# Cryptanalysis and Improvement of a Block Cipher Based on Multiple Chaotic Systems

Authors: Jun He; Haifeng Qian; Yuan Zhou; Zhibin Li
Journal: Mathematical Problems in Engineering
 (2010)

---

## Abstract

Wang and Yu proposed a block cipher scheme based on dynamic sequences generated
by multiple chaotic systems, which overcomes the problem of periodical degradation on
random sequences due to computational precision. Their scheme has a feature that a
plaintext is encrypted by a keystream created from several one-dimensional chaotic maps.
However, this feature results in some weaknesses of the encryption algorithm. We show
three kinds of attacks in this paper, through which one can recover the plaintext from
a given ciphertext without the secret key. We also present an improvement on their
scheme, which prevents the three attacks mentioned above. Security of the enhanced
cipher is presented and analyzed, which shows that our improved scheme is secure under
the current attacks.


---

## Body

## 1. Introduction

Thechaos-based encryption scheme was first proposed in 1989 [1]. Following the work, a lot of cryptography researchers haveproposed many chaos-based encryption schemes (some of them are the improvements on the previous ones) [2–6]. Security of all these schemes relies on the properties of chaotic systems: the sensitive dependence on initial conditions and system parameters, pseudorandom property, nonperiodicity and topological transitivity.There are two types of cipher schemes in the chaos-based cryptosystems: stream ciphers and block ciphers. In the chaotic stream ciphers [2, 7–9], a pseudorandom sequence is generated by chaotic sequence generator to encrypt the plaintext. However, the limited computational precision degrades the pseudorandom sequence to a periodic sequence eventually. The chaotic block ciphers adopt chaotic maps to generate parameters used in encryption and decryption procedures. Pareek has proposed two block ciphers based on external keys [10, 11]. But too much time consumption in computation makes them hard to implement in the real-time telecommunication.Wang and Yu proposed a new block encryption scheme in [12] (the Wang-Yu scheme) by combining these two methods of chaotic cryptography. Their scheme provides not only good randomness but also high computational efficiency. In their scheme, several one-dimensional chaotic maps are used to generate pseudorandom sequences with independent and uniform distribution. Through a series of transformations, the sequences constitute a keystream randomly distributed in the key space. The keysteam is used to encrypt the plaintext by executing simple operations such as Exclusive-OR (XOR) and shifting repeatedly with sufficient rounds.Generally speaking, a secure cipher is supposed to resist the following attacks: the chosen plaintext attacks (CPAs), the chosen ciphertext attacks (CCAs) and the known plaintext attacks (KPAs). Unfortunately, the Wang-Yu cipher cannot resist any of the above attacks because the keystream remains unchanged during the execution of the encryption procedure each time. Thus, for an attacker, knowing the keystream is equivalent to knowing the secret key.Our Contributions
We point out the drawbacks of the Wang-Yu block cipher based on dynamic sequences generated by multiple chaotic systems. Their scheme is vulnerable to the following three kinds of attacks: the chosen plaintext attacks, the chosen ciphertext attacks, and the known plaintext attacks. In order to obtain a secure block cipher from chaotic systems, we make efforts to improve the Wang-Yu block cipher. We design a new block cipher which makes the keystream sensitive to any change of the plaintext and the ciphertext. Therefore, our new block cipher is able to resist the above attacks. On the other hand, our scheme preserves the high computational efficiency of the original one.In Section2, some essential notations and security definitions are introduced. In Section 3, the Wang-Yu block cipher is reviewed. In Section 4, we analyze the Wang-Yu scheme and show three different attacks to the scheme. In Section 5, an improved block cipher scheme is proposed. We analyze security and discuss the efficiency of the new scheme in Section 6. Finally, we conclude the paper in Section 7.


## 2. Preliminaries

### 2.1. Notations

We use the following notations:P:
Plaintext,Pi:
ith plaintext block,C:
Ciphertext,Ci:
ith ciphertext block,L:
Number of plaintext blocks,r:
Number of transformation rounds,c(l):
Index of a chosen chaotic map,Bi(l):
64-bit temporary value in encryption/decryption transformation,Sic(l):
64-bit value generated by a chaotic map in the Wang-Yu scheme,Si:
Keystream ofith plaintext block in the Wang-Yu scheme,SKic(l):
64-bit value generated by a chaotic map in the improved scheme,SKi:
Key stream ofith plaintext block in the improved scheme,xj:
A real number in(0,1) indexed by j.


### 2.2. Definitions and Security Notions

We review the definition of chaos and security notions for block cipher as follows.Definition 2.1 (Chaos).
Chaos is aperiodic time-asymptotic behaviour in a deterministic system which exhibits sensitive dependence on initial conditions.
This definition contains three main elements.
(1)
Aperiodic time-asymptotic behaviour: this implies the existence of phase-space trajectories which do not settle down to fixed points or periodic orbits. For practical reasons, we insist that these trajectories are not too rare. We also require the trajectories to be bounded, that is, they should not go off to infinity.(2)
Deterministic: this implies that the equations of motion of the system possess no random inputs. In other words, the irregular behaviour of the system arises from nonlinear dynamics and not from noisy driving forces.(3)
Sensitive dependence on initial conditions: this implies that nearby trajectories in phase-space separate exponentially fast in time; that is, the system has a positive Lyapunov exponent.Definition 2.2 (One-way function).
A functionf:{0,1}*→{0,1}* is one-way if f(·) can be computed by a polynomial time algorithm, but for every randomized polynomial time algorithm 𝒜,
(2.1)Pr[f(𝒜(f(x)))=f(x)]<1p(n),
for every polynomial p(n) and sufficiently large n, assuming that x is chosen from the uniform distribution on {0,1}n.Definition 2.3 (Block cipher).
A symmetric key block cipher consists of two PPT algorithms(Ek(·),Dk(·)) with the following properties: for any random k∈R{0,1}κ, the encryption algorithm on input m∈{0,1}n and k, outputs a ciphertext c=Ek(m); the decryption algorithm on input c and k, outputs a plaintext m if c=Ek(m). For any k∈R{0,1}κ and m∈{0,1}n, correctness requires the following to be hold:
(2.2)m=Dk(Ek(m)).Definition 2.4 (One-way CPA).
LetEk(·) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is allowed to obtain the ciphertext of any message, cannot extract the plaintext from a challenge ciphertext, we say that Ek(·) is one-way under the chosen plaintext attacks.Definition 2.5 (One-way CCA).
LetEk(·) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is allowed to obtain the plaintext of any ciphertext (except for the challenge ciphertext), cannot extract the plaintext from a challenge ciphertext, we say that Ek(·) is one-way under the chosen ciphertext attacks.Definition 2.6 (One-way KPA).
LetEk(·) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is given a set of random plaintexts and corresponding ciphertexts (except for the challenge ciphertext), cannot extract the plaintext from a challenge ciphertext. We say that Ek(·) is one-way under the known plaintext attacks.


## 2.1. Notations

We use the following notations:P:
Plaintext,Pi:
ith plaintext block,C:
Ciphertext,Ci:
ith ciphertext block,L:
Number of plaintext blocks,r:
Number of transformation rounds,c(l):
Index of a chosen chaotic map,Bi(l):
64-bit temporary value in encryption/decryption transformation,Sic(l):
64-bit value generated by a chaotic map in the Wang-Yu scheme,Si:
Keystream ofith plaintext block in the Wang-Yu scheme,SKic(l):
64-bit value generated by a chaotic map in the improved scheme,SKi:
Key stream ofith plaintext block in the improved scheme,xj:
A real number in(0,1) indexed by j.


## 2.2. Definitions and Security Notions

We review the definition of chaos and security notions for block cipher as follows.Definition 2.1 (Chaos).
Chaos is aperiodic time-asymptotic behaviour in a deterministic system which exhibits sensitive dependence on initial conditions.
This definition contains three main elements.
(1)
Aperiodic time-asymptotic behaviour: this implies the existence of phase-space trajectories which do not settle down to fixed points or periodic orbits. For practical reasons, we insist that these trajectories are not too rare. We also require the trajectories to be bounded, that is, they should not go off to infinity.(2)
Deterministic: this implies that the equations of motion of the system possess no random inputs. In other words, the irregular behaviour of the system arises from nonlinear dynamics and not from noisy driving forces.(3)
Sensitive dependence on initial conditions: this implies that nearby trajectories in phase-space separate exponentially fast in time; that is, the system has a positive Lyapunov exponent.Definition 2.2 (One-way function).
A functionf:{0,1}*→{0,1}* is one-way if f(·) can be computed by a polynomial time algorithm, but for every randomized polynomial time algorithm 𝒜,
(2.1)Pr[f(𝒜(f(x)))=f(x)]<1p(n),
for every polynomial p(n) and sufficiently large n, assuming that x is chosen from the uniform distribution on {0,1}n.Definition 2.3 (Block cipher).
A symmetric key block cipher consists of two PPT algorithms(Ek(·),Dk(·)) with the following properties: for any random k∈R{0,1}κ, the encryption algorithm on input m∈{0,1}n and k, outputs a ciphertext c=Ek(m); the decryption algorithm on input c and k, outputs a plaintext m if c=Ek(m). For any k∈R{0,1}κ and m∈{0,1}n, correctness requires the following to be hold:
(2.2)m=Dk(Ek(m)).Definition 2.4 (One-way CPA).
LetEk(·) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is allowed to obtain the ciphertext of any message, cannot extract the plaintext from a challenge ciphertext, we say that Ek(·) is one-way under the chosen plaintext attacks.Definition 2.5 (One-way CCA).
LetEk(·) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is allowed to obtain the plaintext of any ciphertext (except for the challenge ciphertext), cannot extract the plaintext from a challenge ciphertext, we say that Ek(·) is one-way under the chosen ciphertext attacks.Definition 2.6 (One-way KPA).
LetEk(·) be a block cipher. If any adversary 𝒜 (any PPT algorithm) that is given a set of random plaintexts and corresponding ciphertexts (except for the challenge ciphertext), cannot extract the plaintext from a challenge ciphertext. We say that Ek(·) is one-way under the known plaintext attacks.


## 3. Review of the Wang-Yu Block Cipher

### 3.1. Algorithm Description

In this section, we briefly review the block cipher proposed by Wang and Yu [12]. In their scheme, plaintext blocks are converted into ciphertext blocks after several round transformations with XOR and shift operations. A number of 64-bit binary strings as the keystreams are generated in such transformations.Let us see how the keystream is generated. There are two tables in the Wang-Yu scheme. One table consists of four one-dimensional chaotic maps. The other called chaotic map set (CMS) includes initial values between 0 and 1, which are produced through a random number generator from a given secret key. At the beginning, one map is randomly chosen from the first table. An initial value is also chosen from the CMS table by certain rules. The chosen map is then iterated with the initial value for 64 times. Each time the map generates a new real number. If the new number is bigger than0.5, we get 1 for the corresponding digit. Otherwise, we get 0. Eventually, we get a 64-bit binary string after 64 iterations.


### 3.2. Procedure in Detail

The Wang-Yu scheme is described as follows.(i)
Encryption ofPi∈{0,1}64: Ci=Ek(Pi).
(1)
Initialization:Bi(0)=Pi; l=1; d=1; r∈R{0,1}*; CMS table←k. Here, k∈R{0,1}64 is the secret key of the block cipher.(2)
c(l)∈R[0,3], x0← value of cth column, dth row in the CMS table.(3)
Forj=1 to 64:
(a)
ifc(l)=0: xj=μxj-1(1-xj-1);(b)
ifc(l)=1: xj=μsin(πxj-1);(c)
ifc(l)=2: xj=μcos(π|xj-1-0.5|);(d)
ifc(l)=3: xj=1-μ|xj-1-0.5|.(4)
Forj=1 to 64:
(3.1)sj={1,xj⩾x¯,0,xj<x¯,
where x¯=0.5. The keystream is Sic(l)=s1s2⋯s64.(5)
Encryption transformation:(3.2)Bi(2l-1)=Bi(2l-2)⊕Sic(l),Bi(2l)=Bi(2l-1)≪16bits.(6)
Ifl=r, go to step (7);  else l←l+1; d←d+1; goto step (2).(7)
Ci=Bi(2l).   Here, the operation “x≪y” represents a cyclic left shift of x by y bits.(ii)
Decryption ofCi∈{0,1}64: Pi=Dk(Ci).Parameter and keystream generations here are the same as those in the encryption. The only difference is that the equations in step (5) should be replaced by(3.3)Bi(2l-1)=Bi(2l)≫16bits,Bi(2l-2)=Bi(2l-1)⊕Sic(l).
Here, the operation “x≫y” represents a cyclic right shift of x by y bits.


### 3.3. Weaknesses of the Scheme

A keystreamSi=(Sic(1),Sic(2),…,Sic(r)) in the Wang-Yu scheme is generated by a certain secret key k. Then it is used to encrypt the plaintext according to the following rule: (3.4)Ci=ESi(Pi),fori=1,…,L.
Decryption of a ciphertext block Ci can be accomplished by calculating the corresponding keystream Si if the key is given and doing the reverse operations of encryption ESi(·). However, the block cipher is not secure because some problems occur in their keystream generation and the encryption algorithm. Exactly, if we know the keystream Si, we can recover the plaintext of a given ciphertext without the secret key.In the next section we will show how to recover the keystream under the chosen plaintext attack, the chosen ciphertext attack and the known plaintext attack, respectively. We note that knowing the keystreamSi generated by a certain secret key is equivalent to knowing the key indeed [3].


## 3.1. Algorithm Description

In this section, we briefly review the block cipher proposed by Wang and Yu [12]. In their scheme, plaintext blocks are converted into ciphertext blocks after several round transformations with XOR and shift operations. A number of 64-bit binary strings as the keystreams are generated in such transformations.Let us see how the keystream is generated. There are two tables in the Wang-Yu scheme. One table consists of four one-dimensional chaotic maps. The other called chaotic map set (CMS) includes initial values between 0 and 1, which are produced through a random number generator from a given secret key. At the beginning, one map is randomly chosen from the first table. An initial value is also chosen from the CMS table by certain rules. The chosen map is then iterated with the initial value for 64 times. Each time the map generates a new real number. If the new number is bigger than0.5, we get 1 for the corresponding digit. Otherwise, we get 0. Eventually, we get a 64-bit binary string after 64 iterations.


## 3.2. Procedure in Detail

The Wang-Yu scheme is described as follows.(i)
Encryption ofPi∈{0,1}64: Ci=Ek(Pi).
(1)
Initialization:Bi(0)=Pi; l=1; d=1; r∈R{0,1}*; CMS table←k. Here, k∈R{0,1}64 is the secret key of the block cipher.(2)
c(l)∈R[0,3], x0← value of cth column, dth row in the CMS table.(3)
Forj=1 to 64:
(a)
ifc(l)=0: xj=μxj-1(1-xj-1);(b)
ifc(l)=1: xj=μsin(πxj-1);(c)
ifc(l)=2: xj=μcos(π|xj-1-0.5|);(d)
ifc(l)=3: xj=1-μ|xj-1-0.5|.(4)
Forj=1 to 64:
(3.1)sj={1,xj⩾x¯,0,xj<x¯,
where x¯=0.5. The keystream is Sic(l)=s1s2⋯s64.(5)
Encryption transformation:(3.2)Bi(2l-1)=Bi(2l-2)⊕Sic(l),Bi(2l)=Bi(2l-1)≪16bits.(6)
Ifl=r, go to step (7);  else l←l+1; d←d+1; goto step (2).(7)
Ci=Bi(2l).   Here, the operation “x≪y” represents a cyclic left shift of x by y bits.(ii)
Decryption ofCi∈{0,1}64: Pi=Dk(Ci).Parameter and keystream generations here are the same as those in the encryption. The only difference is that the equations in step (5) should be replaced by(3.3)Bi(2l-1)=Bi(2l)≫16bits,Bi(2l-2)=Bi(2l-1)⊕Sic(l).
Here, the operation “x≫y” represents a cyclic right shift of x by y bits.


## 3.3. Weaknesses of the Scheme

A keystreamSi=(Sic(1),Sic(2),…,Sic(r)) in the Wang-Yu scheme is generated by a certain secret key k. Then it is used to encrypt the plaintext according to the following rule: (3.4)Ci=ESi(Pi),fori=1,…,L.
Decryption of a ciphertext block Ci can be accomplished by calculating the corresponding keystream Si if the key is given and doing the reverse operations of encryption ESi(·). However, the block cipher is not secure because some problems occur in their keystream generation and the encryption algorithm. Exactly, if we know the keystream Si, we can recover the plaintext of a given ciphertext without the secret key.In the next section we will show how to recover the keystream under the chosen plaintext attack, the chosen ciphertext attack and the known plaintext attack, respectively. We note that knowing the keystreamSi generated by a certain secret key is equivalent to knowing the key indeed [3].


## 4. Cryptanalysis of the Wang-Yu Block Cipher

With the help of the keystreamSi, we can recover the plaintext from a given ciphertext. Therefore, the following attacks focus on recovering the keystream Si. Suppose that we have a challenge ciphertext C composed by Ci (i=1,2,…,L) to “decrypt” without the secret key. We shall calculate the keystream Si by launching one of the attacks described later.The encryption transformation can be described as follows:(4.1)Bi(0)=Pi,Bi(1)=Bi(0)⊕Sic(1),Bi(2)=Bi(1)≪16bits,Bi(3)=Bi(2)⊕Sic(2),Bi(4)=Bi(3)≪16bits,⋮Bi(2r-1)=Bi(2r-2)⊕Sic(r),Bi(2r)=Bi(2r-1)≪16bits,Bi(2r)=Ci.
For simplicity, the encryption procedure is described as follows:(4.2)Ci=ESi(Pi)=(Pi≪16bits)r⊕Si,fori=1,…,L,
where Si=((((Sic(1)≪16bits)⊕Sic(2))≪16bits)⋯⊕Sic(r))≪16bits. The operation (f)r represents that the action of f is repeated r times.Since the keystream does not change for every plaintext blocks, we can get it from a given plaintext block and a corresponding ciphertext block. Then we can use it to recover the plaintexts from other ciphertexts. A plaintext blockPi can be recovered by using the known keystream Si and a given ciphertext block Ci as follows:(4.3)Pi=DSi(Ci)=((Si⊕Ci)≫16bits)r,fori=1,…,L.
Then, we can recover the plaintexts without the secret key. The following explains how to recover the plaintexts under three different attacks.


### 4.1. How to Recover the Plaintext under CPA

Suppose that we have obtained temporary access to the encryption machine. Given indexi and a special plaintext block Mi, where Mi=(000⋯0)64(the ciphertext block also consists of 64 bits), we can obtain the ciphertext block Di of the plaintext block Mi=(000⋯0)64 from the encryption machine.So, the keystreamSi can be generated from Mi and Di:(4.4)Si=Di⊕(Mi≪16bits)r=Di,fori=1,2,…,L.The recovered plaintext block can be obtained using the keystreamSi and the ciphertext block Ci as follows:(4.5)Pi=((Si⊕Ci)≫16bits)r,fori=1,2,…,L.The flowchart of this attack is given in Figure1, and Figure 2 shows the simulation results of the chosen plaintext attack on a ciphered image of size 256×256.Figure 1
Flowchart of chosen plaintext attacks.Results of the CPA: (a) the original imageP; (b) ciphered image C of P; (c) ciphered image of M = 0000; (d) recovered image.
(a)(b)(c)(d)


### 4.2. How to Recover the Plaintext under CCA

Assume that we have obtained temporary access to the decryption machine. Given indexi and a special ciphertext block Di, where Di=(000⋯0)64(the challenge ciphertext block also consists of 64 bits), we can obtain the plaintext block Mi of the ciphertext block Di=(000⋯0)64 from the decryption machine. The keystream Si can be generated from Mi and Di by(4.6)Si=Di⊕(Mi≪16bits)r=(Mi≪16bits)r,fori=1,2,…,L.The recovered plaintext block can be obtained by using the keystreamSi and the ciphertext block Ci as follows:(4.7)Pi=((Si⊕Ci)≫16bits)r,fori=1,2,…,L.The flowchart of this attack is given in Figure3. Simulation results of a chosen ciphertext attack on a ciphered image of size 512×512 are given in Figure 4.Figure 3
Flowchart of chosen ciphertext attacks.Results of the CCA: (a) the original imageP; (b) ciphered image C of P; (c) plain image of the ciphered image D = 0000; (d) recovered image.
(a)(b)(c)(d)


### 4.3. How to Recover the Plaintext under KPA

The knowledge of one plaintext block and its corresponding ciphertext block with the same length leads to potential damage of privacy for the cryptosystems. We know that given a plaintext blockMi and its corresponding ciphertext block Di, the keystream can be computed as follows:(4.8)Si=(Mi≪16bits)r⊕Di,fori=1,2,…,L.The recovered plaintext block can be obtained by using the keystreamSi and the ciphertext block Ci as follows:(4.9)Pi=((Si⊕Ci)≫16bits)r,fori=1,2,…,L.The flowchart of this attack is given in Figure5 and Figure 6 shows a recovered Lena image from the ciphertext by the known plaintext attack using a known pair of plaintext/ciphertext of Jet.Figure 5
Flowchart of known plaintext attacks.Results of the KPA: (a) the original imageP; (b) ciphered image C of P; (c) plain image M; (d) ciphered image D of M; (e) recovered image from C.
(a)(b)(c)(d)(e)Therefore, we can draw the following conclusion from the above three attacks.Theorem 4.1.
The Wang-Yu block cipher is not secure (i.e., not one-way) under any of the following attacks: the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks.


## 4.1. How to Recover the Plaintext under CPA

Suppose that we have obtained temporary access to the encryption machine. Given indexi and a special plaintext block Mi, where Mi=(000⋯0)64(the ciphertext block also consists of 64 bits), we can obtain the ciphertext block Di of the plaintext block Mi=(000⋯0)64 from the encryption machine.So, the keystreamSi can be generated from Mi and Di:(4.4)Si=Di⊕(Mi≪16bits)r=Di,fori=1,2,…,L.The recovered plaintext block can be obtained using the keystreamSi and the ciphertext block Ci as follows:(4.5)Pi=((Si⊕Ci)≫16bits)r,fori=1,2,…,L.The flowchart of this attack is given in Figure1, and Figure 2 shows the simulation results of the chosen plaintext attack on a ciphered image of size 256×256.Figure 1
Flowchart of chosen plaintext attacks.Results of the CPA: (a) the original imageP; (b) ciphered image C of P; (c) ciphered image of M = 0000; (d) recovered image.
(a)(b)(c)(d)


## 4.2. How to Recover the Plaintext under CCA

Assume that we have obtained temporary access to the decryption machine. Given indexi and a special ciphertext block Di, where Di=(000⋯0)64(the challenge ciphertext block also consists of 64 bits), we can obtain the plaintext block Mi of the ciphertext block Di=(000⋯0)64 from the decryption machine. The keystream Si can be generated from Mi and Di by(4.6)Si=Di⊕(Mi≪16bits)r=(Mi≪16bits)r,fori=1,2,…,L.The recovered plaintext block can be obtained by using the keystreamSi and the ciphertext block Ci as follows:(4.7)Pi=((Si⊕Ci)≫16bits)r,fori=1,2,…,L.The flowchart of this attack is given in Figure3. Simulation results of a chosen ciphertext attack on a ciphered image of size 512×512 are given in Figure 4.Figure 3
Flowchart of chosen ciphertext attacks.Results of the CCA: (a) the original imageP; (b) ciphered image C of P; (c) plain image of the ciphered image D = 0000; (d) recovered image.
(a)(b)(c)(d)


## 4.3. How to Recover the Plaintext under KPA

The knowledge of one plaintext block and its corresponding ciphertext block with the same length leads to potential damage of privacy for the cryptosystems. We know that given a plaintext blockMi and its corresponding ciphertext block Di, the keystream can be computed as follows:(4.8)Si=(Mi≪16bits)r⊕Di,fori=1,2,…,L.The recovered plaintext block can be obtained by using the keystreamSi and the ciphertext block Ci as follows:(4.9)Pi=((Si⊕Ci)≫16bits)r,fori=1,2,…,L.The flowchart of this attack is given in Figure5 and Figure 6 shows a recovered Lena image from the ciphertext by the known plaintext attack using a known pair of plaintext/ciphertext of Jet.Figure 5
Flowchart of known plaintext attacks.Results of the KPA: (a) the original imageP; (b) ciphered image C of P; (c) plain image M; (d) ciphered image D of M; (e) recovered image from C.
(a)(b)(c)(d)(e)Therefore, we can draw the following conclusion from the above three attacks.Theorem 4.1.
The Wang-Yu block cipher is not secure (i.e., not one-way) under any of the following attacks: the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks.


## 5. Improvement

The ciphertext is independent from the keystream, which makes the encryption algorithm presented in [12] vulnerable to the above attacks. To enable the block cipher to be secure against the above attacks, a reasonable solution is shown. Actually, the ciphertext is sensitive to the change of the keystream and the plaintext in our improvement, which results in a cipher with enhanced security. In this section, we present the modification as follows. (i)
Encryption ofPi∈{0,1}64: Ci=Ek(Pi).
(1)
Initialization:Bi(0)=Pi; l=1; r∈R{0,1}*; CMS table←k; P0=1; C0=1. Here, k∈R{0,1}64 is the secret key of the block cipher.(2)
c(l)∈R[0,3], d=(Pi-1⊕Ci-1)mod128, x0← value of cth column, dth row in the CMS table.(3)
Forj=1 to 64:
(a)
ifc(l)=0: xj=μxj-1(1-xj-1);(b)
ifc(l)=1: xj=μsin(πxj-1);(c)
ifc(l)=2: xj=μcos(π|xj-1-0.5|);(d)
ifc(l)=3: xj=1-μ|xj-1-0.5|.(4)
Forj=1 to 64:
(5.1)sj={1,xj⩾x¯,0,xj<x¯,
where x¯=0.5. The keystream is SKic(l)=s1s2⋯s64.(5)
Encryption transformation:(5.2)Bi(2l-1)=Bi(2l-2)⊕SKic(l),Bi(2l)=Bi(2l-1)≪16bits.(6)
Ifl=r, goto step (7); else l←l+1; d←d+1; goto step (2).(7)
Ci=Bi(2l).(ii)
Decryption ofCi∈{0,1}64: Pi=Dk(Ci)Parameter and keystream generations here are the same as those in the encryption. The only difference is that the equations in step (5) should be replaced by(5.3)Bi(2l-1)=Bi(2l)≫16bits,Bi(2l-2)=Bi(2l-1)⊕SKic(l).


## 6. Security and Efficiency of the Improved Scheme

The block cipher algorithm in [12] is not secure since its keystream is reused each time, which makes the keystream easy to recover. Our proposed version of the scheme is designed in a PCBC (Propagating Cipher Block Chaining) mode [13]. Through this mode, an attacker cannot discover the relationship among the keystream, the plaintext and the ciphertext. In order to show that our improved cipher is secure, we consider the three kinds of attacks described previously to recover the keystream in our scheme. As a result, we find that the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks all fail if the encryption algorithm and the decryption algorithm follow our proposal.Moreover, the described attacks are harmless for the enhanced scheme. We assume thatSKi is the keystream used in the encryption of ith block. The keystream SKi is computed as follows:(6.1)SKi=Hk(Pi-1,Ci-1),fori=1,2,…,L.
Here, Pi-1 and Ci-1 are the plaintext block and the ciphertext block with index i-1, respectively; Hk() is a one-way function from chaotic map iterations. Obviously, even if an attacker knows Pi-1 and Ci-1, he cannot get SKi without the secret key.Meanwhile, the above attacks cannot break our scheme since breaking the cipher is equivalent to knowingSKi. However, knowing SKi is impossible in our proposal. Thus, the algorithm is secure against the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks.In our scheme, one XOR and one MOD operations are added in the encryption of a plaintext block. The overload of the improved scheme does not influence the efficiency, compared with the Wang-Yu scheme. But our improved scheme achieves a high level of security.The simulation for the proposed scheme is implemented in Matlab 7.0. Performance is measured on a 2.0 GHz Pentium Dual-Core with 1 GB RAM running Windows XP. The simulation results show that the average running speed of the Wang-Yu cipher and that of our improved cipher are 20.46 MB/s and 19.54 MB/s, respectively.


## 7. Conclusions

In this paper, three kinds of attacks are presented to break a recently proposed block cipher based on multiple chaotic systems. We show that the reuse of the keystream during the encryption iteration makes the Wang-Yu scheme insecure against the chosen plaintext attacks, the chosen ciphertext attacks and the known plaintext attacks. To enhance the security, we introduce a new method by updating the keystream in a way sensitive to the plaintext and the ciphertext.Chaotic system is distinguished by its ergodicity and sensitivity to initial conditions and system parameters. These attributes allow the chaotic time series to be a promising alternative to the conventional cryptographic algorithms and image processing [14–21]. Fractal time series is distributed in a more random pattern than chaos time series does, due to the nondeterministic characteristic. Fractal time series differs from the conventional time series in the statistic properties [22–24]. Many open problems exist in this research area such as stationarity test problem [25], power spectrum problem [26, 27] and bound problem [28]. We are looking for possible ways to apply fractal time series to stochastic number simulation in cryptographic research.



---

*Source: 590590-2010-08-12.xml*