEA-HCNN by Using Chosen-Plaintext Attack

First, according to the analysis in Section3.2.1, choose a full zero plaintext image of size 512×512 denoted by P1 and get the corresponding ciphertext image C1, as shown in Figures 3(a) and 3(b). Based on equation (12), P1 and C1, one obtains the equivalent diffusion key ED given by(23)ED=142223532251...8204439027113927961173...1791981971326221551229518...4172103881663×262144.Figure 3
Zero plaintext imageP1 and its corresponding ciphertext image C1. (a) Zero plaintext image P1. (b) Its corresponding ciphertext image C1.
(a)(b)Second, according to Section3.2.1, construct a color image of size 512×512 defined by P2, let the pixels of the coordinates 2,2 and 2,3 be 1 and 2 in the R channel of the plaintext image P2, other pixels are set as 0, and all pixels of the G and B channels are defined as 0, as shown in Figure 4(a). According to chosen-plaintext attack, one can get the corresponding ciphertext image of P2 denoted by C2, as shown in Figure 4(b). Recover the permutation encryption image represented by S2′ from the ciphertext image C2 by using the equivalent diffusion key ED, and then convert the permutation encryption image into the temporary permutation encryption image S2, as shown in Figure 4(c). Based on equation (15), and comparing P2 with S2, one gets(24)P22,2,1=S2m1,n1,1=1,P22,3,1=S2m2,n2,1=2.Figure 4
Plaintext imageP2, the corresponding ciphertext image C2, and the temporary permutation encryption image S2. (a) Plaintext image P2. (b) The corresponding ciphertext image C2. (c) The temporary permutation encryption image S2.
(a)(b)(c)According to equations (16)-(18), one obtains the equivalent permutation key ET defined as(25)ET=11622757mod512.Finally, according to Section3.2.3, the plaintext images of Lena, Baboon, and Pepper with the size of 512×512 are recovered by using the equivalent diffusion key ED and the equivalent permutation key ET; moreover, in order to verify that the recovered plaintext image is equal to the original plaintext image, performing the bitwise XOR operation on them, one gets a full zero image. The breaking results on CIEA-HCNN with RGB color Lena, Baboon, and Pepper are shown in Figure 5.Figure 5
The breaking results on CIEA-HCNN with RGB color Lena, Baboon, and Pepper. (a) Lena ciphertext image. (b) Recovered permutation image of Lena. (c) Recovered plaintext image of Lena. (d) Difference image of Lena. (e) Baboon ciphertext image. (f) Recovered permutation image of Baboon. (g) Recovered plaintext image of Baboon. (h) Difference image of Baboon. (i) Pepper ciphertext image. (j) Recovered permutation image of Pepper. (k) Recovered plaintext image of Pepper. (l) Difference image of Pepper.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)


### 4.2. Attack Complexity Analysis

The attack complexity consists of time complexity and data complexity. On the aspect of time complexity, according to chosen-plaintext attack, the cracking time of CIEA-HCNN is 11.164 seconds for the color image with the size of512×512, and the encryption time is 5.813 seconds. Moreover, on the aspect of data complexity, given the same size of color image, the data complexity of breaking CIEA-HCNN is O1. Therefore, the experimental results verify that the attack method is both effective and efficient, meanwhile having lower attack complexity.


### 4.3. Suggestions for Improvement

According to the security defects of CIEA-HCNN, the suggestions for improvement are given as follows:(1)
In the permutation encryption structure, one can construct the combination of parameters of Arnold cat map and the characters of plaintext image such as all pixels sum and average and hash value of the plaintext information. One adopts multiple-round permutation encryption based on the encryption efficiency. Simultaneously, one suggests that using different permutation matrix performs the scrambling operation on the three R, G, B channels of the color image, respectively. Moreover, after the permutation encryption, exchange the pixel of coordinate0,0 to the other random pixel to improve the security of the original permutation encryption.(2)
In the diffusion encryption structure, one could add some nonlinear diffusion encryption structure and ciphertext feedback mechanism to enhance the combination of plaintext, keys, and ciphertext and further promote the security of the original encryption algorithm.(3)
One suggests that multiple-round encryption algorithm is proposed to improve the security based on the higher efficiency.


## 4.1. The Experiments for Breaking CIEA-HCNN by Using Chosen-Plaintext Attack

First, according to the analysis in Section3.2.1, choose a full zero plaintext image of size 512×512 denoted by P1 and get the corresponding ciphertext image C1, as shown in Figures 3(a) and 3(b). Based on equation (12), P1 and C1, one obtains the equivalent diffusion key ED given by(23)ED=142223532251...8204439027113927961173...1791981971326221551229518...4172103881663×262144.Figure 3
Zero plaintext imageP1 and its corresponding ciphertext image C1. (a) Zero plaintext image P1. (b) Its corresponding ciphertext image C1.
(a)(b)Second, according to Section3.2.1, construct a color image of size 512×512 defined by P2, let the pixels of the coordinates 2,2 and 2,3 be 1 and 2 in the R channel of the plaintext image P2, other pixels are set as 0, and all pixels of the G and B channels are defined as 0, as shown in Figure 4(a). According to chosen-plaintext attack, one can get the corresponding ciphertext image of P2 denoted by C2, as shown in Figure 4(b). Recover the permutation encryption image represented by S2′ from the ciphertext image C2 by using the equivalent diffusion key ED, and then convert the permutation encryption image into the temporary permutation encryption image S2, as shown in Figure 4(c). Based on equation (15), and comparing P2 with S2, one gets(24)P22,2,1=S2m1,n1,1=1,P22,3,1=S2m2,n2,1=2.Figure 4
Plaintext imageP2, the corresponding ciphertext image C2, and the temporary permutation encryption image S2. (a) Plaintext image P2. (b) The corresponding ciphertext image C2. (c) The temporary permutation encryption image S2.
(a)(b)(c)According to equations (16)-(18), one obtains the equivalent permutation key ET defined as(25)ET=11622757mod512.Finally, according to Section3.2.3, the plaintext images of Lena, Baboon, and Pepper with the size of 512×512 are recovered by using the equivalent diffusion key ED and the equivalent permutation key ET; moreover, in order to verify that the recovered plaintext image is equal to the original plaintext image, performing the bitwise XOR operation on them, one gets a full zero image. The breaking results on CIEA-HCNN with RGB color Lena, Baboon, and Pepper are shown in Figure 5.Figure 5
The breaking results on CIEA-HCNN with RGB color Lena, Baboon, and Pepper. (a) Lena ciphertext image. (b) Recovered permutation image of Lena. (c) Recovered plaintext image of Lena. (d) Difference image of Lena. (e) Baboon ciphertext image. (f) Recovered permutation image of Baboon. (g) Recovered plaintext image of Baboon. (h) Difference image of Baboon. (i) Pepper ciphertext image. (j) Recovered permutation image of Pepper. (k) Recovered plaintext image of Pepper. (l) Difference image of Pepper.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)


## 4.2. Attack Complexity Analysis

The attack complexity consists of time complexity and data complexity. On the aspect of time complexity, according to chosen-plaintext attack, the cracking time of CIEA-HCNN is 11.164 seconds for the color image with the size of512×512, and the encryption time is 5.813 seconds. Moreover, on the aspect of data complexity, given the same size of color image, the data complexity of breaking CIEA-HCNN is O1. Therefore, the experimental results verify that the attack method is both effective and efficient, meanwhile having lower attack complexity.


## 4.3. Suggestions for Improvement

According to the security defects of CIEA-HCNN, the suggestions for improvement are given as follows:(1)
In the permutation encryption structure, one can construct the combination of parameters of Arnold cat map and the characters of plaintext image such as all pixels sum and average and hash value of the plaintext information. One adopts multiple-round permutation encryption based on the encryption efficiency. Simultaneously, one suggests that using different permutation matrix performs the scrambling operation on the three R, G, B channels of the color image, respectively. Moreover, after the permutation encryption, exchange the pixel of coordinate0,0 to the other random pixel to improve the security of the original permutation encryption.(2)
In the diffusion encryption structure, one could add some nonlinear diffusion encryption structure and ciphertext feedback mechanism to enhance the combination of plaintext, keys, and ciphertext and further promote the security of the original encryption algorithm.(3)
One suggests that multiple-round encryption algorithm is proposed to improve the security based on the higher efficiency.


## 5. Conclusions

In this paper, the security analysis of a color image encryption algorithm based on Hopfield chaotic neural network called CIEA-HCNN is given. CIEA-HCNN adopts permutation encryption-diffusion encryption structure; from the view of cryptanalysis, it has the equivalent keys due to the inherent defects. Therefore, one can obtain the equivalent permutation key and the equivalent diffusion key by utilizing the chosen-plaintext attack and further crack CIEA-HCNN. Theoretical analysis and numerical simulation experiment results verify the effectiveness of the deciphering method; as for the color image of sizeM×N, the data complexity is O1. Finally, some suggestions are proposed to improve the security of chaotic encryption algorithm. The reported results may help the designers of chaotic cryptography realize the importance of the essential structure of a color image encryption algorithm based on Hopfield chaotic neural network.



---

*Source: 2051653-2020-07-30.xml*