# On the Cryptanalysis of a Bit-Level Image Chaotic Encryption Algorithm

Authors: Yingchun Hu; Simin Yu; Zeqing Zhang
Journal: Mathematical Problems in Engineering
 (2020)

---

## Abstract

In this paper, the security analysis of a bit-level image chaotic encryption algorithm based on the 1D chaotic map is proposed. The original image chaotic encryption algorithm includes bit-level permutation encryption, diffusion encryption, and linear transform. Deciphering of it can be divided into two stages. First, bit-level permutation encryption, diffusion encryption, and linear transform can be simplified into bit-level equivalent permutation encryption and equivalent diffusion encryption, which is a key breakthrough point of cryptanalysis. Second, the chaotic sequence generated by this algorithm is independent of the plaintext image. Therefore, the equivalent diffusion key and the equivalent permutation key can be obtained by chosen-plaintext attack, respectively. Theoretical analysis and numerical simulation experiment results verify the effectiveness of the analytical method. Finally, some suggestions are proposed to promote the security of the original image chaotic encryption algorithm.


---

## Body

## 1. Introduction

With the rapid development of network technology, a large amount of multimedia information, such as image, voice, text, and video, needs to be transmitted through the Internet. Therefore, the security problem becomes an important research subject and attracts more and more attention. Because of some intrinsic properties of images, for example, bulk data capacity, high redundancy, and strong correlation of two adjacent pixels, traditional text encryption algorithms such as AES and DES, which have higher time complicity, are not suitable for image encryption [1]. Because chaos is pseudo-random, ergodic, and highly sensitive to initial values and control parameters, these characteristics can achieve good confusion and diffusion effects and can meet the basic requirements of cryptography. Therefore, many image encryption algorithms have been proposed based on the chaotic map in recent years [1–20].In 1997, the first image chaotic encryption algorithm based on the permutation-diffusion structure is proposed in [2]. Thereafter, a symmetric image encryption algorithm based on 3D chaotic cat map is presented in [1]. In 2007, a new image encryption algorithm based on the permutation-diffusion structure is proposed in [3]. In [4], a novel image encryption algorithm based on the skew tent chaotic map and classic permutation-diffusion structure is proposed. To enhance the security of the image chaotic encryption algorithm, some bit-level image chaotic encryption algorithms are proposed in [5–8]. In addition, many image encryption schemes based on constructing new chaotic maps are also proposed in [9–13]. An image chaotic encryption algorithm based on CHHCS and LBP is proposed in [14], where CHHCS is used to scramble the plaintext image, while LBP is considered to diffuse the scrambled image in order to change the values of all pixels. In [15], a color image encryption algorithm is proposed based on cellular automata and hyperchaotic system; the main contribution is the application of the hyperchaotic system and nonuniform cellular automata for robust keys. An image encryption algorithm utilizing the principles of the Josephus problem and the filtering technology is developed in [16]. Moreover, some typical image encryption algorithms based on the chaotic S-box are proposed in [17–20].Note that the chaotic encryption schemes proposed in [1–4, 6–15, 20] adopt the classical permutation-diffusion two-stage encryption structure; security test metrics are mainly limited to histogram, correlation analysis, differential analysis, key sensitivity test, and so on, which are not enough to guarantee cryptosystem security. In [21–32], the cryptanalysis literature studies point that many chaotic encryption algorithms have some intrinsic security weaknesses, which are not robust against chosen-plaintext attack, chosen-ciphertext attack, and conquer attack. In addition, the chaotic encryption algorithm proposed in [5] adopts permutation-only structure; however, permutation-only is vulnerable to chosen-plaintext attack given in [33–36]; for example, according to the chosen-plaintext attack, one can obtain equivalent permutation keys by choosing several pairs of plaintext-ciphertext images and then recovering the corresponding original plaintext image.This paper re-evaluates the security of a bit-level image encryption algorithm based on the 1D chaotic map proposed in [37]. The algorithm adopts a permutation encryption-diffusion encryption-linear transform structure. In the permutation encryption stage, 1D chaotic sequence is generated by the improved logistic map, and its corresponding index sequence is used to scramble the plaintext image. In the diffusion encryption stage, 1D diffusion sequence is utilized to diffuse the scrambled image. In the linear transform stage, the ciphertext encrypted by diffusion is rotated to the right. The authors also give the statistical test results of key space, histogram, correlation of two adjacent pixels, and key sensitivity and claim that the algorithm is secure. However, the cryptanalysis results in this paper show that the algorithm has three security vulnerabilities as follows:(1)
The three-stage structure for the permutation encryption-diffusion encryption-linear transform of the original encryption algorithm can be simplified to an equivalent permutation encryption-equivalent diffusion encryption two-stage structure(2)
The generated chaotic sequence is independent of the plaintext image(3)
There is no ciphertext feedback mechanism in the algorithmBased on the aforementioned security vulnerabilities, the equivalent permutation encryption-equivalent diffusion encryption parts of the image chaotic encryption algorithm proposed in [37] can be cracked separately by the divide-and-conquer strategy. Furthermore, the equivalent diffusion key and the equivalent permutation key can be obtained by chosen-plaintext attack.The rest of the paper is organized as follows. Section2 briefly introduces the image chaotic encryption algorithm under study. Section 3 presents the security analysis. Section 4 gives the numerical simulation experiments. Section 5 proposes some suggestions for improvement. Section 6 concludes the paper.


## 2. Description of the Original Encryption Algorithm

In [37], the original encryption algorithm adopts the permutation encryption-diffusion encryption-linear transform three-stage structure. It consists of secret key selection, bit-plane decomposition, permutation encryption, diffusion encryption, linear transform, and bit-plane composition, as shown in Figure 1. In Figure 1, x0,μ,k,N0,kd,rp are secret key parameters, Ii,j is a 2D plaintext image, Bl is a 1D bit-plane decomposition sequence of Ii,j, Ql is a 1D index sequence corresponding to the improved logistic map, Pl is a 1D diffusion sequence corresponding to the improved logistic map, Sl is a 1D permutation encryption sequence of Bl, Dl is a 1D diffusion encryption sequence of Sl, Ll is a 1D linear transform sequence of Dl, and the corresponding ciphertext image of Ii,j is defined by Ci,j. Note that Ii,j, Ci,j, and Qlare denoted by a decimal number, and Bl, Pl, Sl, Dl, and Ll are denoted by a binary number, where i=1,2,…,M, j=1,2,…,N, l=1,2,…,8NM, the size of the 2D plaintext image is N×M, M is the height, and N is the width, respectively.Figure 1
Block diagram of the permutation encryption-diffusion encryption-linear transform three-stage structure.Figure 2
Schematic diagram of bit-plane decomposition.The detailed principle of the chaotic encryption algorithm given by Figure1 can be described as follows:(1)
Choose the secret key parameters: according to Figure1, the chaotic encryption algorithm includes six secret key parameters x0,μ,k,N0,kd,andrp, where x0,μ,k,andN0 are initial values and control parameters of the improved logistic map, kd is a disturb parameter, and rp is the number of circle shifts to the right.(2)
Generate the 1D index sequenceQl and the 1D diffusion sequence Pl by using the chaotic sequence: first, obtain the 1D chaotic sequence xnn=0,1,2,… by adopting the improved logistic map xn+1=modμxn1−xn−4−μxn1−xn2k,1, where μ∈0,4, k=12, and mod denotes module operation. Then, obtain the 1D index sequence Ql and the 1D diffusion sequence Pl corresponding to xn [37].(3)
Encrypt the image by using the original encryption algorithm: the encrypted object may be a color image or a grayscale image [37]. For the sake of analysis, here, a plaintext grayscale image of size N×M resolution is taken as an example to indicate the encryption process. Suppose that Ii,j∈0,1,…,255i=1,2,…,M;j=1,2,…,N denotes the 2D plaintext grayscale image, hereinafter referred to as the 2D plaintext image. The steps for the original encryption algorithm are shown as follows:Step 1: bit-plane decomposition: first, convert the 2D plaintext imageIi,j∈0,1,…,255i=1,2,…,M;j=1,2,…,N into a 1D sequence Zm∈0,1,…,255m=1,2,…,NM by scanning it from left to right and up to down. Second, according to the bit-plane decomposition method, the pixel of Zm can be represented as 8 bit planes, and then Bvm∈0,1m=1,2,…,NM;v=1,2,…,8 is obtained [38]. Finally, transform Bvm into the 1D sequence Bll=1,2,…,8NM with binary form. Note that the relationship between Zm and Bvm is defined as(1)Zm=∑v=18Bvm×2v−1=B1m×20+B2m×21+⋯+B8m×27,wherem=1,2,…,NM. Take a plaintext image of size N×M=2×2 resolution as an example, and the bit-plane decomposition process is shown in Figure 2.Step 2: bit-level permutation encryption: in Figure1, scramble Bl by using 1D index sequence Ql and obtain the corresponding 1D permutation encryption sequence Sl, given by(2)Sl=BQl,wherel=1,2,…,8NM.Step 3: bit-level diffusion encryption: in Figure1, diffuse Sl by utilizing 1D diffusion sequence Pl and obtain the corresponding 1D diffusion encryption sequence Dl as(3)Dl=Pl⊕Sl,wherel=1,2,…,8NM and ⊕ denotes the bitwise XOR operation.Step 4: linear transform: obtain 1D linear transform sequenceLl by circle shifting Dl to the right with step rp, given by(4)Ll+rp=Dl,l+rp≤8NM,Ll+rp−8NM=Dl,l+rp>8NM,wherel=1,2,…,8NM and rp=1,2,…,8NM.Step 5: bit-plane composition: it is the inverse process of the bit-plane decomposition. Convert the 1D linear transform sequenceLll=1,2,…,8NM with binary form into a 2D ciphertext image Ci,j∈0,1,…,255i=1,2,…,M;j=1,2,…,N with decimal form by utilizing the bit-plane composition method.(4)
Decrypt the image by using the original decryption algorithm: decryption is the inverse of encryption. The plaintext imageIi,j is recovered from the 2D ciphertext image Ci,j. Note that the detail relevant statistical test analysis of the original encryption algorithm can be referred from Tables 1–8 of Section 5.2 proposed in [37].Table 1
Information entropy of some encrypted images.
ImageOriginal imageEncrypted imageRGBRGBLena7.3140297.6394437.0506127.9972137.9971997.997233Flower7.7437437.1300986.8541027.9972157.9971827.99711Greens7.7435287.4685235.8341177.9971927.9973337.997374Koala7.8942087.8491157.821627.9970367.9969957.997507Table 2
Information entropy performance.
ImageProposalLi et al. [39]RGBRGBLena7.99727.99727.99727.99747.99707.9971Table 3
Correlation coefficient of some encrypted images in theR channel.
ImageOriginal imageEncrypted imageVerticalHorizontalDiagonalVerticalHorizontalDiagonalLena0.92390.95670.8888−0.00240.00350.0014Flower0.95630.95420.92380.0025−0.0017−0.0037Greens0.97580.97890.9622−0.00070.01030.0047Koala0.90780.90510.86870.00160.00210.0039Back0.91780.90860.8661−0.0036−0.0071−0.0019Leaf0.88650.85770.7798−0.0074−0.00030.0007Bird0.94940.94260.9212−0.0089−0.0009−0.0004Cup0.95260.94540.90920.00010.0009−0.0017Table 4
Correlation coefficient performance.
ChannelProposalLi et al. [39]VerticalHorizontalDiagonalVerticalHorizontalDiagonalR−0.00240.00350.00140.0067−0.01270.0060G−0.00080.00070.0008−0.0068−0.0075−0.0078B−0.0033−0.00280.00140.0018−0.00070.0026Table 5
The mean NPCR and UACI of some encrypted images.
ImageNPCR (%)UACI (%)RGBRGBLena99.612499.627799.639933.571533.335633.4044Flower99.568299.638499.61733.531933.506333.4894Greens99.620199.624699.623133.452733.468533.515Koala99.620199.600299.58533.534633.463733.3583Back99.681199.636899.61733.448533.374433.5597Leaf99.641499.604899.604833.559533.603233.5455Bird99.595699.624699.55933.290633.453233.2876Cup99.633899.595699.612433.302533.455733.4035Table 6
The NPCR and UACI performance.
NPCR (%)UACI (%)RGBRGBProposal99.612499.627799.639933.571533.335633.4044Li et al. [39]99.612499.613499.619233.443833.523233.5010Table 7
The PSNR of some encrypted images.
LenaFlowerGreensKoalaBackLeafBirdCupData loss45.804645.499945.532845.722745.633545.498245.768445.5385Noise attack52.923452.849752.970952.912352.847253.151153.001952.6502Table 8
The PSNR performance.
ProposalPak and Huang [13]Data loss45.804647.4199Noise attack52.923448.17702


## 3. Cryptanalysis

### 3.1. Analysis of Equivalent Permutation Encryption-Equivalent Diffusion Encryption

According to Figure1, the chaotic encryption algorithm adopts the permutation encryption-diffusion encryption-linear transform three-stage structure, which can be simplified into its corresponding equivalent permutation encryption-equivalent diffusion encryption two-stage structure. From equation (4), one gets the diagram of linear transform between Ll and Dl, as shown in Figure 3.Figure 3
Diagram of linear transform betweenLl and Dl.From Figure3, one gets(5)Lrp+1=D1,Lrp+2=D2,⋯⋯,L8NM=D8NM−rp,L1=D8NM−rp+1,L2=D8NM−rp+2,⋯⋯,Lrp=D8NM.According to equation (5), its general iterative form is given by(6)Ll=Lmodl+rp,8NM=Dl,where ℓ=1,2,…,8NM and l=1,2,…,8NM.From equation (6), one gets the relationship between coordinate l before linear transform and coordinate ℓ after linear transform as(7)ℓ=modl+rp,8NM.Note that whenl=8NM−rp, ℓ=8NM.In the image chaotic encryption algorithm, permutation encryption-diffusion encryption is a general two-stage encryption algorithm. However, the algorithm, as shown in Figure1, is a permutation encryption-diffusion encryption-linear transform three-stage structure. For the sake of cryptanalysis, according to equations (2) and (3) with equations (6) and (7), one can simplify the three-stage structure of Figure 1 to its corresponding equivalent permutation encryption-equivalent diffusion encryption two-stage structure, as shown in Figure 4.Figure 4
Block diagram of the two-stage structure for equivalent permutation-diffusion encryption.In Figure4, Q′ℓ=Q′modl+rp,8NM=Ql represents the 1D equivalent index sequence by shifting Ql to the right of size rp, P′ℓ=P′modl+rp,8NM=Pl represents the 1D equivalent diffusion sequence through rotating Pl to the right of size rp, S′ℓ=BQ′ℓ represents the 1D sequence obtained by equivalent permutation encryption of Bℓ with Q′ℓ, Lℓ=S′ℓ⊕P′ℓ represents the 1D sequence obtained by equivalent diffusion encryption of S′ℓ with P′ℓ, Ii,j, Ci,j, and Q′ℓ are denoted by a decimal number, and Bℓ, P′ℓ, S′ℓ, and Lℓ are denoted by a binary number, where ℓ=1,2,…,8NM, i=1,2,…,M, and j=1,2,…,N.Proposition 1.
Equivalent permutation encryption-equivalent diffusion encryption two-stage structure, as shown in Figure4, is equivalent to the permutation encryption-diffusion encryption-linear transform three-stage structure as shown in Figure 1.Proof.
The equivalence is proved by comparing the three-level encryption as shown in Figure1 with the two-level encryption as shown in Figure 4.(1)
From Figure1 and equations (6) and (7), the result of the permutation encryption-diffusion encryption-linear transform is given by(8)Lℓ=Lmodl+rp,8NM,=Dl,=Sl⊕Pl,=BQl⊕Pl.(2)
According to Figure4 and equation (2), the result of equivalent permutation encryption is given by(9)S′ℓ=BQ′ℓ,=BQℓ.
Similarly, from Figure4 with equation (9), the result of diffusion encryption is given by(10)Lℓ=S′ℓ⊕P′ℓ,=BQ′ℓ⊕P′ℓ,=BQℓ⊕Pl.
Comparing equation (8) with (10), it can be seen that the results of the permutation encryption-diffusion encryption-linear transformation three-level structure are equal to those of the equivalent permutation encryption-equivalent diffusion encryption two-level structure. The proof is completed.
According to Figure4, Q′ℓ is the 1D equivalent index sequence expressed in the decimal number, and P′ℓ is the 1D equivalent diffusion sequence expressed in the binary number. Therefore, the problem of deciphering key parameters x0,μ,k,N0,kd,andrp in the original chaotic encryption algorithm can be solved by chosen-plaintext attack and transforming it into solving the 1D equivalent index sequence Q′ℓ and the 1D equivalent diffusion sequence P′ℓ.


### 3.2. Deciphering 1D Equivalent Diffusion SequenceP′ℓℓ=1,2,…,8NM

According to chosen-plaintext attack, first, choose a full zero 2D plaintext image asI0i,ji=1,2,…,M;j=1,2,…,N, and its corresponding 2D ciphertext image is denoted by C0i,ji=1,2,…,M;j=1,2,…,N. Then, using the obtained I0i,j,C0i,j as a known condition, one further gets the corresponding 1D equivalent diffusion sequence P′ℓℓ=1,2,…,8NM. In addition, the attack complexity contains data complexity and time complexity. Therefore, the data complexity of the proposed deciphering 1D equivalent diffusion sequence P′ℓ is O1.The specific approach for deciphering the 1D equivalent diffusion sequenceP′ℓℓ=1,2,…,8NM is as follows:(1)
Choose a full zero 2-D plaintext image asI0i,j; its corresponding 1D bit-plane decomposition sequence is B0ℓ. According to chosen-plaintext attack, one obtains a 2D ciphertext image C0i,j corresponding to I0i,j, and its corresponding 1D bit-plane decomposition sequence is C0ℓ. Then, one further gets the 1D ciphertext sequence L0ℓ corresponding to C0ℓ such that(11)L0ℓ=C0ℓ,whereI0i,j and C0i,j are denoted by the decimal number and B0ℓ, C0ℓ, and L0ℓare denoted by the binary number, respectively.(2)
According to equation (10), one has(12)L0ℓ=B0Q′ℓ⊕P′ℓ,whereQ′ℓ is denoted by the decimal number. Since all pixels of I0i,j are zero, the corresponding 1D bit-plane decomposition sequence satisfies B0ℓ=0. After performing equivalent permutation encryption operation, B0Q′ℓ=B0ℓ=0 also holds.(3)
According to equations (11) and (12) with B0Q′ℓ=0, one gets the 1D equivalent diffusion sequence P′ℓ, given by(13)P′ℓ=L0ℓ=C0ℓ,where ℓ=1,2,…,8NM and P′ℓ is denoted by the binary number.


### 3.3. Deciphering 1D Equivalent Index SequenceQ′ℓ=ℓ=1,2,…,8NM

After deciphering the 1D equivalent diffusion sequenceP′ℓ=ℓ=1,2,…,8MN, the original equivalent permutation encryption-equivalent diffusion encryption two-stage structure is simplified to the equivalent permutation-only encryption one-stage structure. On this basis, one can further choose n=⌈log28NM⌉ plaintext images as Iqi,ji=1,2,…,M;j=1,2,…,N;q=1,2,…,n, obtain the corresponding ciphertext images as Cqi,ji=1,2,…,M;j=1,2,…,N;q=1,2,…,n, and decipher the 1D equivalent index sequence Q′ℓℓ=1,2,…,8NM by using both 2D plaintext images Iqi,j and the corresponding 2D ciphertext images Cqi,j. Therefore, the corresponding data complexity of deciphering the 1D equivalent index sequence Q′ℓ is OlogNM.The specific approach for deciphering the 1D equivalent index sequenceQ′ℓℓ=1,2,…,8NM is as follows:(1)
Choosen 2D plaintext images Iqi,jq=1,2,…,n, obtain the corresponding 1D bit-plane decomposition sequence Bqℓq=1,2,…,n, and get the 2D ciphertext images Cqi,jq=1,2,…,n corresponding to Iqi,j. Then, by using Cqi,jq=1,2,…,n, the 1D ciphertext sequence Lqℓq=1,2,⋯,n can be finally determined.(2)
On the basis of acquiringBqℓ, Lqℓ, and P′ℓ, according to equation (10), corresponding Q′qℓq=1,2,…,n is obtained by(14)Lqℓ=BqQ′qℓ⊕P′ℓ,⇒BqQ′qℓ=Lqℓ⊕P′ℓ,⇒Bq−1BqQ′qℓ=Bq−1Lqℓ⊕P′ℓ,⇒Q′qℓ=Bq−1Lqℓ⊕P′ℓ,q=1,2,…,n,whereBq−1 denotes the inverse operation of Bq and Q′qℓ is denoted by the binary number.(3)
According toQ′qℓ, one gets the 1D equivalent index sequence Q′ℓ as(15)Q′ℓ=∑q=1nQ′qℓ×2q−1+1,where ℓ=1,2,…,8NM and Q′ℓ is denoted by the decimal number.


## 3.1. Analysis of Equivalent Permutation Encryption-Equivalent Diffusion Encryption

According to Figure1, the chaotic encryption algorithm adopts the permutation encryption-diffusion encryption-linear transform three-stage structure, which can be simplified into its corresponding equivalent permutation encryption-equivalent diffusion encryption two-stage structure. From equation (4), one gets the diagram of linear transform between Ll and Dl, as shown in Figure 3.Figure 3
Diagram of linear transform betweenLl and Dl.From Figure3, one gets(5)Lrp+1=D1,Lrp+2=D2,⋯⋯,L8NM=D8NM−rp,L1=D8NM−rp+1,L2=D8NM−rp+2,⋯⋯,Lrp=D8NM.According to equation (5), its general iterative form is given by(6)Ll=Lmodl+rp,8NM=Dl,where ℓ=1,2,…,8NM and l=1,2,…,8NM.From equation (6), one gets the relationship between coordinate l before linear transform and coordinate ℓ after linear transform as(7)ℓ=modl+rp,8NM.Note that whenl=8NM−rp, ℓ=8NM.In the image chaotic encryption algorithm, permutation encryption-diffusion encryption is a general two-stage encryption algorithm. However, the algorithm, as shown in Figure1, is a permutation encryption-diffusion encryption-linear transform three-stage structure. For the sake of cryptanalysis, according to equations (2) and (3) with equations (6) and (7), one can simplify the three-stage structure of Figure 1 to its corresponding equivalent permutation encryption-equivalent diffusion encryption two-stage structure, as shown in Figure 4.Figure 4
Block diagram of the two-stage structure for equivalent permutation-diffusion encryption.In Figure4, Q′ℓ=Q′modl+rp,8NM=Ql represents the 1D equivalent index sequence by shifting Ql to the right of size rp, P′ℓ=P′modl+rp,8NM=Pl represents the 1D equivalent diffusion sequence through rotating Pl to the right of size rp, S′ℓ=BQ′ℓ represents the 1D sequence obtained by equivalent permutation encryption of Bℓ with Q′ℓ, Lℓ=S′ℓ⊕P′ℓ represents the 1D sequence obtained by equivalent diffusion encryption of S′ℓ with P′ℓ, Ii,j, Ci,j, and Q′ℓ are denoted by a decimal number, and Bℓ, P′ℓ, S′ℓ, and Lℓ are denoted by a binary number, where ℓ=1,2,…,8NM, i=1,2,…,M, and j=1,2,…,N.Proposition 1.
Equivalent permutation encryption-equivalent diffusion encryption two-stage structure, as shown in Figure4, is equivalent to the permutation encryption-diffusion encryption-linear transform three-stage structure as shown in Figure 1.Proof.
The equivalence is proved by comparing the three-level encryption as shown in Figure1 with the two-level encryption as shown in Figure 4.(1)
From Figure1 and equations (6) and (7), the result of the permutation encryption-diffusion encryption-linear transform is given by(8)Lℓ=Lmodl+rp,8NM,=Dl,=Sl⊕Pl,=BQl⊕Pl.(2)
According to Figure4 and equation (2), the result of equivalent permutation encryption is given by(9)S′ℓ=BQ′ℓ,=BQℓ.
Similarly, from Figure4 with equation (9), the result of diffusion encryption is given by(10)Lℓ=S′ℓ⊕P′ℓ,=BQ′ℓ⊕P′ℓ,=BQℓ⊕Pl.
Comparing equation (8) with (10), it can be seen that the results of the permutation encryption-diffusion encryption-linear transformation three-level structure are equal to those of the equivalent permutation encryption-equivalent diffusion encryption two-level structure. The proof is completed.
According to Figure4, Q′ℓ is the 1D equivalent index sequence expressed in the decimal number, and P′ℓ is the 1D equivalent diffusion sequence expressed in the binary number. Therefore, the problem of deciphering key parameters x0,μ,k,N0,kd,andrp in the original chaotic encryption algorithm can be solved by chosen-plaintext attack and transforming it into solving the 1D equivalent index sequence Q′ℓ and the 1D equivalent diffusion sequence P′ℓ.


## 3.2. Deciphering 1D Equivalent Diffusion SequenceP′ℓℓ=1,2,…,8NM

According to chosen-plaintext attack, first, choose a full zero 2D plaintext image asI0i,ji=1,2,…,M;j=1,2,…,N, and its corresponding 2D ciphertext image is denoted by C0i,ji=1,2,…,M;j=1,2,…,N. Then, using the obtained I0i,j,C0i,j as a known condition, one further gets the corresponding 1D equivalent diffusion sequence P′ℓℓ=1,2,…,8NM. In addition, the attack complexity contains data complexity and time complexity. Therefore, the data complexity of the proposed deciphering 1D equivalent diffusion sequence P′ℓ is O1.The specific approach for deciphering the 1D equivalent diffusion sequenceP′ℓℓ=1,2,…,8NM is as follows:(1)
Choose a full zero 2-D plaintext image asI0i,j; its corresponding 1D bit-plane decomposition sequence is B0ℓ. According to chosen-plaintext attack, one obtains a 2D ciphertext image C0i,j corresponding to I0i,j, and its corresponding 1D bit-plane decomposition sequence is C0ℓ. Then, one further gets the 1D ciphertext sequence L0ℓ corresponding to C0ℓ such that(11)L0ℓ=C0ℓ,whereI0i,j and C0i,j are denoted by the decimal number and B0ℓ, C0ℓ, and L0ℓare denoted by the binary number, respectively.(2)
According to equation (10), one has(12)L0ℓ=B0Q′ℓ⊕P′ℓ,whereQ′ℓ is denoted by the decimal number. Since all pixels of I0i,j are zero, the corresponding 1D bit-plane decomposition sequence satisfies B0ℓ=0. After performing equivalent permutation encryption operation, B0Q′ℓ=B0ℓ=0 also holds.(3)
According to equations (11) and (12) with B0Q′ℓ=0, one gets the 1D equivalent diffusion sequence P′ℓ, given by(13)P′ℓ=L0ℓ=C0ℓ,where ℓ=1,2,…,8NM and P′ℓ is denoted by the binary number.


## 3.3. Deciphering 1D Equivalent Index SequenceQ′ℓ=ℓ=1,2,…,8NM

After deciphering the 1D equivalent diffusion sequenceP′ℓ=ℓ=1,2,…,8MN, the original equivalent permutation encryption-equivalent diffusion encryption two-stage structure is simplified to the equivalent permutation-only encryption one-stage structure. On this basis, one can further choose n=⌈log28NM⌉ plaintext images as Iqi,ji=1,2,…,M;j=1,2,…,N;q=1,2,…,n, obtain the corresponding ciphertext images as Cqi,ji=1,2,…,M;j=1,2,…,N;q=1,2,…,n, and decipher the 1D equivalent index sequence Q′ℓℓ=1,2,…,8NM by using both 2D plaintext images Iqi,j and the corresponding 2D ciphertext images Cqi,j. Therefore, the corresponding data complexity of deciphering the 1D equivalent index sequence Q′ℓ is OlogNM.The specific approach for deciphering the 1D equivalent index sequenceQ′ℓℓ=1,2,…,8NM is as follows:(1)
Choosen 2D plaintext images Iqi,jq=1,2,…,n, obtain the corresponding 1D bit-plane decomposition sequence Bqℓq=1,2,…,n, and get the 2D ciphertext images Cqi,jq=1,2,…,n corresponding to Iqi,j. Then, by using Cqi,jq=1,2,…,n, the 1D ciphertext sequence Lqℓq=1,2,⋯,n can be finally determined.(2)
On the basis of acquiringBqℓ, Lqℓ, and P′ℓ, according to equation (10), corresponding Q′qℓq=1,2,…,n is obtained by(14)Lqℓ=BqQ′qℓ⊕P′ℓ,⇒BqQ′qℓ=Lqℓ⊕P′ℓ,⇒Bq−1BqQ′qℓ=Bq−1Lqℓ⊕P′ℓ,⇒Q′qℓ=Bq−1Lqℓ⊕P′ℓ,q=1,2,…,n,whereBq−1 denotes the inverse operation of Bq and Q′qℓ is denoted by the binary number.(3)
According toQ′qℓ, one gets the 1D equivalent index sequence Q′ℓ as(15)Q′ℓ=∑q=1nQ′qℓ×2q−1+1,where ℓ=1,2,…,8NM and Q′ℓ is denoted by the decimal number.


## 4. Numerical Simulation Experiments

In our numerical simulation experiments, grayscale images of Lena, Baboon, and Pepper and RGB color images of Lena, Baboon, and Pepper are taken as six examples, where the size of the images isN×M=256×256. The secret keys are set as x0=0.34, μ=2.56, k=12, N0=1000, kd=654321, and rp=1000. Simulation experiments are operated on MATLAB R2017a running on the desktop computer with Intel(R) Core(TM) i7-7700 CPU @3.60 GHz, 16 GB RAM, and the operation system is Windows 7.Figure 5
(a) Zero 2D plaintext imageI0i,j and (b) its corresponding 2D ciphertext image C0i,j.
(a)(b)Figure 6
2D imagesB1ℓ–B19ℓ and L1ℓ–L19ℓ with a size of 8N×M resolution.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)(r)(s)Figure 7
Original images, ciphertext images, recovered permutated images, recovered images, and difference images of grayscale images of Lena, Baboon, and Pepper. (a) Lena original grayscale image. (b) Lena ciphertext image. (c) Lena recovered permutated image. (d) Lena recovered image. (e) Lena difference image. (f) Baboon original grayscale image. (g) Baboon ciphertext image. (h) Baboon recovered permutated image. (i) Baboon recovered image. (j) Baboon difference image. (k) Pepper original grayscale image. (l) Pepper ciphertext image. (m) Pepper recovered permutated image. (n) Pepper recovered image. (o) Pepper difference image.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)


### 4.1. Breaking Results for Grayscale Images Using Chosen-Plaintext Attack

(1)
According to chosen-plaintext attack, choose a full zero 2D plaintext imageI0i,j, and the corresponding ciphertext image is C0i,j, as shown in Figure 5.Based onI0i,j and C0i,j, one obtains their corresponding 1D bit-plane decomposition sequences B0ℓℓ=1,2,…,524288 and C0ℓℓ=1,2,…,524288, respectively, and gets the 1D ciphertext sequence L0ℓℓ=1,2,…,524288 corresponding to C0ℓℓ=1,2,…,524288. Then, according to equations (11)–(13), one further deciphers the 1D equivalent diffusion sequence P′ℓℓ=1,2,…,524288, given by(16)P′1,P′2,…,P′524288=1,1,0,1,0,0,1,1,0,1,…,0,0,1,1,1,1,1,1,1,1.(2)
Letn=⌈log28NM⌉=19. According to chosen-plaintext attack, by choosing 19 special 2D plaintext images Iqi,jq=1,2,…,19, one obtains the corresponding 1D bit-plane decomposition sequences Bqℓq=1,2,…,19, 2D ciphertext images Cqi,jq=1,2,…,19, and Lqℓq=1,2,…,19, respectively. Moreover, in our numerical simulation experiments, 2D images with the size of 8N×M=2048×256 resolution are adopted to represent 1D sequences Bqℓ and Lqℓ, as shown in Figure 6.After obtainingBqℓ, Lqℓ, and P′ℓ, from equation (14), the 1D sequences Q′qℓℓ=1,2,…,524288;q=1,2,…,19 can be deciphered as(17)Q′11,Q′12,…,Q′1524288=1,1,1,1,1,1,1,0,1,0,…,1,1,0,1,1,1,1,0,0,0,Q′21,Q′22,…,Q′2524288=0,1,0,0,1,1,0,0,1,0,…,0,1,1,1,0,0,1,1,0,1,⋯⋯,Q′191,Q′192,…,Q′2524288=0,1,0,0,1,1,1,0,0,0,…,1,0,0,0,0,0,0,0,0,0.Based on obtainedQ′qℓℓ=1,2,…,524288;q=1,2,…,19, according to equation (15), the 1D equivalent diffusion sequence Q′ℓℓ=1,2,…,524288 can also be deciphered, which is given by(18)Q′1,Q′2,…,Q′524288=∑q=119Q′q1×2q−1+1,∑q=119Q′q2×2q−1+1,…,∑q=119Q′q524288×2q−1+1,=71746,421934,…153983.(3)
By utilizing the deciphered 1D equivalent diffusion sequenceP′ℓℓ=1,2,…,524288 and the 1D equivalent index sequence Q′ℓℓ=1,2,…,524288, the plaintext grayscale images can be recovered, as shown in Figure 7. Note that Figures 7(e), 7(j), and 7(o) show that the original plaintext grayscale images and the recovered plaintext grayscale images are equal, concluding that the proposed attack scheme is effective.


### 4.2. Breaking Results for RGB Color Images Using Chosen-Plaintext Attack

Similarly, according to the proposed attack method in Sections3.2 and 3.3, the breaking experiments are carried on the RGB color images of Lena, Baboon, and Pepper with the size of N×M=256×256. Note that, as for the RGB color images of the same size, the number of plaintext images and the corresponding ciphertext images required to crack the permutation-only process is ⌈log224NM⌉=21 because the total size of RGB color images is 3×256×256. Hence, according to chosen-plaintext attack, one reveals the recovered RGB color images, as shown in Figure 8. Note that Figures 8(e), 8(j), and 8(o) show that the original plaintext RGB color images and the recovered plaintext RGB color images are equal.Figure 8
Original images, ciphertext images, recovered permutated images, recovered images, and difference images of RGB color images of Lena, Baboon, and Pepper. (a) Lena original RGB color image. (b) Lena ciphertext image. (c) Lena recovered permutated image. (d) Lena recovered image. (e) Lena difference image. (f) Baboon original RGB color image. (g) Baboon ciphertext image. (h) Baboon recovered permutated image. (i) Baboon recovered image. (j) Baboon difference image. (k) Pepper original RGB color image. (l) Pepper ciphertext image. (m) Pepper recovered permutated image. (n) Pepper recovered image. (o) Pepper difference image.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)


### 4.3. A Simple Numerical Example

In order to demonstrate the effectiveness of the cryptanalysis, one provides a simple numerical example.Suppose that a plaintext grayscale image of sizeN×M=2×2 is set as an example, which is denoted by Ii,ji=1,2;j=1,2. Then, one obtains the corresponding ciphertext image represented by Ci,ji=1,2;j=1,2 through utilizing the original encryption algorithm. Moreover, let Ii,j and Ci,j be(19)I=8418086183,C=1101234175.Suppose thatIi,j is unknown, and IRi,j represents the recovered plaintext grayscale image from the ciphertext image Ci,j. The steps for obtaining IRi,j by using the proposed chosen-plaintext attack scheme are given as follows:(1)
According to chosen-plaintext attack, choose a full zero plaintext image asI0i,j, and the corresponding ciphertext image is C0i,j, which are given by(20)I0=0000,C0=244237235.Then, based on equations (19) and (20), one gets their corresponding 1D bit-plane decomposition sequences B0ℓℓ=1,2,…,32 and C0ℓℓ=1,2,…,32, respectively, and gets the 1D ciphertext sequence L0ℓℓ=1,2,⋯,32 corresponding to C0ℓℓ=1,2,…,32. Then, according to equations (11)–(13), one further deciphers the 1D equivalent diffusion sequence P′ℓℓ=1,2,…,32, which is denoted by(21)P′1,P′2,…,P′32=0,1,0,1,0,0,1,1,0,1,0,0,1,0,1,1,1,0,0,0,0,1,1,1,0,0,0,1,0,0,0,1.(2)
Givenn=⌈log28×2×2⌉=5. According to chosen-plaintext attack, by choosing 5 special 2D plaintext images Iqi,jq=1,2,…,5, one obtains the corresponding 1D bit-plane decomposition sequences Bqℓq=1,2,…,5, 2D ciphertext images Cqi,jq=1,2,…,5, and 1D ciphertext sequences Lqℓq=1,2,…,5, respectively. Besides, the mathematical expressions of Bqℓ and Lqℓare represented by(22)B11,B12,…,B132=0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,B21,B22,…,B232=0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,B31,B32,…,B332=0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,1,B41,B42,…,B432=0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,B51,B52,…,B532=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,(23)L11,L12,…,L132=0,1,1,1,1,0,1,0,1,0,0,1,1,0,1,1,0,0,1,0,1,0,0,0,1,1,0,1,0,0,1,0,L21,L22,…,L232=0,0,1,0,0,1,0,0,1,0,1,1,1,0,1,0,1,0,0,0,0,1,1,1,1,1,1,0,0,0,1,1,L31,L32,…,L332=0,1,0,1,1,1,1,0,0,1,0,1,0,0,1,0,1,1,0,1,0,0,1,0,1,1,1,0,1,0,0,0,L41,L42,…,L432=0,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,0,1,1,1,1,0,1,0,0,1,0,1,1,0,L51,L52,…,L532=0,0,1,0,0,1,1,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,1,1,0,0,1,0,1,1.(3)
Based on equations (21) and (22), one deciphers the 1D sequences Q′qℓ as(24)Q′11,Q′12,⋯,Q′132=0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,0,1,0,1,0,1,1,1,1,1,1,0,0,0,0,1,1,Q′21,Q′22,⋯,Q′232=0,1,1,1,0,1,1,1,1,1,1,1,0,0,0,1,0,0,0,0,0,0,0,0,1,1,1,1,0,0,1,0,Q′31,Q′32,⋯,Q′332=0,0,0,0,1,1,0,1,0,0,0,1,1,0,0,1,0,1,0,1,0,1,0,1,1,1,1,1,1,0,0,1,Q′41,Q′42,⋯,Q′432=0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,1,1,1,0,1,1,0,0,1,1,0,0,0,0,1,1,1,Q′51,Q′52,⋯,Q′532=0,1,1,1,0,1,0,0,0,0,0,0,0,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,1,0,1,0.(4)
According to equations (15) and (24), one reveals the 1D equivalent index sequence Q′ℓ, given by(25)Q′1,Q′2,…,Q′32=1,19,20,27,6,31,11,16,4,12,3,8,5,17,25,15,26,13,2,29,10,22,18,30,32,24,7,23,21,9,28,14.(5)
First, by using the obtained 1D equivalent diffusion sequenceP′ℓ, rediffuse the 1D diffusion sequence Lℓ corresponding to the ciphertext image Ci,j. The 1D equivalent permutation encryption sequence S′ℓ is deciphered as(26)S′1,S′2,…,S′32=0,1,1,0,1,1,1,0,1,1,0,1,0,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,0,1,0,0.Then, rescrambleS′ℓ by utilizing the 1D equivalent index sequence Q′ℓ, and the 1D bit-plane decomposition sequence B′ℓ is given by(27)B′1,B′2,…,B′32=0,0,0,1,0,1,0,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,1,1,1,1,0,0,0,0,1,1.Finally, according to the bit-plane composition principle,B′ℓis converted into 2D plaintext image IRi,j, that is, one recovered plaintext grayscale image IRi,j from the ciphertext image Ci,j is(28)IR=8418086183.According to equations (19) and (28), one obtains that IR=I. Therefore, the proposed chosen-plaintext attack scheme has been verified through the above examples.


### 4.4. Attack Complexity and Time

According to above analysis, as for the grayscale images with the size ofN×M, one gets that deciphering the 1D equivalent diffusion sequence P′l and the 1D equivalent index sequence Q′l only require 1+⌈log28NM⌉ plaintext images and the corresponding ciphertext images without any known keys. Therefore, the total data complexity is OlogNM, which represents a logarithmic level complexity. Moreover, the breaking time is 12.18 seconds by utilizing our proposed schemes. As for the RGB color images with the size of N×M, the total data complexity is OlogNM. Besides, the breaking time is 40.3 seconds by utilizing our proposed schemes, respectively. Consequently, the experiment results show that the cracking method is both effective and efficient, where it has lower running time and attack complexity.


## 4.1. Breaking Results for Grayscale Images Using Chosen-Plaintext Attack

(1)
According to chosen-plaintext attack, choose a full zero 2D plaintext imageI0i,j, and the corresponding ciphertext image is C0i,j, as shown in Figure 5.Based onI0i,j and C0i,j, one obtains their corresponding 1D bit-plane decomposition sequences B0ℓℓ=1,2,…,524288 and C0ℓℓ=1,2,…,524288, respectively, and gets the 1D ciphertext sequence L0ℓℓ=1,2,…,524288 corresponding to C0ℓℓ=1,2,…,524288. Then, according to equations (11)–(13), one further deciphers the 1D equivalent diffusion sequence P′ℓℓ=1,2,…,524288, given by(16)P′1,P′2,…,P′524288=1,1,0,1,0,0,1,1,0,1,…,0,0,1,1,1,1,1,1,1,1.(2)
Letn=⌈log28NM⌉=19. According to chosen-plaintext attack, by choosing 19 special 2D plaintext images Iqi,jq=1,2,…,19, one obtains the corresponding 1D bit-plane decomposition sequences Bqℓq=1,2,…,19, 2D ciphertext images Cqi,jq=1,2,…,19, and Lqℓq=1,2,…,19, respectively. Moreover, in our numerical simulation experiments, 2D images with the size of 8N×M=2048×256 resolution are adopted to represent 1D sequences Bqℓ and Lqℓ, as shown in Figure 6.After obtainingBqℓ, Lqℓ, and P′ℓ, from equation (14), the 1D sequences Q′qℓℓ=1,2,…,524288;q=1,2,…,19 can be deciphered as(17)Q′11,Q′12,…,Q′1524288=1,1,1,1,1,1,1,0,1,0,…,1,1,0,1,1,1,1,0,0,0,Q′21,Q′22,…,Q′2524288=0,1,0,0,1,1,0,0,1,0,…,0,1,1,1,0,0,1,1,0,1,⋯⋯,Q′191,Q′192,…,Q′2524288=0,1,0,0,1,1,1,0,0,0,…,1,0,0,0,0,0,0,0,0,0.Based on obtainedQ′qℓℓ=1,2,…,524288;q=1,2,…,19, according to equation (15), the 1D equivalent diffusion sequence Q′ℓℓ=1,2,…,524288 can also be deciphered, which is given by(18)Q′1,Q′2,…,Q′524288=∑q=119Q′q1×2q−1+1,∑q=119Q′q2×2q−1+1,…,∑q=119Q′q524288×2q−1+1,=71746,421934,…153983.(3)
By utilizing the deciphered 1D equivalent diffusion sequenceP′ℓℓ=1,2,…,524288 and the 1D equivalent index sequence Q′ℓℓ=1,2,…,524288, the plaintext grayscale images can be recovered, as shown in Figure 7. Note that Figures 7(e), 7(j), and 7(o) show that the original plaintext grayscale images and the recovered plaintext grayscale images are equal, concluding that the proposed attack scheme is effective.


## 4.2. Breaking Results for RGB Color Images Using Chosen-Plaintext Attack

Similarly, according to the proposed attack method in Sections3.2 and 3.3, the breaking experiments are carried on the RGB color images of Lena, Baboon, and Pepper with the size of N×M=256×256. Note that, as for the RGB color images of the same size, the number of plaintext images and the corresponding ciphertext images required to crack the permutation-only process is ⌈log224NM⌉=21 because the total size of RGB color images is 3×256×256. Hence, according to chosen-plaintext attack, one reveals the recovered RGB color images, as shown in Figure 8. Note that Figures 8(e), 8(j), and 8(o) show that the original plaintext RGB color images and the recovered plaintext RGB color images are equal.Figure 8
Original images, ciphertext images, recovered permutated images, recovered images, and difference images of RGB color images of Lena, Baboon, and Pepper. (a) Lena original RGB color image. (b) Lena ciphertext image. (c) Lena recovered permutated image. (d) Lena recovered image. (e) Lena difference image. (f) Baboon original RGB color image. (g) Baboon ciphertext image. (h) Baboon recovered permutated image. (i) Baboon recovered image. (j) Baboon difference image. (k) Pepper original RGB color image. (l) Pepper ciphertext image. (m) Pepper recovered permutated image. (n) Pepper recovered image. (o) Pepper difference image.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)


## 4.3. A Simple Numerical Example

In order to demonstrate the effectiveness of the cryptanalysis, one provides a simple numerical example.Suppose that a plaintext grayscale image of sizeN×M=2×2 is set as an example, which is denoted by Ii,ji=1,2;j=1,2. Then, one obtains the corresponding ciphertext image represented by Ci,ji=1,2;j=1,2 through utilizing the original encryption algorithm. Moreover, let Ii,j and Ci,j be(19)I=8418086183,C=1101234175.Suppose thatIi,j is unknown, and IRi,j represents the recovered plaintext grayscale image from the ciphertext image Ci,j. The steps for obtaining IRi,j by using the proposed chosen-plaintext attack scheme are given as follows:(1)
According to chosen-plaintext attack, choose a full zero plaintext image asI0i,j, and the corresponding ciphertext image is C0i,j, which are given by(20)I0=0000,C0=244237235.Then, based on equations (19) and (20), one gets their corresponding 1D bit-plane decomposition sequences B0ℓℓ=1,2,…,32 and C0ℓℓ=1,2,…,32, respectively, and gets the 1D ciphertext sequence L0ℓℓ=1,2,⋯,32 corresponding to C0ℓℓ=1,2,…,32. Then, according to equations (11)–(13), one further deciphers the 1D equivalent diffusion sequence P′ℓℓ=1,2,…,32, which is denoted by(21)P′1,P′2,…,P′32=0,1,0,1,0,0,1,1,0,1,0,0,1,0,1,1,1,0,0,0,0,1,1,1,0,0,0,1,0,0,0,1.(2)
Givenn=⌈log28×2×2⌉=5. According to chosen-plaintext attack, by choosing 5 special 2D plaintext images Iqi,jq=1,2,…,5, one obtains the corresponding 1D bit-plane decomposition sequences Bqℓq=1,2,…,5, 2D ciphertext images Cqi,jq=1,2,…,5, and 1D ciphertext sequences Lqℓq=1,2,…,5, respectively. Besides, the mathematical expressions of Bqℓ and Lqℓare represented by(22)B11,B12,…,B132=0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,0,1,B21,B22,…,B232=0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,0,0,1,1,B31,B32,…,B332=0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,1,0,0,0,0,1,1,1,1,B41,B42,…,B432=0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,B51,B52,…,B532=0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,0,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,1,(23)L11,L12,…,L132=0,1,1,1,1,0,1,0,1,0,0,1,1,0,1,1,0,0,1,0,1,0,0,0,1,1,0,1,0,0,1,0,L21,L22,…,L232=0,0,1,0,0,1,0,0,1,0,1,1,1,0,1,0,1,0,0,0,0,1,1,1,1,1,1,0,0,0,1,1,L31,L32,…,L332=0,1,0,1,1,1,1,0,0,1,0,1,0,0,1,0,1,1,0,1,0,0,1,0,1,1,1,0,1,0,0,0,L41,L42,…,L432=0,1,0,0,0,1,0,0,0,0,0,0,1,0,0,0,0,1,0,1,1,1,1,0,1,0,0,1,0,1,1,0,L51,L52,…,L532=0,0,1,0,0,1,1,1,0,1,0,0,1,1,0,1,0,0,0,1,0,0,0,0,1,1,0,0,1,0,1,1.(3)
Based on equations (21) and (22), one deciphers the 1D sequences Q′qℓ as(24)Q′11,Q′12,⋯,Q′132=0,0,1,0,1,0,0,1,1,1,0,1,0,0,0,0,1,0,1,0,1,1,1,1,1,1,0,0,0,0,1,1,Q′21,Q′22,⋯,Q′232=0,1,1,1,0,1,1,1,1,1,1,1,0,0,0,1,0,0,0,0,0,0,0,0,1,1,1,1,0,0,1,0,Q′31,Q′32,⋯,Q′332=0,0,0,0,1,1,0,1,0,0,0,1,1,0,0,1,0,1,0,1,0,1,0,1,1,1,1,1,1,0,0,1,Q′41,Q′42,⋯,Q′432=0,0,0,1,0,1,1,1,0,1,0,0,0,0,1,1,1,1,0,1,1,0,0,1,1,0,0,0,0,1,1,1,Q′51,Q′52,⋯,Q′532=0,1,1,1,0,1,0,0,0,0,0,0,0,1,1,0,1,0,0,1,0,1,1,1,1,1,0,1,1,0,1,0.(4)
According to equations (15) and (24), one reveals the 1D equivalent index sequence Q′ℓ, given by(25)Q′1,Q′2,…,Q′32=1,19,20,27,6,31,11,16,4,12,3,8,5,17,25,15,26,13,2,29,10,22,18,30,32,24,7,23,21,9,28,14.(5)
First, by using the obtained 1D equivalent diffusion sequenceP′ℓ, rediffuse the 1D diffusion sequence Lℓ corresponding to the ciphertext image Ci,j. The 1D equivalent permutation encryption sequence S′ℓ is deciphered as(26)S′1,S′2,…,S′32=0,1,1,0,1,1,1,0,1,1,0,1,0,1,1,0,1,0,0,0,1,0,1,0,1,1,0,1,0,1,0,0.Then, rescrambleS′ℓ by utilizing the 1D equivalent index sequence Q′ℓ, and the 1D bit-plane decomposition sequence B′ℓ is given by(27)B′1,B′2,…,B′32=0,0,0,1,0,1,0,1,1,1,1,1,0,0,0,0,1,1,1,1,0,0,1,1,1,1,0,0,0,0,1,1.Finally, according to the bit-plane composition principle,B′ℓis converted into 2D plaintext image IRi,j, that is, one recovered plaintext grayscale image IRi,j from the ciphertext image Ci,j is(28)IR=8418086183.According to equations (19) and (28), one obtains that IR=I. Therefore, the proposed chosen-plaintext attack scheme has been verified through the above examples.


## 4.4. Attack Complexity and Time

According to above analysis, as for the grayscale images with the size ofN×M, one gets that deciphering the 1D equivalent diffusion sequence P′l and the 1D equivalent index sequence Q′l only require 1+⌈log28NM⌉ plaintext images and the corresponding ciphertext images without any known keys. Therefore, the total data complexity is OlogNM, which represents a logarithmic level complexity. Moreover, the breaking time is 12.18 seconds by utilizing our proposed schemes. As for the RGB color images with the size of N×M, the total data complexity is OlogNM. Besides, the breaking time is 40.3 seconds by utilizing our proposed schemes, respectively. Consequently, the experiment results show that the cracking method is both effective and efficient, where it has lower running time and attack complexity.


## 5. Suggestions for Improvement

According to the security defects of the original image chaotic encryption algorithm, the suggestions for improvement are given as follows:(1)
In the permutation encryption structure, one can construct the combination of key stream parameters and the characters of the plaintext image, such as all pixels’ sum, average, and hash value of the plaintext information, where the equivalent permutation keys can be avoided.(2)
In the diffusion encryption structure, one could add some nonlinear diffusion encryption techniques such as S-box and ciphertext feedback mechanism to enhance the combination of plaintext, keys, and ciphertext and further promote the security of the original encryption algorithm. Moreover, one can suggest building the combination of the circle shift parameter and the diffusion encryption results to avoid the equivalent diffusion keys.(3)
One can suggest that the multiple-round encryption algorithm is proposed to improve the security based on the higher efficiency.(4)
One can check the randomness of chaotic sequences. The periods of chaotic sequences obtained by iterating the logistic map in the digital computer are rigorously analysed in [39] and further lead to the dynamic degradation of chaotic maps. Moreover, the randomness of chaotic sequences affects the security of the encryption algorithm. Therefore, it is necessary to check the randomness of chaotic sequences from the perspective of cryptanalysis.


## 6. Conclusions

In this paper, the chaotic cryptosystem with the three-level structure of permutation encryption, diffusion encryption, and linear transformation is analysed. Simplifying the three-level encryption structure of a chaotic cipher into the two-level encryption structure of equivalent permutation encryption and equivalent diffusion encryption is the key point to solve the security analysis problem. In addition, because the chaotic cipher algorithm belongs to an open-loop structure and lacks the ciphertext feedback mechanism, the generated chaotic sequence has nothing to do with the plaintext image, so the equivalent key method can be used to decipher it. The results of theoretical analysis and numerical simulation show that, as for the grayscale images and RGB color images of sizeNM, by utilizing the chosen-plaintext attack method, the equivalent diffusion key and equivalent permutation key can be obtained by choosing only 1+⌈log28NM⌉ and 1+⌈log224NM⌉ plaintext images and the corresponding ciphertext images; thus, the original algorithm can be deciphered successfully. Finally, some suggestions are presented to improve the security of the original image chaotic encryption algorithm. Furthermore, the paper sets up a good example framework for security analysis of bit-level chaotic cryptosystems.



---

*Source: 5747082-2020-08-03.xml*