† Corresponding author. E-mail:
Project supported by the Natural Science Foundation of Shaanxi Province, China (Grant No. 2014JM8322).
Single or multiple S-boxes are widely used in image encryption schemes, and in many image encryption schemes the asynchronous encryption structure is utilized, which separates the processes of substitution and diffusion. In this paper, we analyze the defects of this structure based on the example of an article and crack it using a simpler method. To address the defects of the asynchronous encryption structure, a novel encryption scheme is proposed, in which the structure of synchronous substitution and diffusion based on double S-boxes is utilized, so the processes of substitution and diffusion are combined together and the attackers cannot crack the cryptosystem by any of the processes. The simulation results and security analysis show that the proposed encryption scheme is safer and more efficient to expediently use in the real-time system.
During the past decade, the rapid growth of the internet has promoted a great deal of information to be generated, of which images occupy a large proportion. Research on the image is a very hot topic.[1–3] Therefore, the security issues of images have received more and more attention; however, traditional encryption algorithms are typically designed for textual information and have been found to be unsuitable for image encryption due to some intrinsic features of images such as high pixel correlation and redundancy.[4] Then, some image encryption schemes based on Chaos,[5–8] one-time keys,[9,10] bit-level,[11–13] DNA rule,[14–16] and frequency domain[17,18] are proposed. For example, in Ref. [5], a chaotic image encryption scheme based on a perceptron model was proposed, while the high-dimension Lorenz system and a neural network were used in the encryption scheme to improve the security of the cryptosystem. In Ref. [9], the authors proposed a color image encryption based on one-time keys and robust chaotic maps. They utilized the MD5 and combined the algorithm with the traditional cycle encryption to ensure higher security. In Ref. [11], the authors proposed a color image encryption by using a spatial bit-level permutation and high-dimensional chaotic system. The plain image was transformed into a binary matrix and encrypted based on the bit-level, so the encryption scheme achieved a good encryption result and the key space was large enough. In Ref. [14], the authors proposed an image encryption by using DNA complementary rule and chaotic maps. The plain image was encoded into four nucleotides by the deoxyribonucleic acid (DNA) coding, and the initial conditions of the chaotic maps were changed automatically in every encryption process. In the above encryption methods, chaos is widely applied to image encryption, since it is characterized in aperiodicity, pseudo-randomness, and high sensitivity to initial values and parameters.
Recently, many image encryption schemes were proposed based on chaos.[19–25] For example, in 2017, Wu et al.[19] proposed a color image encryption based on chaotic systems and an elliptic curve ElGamal scheme. The authors designed an asymmetric image encryption scheme for the advantages that the key groups and the number of keys in a secret information transmission among multiple people were very small, and the key transmission mode was relatively simple and secure. Chai et al.[20] proposed an image encryption scheme based on three-dimensional (3D) Brownian motion and chaotic system. It utilized the block confusion based on 3D Brownian motion and position sequence group (BCBPSG), which effectively improved the statistical performance of the algorithm. Ye et al.[21] proposed a self-cited pixel summation based image encryption algorithm. Because of the sensitivity of the chaotic map to its initial condition and the plain-image-dependent key stream, any tiny change in the secret key or the plain image would lead to a significantly different cipher image. In 2018, Parvaz and Zarebnia[22] proposed a novel color image encryption scheme. They defined a combined chaotic system which had good properties, and the combined chaotic system was effectively applied to the cryptosystem. Ullah et al.[23] proposed a novel scheme for image encryption by using a substitution box and chaotic system. The substitution box was constructed by a new method, and the encryption scheme exhibited outstanding diffusion as well as confusion properties.
The typical image encryption structure based on chaos is of permutation-substitution. The process of permutation changes the position of the pixels in the image. But the permutation-only encryption scheme is unsafe, because the pixels in the image are unchanged, and the attackers can obtain the equivalent permutation matrix by the chosen-plaintext attack. So the structure of permutation-substitution is widely used, while the process of substitution changes the pixel values to improve the security of cryptosystem.
Many image encryption schemes substitute the pixels by the single or multiple S-boxes, then diffuse the pixels to improve the effect of encryption.[26–29] However, some encryption schemes separate the processes of substitution and diffusion, namely, asynchronous substitution and diffusion scheme (ASAD). There are some potential defects based on the ASAD, for example, once the attackers obtain the equivalent key streams used in the diffusion, they can easily make the process of substitution useless and the whole encryption scheme is totally cracked. So the potential insecurity is caused by the separated processes of substitution and diffusion. Some encryption schemes based on the ASAD proved to be unsafe and suffered attack. For instance, in Ref. [26], an image encryption scheme based on a hyper-chaotic system and dynamic S-box was proposed, which permuted and substituted the plain image to obtain the substituted image firstly, and then diffused the substituted image to obtain the cipher image. However, the diffusion process revealed information about the substituted image, which resulted in the attackers easily recovering the substituted image.[30] In Ref. [27], a novel chaotic diffusion was added into the existing process of substitution, and the encrypted images with different gray scales were totally confused, but it was cracked in Ref. [31], which cracked the diffusion process to obtain the substituted image without the first block by the ciphertext-only attack, then totally restored the cipher image by the chosen-plaintext attack. In Ref. [32], the authors pointed out the defects of the diffusion process in an encryption scheme, which was based on a new mapping rule. So the structure of ASAD is actually unsafe.
In this paper, we analyze an encryption scheme described in Ref. [27] to explain the defects of ASAD, and crack the encryption scheme by using a simpler method than the method in Ref. [31]. Then a novel image encryption scheme is proposed to address the defects of ASAD. To improve the security of the encryption scheme further, the pixels in the plain image are encrypted twice by the double S-boxes, so the relationship between two encryption steps is enhanced, while the parameters used in the different S-boxes can influence each other. Also, the novel encryption scheme combines the processes of substitution and diffusion, so the encryption structure is synchronous, and the defects of the ASAD are addressed in the novel encryption scheme. Meanwhile, the efficiency of the novel encryption scheme is enormously high compared with other encryption schemes.
The rest of this paper is organized as follows. The example of ASAD in Ref. [27], the attack method in Ref. [31], and a simple attack method are described in Section
In this subsection, the example of ASAD in Ref. [27] is described. The sketch of the encryption scheme is shown in Fig.
![]() |
![]() |
![]() |
![](cpb_27_8_080701/cpb_27_8_080701_ieqn2.gif)
The potential defects of the above encryption scheme based on ASAD are summed up as follows.
1) Unsafe diffusion process The diffusion process is easily cracked by the cipher-only attack, so the substituted image without the first block is obtained. The attack method is shown below.
![]() |
2) Ineffective diffusion process While one pixel is changed in the plain image, there are few changed pixels in the cipher image. So the encryption scheme cannot resist the chosen-plaintext attack.
3) Separated processes of substitution and diffusion While the diffusion process is unsafe and unrelated to the substitution, the attackers can crack the diffusion process and obtain the equivalent key streams first, then the process of substitution is useless and the whole encryption scheme is cracked.
The encryption scheme in Ref. [27] was attacked in Ref. [31] and described as follows. Firstly, the substituted image without the first block was obtained by the cipher-only attack shown in Eq. (
The novel attack method simplifies the process of cryptanalysis compared with the attack method in Ref. [31], while it does not need to know the whole distribution map {di} and the three S-boxes used in the substitution process. As shown in Eq. (
![]() |
![]() |
Transform the vector P into the size M × N, and the plain image will be obtained.
The computational complexity of the novel attack method of obtaining the coding table T is 257 times that of the encryption and cipher-only attack, so the time spent is acceptable.
The result of the crack experiment is shown in Fig.
In the original encryption scheme, the authors encrypted the pixels based on ASAD and the encryption scheme proved to be unsafe and cracked. The main defects of the ASAD are that the processes of substitution and diffusion are separated, then the diffusion process is ineffective and unsafe. So the encryption scheme based on ASAD has potential security risks, while the attackers can crack the process of the diffusion first, and the substitution process has no relationship with the diffusion process, so the process of substitution is also easily cracked and the whole encryption scheme is unsafe.
To overcome the defects of ASAD, a novel encryption scheme is proposed. The main ideas of the encryption scheme are reflected in the three aspects as follows. (i) To improve the security of the encryption scheme, the pixels are encrypted twice by double S-boxes, and the parameters used in different encryption steps can influence each other and be dynamically updated, so the two processes of encryption are contacted closely. (ii) The two processes of substitution and diffusion are combined by double S-boxes, so the encryption structure is synchronous and not separated. As a result, the defects of the ASAD are addressed. (iii) The forward and backward encryption are used to improve the security of the cryptosystem further, and the initial encryption position is denoted as a secret key to enlarge the key space. Based on the above encryption ideas, the attackers cannot gradually crack the cryptosystem by any of the processes of substitution and diffusion, so the encryption scheme is safe enough.
According to the above encryption ideas, we design the encryption scheme, and the sketch of the novel encryption scheme is shown in Fig.
![]() |
![]() |
The total encryption steps are described as follows.
In the decryption process, assume that the
![]() |
In this section, the different images are used to evaluate the encryption effect of the proposed algorithm. All the simulations are performed on a personal computer with intel (R) Core(TM) i5-2400 CPU, 3.10 GHz, 8.00 G memory, and 450-GB hard disk with a Window 7 operating system, and the compile platform is the Visual Studio of version 2013.
For the comparison purpose, we employ three encryption schemes in Refs. [6], [13], and [16], while the encryption schemes in Refs. [6], [13], and [16] are based on the chaos, bit-level, and DNA rule respectively. Therefore, this comparison can exhibit the differences among the performances obtained by applying different encryption methods.
To show the security and efficiency of the proposed algorithm, we use eight gray images each with a size of 512 × 512 as the original ones, i.e., the ‘Lena’, ‘Peppers’, ‘Baboon’, ‘Boat’, ‘Bridge’, ‘Lake’, ‘White’, and ‘Black’ images.
Figure
An effective image encryption scheme should have a large key space so that the brute-force attack is useless. In the proposed encryption scheme, the secret keys include two initial values x1 and x2 and parameter μ to generate the double S-boxes, two parameters cxor, csum used in forward encryption. Then the values used in backward encryption are different, named x3, x4, μ′, cxor′, and csum′, so the minimum number of secret keys is eleven when the secret key pos is added. Suppose that the calculation precision of the computer is set to be 10−14, so the total key space is at least 1096, and it is large enough to resist all types of brute-force attack.
A good encryption scheme should make the histogram of an encrypted image as flat as possible. The histograms of the Lena and the cipher image are shown in Fig.
The variances of histograms are used to evaluate the uniformity of ciphered images. The lower value of variances indicates the higher uniformity of ciphered images. Then two variances of ciphered images, which are encrypted by different secret keys on the same plaintext image are also calculated, and the two values of variances being closer to each other indicates the higher uniformity of ciphered images when the secret keys are varying.[33] The variance of histogram is presented as follows:
![]() |
In simulating experiments, two variances of histograms of two ciphered images by Eq. (
The eight plain images shown in Fig.
![]() | Table 1. Comparison among variances of histograms of all secret keys in the proposed algorithm. . |
The variance values are about 5000, which indicates that the average fluctuation of the number of pixels in each gray value is about 70 pixels. However, the variance value is 625571.4908 for the histogram of the plain image Lena. It is obvious that the proposed algorithm is effective.
To measure the uniformity of each parameter in secret keys, we calculate the percentage of variance differences between the x1 and the secret key that only one parameter is changed compared with x1. Each parameter such as x2, μ, cxor, and csum for three plain images is calculated and listed in Table
![]() | Table 2. Comparison among percentages of variances difference of histograms of secret keys in the proposed algorithm. . |
To measure the histogram difference against plain images, the variance values among three images are changed obviously in Table
The natural image has a high correlation with adjacent pixels, so the encryption scheme should effectively reduce the correlation in the encrypted image. In order to analyze the correlation with the adjacent pixels in the plain and cipher images, 2000 pairs of adjacent pixels are randomly chosen in the horizontal, vertical, and diagonal direction from the plain images and cipher images. The correlation distribution is shown in Fig.
In order to calculate the correlation coefficient γxy of the adjacent pixels, we use the following formulas:
![]() |
![]() | Table 3. Correlations between the plain images and the encrypted images. . |
The information entropy is defined to express the degree of uncertainty or randomness in a given system. The information entropy H(m) of an image is calculated from
![]() |
![]() | Table 4. Comparison of entropy between plain images and encrypted images. . |
To resist the differential attack, an effective encryption scheme should be sensitive to the change of plain image. The number-of-pixels changing rate (NPCR) and the unified average changing intensity (UACI) are used to evaluate the difference between two images. The NPCR and UACI are calculated by Eqs. (
![]() |
![]() |
![]() |
From Tables
![]() | Table 5. NPCR and UACI for different images based on the proposed algorithm. . |
![]() | Table 6. Comparison between NPCR and UACI. . |
In the encryption scheme, the cipher image should totally change when there is a slight change in the secret keys. To test the key sensitivity of the proposed encryption scheme, we randomly choose two groups of secret keys with only one-bit difference to encrypt the plain image, respectively. Then, the NPCR and the UACI of the encrypted image are calculated. This test is performed 1000 times for each plain image, and the average, maximum, and minimum values of NPCR and UACI are shown in Table
![]() | Table 7. Key sensitivities of the proposed scheme. . |
The encryption speed is an important factor for the encryption scheme to be widely used in the practical application. The proposed encryption scheme cannot be implemented in parallel forms, while the algorithms in Refs. [13] and [16] can be implemented in parallel to potentially enhance the computational efficiency. So the algorithms in Refs. [13] and [16] are replaced by other algorithms in the speed test. We run our encryption scheme 1000 times on 256 gray-scale images with the Lena image in a size of 256 × 256 and compare the average encryption efficiency with those of the algorithms proposed in Refs. [6] and [27] and Refs. [34]–[36]. The test results are listed in Table
![]() | Table 8. Comparison between encryption speeds cited from the literature and calculated by our proposed algorithm. . |
According to Kerchoff’s principle,[37] the cryptosystem should be open and its security entirely depends on the secre key. In other words, the cryptanalyst can know everything about the cryptosystem without the secret key. A secure cryptosystem should resist all kinds of attacks; otherwise, the cryptosystem is insecure. Generally speaking, there are four classical types of attacks to break a cryptosystem, and their orders from the hardest types to the easiest types are listed as follows.
(I) Ciphertext attack: The opponent only possesses a series of ciphertexts.
(II) Known plaintext attack: The opponent only can possess a series of plaintext and corresponding ciphertexts.
(III) Chosen plaintext attack: The opponent can obtain the encryption machinery. Some plaintexts are chosen to encrypt and their corresponding ciphertexts can be obtained.
(IV) Chosen ciphertext attack: The opponent can obtain the decryption machinery. Some known ciphertexts are chosen to decrypt and their corresponding plaintexts can be obtained.
Obviously, the chosen plaintext attack is the most powerful attack. If a cryptosystem can resist this attack, it can resist other types of attacks.[38] The proposed encryption scheme combines the processes of substitution and diffusion by double S-boxes and the pixels encrypted by double S-boxes in different steps can influence each other. Meanwhile, the forward encryption and backward encryption are used to improve the security of a cryptosystem, so the attackers cannot gradually crack the encryption scheme by one of the S-boxes or the processes of substitution and diffusion. So the proposed encryption scheme can resist the chosen plaintext or ciphertext attack.
In this paper, an image encryption scheme based on asynchronous substitution and diffusion (ASAD) is described and some defects are pointed out, which makes the cryptosystem unsafe and cracked. Then a novel encryption scheme is proposed to address the defects in the ASAD. The pixels are encrypted twice by the double S-boxes, and the processes of substitution and diffusion are combined and synchronous. To improve the security of the cryptosystem further, the forward and backward encryption are also used in the encryption scheme. The simulation results and security analysis show that the proposed encryption scheme is safer and more efficient to expediently use in the real-time system.
[1] | |
[2] | |
[3] | |
[4] | |
[5] | |
[6] | |
[7] | |
[8] | |
[9] | |
[10] | |
[11] | |
[12] | |
[13] | |
[14] | |
[15] | |
[16] | |
[17] | |
[18] | |
[19] | |
[20] | |
[21] | |
[22] | |
[23] | |
[24] | |
[25] | |
[26] | |
[27] | |
[28] | |
[29] | |
[30] | |
[31] | |
[32] | |
[33] | |
[34] | |
[35] | |
[36] | |
[37] | |
[38] |