# Cryptanalysis and Improvement of Chaos-Based Image Encryption Scheme with Circular Inter-Intra-Pixels Bit-Level Permutation

Authors: Haiju Fan; Ming Li
Journal: Mathematical Problems in Engineering
 (2017)

---

## Abstract

A novel chaos-based image encryption scheme has been proposed recently. In this scheme, redundancies of the Fridrich’s structure were reduced significantly via a new circular inter-intra-pixels bit-level permutation strategy. However, we proved that the original encryption scheme is vulnerable to the known/chosen-plaintext attacks. Both the permutation and diffusion phases have been improved to enhance the security of the original scheme. By shifting each row of the plain image randomly, known-plaintext attacks could be resisted. Furthermore, by appending double crossover diffusion to the end of the original scheme, chosen-plaintext attacks lost their efficacies. Simulation results demonstrated that the improved encryption scheme outperforms the original one.


---

## Body

## 1. Introduction

With the development of Internet technology, image data has been widely applied in many fields, such as military systems, government agencies, medical imaging systems, and online trade and business. However, digital images are also vulnerable to security risks; that is, sensitive information can be destroyed in the case of unauthorized access, such as interception, tampering, illegal copy, and dissemination. Encryption is a widely employed tool to minimize the potential security risks. However, in most cases, traditional encryption techniques, such as DES, RSA, AES, and IDEA, are specifically made for text data. For image data with different intrinsic characteristics, such as large data storage requirements, high redundancy, and strong correlation among adjacent pixels [1, 2], traditional encryption techniques demonstrate limited performance at best. Therefore, chaos-based image encryption schemes have been developed specifically for images. Benefiting from the inherent properties of chaotic sequences, such as ergodicity, pseudo-randomness, and sensitivity to initial conditions and control parameters [3], these chaos-based image encryption schemes have exhibited excellent properties, including complexity, security, and computational efficiency.To date, a variety of chaos-based schemes have been proposed. However, most [4–6] are based on Fridrich’s permutation-substitution model [7] and demonstrate statistical correlations among the plain image, the cipher image, and the key. Previous studies [8, 9] proved that 96.7% of the bit values were unchanged using Fridrich’s encryption structure. To reduce redundancy and statistical links, many bit-level-based techniques have been proposed [10–16]. However, these techniques also have some limitations. For example, the permutation phase has repetitive patterns [14] and the operations require significant computation time [15, 16]. In 2016, Diaconu proposed a circular inter-intra-pixels bit-level permutation-confusion strategy [17]. This strategy takes advantage of Fridrich’s structure; however, employing the confusion strategy reduces the redundancy significantly. Bit-level circular shifting of each row demonstrates three strong characteristics, that is, no repetitive patterns, uniform bits distribution, and reduced correlation between adjacent higher bit-planes.To improve the security of existing cryptosystems, many cryptanalytic methods have been proposed [18, 19]. Such processes can render the existing cryptographic mechanisms insecure. In this study, we assessed Diaconu’s strategy [17] and found a dangerous vulnerability in the circular shift procedure. In addition, the secret matrix, that is, the equivalent of the keys, can be revealed through known-plaintext attacks. To overcome these security problems, we propose two improvements/changes to the scheme; that is, we improve the permutation phase to resist known-plaintext attacks and improve the diffusion phase to resist chosen-plaintext and differential attacks [20], respectively.The remainder of this paper is organized as follows. Section2 presents an overview of Diaconu’s encryption scheme [17]. Section 3 discusses cryptanalysis using a known-plaintext attack. Improvements to the original algorithm are described in Section 4. Simulation results are provided and they are evaluated in Section 5, and the conclusions are presented in Section 6.


## 2. Original Encryption Scheme

In this section, we describe the original scheme, which is composed of permutation and diffusion phases. The permutation phase scrambles pixels by bit-level circular shift, which updates the pixel positions and generates new pixel values. In the diffusion phase, the permutated image is encrypted using two ciphering matrices.


### 2.1. Permutation

Here, letI0={I0(i,j)}i=1,j=1m,=m denote a grayscale plain image, and let (1)I0i,:=I0i,1,I0i,2,…,I0i,mbe the ith row of I0.The permutation phase is performed as follows.Step 1.
DecomposeI0(i,:) into a vector I0i={I0i(k)}k=18m as follows:(2)I0i=dec2binI0i,:,where the function dec2bin converts the decimal number to a binary number.Step 2.
Compute the circular shift stepsNshifts and direction Dshifts of each row.(3)Nshifts=∑k=18mI0ik,where Nshifts is the number of 1s of each row.(4)Dshifts=modNshifts,2.Each vector I0i is right circular-shifted with Nshifts steps if Dshifts equals 0 and left circular-shifted if Dshifts equals 1.Step 3.
Each group of 8 bits of vectorI0i is converted to a decimal number step by step; thus, the permuted image Is={Is(i,j)}i=1,j=1m,=m can be obtained:(5)Isi,:=bin2decI0i,where Is(i,:) denotes the ith row of the permuted image and the function bin2dec converts the binary number to a decimal number.


### 2.2. Diffusion

The final cipher imageIENC={IENC(i,j)}i=1,j=1m,=m is obtained as follows.For each rowIENC(i,:),(6)IENCi,:=Ιsi,:⊕Icipher_rowi,:,and for each column IENC(:,j), (7)IENC:,j=ΙENC:,j⊕Icipher_colj,:′,where symbol ⊕ represents a bitwise XOR operation, and Icipher_row={Icipher_row(i,j)}i=1,j=1m,=m and Icipher_col={Icipher_col(i,j)}i=1,j=1m,=m are two ciphering matrices.


### 2.3. Computing Ciphering Matrices

Two ciphering matrices are computed by the pseudorandom number generator PRNG (8), which has been proven to have attractor’s fractal structure, ergodicity, and an enormous key space [24]. (8)yi=fr1xi1∗fr2xi2=fr1xi1+fr2xi21-fr1xi1fr2xi2,where r1, r2 are the control parameters, x01, x02 are the initial values, and xi1, xi2 can be generated by the following equation:(9)xi+1ω=frωxiω=2πarctgctgxiω·rω,ω=1,2.A chaotic sequence of size 8m2 can be generated using (8) and (9). Then, the sequence is discretized into dibits by using four thresholds. The high and low bits of all dibits are arranged in two vectors h={h(t)}t=18m2 and l={l(t)}t=18m2, respectively.In [17], x01=0.68775492511773, x02=-0.0134623354671, r1=5.938725025421, and r2=1.257490188615; thus, the key is denoted as K=[x01,x02,r1,r2].Based on the definition above, two ciphering matrices are obtained as follows.Step 1.
Initialize(10)Icipher_row=Icipher_col=O,n=0.Step 2.
Fori=1:m and j=1:m(a)
take eight consecutive bits separately fromh and l in turn,(11)Bcol=strcathn+kk=1,…,8,Brow=strcatln+kk=1,…,8,(b)
get the element of theith row and jth column,(12)Icipher_coli,j=bin2decBcol,Icipher_rowi,j=bin2decBrow,(c)
update the variablen,(13)n=n+8.


## 2.1. Permutation

Here, letI0={I0(i,j)}i=1,j=1m,=m denote a grayscale plain image, and let (1)I0i,:=I0i,1,I0i,2,…,I0i,mbe the ith row of I0.The permutation phase is performed as follows.Step 1.
DecomposeI0(i,:) into a vector I0i={I0i(k)}k=18m as follows:(2)I0i=dec2binI0i,:,where the function dec2bin converts the decimal number to a binary number.Step 2.
Compute the circular shift stepsNshifts and direction Dshifts of each row.(3)Nshifts=∑k=18mI0ik,where Nshifts is the number of 1s of each row.(4)Dshifts=modNshifts,2.Each vector I0i is right circular-shifted with Nshifts steps if Dshifts equals 0 and left circular-shifted if Dshifts equals 1.Step 3.
Each group of 8 bits of vectorI0i is converted to a decimal number step by step; thus, the permuted image Is={Is(i,j)}i=1,j=1m,=m can be obtained:(5)Isi,:=bin2decI0i,where Is(i,:) denotes the ith row of the permuted image and the function bin2dec converts the binary number to a decimal number.


## 2.2. Diffusion

The final cipher imageIENC={IENC(i,j)}i=1,j=1m,=m is obtained as follows.For each rowIENC(i,:),(6)IENCi,:=Ιsi,:⊕Icipher_rowi,:,and for each column IENC(:,j), (7)IENC:,j=ΙENC:,j⊕Icipher_colj,:′,where symbol ⊕ represents a bitwise XOR operation, and Icipher_row={Icipher_row(i,j)}i=1,j=1m,=m and Icipher_col={Icipher_col(i,j)}i=1,j=1m,=m are two ciphering matrices.


## 2.3. Computing Ciphering Matrices

Two ciphering matrices are computed by the pseudorandom number generator PRNG (8), which has been proven to have attractor’s fractal structure, ergodicity, and an enormous key space [24]. (8)yi=fr1xi1∗fr2xi2=fr1xi1+fr2xi21-fr1xi1fr2xi2,where r1, r2 are the control parameters, x01, x02 are the initial values, and xi1, xi2 can be generated by the following equation:(9)xi+1ω=frωxiω=2πarctgctgxiω·rω,ω=1,2.A chaotic sequence of size 8m2 can be generated using (8) and (9). Then, the sequence is discretized into dibits by using four thresholds. The high and low bits of all dibits are arranged in two vectors h={h(t)}t=18m2 and l={l(t)}t=18m2, respectively.In [17], x01=0.68775492511773, x02=-0.0134623354671, r1=5.938725025421, and r2=1.257490188615; thus, the key is denoted as K=[x01,x02,r1,r2].Based on the definition above, two ciphering matrices are obtained as follows.Step 1.
Initialize(10)Icipher_row=Icipher_col=O,n=0.Step 2.
Fori=1:m and j=1:m(a)
take eight consecutive bits separately fromh and l in turn,(11)Bcol=strcathn+kk=1,…,8,Brow=strcatln+kk=1,…,8,(b)
get the element of theith row and jth column,(12)Icipher_coli,j=bin2decBcol,Icipher_rowi,j=bin2decBrow,(c)
update the variablen,(13)n=n+8.


## 3. Cryptanalysis of the Original Scheme

The original algorithm proposed circular inter-intra-pixels bit-level permutation. Within this algorithm, the chaotic map is highly sensitive to the four parameters and a large key space can be obtained. However, the circular shift process has a dangerous vulnerability.Equations (6) and (7) can be transformed into the following expressions:(14)ΙENC=Is⊕Icipher_row_col,(15)Ιcipher_row_col=Icipher_row⊕Icipher_col′.According to Kerckhoff’s principle, the security of a cryptosystem should only depend on the secrecy of the key; that is, everything else in the system can be public knowledge. In other words, the original scheme is assumed to be known, but the key is unknown. Obviously, it is nearly impossible to obtain the key used in Section2.3. Fortunately, the chaotic secret matrix Ιcipher_row_col in (14) is unchanged if the key is fixed. Thus, our goal is to obtain this matrix, which can be realized by a known-plaintext attack.Known-plaintext attacks assume that the plaintext and corresponding cipher are known. If a known-plaintext attack is used to break the original scheme, we must first obtain the scrambled image of a known plain image. Fortunately, the scrambled image can be computed easily by circular shifting.Here, consider a known plain imageIk, whose corresponding scrambled image and cipher image are Sk and Ck, respectively. The scrambled image Sk can be computed easily using the procedure described in Section 2.1. With the cipher image Ck and the computed Sk, the secret matrix Ιcipher_row_col can be obtained using (16)Ιcipher_row_col=Ck⊕Sk,because Ck⊕Sk=Sk⊕Icipher_row⊕Icipher_col′⊕Sk=Icipher_row⊕Icipher_col′=Ιcipher_row_col.If the secret matrixΙcipher_row_col is available, any given cipher image to be decrypted can be restored into the scrambled image Sk. Since the number of 1s in each row of the scrambled image is the same as that of the plain image, the permutation can be reversed easily, and the deciphering image can be obtained.The steps of a known-plaintext attack are as follows.Step 1.
Obtain the secret matrix.Step  1.1. Calculate Sk (Section 2.1) with the known plain image Ik.Step  1.2. Obtain the secret matrix Ιcipher_row_col using (16).Step 2.
Decrypt the given cipher image.Step  2.1. With the given cipher image IENC, calculate the scrambled image Is using (17).(17)IENC⊕Icipher_row_col=Is⊕Icipher_row⊕Icipher_col′⊕Icipher_row_col=Is⊕Icipher_row⊕Icipher_col′⊕Icipher_row⊕Icipher_col′=Is.Step  2.2. Obtain the deciphering image I0 by applying the opposite circular shift to Is; that is, if Dshifts=0, then each row of Is should be left circular-shifted, and if Dshifts=1, then each row of Is should be right circular-shifted.To further demonstrate this idea, experimental results are shown in Figures1 and 2. Figure 1 illustrates how to obtain the secret matrix. Assume that a known plain image is Lena (Figure 1(a)). The cipher image corresponding to Figure 1(a) is shown in Figure 1(b). The circular-shifted image, that is, the permutated image Sk, is shown in Figure 1(c). The secret matrix Ιcipher_row_col computed by (16) is shown in Figure 1(d). The deciphering process of the given cipher image is shown in Figure 2. Here, Figure 2(a) is the plain image and its corresponding cipher image to be deciphered is shown in Figure 2(b). The scrambled image, which is obtained by an XOR operation between the secret matrix Ιcipher_row_col (Figure 1(d)) and the cipher image (Figure 2(b)), is shown in Figure 2(c). Then, after inverse circular shifting, the deciphering image is obtained which is shown in Figure 2(d). Note that the deciphering image is the same as the plain image.Figure 1
Step1 of a known-plaintext attack: (a) known plain image; (b) cipher image corresponding to (a); (c) scrambled image corresponding to (a); and (d) secret matrix.
(a)
(b)
(c)
(d)Figure 2
Step2 of a known-plaintext attack: (a) plain image; (b) cipher image corresponding to (a); (c) scrambled image retrieved from (b); and (d) deciphering image of (b).
(a)
(b)
(c)
(d)


## 4. Analysis, Discussion, and Improvement

### 4.1. Improving Permutation

#### 4.1.1. Vulnerability to Known-Plaintext Attack

In the original scheme, the shift steps and direction are decided by the number of 1s of each row. After permutation, the number of 1s of each row remains unchanged. Therefore, the scrambled image for any known plain image can be computed, which is the primary vulnerability of the original encryption scheme.


#### 4.1.2. Improvement

Randomizing the shift steps and direction of each row can remove this vulnerability. Here, a secret sequence must be introduced to satisfy this requirement. For simplicity, the chaos map based on (8) and (9) is used. If the plain image has m rows, the number of pairs of steps and directions is m. The permutation phase is improved as follows.First, a random sequence of lengthm∗e is generated by iterations, where the parameter e is computed by (18) and 8m is the bits of each row of the plain image. (18)e=log28m.Then, the sequence is discretized into dibits using four thresholds. The high and low bits of the dibits are arranged into vectorshs={hs(t)}t=1m∗e and ls={ls(t)}t=1m∗e, separately.Assume thatds={ds(i)}i=1m denotes the shift direction (left or right) and ps={ps(i)}i=1m denotes the steps of shift. Based on the definition above, the two vectors can be computed as follows.Step 1.
Initialize the vectorsds and ps and the counter variable n,(19)ds=ps=O,n=0.Step 2.
(a) Takee consecutive bits separately from hs and ls in turn,(20)Bd=strcathsn+kk=1,…,e,Bl=strcatlsn+kk=1,…,e.
(b) Obtain theith pair of elements of the vectors ds and ps, (21)dsi=modbin2decBd,2,psi=bin2decBl.
(c) Update the variablen,(22)n=n+e.The permutation process is similar to the process described in Section2.1. Here, vector I0i is right circular-shifted with ps(i) steps if ds(i) equals 0 and left circular-shifted if ds(i) equals 1.Since the scrambled image cannot be computed directly from the plain image, the known-plaintext attack would not break the original encryption scheme. However, the following analysis shows that it is insufficient to improve the permutation phase solely.


### 4.2. Improving Diffusion

#### 4.2.1. Vulnerability to Chosen-Plaintext Attack

After improving permutation, there are two secret sequences. One sequence generates the matrixΙcipher_row_col used in the diffusion phase and the other generates hs and ls used in the permutation phase. Compared to the original algorithm, security is increased; however, the improved encryption scheme can still be broken by a chosen-plaintext attack.IfIz is a matrix where all elements are zero, the permutation phase has no influence on the Iz. Then, the encrypted image ΙZ_ENC can be expressed as follows:(23)ΙZ_ENC=Iz⊕Icipher_row_col=O⊕Icipher_row_col=Icipher_row_col.Here, we find that the secret matrixΙcipher_row_col is equal to the encryption output ΙZ_ENC. Next, random vectors hs and ls used in the permutation phase can be computed by using a matrix Ι1, which is defined as follows: (24)Ι1=00⋯0100⋯01⋯⋯⋯00⋯01.The cipher and scrambled images corresponding toΙ1 are denoted as Ι1_ENC in (25) and I1s, respectively:(25)Ι1_ENC=I1s⊕Icipher_row_col.The secret matrix Ιcipher_row_col is calculated based on (23). Then, we obtain the scrambled image I1s by applying an XOR operation between the cipher image Ι1_ENC and the secret matrix Ιcipher_row_col.(26)I1s=Ι1_ENC⊕Icipher_row_col=I1s⊕Icipher_row_col⊕Icipher_row_col.By transforming each element ofI1s into an 8-bit binary number, we can obtain a matrix I1sb of size m×8m, which has only one “1” in each row. Note that we must obtain the column position of “1.” For example, if the element “1” in the ith row is located at the jth column, we can conclude that the ith row of Ι1 has been right circular-shifted with j steps. Assume that all the shift steps are saved in a vector ld={ld(i)}i=1m, where ld(i)=j can be obtained easily.The deciphering steps are described as follows.Step 1.
ObtainΙcipher_row_col via the chosen plain image Iz.Step 2.
Obtain the scrambled imageIs by an XOR operation between ΙENC and Ιcipher_row_col based on (17).Step 3.
Obtain the permutation steps vectorld using the chosen plain image Ι1.Step 4.
Perform opposite circular shift onIs; that is, the ith row of the scrambled image Is is circularly shifted towards the left direction with ld(i) steps.


#### 4.2.2. Improvement

The deciphering algorithm (Section4.2.1) is performed successfully because it is easy to calculate the secret matrix Ιcipher_row_col. If we design a method to prevent an attacker from obtaining this matrix, the encryption would be secure. Therefore, the diffusion phase should also be improved. An operation, called double crossover diffusion (DCD) [20], is added to the end of the original scheme.Assume thatIv={I(t)}t=1m2 is a stretched vector of cipher image IENC. The DCD mechanism requires a random sequence, which is generated by the logistic map.(27)ui+1=αui1-ui,ui∈0,1.If parameter α is chosen in the range [3.5699456,4] and the initial value u0 is in the range [0,1], the system is in a chaotic state. We can run the logistic map from u0 to generate a chaotic sequence u={u(t)}t=1m2. Then, by sorting this vector, a vector q={q(t)}t=1m2 is obtained, where u(q(t)) is the tth largest element of the chaotic sequence u.The general structure of the improved procedure is presented in Algorithms1 and 2. As shown in Algorithm 1, the cipher image is first reshaped to a vector Iv and ordered by random sequence q. As shown in Algorithm 2, the sorted vector Iv is divided into two blocks and encrypted sequentially by the left and right parts. The key vector key in one block (Algorithm 2) is connected to the vector q and the prior encrypted pixels of the other block.Algorithm 1:Overall structure of DCD.
Read the cipher imageIENC, the vector q from input. Reshape IENC into a vector Iv.
fort=1:m2
I
v
(
t
)
=
I
v
(
q
(
t
)
).
end
I
v = double_crossover_diffusion (Iv,q).
fort=1:m2
I
v
(
q
(
i
)
)
=
I
v
(
i
).
end
ReshapeIv into a new matrix IENC of size m×m.Algorithm 2:Double_crossover_diffusion function.
Read the vectorIv and q from input, set C0=52 and le=m2.
K
e
y
(
1
)
=
m
o
d
(
C
0
+
q
(
1
)
,
256
).Key(1)=mod(C(le)+q(1),256).
C
(
1
)
=
b
i
t
x
o
r
(
I
v
(
1
)
,
K
e
y
(
1
)
).C(1)=bitxor(C(1),Key(1)).
K
e
y
(
l
e
/
2
+
1
)
=
m
o
d
(
C
(
1
)
+
q
(
l
e
/
2
+
1
)
,
256
).Key(le/2+1)=mod(C(1)+q(le/2+1),256).
C
(
l
e
/
2
+
1
)
=
b
i
t
x
o
r
(
I
v
(
l
e
/
2
+
1
)
,
K
e
y
(
l
e
/
2
+
1
)
).C(le/2+1)=bitxor(C(le/2+1),Key(le/2+1)).
fori=2:le/2for i=2:le/2
K
e
y
(
i
)
=
m
o
d
(
C
(
l
e
/
2
+
i
-
1
)
+
q
(
i
)
,
256
).Key(i)=mod(C(le/2+i-1)+q(i),256).
C
(
i
)
=
b
i
t
x
o
r
(
I
v
(
i
)
,
K
e
y
(
i
)
).C(i)=bitxor(C(i),Key(i)).
K
e
y
(
l
e
/
2
+
i
)
=
m
o
d
(
C
(
i
)
+
q
(
l
e
/
2
+
i
)
,
256
).Key(le/2+i)=mod(C(i)+q(le/2+i),256).
C
(
l
e
/
2
+
i
)
=
b
i
t
x
o
r
(
I
v
(
l
e
/
2
+
i
)
,
K
e
y
(
l
e
/
2
+
i
)
).C(le/2+i)=bitxor(C(le/2+i),Key(le/2+i)).
endend
I
v
=
C.


## 4.1. Improving Permutation

### 4.1.1. Vulnerability to Known-Plaintext Attack

In the original scheme, the shift steps and direction are decided by the number of 1s of each row. After permutation, the number of 1s of each row remains unchanged. Therefore, the scrambled image for any known plain image can be computed, which is the primary vulnerability of the original encryption scheme.


### 4.1.2. Improvement

Randomizing the shift steps and direction of each row can remove this vulnerability. Here, a secret sequence must be introduced to satisfy this requirement. For simplicity, the chaos map based on (8) and (9) is used. If the plain image has m rows, the number of pairs of steps and directions is m. The permutation phase is improved as follows.First, a random sequence of lengthm∗e is generated by iterations, where the parameter e is computed by (18) and 8m is the bits of each row of the plain image. (18)e=log28m.Then, the sequence is discretized into dibits using four thresholds. The high and low bits of the dibits are arranged into vectorshs={hs(t)}t=1m∗e and ls={ls(t)}t=1m∗e, separately.Assume thatds={ds(i)}i=1m denotes the shift direction (left or right) and ps={ps(i)}i=1m denotes the steps of shift. Based on the definition above, the two vectors can be computed as follows.Step 1.
Initialize the vectorsds and ps and the counter variable n,(19)ds=ps=O,n=0.Step 2.
(a) Takee consecutive bits separately from hs and ls in turn,(20)Bd=strcathsn+kk=1,…,e,Bl=strcatlsn+kk=1,…,e.
(b) Obtain theith pair of elements of the vectors ds and ps, (21)dsi=modbin2decBd,2,psi=bin2decBl.
(c) Update the variablen,(22)n=n+e.The permutation process is similar to the process described in Section2.1. Here, vector I0i is right circular-shifted with ps(i) steps if ds(i) equals 0 and left circular-shifted if ds(i) equals 1.Since the scrambled image cannot be computed directly from the plain image, the known-plaintext attack would not break the original encryption scheme. However, the following analysis shows that it is insufficient to improve the permutation phase solely.


## 4.1.1. Vulnerability to Known-Plaintext Attack

In the original scheme, the shift steps and direction are decided by the number of 1s of each row. After permutation, the number of 1s of each row remains unchanged. Therefore, the scrambled image for any known plain image can be computed, which is the primary vulnerability of the original encryption scheme.


## 4.1.2. Improvement

Randomizing the shift steps and direction of each row can remove this vulnerability. Here, a secret sequence must be introduced to satisfy this requirement. For simplicity, the chaos map based on (8) and (9) is used. If the plain image has m rows, the number of pairs of steps and directions is m. The permutation phase is improved as follows.First, a random sequence of lengthm∗e is generated by iterations, where the parameter e is computed by (18) and 8m is the bits of each row of the plain image. (18)e=log28m.Then, the sequence is discretized into dibits using four thresholds. The high and low bits of the dibits are arranged into vectorshs={hs(t)}t=1m∗e and ls={ls(t)}t=1m∗e, separately.Assume thatds={ds(i)}i=1m denotes the shift direction (left or right) and ps={ps(i)}i=1m denotes the steps of shift. Based on the definition above, the two vectors can be computed as follows.Step 1.
Initialize the vectorsds and ps and the counter variable n,(19)ds=ps=O,n=0.Step 2.
(a) Takee consecutive bits separately from hs and ls in turn,(20)Bd=strcathsn+kk=1,…,e,Bl=strcatlsn+kk=1,…,e.
(b) Obtain theith pair of elements of the vectors ds and ps, (21)dsi=modbin2decBd,2,psi=bin2decBl.
(c) Update the variablen,(22)n=n+e.The permutation process is similar to the process described in Section2.1. Here, vector I0i is right circular-shifted with ps(i) steps if ds(i) equals 0 and left circular-shifted if ds(i) equals 1.Since the scrambled image cannot be computed directly from the plain image, the known-plaintext attack would not break the original encryption scheme. However, the following analysis shows that it is insufficient to improve the permutation phase solely.


## 4.2. Improving Diffusion

### 4.2.1. Vulnerability to Chosen-Plaintext Attack

After improving permutation, there are two secret sequences. One sequence generates the matrixΙcipher_row_col used in the diffusion phase and the other generates hs and ls used in the permutation phase. Compared to the original algorithm, security is increased; however, the improved encryption scheme can still be broken by a chosen-plaintext attack.IfIz is a matrix where all elements are zero, the permutation phase has no influence on the Iz. Then, the encrypted image ΙZ_ENC can be expressed as follows:(23)ΙZ_ENC=Iz⊕Icipher_row_col=O⊕Icipher_row_col=Icipher_row_col.Here, we find that the secret matrixΙcipher_row_col is equal to the encryption output ΙZ_ENC. Next, random vectors hs and ls used in the permutation phase can be computed by using a matrix Ι1, which is defined as follows: (24)Ι1=00⋯0100⋯01⋯⋯⋯00⋯01.The cipher and scrambled images corresponding toΙ1 are denoted as Ι1_ENC in (25) and I1s, respectively:(25)Ι1_ENC=I1s⊕Icipher_row_col.The secret matrix Ιcipher_row_col is calculated based on (23). Then, we obtain the scrambled image I1s by applying an XOR operation between the cipher image Ι1_ENC and the secret matrix Ιcipher_row_col.(26)I1s=Ι1_ENC⊕Icipher_row_col=I1s⊕Icipher_row_col⊕Icipher_row_col.By transforming each element ofI1s into an 8-bit binary number, we can obtain a matrix I1sb of size m×8m, which has only one “1” in each row. Note that we must obtain the column position of “1.” For example, if the element “1” in the ith row is located at the jth column, we can conclude that the ith row of Ι1 has been right circular-shifted with j steps. Assume that all the shift steps are saved in a vector ld={ld(i)}i=1m, where ld(i)=j can be obtained easily.The deciphering steps are described as follows.Step 1.
ObtainΙcipher_row_col via the chosen plain image Iz.Step 2.
Obtain the scrambled imageIs by an XOR operation between ΙENC and Ιcipher_row_col based on (17).Step 3.
Obtain the permutation steps vectorld using the chosen plain image Ι1.Step 4.
Perform opposite circular shift onIs; that is, the ith row of the scrambled image Is is circularly shifted towards the left direction with ld(i) steps.


### 4.2.2. Improvement

The deciphering algorithm (Section4.2.1) is performed successfully because it is easy to calculate the secret matrix Ιcipher_row_col. If we design a method to prevent an attacker from obtaining this matrix, the encryption would be secure. Therefore, the diffusion phase should also be improved. An operation, called double crossover diffusion (DCD) [20], is added to the end of the original scheme.Assume thatIv={I(t)}t=1m2 is a stretched vector of cipher image IENC. The DCD mechanism requires a random sequence, which is generated by the logistic map.(27)ui+1=αui1-ui,ui∈0,1.If parameter α is chosen in the range [3.5699456,4] and the initial value u0 is in the range [0,1], the system is in a chaotic state. We can run the logistic map from u0 to generate a chaotic sequence u={u(t)}t=1m2. Then, by sorting this vector, a vector q={q(t)}t=1m2 is obtained, where u(q(t)) is the tth largest element of the chaotic sequence u.The general structure of the improved procedure is presented in Algorithms1 and 2. As shown in Algorithm 1, the cipher image is first reshaped to a vector Iv and ordered by random sequence q. As shown in Algorithm 2, the sorted vector Iv is divided into two blocks and encrypted sequentially by the left and right parts. The key vector key in one block (Algorithm 2) is connected to the vector q and the prior encrypted pixels of the other block.Algorithm 1:Overall structure of DCD.
Read the cipher imageIENC, the vector q from input. Reshape IENC into a vector Iv.
fort=1:m2
I
v
(
t
)
=
I
v
(
q
(
t
)
).
end
I
v = double_crossover_diffusion (Iv,q).
fort=1:m2
I
v
(
q
(
i
)
)
=
I
v
(
i
).
end
ReshapeIv into a new matrix IENC of size m×m.Algorithm 2:Double_crossover_diffusion function.
Read the vectorIv and q from input, set C0=52 and le=m2.
K
e
y
(
1
)
=
m
o
d
(
C
0
+
q
(
1
)
,
256
).Key(1)=mod(C(le)+q(1),256).
C
(
1
)
=
b
i
t
x
o
r
(
I
v
(
1
)
,
K
e
y
(
1
)
).C(1)=bitxor(C(1),Key(1)).
K
e
y
(
l
e
/
2
+
1
)
=
m
o
d
(
C
(
1
)
+
q
(
l
e
/
2
+
1
)
,
256
).Key(le/2+1)=mod(C(1)+q(le/2+1),256).
C
(
l
e
/
2
+
1
)
=
b
i
t
x
o
r
(
I
v
(
l
e
/
2
+
1
)
,
K
e
y
(
l
e
/
2
+
1
)
).C(le/2+1)=bitxor(C(le/2+1),Key(le/2+1)).
fori=2:le/2for i=2:le/2
K
e
y
(
i
)
=
m
o
d
(
C
(
l
e
/
2
+
i
-
1
)
+
q
(
i
)
,
256
).Key(i)=mod(C(le/2+i-1)+q(i),256).
C
(
i
)
=
b
i
t
x
o
r
(
I
v
(
i
)
,
K
e
y
(
i
)
).C(i)=bitxor(C(i),Key(i)).
K
e
y
(
l
e
/
2
+
i
)
=
m
o
d
(
C
(
i
)
+
q
(
l
e
/
2
+
i
)
,
256
).Key(le/2+i)=mod(C(i)+q(le/2+i),256).
C
(
l
e
/
2
+
i
)
=
b
i
t
x
o
r
(
I
v
(
l
e
/
2
+
i
)
,
K
e
y
(
l
e
/
2
+
i
)
).C(le/2+i)=bitxor(C(le/2+i),Key(le/2+i)).
endend
I
v
=
C.


## 4.2.1. Vulnerability to Chosen-Plaintext Attack

After improving permutation, there are two secret sequences. One sequence generates the matrixΙcipher_row_col used in the diffusion phase and the other generates hs and ls used in the permutation phase. Compared to the original algorithm, security is increased; however, the improved encryption scheme can still be broken by a chosen-plaintext attack.IfIz is a matrix where all elements are zero, the permutation phase has no influence on the Iz. Then, the encrypted image ΙZ_ENC can be expressed as follows:(23)ΙZ_ENC=Iz⊕Icipher_row_col=O⊕Icipher_row_col=Icipher_row_col.Here, we find that the secret matrixΙcipher_row_col is equal to the encryption output ΙZ_ENC. Next, random vectors hs and ls used in the permutation phase can be computed by using a matrix Ι1, which is defined as follows: (24)Ι1=00⋯0100⋯01⋯⋯⋯00⋯01.The cipher and scrambled images corresponding toΙ1 are denoted as Ι1_ENC in (25) and I1s, respectively:(25)Ι1_ENC=I1s⊕Icipher_row_col.The secret matrix Ιcipher_row_col is calculated based on (23). Then, we obtain the scrambled image I1s by applying an XOR operation between the cipher image Ι1_ENC and the secret matrix Ιcipher_row_col.(26)I1s=Ι1_ENC⊕Icipher_row_col=I1s⊕Icipher_row_col⊕Icipher_row_col.By transforming each element ofI1s into an 8-bit binary number, we can obtain a matrix I1sb of size m×8m, which has only one “1” in each row. Note that we must obtain the column position of “1.” For example, if the element “1” in the ith row is located at the jth column, we can conclude that the ith row of Ι1 has been right circular-shifted with j steps. Assume that all the shift steps are saved in a vector ld={ld(i)}i=1m, where ld(i)=j can be obtained easily.The deciphering steps are described as follows.Step 1.
ObtainΙcipher_row_col via the chosen plain image Iz.Step 2.
Obtain the scrambled imageIs by an XOR operation between ΙENC and Ιcipher_row_col based on (17).Step 3.
Obtain the permutation steps vectorld using the chosen plain image Ι1.Step 4.
Perform opposite circular shift onIs; that is, the ith row of the scrambled image Is is circularly shifted towards the left direction with ld(i) steps.


## 4.2.2. Improvement

The deciphering algorithm (Section4.2.1) is performed successfully because it is easy to calculate the secret matrix Ιcipher_row_col. If we design a method to prevent an attacker from obtaining this matrix, the encryption would be secure. Therefore, the diffusion phase should also be improved. An operation, called double crossover diffusion (DCD) [20], is added to the end of the original scheme.Assume thatIv={I(t)}t=1m2 is a stretched vector of cipher image IENC. The DCD mechanism requires a random sequence, which is generated by the logistic map.(27)ui+1=αui1-ui,ui∈0,1.If parameter α is chosen in the range [3.5699456,4] and the initial value u0 is in the range [0,1], the system is in a chaotic state. We can run the logistic map from u0 to generate a chaotic sequence u={u(t)}t=1m2. Then, by sorting this vector, a vector q={q(t)}t=1m2 is obtained, where u(q(t)) is the tth largest element of the chaotic sequence u.The general structure of the improved procedure is presented in Algorithms1 and 2. As shown in Algorithm 1, the cipher image is first reshaped to a vector Iv and ordered by random sequence q. As shown in Algorithm 2, the sorted vector Iv is divided into two blocks and encrypted sequentially by the left and right parts. The key vector key in one block (Algorithm 2) is connected to the vector q and the prior encrypted pixels of the other block.Algorithm 1:Overall structure of DCD.
Read the cipher imageIENC, the vector q from input. Reshape IENC into a vector Iv.
fort=1:m2
I
v
(
t
)
=
I
v
(
q
(
t
)
).
end
I
v = double_crossover_diffusion (Iv,q).
fort=1:m2
I
v
(
q
(
i
)
)
=
I
v
(
i
).
end
ReshapeIv into a new matrix IENC of size m×m.Algorithm 2:Double_crossover_diffusion function.
Read the vectorIv and q from input, set C0=52 and le=m2.
K
e
y
(
1
)
=
m
o
d
(
C
0
+
q
(
1
)
,
256
).Key(1)=mod(C(le)+q(1),256).
C
(
1
)
=
b
i
t
x
o
r
(
I
v
(
1
)
,
K
e
y
(
1
)
).C(1)=bitxor(C(1),Key(1)).
K
e
y
(
l
e
/
2
+
1
)
=
m
o
d
(
C
(
1
)
+
q
(
l
e
/
2
+
1
)
,
256
).Key(le/2+1)=mod(C(1)+q(le/2+1),256).
C
(
l
e
/
2
+
1
)
=
b
i
t
x
o
r
(
I
v
(
l
e
/
2
+
1
)
,
K
e
y
(
l
e
/
2
+
1
)
).C(le/2+1)=bitxor(C(le/2+1),Key(le/2+1)).
fori=2:le/2for i=2:le/2
K
e
y
(
i
)
=
m
o
d
(
C
(
l
e
/
2
+
i
-
1
)
+
q
(
i
)
,
256
).Key(i)=mod(C(le/2+i-1)+q(i),256).
C
(
i
)
=
b
i
t
x
o
r
(
I
v
(
i
)
,
K
e
y
(
i
)
).C(i)=bitxor(C(i),Key(i)).
K
e
y
(
l
e
/
2
+
i
)
=
m
o
d
(
C
(
i
)
+
q
(
l
e
/
2
+
i
)
,
256
).Key(le/2+i)=mod(C(i)+q(le/2+i),256).
C
(
l
e
/
2
+
i
)
=
b
i
t
x
o
r
(
I
v
(
l
e
/
2
+
i
)
,
K
e
y
(
l
e
/
2
+
i
)
).C(le/2+i)=bitxor(C(le/2+i),Key(le/2+i)).
endend
I
v
=
C.


## 5. Performance of the Improved Cryptosystem

This section presents experimental results and analyzes the performance of the improved cryptosystem. Here, we obtained plain images from the USC-SIPI image database [25]. Note that images of other sizes can also be encrypted effectively by the proposed algorithm. The PRNG parameters are x01=0.68775492511773, x02=-0.0134623354671, r1=5.938725025421, and r2=1.257490188615. The logistic map parameters are α=3.99 and u0=0.2113. However, the parameter C0 in crossover diffusion is 52, which is not considered as the key in this paper. Thus, there are six parameters in the key vector K1=[x01,x02,r1,r2,α,u0], where α, r1, r2 are the control parameters and x01, x02, u0 are the initial parameters. All experiments were implemented by using MATLAB R2010b and were executed on a personal computer (Intel Core i5-5300U 2.3 GHz CPU, 4 GB memory).


### 5.1. Security

#### 5.1.1. Key Space

Key space is a significant index to measure the ability to resist brute-force attacks and an effective key space must contain very large and unique keys. Considering the type of PRNG and the logistic map, the six parameters can be expressed by double-real precision (15 decimals). Thus, the key space can achieve(1015)6=1090, which is nearly 299 bits. As a result, the size of the key space in the improved algorithm is sufficient to resist exhaustive attacks.


#### 5.1.2. Key Sensitivity

An important security indicator for an image encryption system is the sensitivity to the key; that is, small changes to the key lead to significant changes in the cipher image. Assume that a new keyK2 can be obtained by transforming K1 (adding 10−15 to r1 and leaving the other parameters unchanged). Figures 3 and 4 represent the improved algorithm’s sensitivity to the key. The contrasts before and after adding 10−15 to r1 are presented in Figure 3, and it shows that small changes to the key generate an entirely different cipher images. Figure 4 shows that a correct secret key can achieve a completely accurate decryption, while a key with a small change cannot.Figure 3
Sensitivity to small changes in the key: (a) image encrypted by keyK1; (b) image encrypted by key K2; and (c) difference image between (a) and (b).
(a)
(b)
(c)Figure 4
Image decryption using correct and incorrect keys: (a) image encrypted by keyK1; (b) deciphering image by correct key K1; and (c) deciphering image by incorrect key K2.
(a)
(b)
(c)Likewise, letE1={E1(i,j)}i=1,j=1m,=m and E2={E2(i,j)}i=1,j=1m,=m represent two cipher images using different keys K1 (the initial key) and K2 (adding 10−15 to u0). To evaluate quantitatively the sensitivity to the key, the percentage of different pixels of the two cipher images is computed. Simulation results are shown in Table 1. As shown in Table 1, over 99.5% of the pixels of one encrypted image differ from the pixels of the other image. Thus, the improved encryption scheme is highly sensitive to the secret key.Table 1
Percentage difference between two cipher images before and after adding 10−15 to u0 (%).
Image
Boat
Baboon
Couple
Peppers
Lena
Cameraman
Difference
99.62
99.61
99.61
99.62
99.59
99.58


#### 5.1.3. Differential Attack Analysis

The ability to resist differential attacks depends on the “sensitivity to the changes” in plain image. Stronger sensitivity affords greater resistance to differential attacks. LetP1={P1(i,j)}i=1,j=1m,=m denote a plain image. After selecting a pixel of this plain image randomly and flipping its least significant bit, we can obtain a new plain image P2={P2(i,j)}i=1,j=1m,=m. The corresponding cipher images are E1={E1(i,j)}i=1,j=1m,=m and E2={E2(i,j)}i=1,j=1m,=m, respectively. To represent the sensitivity of the encryption scheme to plain image, two parameters, the Number of Pixels Change Rate (NPCR) and the Unified Average Changing Intensity (UACI), are introduced and defined by (28)NPCR=1M×N∑i=1M∑j=1NDi,j×100%,UACI=1M×N∑i=1M∑j=1NE1i,j-E2i,j2n-1×100%,where n is the bits of the pixels and M and N represent the width and height of the test images, respectively. If E1(i,j) is equal to E2(i,j), then D(i,j)=0; otherwise, D(i,j)=1. Ideal NPCR and UACI values can be calculated by the following equations, respectively. (29)NPCRE=1-2-n×100%,(30)UACIE=122n∑i=12n-1ii+12n-1×100%.Ifn=8, the ideal NPCR and UACI values are 99.6094% and 33.4635%, respectively.The NPCR and UACI values of the five images are shown in Table2. To demonstrate the broad applicability of the improved scheme, we used different natural plain images and selected pixel multiple times randomly to obtain the average values. Note that our improved scheme requires only one-round encryption process and ideal values of NPCR and UACI have been achieved without encrypting more than one round. As shown in Table 2, the NPCR values are close to the ideal value (i.e., 99.6094%), and the UACI values range from 33.3% to 33.6%. Relative to the NPCR, the proposed scheme is better than [22] and comparable to [17, 21, 23]. For UACI, the improved scheme demonstrates the best performance. Hence, changing one pixel of plain image influences nearly all pixels of the cipher image with the improved scheme, and this demonstrates the better security property of the proposed scheme against differential attacks.Table 2
NPCR and UACI values of different images by different algorithms.
Image
NPCR (%)
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
99.61
99.55
99.61
99.62
99.60
Peppers
99.61
99.58
99.62
99.61
99.61
Couple
99.63
99.56
99.63
99.63
99.64
Cameraman
99.63
99.57
99.61
99.60
99.63
Boat
99.63
99.56
99.62
99.61
99.59
Image
UACI (%)
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
33.56
33.34
33.63
33.48
33.47
Peppers
33.63
33.35
33.74
33.51
33.40
Couple
33.64
33.37
33.72
33.49
33.45
Cameraman
33.71
33.37
33.69
33.52
33.59
Boat
33.61
33.42
33.60
33.49
33.32


### 5.2. Computational and Complexity Analysis

The permutation phase of the improved scheme is the same as that of the original scheme. As a result, the total complexity of the permutation phase is approximate toΘ(8×m×m). The time complexity of the diffusion process is Θ(m×m), which is similar to that of the original algorithm. Therefore, the total time complexity of the proposed algorithm is Θ(8×m×m). The execution time of the improved scheme, the original scheme, and other algorithms are given in Table 3. For accuracy, we encrypted different natural images multiple times to obtain the average value by using different algorithms. As shown in Table 3, the operating speed of the improved scheme is better than those in [17, 21, 22] but less than that in [23]. Moreover, the execution efficiency of the improved scheme is somewhat higher than that of the original scheme. It is because the shift steps and the direction of each row are determined by the available key vectors ds and ps in our permutation phase. In contrast, in the original scheme, they are computed row by row. Besides, the execution time of the improved algorithm would be at least an order of magnitude slower than those reported in [17, 21–23] when they were executed in a different environment without optimization.Table 3
Execution time.
Scheme
Image size
128
×
128
256
×
256
512
×
512
1024
×
1024
Ref. [21]
0.1895
0.3414
1.5026
9.3228
Ref. [22]
0.3125
0.5029
2.2335
11.7568
Ref. [23]
0.1605
0.2921
1.3528
8.2878
Original
0.2379
0.4261
2.0396
11.1652
Improved
0.1811
0.3384
1.4918
9.2796


### 5.3. Visual and Statistical Analysis

#### 5.3.1. Histogram Analysis

Histogram analysis can demonstrate the uniformity of a distribution. A flat histogram indicates a good cipher image obtained by a secure encryption algorithm. The comparative experiments with the original and improved algorithms are shown in Figure5, and the corresponding histograms are shown in Figure 6. In Figure 5(b), it retains more information of plain image than the one in Figure 5(d), because the original permutation is based on the certain numbers of 1s of each row, while the improved scheme is based on a secret sequence. If two adjacent rows are with equal numbers of 1s, they would be circular-shifted with the same steps along with the same direction. In Figures 6(c) and 6(e), one can deduce that the distributions of the two cipher images are nearly uniform. Therefore, both algorithms can resist statistical attack.Figure 5
Comparison of original and improved algorithms: (a) plain image (lady); (b) scrambled image (original algorithm); (c) cipher image (original algorithm); (d) scrambled image (improved algorithm); and (e) cipher image (improved algorithm).
(a)
(b)
(c)
(d)
(e)Figure 6
Histograms corresponding to the images in Figure5.
(a)
(b)
(c)
(d)
(e)


#### 5.3.2. Correlation Analysis

A plain image typically has high neighbor correlation among pixels that can be weakened by an encryption algorithm. Note that better algorithms lead to weaker correlation. The correlations of adjacent pixels of plain image are compared to those of the cipher image, and the results are shown in Figures7–9. Relative to the correlation, the improved algorithm is comparable to the original algorithm. The correlation coefficients are computed by (31)rxy=∑i=1Mxi-1/M∑j=1Mxjxni-1/M∑j=1Mxnj∑i=1Mxi-1/M∑j=1Mxj2∑i=1Mxni-1/M∑j=1Mxnj2,where xi and xni denote theith pair of neighboring pixels of the image and M is the total number of pairs. The correlative coefficients of different algorithms are shown in Tables 4 and 5. As shown in Table 4, all correlation coefficients of the plain images are close to 1, and those of the cipher images are close to 0. Based on the data shown in Table 5, it can be concluded that the coefficients of the improved algorithm in the horizontal, vertical, and diagonal directions are less than those of algorithms found in [21–23], and the improved algorithm’s coefficients in the horizontal and vertical directions (but not the diagonal direction) are less than those of the original algorithm. By using the original algorithm, coefficients in the horizontal direction are greater than those in the vertical and diagonal directions. It is because two adjacent rows with equal numbers of 1s are circular-shifted with the same steps in the same direction, which increases the correlation coefficient in the horizontal direction. This shortcoming of the original algorithm has been remedied by the proposed improved algorithm. The analysis above demonstrates that the improved algorithm can effectively break the correlation between adjacent pixels.Table 4
Correlation coefficients in different directions by different algorithms.
Image
Direction
Plain image
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
Horizontal
0.9456
−0.0086
−0.0066
0.0011
0.0098
0.0057
Vertical
0.9727
−0.0102
−0.0089
0.0098
−0.0013
−0.0001
Diagonal
0.9213
−0.0125
0.0424
−0.0227
−0.0009
0.0031
Peppers
Horizontal
0.9664
−0.0089
0.0194
0.0071
0.0099
−0.0017
Vertical
0.9738
−0.0113
−0.0091
−0.0065
−0.0016
−0.0033
Diagonal
0.9423
0.0045
0.0123
−0.0165
−0.0012
0.0035
Couple
Horizontal
0.9299
−0.0178
−0.0122
−0.0236
0.0145
−0.0056
Vertical
0.8878
−0.0025
0.0262
−0.0045
0.0035
−0.0017
Diagonal
0.8382
0.0001
−0.0257
0.0016
0.0046
−0.0085
Cameraman
Horizontal
0.9335
−0.0211
0.0063
−0.0047
0.0138
0.0030
Vertical
0.9592
−0.0103
−0.0142
−0.0195
0.0031
−0.0020
Diagonal
0.9087
0.0054
0.0168
0.0279
−0.0010
0.0009
Boat
Horizontal
0.9494
−0.0054
−0.0189
−0.0295
0.0078
0.0028
Vertical
0.9553
−0.0009
0.0003
−0.0150
0.0027
0.0008
Diagonal
0.9118
0.0026
−0.0204
−0.0224
0.0050
0.0035Table 5
Average correlation coefficients of different algorithms.
Direction
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Horizontal
0.01236
0.01268
0.01320
0.01177
0.00398
Vertical
0.00704
0.01174
0.00778
0.00208
0.00143
Diagonal
0.00502
0.02350
0.01822
0.00322
0.00415Figure 7
Correlation distribution of adjacent pixels in the horizon direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)Figure 8
Correlation distribution of adjacent pixels in the vertical direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)Figure 9
Correlation distribution of adjacent pixels in diagonal direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)


#### 5.3.3. Information Entropy Analysis

Information entropy is an important indicator reflecting the randomness of information. A secure cipher image demonstrates large statistical randomness and large information entropy. The information entropy of an image can be computed as follows:(32)Hx=∑i=02n-1pxilog2⁡pxi,where p(xi) denotes the probability of pixel value xi and 2n is the total status number of x. The signal source of entropy n can generate 2n characters. Thus, the ideal information entropy value should be 8 for a 256-gray-level cipher image. If the information entropy of a cipher image is close to 8, the distribution is close to a random distribution. The information entropies of different images obtained by using different algorithms are summarized in Table 6, which shows that the entropies of all encryption algorithms are close to 8. The improved algorithm has average information entropy of 7.9978, which is better than [17, 22, 23] and comparable to [21].Table 6
Information entropies of different images based on different algorithms.
Image
Plain image
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
7.4347
7.9991
7.9951
7.9965
7.9980
7.9963
Peppers
7.5680
7.9973
7.9965
7.9958
7.9985
7.9985
Couple
7.1685
7.9987
7.9951
7.9980
7.9978
7.9976
Cameraman
7.0097
7.9966
7.9955
7.9964
7.9966
7.9985
Boat
7.0944
7.9979
7.9960
7.9959
7.9978
7.9981
Mean value
7.9979
7.9956
7.9965
7.9977
7.9978


## 5.1. Security

### 5.1.1. Key Space

Key space is a significant index to measure the ability to resist brute-force attacks and an effective key space must contain very large and unique keys. Considering the type of PRNG and the logistic map, the six parameters can be expressed by double-real precision (15 decimals). Thus, the key space can achieve(1015)6=1090, which is nearly 299 bits. As a result, the size of the key space in the improved algorithm is sufficient to resist exhaustive attacks.


### 5.1.2. Key Sensitivity

An important security indicator for an image encryption system is the sensitivity to the key; that is, small changes to the key lead to significant changes in the cipher image. Assume that a new keyK2 can be obtained by transforming K1 (adding 10−15 to r1 and leaving the other parameters unchanged). Figures 3 and 4 represent the improved algorithm’s sensitivity to the key. The contrasts before and after adding 10−15 to r1 are presented in Figure 3, and it shows that small changes to the key generate an entirely different cipher images. Figure 4 shows that a correct secret key can achieve a completely accurate decryption, while a key with a small change cannot.Figure 3
Sensitivity to small changes in the key: (a) image encrypted by keyK1; (b) image encrypted by key K2; and (c) difference image between (a) and (b).
(a)
(b)
(c)Figure 4
Image decryption using correct and incorrect keys: (a) image encrypted by keyK1; (b) deciphering image by correct key K1; and (c) deciphering image by incorrect key K2.
(a)
(b)
(c)Likewise, letE1={E1(i,j)}i=1,j=1m,=m and E2={E2(i,j)}i=1,j=1m,=m represent two cipher images using different keys K1 (the initial key) and K2 (adding 10−15 to u0). To evaluate quantitatively the sensitivity to the key, the percentage of different pixels of the two cipher images is computed. Simulation results are shown in Table 1. As shown in Table 1, over 99.5% of the pixels of one encrypted image differ from the pixels of the other image. Thus, the improved encryption scheme is highly sensitive to the secret key.Table 1
Percentage difference between two cipher images before and after adding 10−15 to u0 (%).
Image
Boat
Baboon
Couple
Peppers
Lena
Cameraman
Difference
99.62
99.61
99.61
99.62
99.59
99.58


### 5.1.3. Differential Attack Analysis

The ability to resist differential attacks depends on the “sensitivity to the changes” in plain image. Stronger sensitivity affords greater resistance to differential attacks. LetP1={P1(i,j)}i=1,j=1m,=m denote a plain image. After selecting a pixel of this plain image randomly and flipping its least significant bit, we can obtain a new plain image P2={P2(i,j)}i=1,j=1m,=m. The corresponding cipher images are E1={E1(i,j)}i=1,j=1m,=m and E2={E2(i,j)}i=1,j=1m,=m, respectively. To represent the sensitivity of the encryption scheme to plain image, two parameters, the Number of Pixels Change Rate (NPCR) and the Unified Average Changing Intensity (UACI), are introduced and defined by (28)NPCR=1M×N∑i=1M∑j=1NDi,j×100%,UACI=1M×N∑i=1M∑j=1NE1i,j-E2i,j2n-1×100%,where n is the bits of the pixels and M and N represent the width and height of the test images, respectively. If E1(i,j) is equal to E2(i,j), then D(i,j)=0; otherwise, D(i,j)=1. Ideal NPCR and UACI values can be calculated by the following equations, respectively. (29)NPCRE=1-2-n×100%,(30)UACIE=122n∑i=12n-1ii+12n-1×100%.Ifn=8, the ideal NPCR and UACI values are 99.6094% and 33.4635%, respectively.The NPCR and UACI values of the five images are shown in Table2. To demonstrate the broad applicability of the improved scheme, we used different natural plain images and selected pixel multiple times randomly to obtain the average values. Note that our improved scheme requires only one-round encryption process and ideal values of NPCR and UACI have been achieved without encrypting more than one round. As shown in Table 2, the NPCR values are close to the ideal value (i.e., 99.6094%), and the UACI values range from 33.3% to 33.6%. Relative to the NPCR, the proposed scheme is better than [22] and comparable to [17, 21, 23]. For UACI, the improved scheme demonstrates the best performance. Hence, changing one pixel of plain image influences nearly all pixels of the cipher image with the improved scheme, and this demonstrates the better security property of the proposed scheme against differential attacks.Table 2
NPCR and UACI values of different images by different algorithms.
Image
NPCR (%)
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
99.61
99.55
99.61
99.62
99.60
Peppers
99.61
99.58
99.62
99.61
99.61
Couple
99.63
99.56
99.63
99.63
99.64
Cameraman
99.63
99.57
99.61
99.60
99.63
Boat
99.63
99.56
99.62
99.61
99.59
Image
UACI (%)
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
33.56
33.34
33.63
33.48
33.47
Peppers
33.63
33.35
33.74
33.51
33.40
Couple
33.64
33.37
33.72
33.49
33.45
Cameraman
33.71
33.37
33.69
33.52
33.59
Boat
33.61
33.42
33.60
33.49
33.32


## 5.1.1. Key Space

Key space is a significant index to measure the ability to resist brute-force attacks and an effective key space must contain very large and unique keys. Considering the type of PRNG and the logistic map, the six parameters can be expressed by double-real precision (15 decimals). Thus, the key space can achieve(1015)6=1090, which is nearly 299 bits. As a result, the size of the key space in the improved algorithm is sufficient to resist exhaustive attacks.


## 5.1.2. Key Sensitivity

An important security indicator for an image encryption system is the sensitivity to the key; that is, small changes to the key lead to significant changes in the cipher image. Assume that a new keyK2 can be obtained by transforming K1 (adding 10−15 to r1 and leaving the other parameters unchanged). Figures 3 and 4 represent the improved algorithm’s sensitivity to the key. The contrasts before and after adding 10−15 to r1 are presented in Figure 3, and it shows that small changes to the key generate an entirely different cipher images. Figure 4 shows that a correct secret key can achieve a completely accurate decryption, while a key with a small change cannot.Figure 3
Sensitivity to small changes in the key: (a) image encrypted by keyK1; (b) image encrypted by key K2; and (c) difference image between (a) and (b).
(a)
(b)
(c)Figure 4
Image decryption using correct and incorrect keys: (a) image encrypted by keyK1; (b) deciphering image by correct key K1; and (c) deciphering image by incorrect key K2.
(a)
(b)
(c)Likewise, letE1={E1(i,j)}i=1,j=1m,=m and E2={E2(i,j)}i=1,j=1m,=m represent two cipher images using different keys K1 (the initial key) and K2 (adding 10−15 to u0). To evaluate quantitatively the sensitivity to the key, the percentage of different pixels of the two cipher images is computed. Simulation results are shown in Table 1. As shown in Table 1, over 99.5% of the pixels of one encrypted image differ from the pixels of the other image. Thus, the improved encryption scheme is highly sensitive to the secret key.Table 1
Percentage difference between two cipher images before and after adding 10−15 to u0 (%).
Image
Boat
Baboon
Couple
Peppers
Lena
Cameraman
Difference
99.62
99.61
99.61
99.62
99.59
99.58


## 5.1.3. Differential Attack Analysis

The ability to resist differential attacks depends on the “sensitivity to the changes” in plain image. Stronger sensitivity affords greater resistance to differential attacks. LetP1={P1(i,j)}i=1,j=1m,=m denote a plain image. After selecting a pixel of this plain image randomly and flipping its least significant bit, we can obtain a new plain image P2={P2(i,j)}i=1,j=1m,=m. The corresponding cipher images are E1={E1(i,j)}i=1,j=1m,=m and E2={E2(i,j)}i=1,j=1m,=m, respectively. To represent the sensitivity of the encryption scheme to plain image, two parameters, the Number of Pixels Change Rate (NPCR) and the Unified Average Changing Intensity (UACI), are introduced and defined by (28)NPCR=1M×N∑i=1M∑j=1NDi,j×100%,UACI=1M×N∑i=1M∑j=1NE1i,j-E2i,j2n-1×100%,where n is the bits of the pixels and M and N represent the width and height of the test images, respectively. If E1(i,j) is equal to E2(i,j), then D(i,j)=0; otherwise, D(i,j)=1. Ideal NPCR and UACI values can be calculated by the following equations, respectively. (29)NPCRE=1-2-n×100%,(30)UACIE=122n∑i=12n-1ii+12n-1×100%.Ifn=8, the ideal NPCR and UACI values are 99.6094% and 33.4635%, respectively.The NPCR and UACI values of the five images are shown in Table2. To demonstrate the broad applicability of the improved scheme, we used different natural plain images and selected pixel multiple times randomly to obtain the average values. Note that our improved scheme requires only one-round encryption process and ideal values of NPCR and UACI have been achieved without encrypting more than one round. As shown in Table 2, the NPCR values are close to the ideal value (i.e., 99.6094%), and the UACI values range from 33.3% to 33.6%. Relative to the NPCR, the proposed scheme is better than [22] and comparable to [17, 21, 23]. For UACI, the improved scheme demonstrates the best performance. Hence, changing one pixel of plain image influences nearly all pixels of the cipher image with the improved scheme, and this demonstrates the better security property of the proposed scheme against differential attacks.Table 2
NPCR and UACI values of different images by different algorithms.
Image
NPCR (%)
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
99.61
99.55
99.61
99.62
99.60
Peppers
99.61
99.58
99.62
99.61
99.61
Couple
99.63
99.56
99.63
99.63
99.64
Cameraman
99.63
99.57
99.61
99.60
99.63
Boat
99.63
99.56
99.62
99.61
99.59
Image
UACI (%)
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
33.56
33.34
33.63
33.48
33.47
Peppers
33.63
33.35
33.74
33.51
33.40
Couple
33.64
33.37
33.72
33.49
33.45
Cameraman
33.71
33.37
33.69
33.52
33.59
Boat
33.61
33.42
33.60
33.49
33.32


## 5.2. Computational and Complexity Analysis

The permutation phase of the improved scheme is the same as that of the original scheme. As a result, the total complexity of the permutation phase is approximate toΘ(8×m×m). The time complexity of the diffusion process is Θ(m×m), which is similar to that of the original algorithm. Therefore, the total time complexity of the proposed algorithm is Θ(8×m×m). The execution time of the improved scheme, the original scheme, and other algorithms are given in Table 3. For accuracy, we encrypted different natural images multiple times to obtain the average value by using different algorithms. As shown in Table 3, the operating speed of the improved scheme is better than those in [17, 21, 22] but less than that in [23]. Moreover, the execution efficiency of the improved scheme is somewhat higher than that of the original scheme. It is because the shift steps and the direction of each row are determined by the available key vectors ds and ps in our permutation phase. In contrast, in the original scheme, they are computed row by row. Besides, the execution time of the improved algorithm would be at least an order of magnitude slower than those reported in [17, 21–23] when they were executed in a different environment without optimization.Table 3
Execution time.
Scheme
Image size
128
×
128
256
×
256
512
×
512
1024
×
1024
Ref. [21]
0.1895
0.3414
1.5026
9.3228
Ref. [22]
0.3125
0.5029
2.2335
11.7568
Ref. [23]
0.1605
0.2921
1.3528
8.2878
Original
0.2379
0.4261
2.0396
11.1652
Improved
0.1811
0.3384
1.4918
9.2796


## 5.3. Visual and Statistical Analysis

### 5.3.1. Histogram Analysis

Histogram analysis can demonstrate the uniformity of a distribution. A flat histogram indicates a good cipher image obtained by a secure encryption algorithm. The comparative experiments with the original and improved algorithms are shown in Figure5, and the corresponding histograms are shown in Figure 6. In Figure 5(b), it retains more information of plain image than the one in Figure 5(d), because the original permutation is based on the certain numbers of 1s of each row, while the improved scheme is based on a secret sequence. If two adjacent rows are with equal numbers of 1s, they would be circular-shifted with the same steps along with the same direction. In Figures 6(c) and 6(e), one can deduce that the distributions of the two cipher images are nearly uniform. Therefore, both algorithms can resist statistical attack.Figure 5
Comparison of original and improved algorithms: (a) plain image (lady); (b) scrambled image (original algorithm); (c) cipher image (original algorithm); (d) scrambled image (improved algorithm); and (e) cipher image (improved algorithm).
(a)
(b)
(c)
(d)
(e)Figure 6
Histograms corresponding to the images in Figure5.
(a)
(b)
(c)
(d)
(e)


### 5.3.2. Correlation Analysis

A plain image typically has high neighbor correlation among pixels that can be weakened by an encryption algorithm. Note that better algorithms lead to weaker correlation. The correlations of adjacent pixels of plain image are compared to those of the cipher image, and the results are shown in Figures7–9. Relative to the correlation, the improved algorithm is comparable to the original algorithm. The correlation coefficients are computed by (31)rxy=∑i=1Mxi-1/M∑j=1Mxjxni-1/M∑j=1Mxnj∑i=1Mxi-1/M∑j=1Mxj2∑i=1Mxni-1/M∑j=1Mxnj2,where xi and xni denote theith pair of neighboring pixels of the image and M is the total number of pairs. The correlative coefficients of different algorithms are shown in Tables 4 and 5. As shown in Table 4, all correlation coefficients of the plain images are close to 1, and those of the cipher images are close to 0. Based on the data shown in Table 5, it can be concluded that the coefficients of the improved algorithm in the horizontal, vertical, and diagonal directions are less than those of algorithms found in [21–23], and the improved algorithm’s coefficients in the horizontal and vertical directions (but not the diagonal direction) are less than those of the original algorithm. By using the original algorithm, coefficients in the horizontal direction are greater than those in the vertical and diagonal directions. It is because two adjacent rows with equal numbers of 1s are circular-shifted with the same steps in the same direction, which increases the correlation coefficient in the horizontal direction. This shortcoming of the original algorithm has been remedied by the proposed improved algorithm. The analysis above demonstrates that the improved algorithm can effectively break the correlation between adjacent pixels.Table 4
Correlation coefficients in different directions by different algorithms.
Image
Direction
Plain image
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
Horizontal
0.9456
−0.0086
−0.0066
0.0011
0.0098
0.0057
Vertical
0.9727
−0.0102
−0.0089
0.0098
−0.0013
−0.0001
Diagonal
0.9213
−0.0125
0.0424
−0.0227
−0.0009
0.0031
Peppers
Horizontal
0.9664
−0.0089
0.0194
0.0071
0.0099
−0.0017
Vertical
0.9738
−0.0113
−0.0091
−0.0065
−0.0016
−0.0033
Diagonal
0.9423
0.0045
0.0123
−0.0165
−0.0012
0.0035
Couple
Horizontal
0.9299
−0.0178
−0.0122
−0.0236
0.0145
−0.0056
Vertical
0.8878
−0.0025
0.0262
−0.0045
0.0035
−0.0017
Diagonal
0.8382
0.0001
−0.0257
0.0016
0.0046
−0.0085
Cameraman
Horizontal
0.9335
−0.0211
0.0063
−0.0047
0.0138
0.0030
Vertical
0.9592
−0.0103
−0.0142
−0.0195
0.0031
−0.0020
Diagonal
0.9087
0.0054
0.0168
0.0279
−0.0010
0.0009
Boat
Horizontal
0.9494
−0.0054
−0.0189
−0.0295
0.0078
0.0028
Vertical
0.9553
−0.0009
0.0003
−0.0150
0.0027
0.0008
Diagonal
0.9118
0.0026
−0.0204
−0.0224
0.0050
0.0035Table 5
Average correlation coefficients of different algorithms.
Direction
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Horizontal
0.01236
0.01268
0.01320
0.01177
0.00398
Vertical
0.00704
0.01174
0.00778
0.00208
0.00143
Diagonal
0.00502
0.02350
0.01822
0.00322
0.00415Figure 7
Correlation distribution of adjacent pixels in the horizon direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)Figure 8
Correlation distribution of adjacent pixels in the vertical direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)Figure 9
Correlation distribution of adjacent pixels in diagonal direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)


### 5.3.3. Information Entropy Analysis

Information entropy is an important indicator reflecting the randomness of information. A secure cipher image demonstrates large statistical randomness and large information entropy. The information entropy of an image can be computed as follows:(32)Hx=∑i=02n-1pxilog2⁡pxi,where p(xi) denotes the probability of pixel value xi and 2n is the total status number of x. The signal source of entropy n can generate 2n characters. Thus, the ideal information entropy value should be 8 for a 256-gray-level cipher image. If the information entropy of a cipher image is close to 8, the distribution is close to a random distribution. The information entropies of different images obtained by using different algorithms are summarized in Table 6, which shows that the entropies of all encryption algorithms are close to 8. The improved algorithm has average information entropy of 7.9978, which is better than [17, 22, 23] and comparable to [21].Table 6
Information entropies of different images based on different algorithms.
Image
Plain image
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
7.4347
7.9991
7.9951
7.9965
7.9980
7.9963
Peppers
7.5680
7.9973
7.9965
7.9958
7.9985
7.9985
Couple
7.1685
7.9987
7.9951
7.9980
7.9978
7.9976
Cameraman
7.0097
7.9966
7.9955
7.9964
7.9966
7.9985
Boat
7.0944
7.9979
7.9960
7.9959
7.9978
7.9981
Mean value
7.9979
7.9956
7.9965
7.9977
7.9978


## 5.3.1. Histogram Analysis

Histogram analysis can demonstrate the uniformity of a distribution. A flat histogram indicates a good cipher image obtained by a secure encryption algorithm. The comparative experiments with the original and improved algorithms are shown in Figure5, and the corresponding histograms are shown in Figure 6. In Figure 5(b), it retains more information of plain image than the one in Figure 5(d), because the original permutation is based on the certain numbers of 1s of each row, while the improved scheme is based on a secret sequence. If two adjacent rows are with equal numbers of 1s, they would be circular-shifted with the same steps along with the same direction. In Figures 6(c) and 6(e), one can deduce that the distributions of the two cipher images are nearly uniform. Therefore, both algorithms can resist statistical attack.Figure 5
Comparison of original and improved algorithms: (a) plain image (lady); (b) scrambled image (original algorithm); (c) cipher image (original algorithm); (d) scrambled image (improved algorithm); and (e) cipher image (improved algorithm).
(a)
(b)
(c)
(d)
(e)Figure 6
Histograms corresponding to the images in Figure5.
(a)
(b)
(c)
(d)
(e)


## 5.3.2. Correlation Analysis

A plain image typically has high neighbor correlation among pixels that can be weakened by an encryption algorithm. Note that better algorithms lead to weaker correlation. The correlations of adjacent pixels of plain image are compared to those of the cipher image, and the results are shown in Figures7–9. Relative to the correlation, the improved algorithm is comparable to the original algorithm. The correlation coefficients are computed by (31)rxy=∑i=1Mxi-1/M∑j=1Mxjxni-1/M∑j=1Mxnj∑i=1Mxi-1/M∑j=1Mxj2∑i=1Mxni-1/M∑j=1Mxnj2,where xi and xni denote theith pair of neighboring pixels of the image and M is the total number of pairs. The correlative coefficients of different algorithms are shown in Tables 4 and 5. As shown in Table 4, all correlation coefficients of the plain images are close to 1, and those of the cipher images are close to 0. Based on the data shown in Table 5, it can be concluded that the coefficients of the improved algorithm in the horizontal, vertical, and diagonal directions are less than those of algorithms found in [21–23], and the improved algorithm’s coefficients in the horizontal and vertical directions (but not the diagonal direction) are less than those of the original algorithm. By using the original algorithm, coefficients in the horizontal direction are greater than those in the vertical and diagonal directions. It is because two adjacent rows with equal numbers of 1s are circular-shifted with the same steps in the same direction, which increases the correlation coefficient in the horizontal direction. This shortcoming of the original algorithm has been remedied by the proposed improved algorithm. The analysis above demonstrates that the improved algorithm can effectively break the correlation between adjacent pixels.Table 4
Correlation coefficients in different directions by different algorithms.
Image
Direction
Plain image
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
Horizontal
0.9456
−0.0086
−0.0066
0.0011
0.0098
0.0057
Vertical
0.9727
−0.0102
−0.0089
0.0098
−0.0013
−0.0001
Diagonal
0.9213
−0.0125
0.0424
−0.0227
−0.0009
0.0031
Peppers
Horizontal
0.9664
−0.0089
0.0194
0.0071
0.0099
−0.0017
Vertical
0.9738
−0.0113
−0.0091
−0.0065
−0.0016
−0.0033
Diagonal
0.9423
0.0045
0.0123
−0.0165
−0.0012
0.0035
Couple
Horizontal
0.9299
−0.0178
−0.0122
−0.0236
0.0145
−0.0056
Vertical
0.8878
−0.0025
0.0262
−0.0045
0.0035
−0.0017
Diagonal
0.8382
0.0001
−0.0257
0.0016
0.0046
−0.0085
Cameraman
Horizontal
0.9335
−0.0211
0.0063
−0.0047
0.0138
0.0030
Vertical
0.9592
−0.0103
−0.0142
−0.0195
0.0031
−0.0020
Diagonal
0.9087
0.0054
0.0168
0.0279
−0.0010
0.0009
Boat
Horizontal
0.9494
−0.0054
−0.0189
−0.0295
0.0078
0.0028
Vertical
0.9553
−0.0009
0.0003
−0.0150
0.0027
0.0008
Diagonal
0.9118
0.0026
−0.0204
−0.0224
0.0050
0.0035Table 5
Average correlation coefficients of different algorithms.
Direction
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Horizontal
0.01236
0.01268
0.01320
0.01177
0.00398
Vertical
0.00704
0.01174
0.00778
0.00208
0.00143
Diagonal
0.00502
0.02350
0.01822
0.00322
0.00415Figure 7
Correlation distribution of adjacent pixels in the horizon direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)Figure 8
Correlation distribution of adjacent pixels in the vertical direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)Figure 9
Correlation distribution of adjacent pixels in diagonal direction: (a) plain image; (b) cipher image (original algorithm); and (c) cipher image (improved algorithm).
(a)
(b)
(c)


## 5.3.3. Information Entropy Analysis

Information entropy is an important indicator reflecting the randomness of information. A secure cipher image demonstrates large statistical randomness and large information entropy. The information entropy of an image can be computed as follows:(32)Hx=∑i=02n-1pxilog2⁡pxi,where p(xi) denotes the probability of pixel value xi and 2n is the total status number of x. The signal source of entropy n can generate 2n characters. Thus, the ideal information entropy value should be 8 for a 256-gray-level cipher image. If the information entropy of a cipher image is close to 8, the distribution is close to a random distribution. The information entropies of different images obtained by using different algorithms are summarized in Table 6, which shows that the entropies of all encryption algorithms are close to 8. The improved algorithm has average information entropy of 7.9978, which is better than [17, 22, 23] and comparable to [21].Table 6
Information entropies of different images based on different algorithms.
Image
Plain image
Algorithm
Ref. [21]
Ref. [22]
Ref. [23]
Original
Improved
Lena
7.4347
7.9991
7.9951
7.9965
7.9980
7.9963
Peppers
7.5680
7.9973
7.9965
7.9958
7.9985
7.9985
Couple
7.1685
7.9987
7.9951
7.9980
7.9978
7.9976
Cameraman
7.0097
7.9966
7.9955
7.9964
7.9966
7.9985
Boat
7.0944
7.9979
7.9960
7.9959
7.9978
7.9981
Mean value
7.9979
7.9956
7.9965
7.9977
7.9978


## 6. Conclusion

This paper has analyzed a recent chaos-based image encryption algorithm with circular inter-intra-pixels bit-level permutation. It was found that the scheme can be cracked by known-plaintext attacks. In addition, two defects in the original scheme have been identified and discussed. One is the fixed steps and directions of the circular shift, which causes the vulnerability to known-plaintext attacks. The other is the lack of secure diffusion, which causes the vulnerability to chosen-plaintext attacks. To improve the security of the original scheme, we employ the PRNG in the improved scheme to generate random directions and steps in the permutation process and execute the single-round DCD in the diffusion phase. Moreover, the performances of the improved scheme, including statistical, differential, adjacent correlative, and time complexity analyses, have been tested experimentally. The improved scheme has been proven superior or at least comparable to the original and other existing schemes. In the future, we plan to optimize the newly proposed scheme to improve encryption speed.



---

*Source: 8124912-2017-07-05.xml*