Cryptanalysis of a Chaotic Image Encryption Algorithm Based on Information Entropy
Chengqing Li Dongdong Lin Bingbing Feng Jinhu Lü Feng Hao

	
Date of publication xxxx 00, 0000, date of current version xxxx 00, 0000.
10.1109/ACCESS.2018.2883690





[1]School of Computer Science and Electronic Engineering,

	Hunan University, Changsha 410082, China
[2]College of Information Engineering,

	Xiangtan University, Xiangtan 411105, Hunan, China
[3]School of Automation Science and Electrical Engineering, 
	
	Beihang University, Beijing 100083, China
[4]Department of Computer Science, University of Warwick, Coventry CV4 7AL, UK


This research was supported by the Natural Science Foundation of China (No. 61772447, 61532020, U1736113).

C. Li : Cryptanalysis of an Image Encryption Algorithm
C. Li : Cryptanalysis of an Image Encryption Algorithm

Corresponding author: C Li (e-mail: chengqingg@qq.com).


Recently, a chaotic image encryption algorithm based on information entropy (IEAIE) was proposed.
This paper scrutinizes the security properties of the algorithm and evaluates the validity of the used quantifiable security metrics. When the round number is only one, the equivalent secret key of every basic operation of IEAIE can be recovered with a differential attack separately. Some common insecurity problems in the field of chaotic image encryption are found in IEAIE, e.g. the short orbits of the digital chaotic system and the invalid sensitivity mechanism built on information entropy of the plain image. Even worse, each security metric is questionable, which undermines the security credibility of IEAIE. Hence, IEAIE can only serve as a counterexample for illustrating common pitfalls in designing secure communication method for image data.


Chaotic cryptanalysis, multimedia cryptography, image encryption, secure communication, privacy protection.



=-15pt
Cryptanalysis of a Chaotic Image Encryption Algorithm Based on Information Entropy
    Chengqing Li1, Dongdong Lin1, Bingbing Feng2,  Jinhu Lü3, and Feng Hao4
    December 30, 2023
==================================================================================





§ INTRODUCTION


With the popularity of imaging sensors in smartphones and various video recording scenarios, e.g. dashboard camera and closed-circuit television (CCTV),
a vast volume of multimedia data are recorded every day <cit.>. Meanwhile, the fast network transmission
technique allows them to be transmitted among cloud servers, social media platforms, and personal cellphones with ever-growing speed and scope.
Once a multimedia file containing some personal privacy information leaves the original control scope, they may threaten the owner and the related persons very quickly. So,  the security and privacy of multimedia data have become the concerns of everyone living in the cyberspace. To respond to such a challenge, a large number of multimedia privacy protections and preservation schemes were proposed in the past two decades <cit.>.

One of the well-known features of chaos is the so-called butterfly effect: if a butterfly flips its wings
in Brazil, tomorrow Texas, USA will have a storm. In a more scientific term, we say a
system is very sensitive to the initial condition, i.e., a small change at the very
beginning will eventually lead to a completely different result. This implies
unpredictability because an accurate measurement of the initial condition is in
principle impossible. As the sensitivity and unpredictability are some good features we want to have in applications like secure communications and (pseudo-) random number generation, many researchers around the world have tried to apply chaos to build various cryptographic primitives:
permutation relation <cit.>, pseudo-random number generator <cit.>, hash function <cit.>, private-key encryption scheme <cit.>, public-key encryption scheme <cit.>, authentication <cit.>, secure communication based on synchronization <cit.>, secret-key share (agreement) algorithm <cit.>, data hiding <cit.>, and privacy protection <cit.>. The main objective of chaotic cryptanalysis is to disclose the information about the secret key of a chaotic encryption (or secure communication) scheme under all kinds of security models: ciphertext-only attack <cit.>, known-plaintext attack <cit.>, chosen-plaintext attack <cit.>, chosen-ciphertext attack <cit.>, and impossible differential attack <cit.>. Meanwhile, chaotic cryptanalysis also provides a novel perspective to study the dynamical properties of the underlying chaotic system. As degradation of any chaotic system definitely happens in a digital domain <cit.>, a chaos-based encryption scheme may own some special security defects that do not exist in the non-chaotic encryption schemes <cit.>.

In <cit.>, a chaotic image encryption algorithm was proposed using information entropy value calculated from the plain-image, which is named as IEAIE in this paper. In the algorithm, a pseudo-random number sequence generated by the two-dimensional Logistic-adjusted-Sine map (2D-LASM) proposed in <cit.> is used to control a combination of some basic operations, including position permutation and modulo addition. Especially, the information entropy of the plain-image is used to build up a sensitivity mechanism of the encryption result of IEAIE on the plain-image. This paper reports security defects of the chaos-based pseudo-random number generator and the sensitivity mechanism. As for one round version of IEAIE, its three basic parts can be broken with a strategy of the divide-and-conquer technique in the scenario of differential attack. In addition, each used security metric is questioned from the perspective of modern cryptanalysis.

The rest of the paper is organized as follows. Section <ref> briefly introduces the algorithm IEAIE. Section <ref> presents cryptanalysis of IEAIE by disproving security metrics used for IEAIE. The last section concludes the paper.



§ CONCISE DESCRIPTION OF IEAIE



IEAIE ignores any special storage format of image data and just treats it as text data, which is represented as a M× N 8-bit matrix 𝐈 [The transform (5) in <cit.> can not always generate bijective (one-to-one) permutation mapping and should be corrected to assure successful decryption of IEAIE].
	

	
	
  * The secret key is composed of two sets of initial conditions of
	2D-LASM
	
    x_i+1  =  sin( π·μ· (y_i+3)· x_i·(1-x_i)),
    
    			y_i+1  =  sin( π·μ· (x_i+3)· y_i·(1-y_i)),

	(x_0, y_0) and (x'_0, y'_0), where μ∈ [0.37, 0.38]∪ [0.4, 0.42] ∪ [0.44, 0.93].
	
	
  * Keystream generation procedure:
	1) iterate 2D-LASM (<ref>) from initial condition
	
    x̅_0 = ( x_0 + s+1/s+x'_0+y'_0+1)  1
    y̅_0 = ( y_0 + s+2/s+x'_0+y'_0+2)  1
	
	200+M· N/2 times, and from the 201-th iteration, assign the obtained sequence into an M× N matrix 𝐏 in the raster order, where

    s=H( 𝐈 ),

H(𝐗) is the information entropy value of image block 𝐗, namely
	
    H(𝐗)=-∑_i=0^2^8-1p(ϕ_i) ·log_2(p(ϕ_i)),

	ϕ_i is the pixel of value i in 𝐗, and p(ϕ_i) denotes the ratio between the number of ϕ_i in 𝐗 and 𝑀· 𝑁. In this paper, x n=x-n⌊ x/n ⌋, where
	⌊·⌋ denotes the floor function.
	
	3) set
	
    𝐮= ⌈𝐮'· 10^14⌉ M +1, 
    𝐯= ⌈𝐯'· 10^14⌉ N +1,

	where 𝐮' is the a-th row of 𝐏, 𝐯' is the b-th column of 𝐏
	(scalar multiplication and addition are performed if a matrix or vector is involved, the same hereinafter),
	
    a= ⌈ (x_0+y_0+1)· 10^7 ⌉ M+1, 
    
    			b= ⌈ (x'_0+y'_0+2)· 10^7 ⌉ N+1,

	and ⌈·⌉ denotes the ceil function. Separately conduct the two vectors 𝐮 and 𝐯 with the following way:
	if there are elements of the same value, change one as the least number that does not exist in the updated vector.
	
	3) iterate 2D-LASM (<ref>) from initial condition
	
    x̅'_0 = ( x'_0 + 1/x_0+y_0+1)  1
    y̅'_0 = ( y'_0 + 2/x_0+y_0+2)  1

	200+M· N/2 times; starting from the 201-th iteration, transform every element of the generated sequence by
	
    f(x)=⌈ x· 10^14⌉ 256

	and set the results into an M× N matrix 𝐊 in the raster order.
	
	
  * Encryption procedure:
	

		
  * Horizontal permutation:	
		for j=1∼ N, move the j-th column of 𝐈 to the 𝐮(j)-th one of
		𝐁^*, namely 𝐁^*(:, 𝐮(j))=𝐈(:, j).
		
		
  * Vertical permutation:
		for i=1∼ M, move the i-th row of 𝐁^* to the 𝐯(i) row of 𝐁,
		i.e. 𝐁(𝐯(i), :)=𝐁^*(i, :).
		
		
  * Changing gray distribution with a constant matrix 𝐓: for i=1∼ M, j=1∼ N, do
		
    𝐑(i, j)=(𝐁(i, j)+𝐓(i, j)) 256,

		where 𝐓(i, j)=M· N+ i+j.
		
		
  * Diffusion encryption: for i=1∼ M, j=1∼ N, set
		
    𝐂(i, j)=( 𝐑(i, j)+d_j·𝐂(i, j-1)+ 
      d_j·𝐊(i, j)+ 𝐊(i, d_j))  256,

		where 𝐂(i, 𝑁+1)=𝐂(i, 0)≡ 0,
		
    d_j=⌈ H( 𝐑_j )· 10^14⌉ N+1,

	and 𝐑_j={𝐑(i, k)}_i=1, k=j+1^M, N.

	
	
  * Repeation: Repeat the above four steps one more round.
	
	
  * Decryption procedure is similar to the encryption one except the following points:
	1) the order of the above four main steps is reversed; 2) every operation in each main step is replaced by its inverse version.


The horizontal and vertical permutations on the plain-image controlled by 𝐮 and 𝐯 can be equivalently represented by a permutation matrix  𝐏 as <cit.>, namely

    𝐁( 𝐏(i, j ))=𝐈(i, j),

where i=1∼ M, and j=1∼ N. 



[!htb](topskip=0pt, botskip=0pt, midskip=0pt)s1_e3_m2_d2_re_index3
The functional graph of 2D-LASM with 6-bit floating-point precision and round quantization, where the length of mantissa fraction is 3.	



§ CRYPTANALYSIS



In <cit.>, various aspects of IEAIE were analyzed to conclude that it owns superior security performance. However, we try to demonstrate that all the arguments are groundless.



 §.§ Some security defects of IEAIE



In <cit.>, some rules and suggestions for designing secure and efficient image encryption schemes were concluded. Some concrete steps for evaluating security performances of a chaotic image encryption schemes were given in <cit.>. Unfortunately, IEAIE did not follow the lessons summarized in <cit.>. To attract the attention of designers of image encryption schemes on cryptanalysis, we check the security of
every aspect of IEAIE and its test given in <cit.> as follows.






  * Underlying chaotic map:

In <cit.>, a new two-dimensional chaotic map 2D-LASM was constructed by `adjusting' Logistic map and Sine map with three strategies: cascading output of the former as the input of the latter; extending dimension of the phase plane from 1D to 2D; adopting one more multiplication variable with a constant delay parameter. It was proved that 2D-LASM can demonstrate much more complex chaotic behaviors than the two original 1D maps <cit.>. As shown in Fig. <ref>, any orbit will definitely enter a cycle after a transient process. Rigorous theoretical analyses given in <cit.> prove that the functional graph of any digital chaotic map is highly correlated with that in a domain with arithmetic precision as small as 3. As shown in Figs. <ref>, <ref>, the cycle length of the functional graph of 2D-LASM is very small for either arithmetic format. In <cit.>, it was stated that “previously iterated values were discarded to avoid transient effects”. Actually, the differences between neighboring states change exponentially along an orbit of any iterated map, which is different from the case for chaotic flow. The real purpose of discarding some initial iterated values is to avoid recovering the control parameters of the corresponding chaotic map from them, which is demonstrated in <cit.>.
As shown in <cit.>, some cycles of short period (even self-loop) always exist no matter which enhancement method is
adopted, e.g. increasing the arithmetic precision, perturbing states, perturbing the control parameters, switching among multiple chaotic maps, and cascading among multiple chaotic maps. If the initial state is located in a small-scale connected component or a cycle of short period in the functional graph of the used chaotic map, there are not enough available states (200 states specified in <cit.>) to be discarded. So, an adaptive threshold should be set to avoid this problem. But, it would cost additional computation.
	

  * Key sensitivity:

In <cit.>, “a small change of 10^-14 is shifted in keys x_0, y_0, x'_0, y'_0” to check their influence on the decryption results. Although 10^-14 is small in itself as for our daily lives, the shift may cause a dramatic change of binary presentation of a number. Let's illustrate this problem with arithmetic format binary32 (single-precision floating-point format), where 10^-14 =( 1.011 0100 0010 0100 1101 1100)_2· 2^-47 (stored as binary string “0 01010000 011 0100 0010 0100 1101 1100”).
As for number 10^-12 = (1.000 1100 1011 1100 1100 110 0)_2· 2^-40 (“0 01010111 000 1100 1011 1100 1100 1100”),
10^-12-10^-14 =(1.000 1011 0101 0100 1000 0010)_2· 2^-40 (“0 01010111 000 1011 0101 0100 1000 0010”). It can be calculated that 11 bits among the 23 fraction bits (underlined parts) of the subtracted number are changed. So, the four cases given in <cit.> are far not enough to convince us anything. Now, we can see that a small decimal number should not be used to measure the change degree of initial condition in a binary computer.

Observing Eq. (<ref>), one can see that (x_0, y_0) and (1-x_0, 1-y_0) are equivalent if 2D-LASM is implemented in a fixed-point arithmetic domain. Due to the modulo addition and division operation in Eq. (<ref>), there may exist even much more equivalent secret keys. Besides these, quantization effects of the digital chaotic map may generate the same iteration orbit for different initial conditions (See Figs. <ref>, <ref>). So, the sensitivity of encryption results of IEAIE with respect to the change of its secret key is very weak.


  * Key space analysis:
	
In <cit.>, the precision of the secret key of IEAIE is fixed as 10^-14. In digital world, the precision can only be precisely specified by a power of two. If a floating-point number format (binary32 or binary64) is adopted, the distances between neighboring representable numbers are not uniform, which requires setting the length of mantissa fraction, and that of exponent, elaborately <cit.>. As shown in Fig. <ref> and <cit.>, there exists a number of nonchaotic regions of (x_0, y_0). The initial conditions falling in such regions may compose invalid or weak secret keys. So, we can conclude that the specification of IEAIE seriously violates Rule 5 suggested in <cit.>, “The key space 𝒦, from which valid keys are to be chosen, should be precisely specified and avoid nonchaotic regions.” In addition, the computational complexity of checking each secret key and the valid time of the protected plain-image are not considered in <cit.>. In all, the statement “the brute-force attack is impossible to successfully execute” is unconvincing.
	

  * Histogram:
	
In <cit.>, it was emphasized that “the histogram of the cipher-image should be or near uniform and be different from that of the plain-image after encryption”. In fact, what counted for the security of IEAIE should be the matching degree between secret-key (or plain-image) and the histogram of the corresponding cipher-image.
As shown in<cit.>, an attacker can recover some statistical information of the plain-image by changing the counting objects of the histogram from pixel to bit. In addition, the spatial information of pixels may play a dominant role for the visual effect of the composed image. To show this point, Fig. <ref> presents two 512× 512 images with the same flat (exactly uniform) histogram, whose number of pixels for each tonal value is 512 · 512/256=1024. Figure <ref> gives the encryption results of the two images shown in Fig. <ref> with the position permutation-only scheme HCIE cryptanalyzed in <cit.>. Although histograms of the two encrypted images kept unchanged, the scheme is secure enough for some application scenario, e.g. surveillance and protection of pay-TV from illegal users. Anyway, the three histograms calculated in terms of pixel shown in
<cit.> are not far enough to prove “the proposed algorithm has a good ability to frustrate the attack” based on the histogram.



	

  * Variance of histogram:
	
To further measure the uniformity degree of a cipher-image, the variance of its histogram was calculated in <cit.>. Actually, the variance of a histogram cannot measure the number of different possible histograms generated by a tested encryption scheme. For example, the variances of two histograms “2, 2, 3, 4, 7” and “2, 2, 3, 5, 6” are different, but their number of different combinations are the same. But, the histogram variances of four cipher-images given in <cit.> are far not sufficient to demonstrate existence of any rule. In addition, even some insecure encryption schemes can also make the obtained cipher-image own very low variance of histogram <cit.>. Moreover, visual security indexes of the three cipher-images shown in Fig. <ref> are different, but the variances of the histogram of them are fixed to zero. In all, the statement “a lower variance represents higher uniformity” in <cit.> is not right.
	

  * Information entropy:
	
Information entropy is a quantitative metric measuring the disorder or randomness in a closed system. From Eq. (<ref>), one can see that the entropy value of a message kept unchanged with respect to the following two kinds of changes: 1) permuting the position of every element within the message; 2) changing the elements of a given value as another one that does not exist in the message (if there is)  <cit.>. In each case, the changes compose a bijection between specific domain
and the corresponding codomain (See Fact <ref>). In all, there are a huge number of different images owning the same information entropy as a given image when its size is relatively large. For example, the five different images shown in Fig. <ref>, <ref> share the same value of information entropy. 
Embedding Eq. (<ref>) into Eq. (<ref>), one can see that
H(𝐑_j ) is determined by the two matrixes 𝐏 and 𝐓 for a given plain-image 𝐈, where j∈{1, 2, ⋯, N}. From the definition of 𝐑_j
and 𝐓, one can deduce that every column of 𝐓 should be of fixed value
to assure that the modulo addition in Eq. (<ref>) has the same effect on 
{𝐑_j}_j=1^N, namely every column of 𝐑 (the difference between 𝐑_j and 𝐑_j+1), for different plain-images. To satisfy such condition, N≡ 0 256 should hold. Even this, the statement “the value of the information entropy is very sensitive to the message” given in <cit.> is still baseless. Note that the tiny differences of entropy given in <cit.> are only bounded by 0.01 and the cipher-image of “Lenna” encrypted by the analyzed bit-level permutation-only scheme cryptanalyzed in <cit.> can also reach as high as 7.978.


For any function f, entropy function H(𝐗) (Eq. (<ref>)) satisfies that H(f(𝐗))≤ H(𝐗) and the equality holds if and only if f is a bijection.




  * Plaintext sensitivity:
	
Plaintext sensitivity is very important for high-strength image encryption schemes as a plain-image and its slightly modified version (embedded by a watermark or some hiding messages) are often encrypted at the same time. If the used encryption scheme does not satisfy the sensitivity requirement, leakage of the cipher-image corresponding to one of the two similar plain-image may disclose the visual information of the other. In the field of image security, two metrics
UACI (unified averaged changed intensity) and NPCR (number of pixels changing rate) are widely used to measure plaintext sensitivity. Unfortunately, the validity of the two metrics has been questioned in <cit.> by statistical information of the outputs of some insecure encryption schemes. Here, we emphasize that the internal structure of IEAIE cannot perform well to achieve the expected plaintext sensitivity. Observing the encryption procedure of IEAIE, one can see that all involved operations can make every operated bit `run' from the least significant bit (LSB) to the most significant bit (MSB), not the opposite order. Concretely, the change of a bit in the i-th bit-plane (counted from the LSB to MSB) can only influence the bits in the i∼ 8-th ones. So, the influence scope of every bit of the plaintext on the corresponding cipher-text is dramatically different. No matter how many round numbers are repeated, this problem remains to exist <cit.>. The designers of IEAIE claimed that “the keystreams are different with respect to different plain-images” based on the assumption of high sensitivity of information entropy on change of the plain-image. However, as we have explained above, this assumption is not correct. In all, the statement “a slight change in the plain-image leads to a completely different cipher-image” in <cit.> is incorrect.
	

	

  * Coefficient correlation:
	
Just like most chaos-based image encryption schemes, <cit.> adopted the 
coefficient correlation of neighboring pixels of cipher-images encrypted by IEAIE to demonstrate its good security performance. As mentioned in <cit.>, there is “no clear (statistical) decision criterion for passing this test”. Furthermore, three insecure encryption schemes deliberately constructed in <cit.> can perform very well in terms of fulfilling the metric. Actually, this metric can be calculated only from image encryption schemes working in the spatial domain. Reasonable security index of image data should consider the characteristics of the human visual system and the distribution of compressing coefficients of image data <cit.>.
	

  * Efficiency analysis:
	
The authors of <cit.> claimed that IEAIE is suitable for real-time secure communication by comparing it with the image encryption scheme proposed in <cit.>. In fact, the fast running speed of IEAIE comes from less computation operations, namely the obtained efficiency is built on sacrificing security instead of better structure.
In Eqs. (<ref>), (<ref>), (<ref>), (<ref>), IEAIE uses integer conversion functions
following the general form

    f_n(x)=f(10^m · x)  D,

where m and D are positive integers, f(x) is a quantization function, e.g. ceil and round.
In processors, multiplication by a constant is implemented using a sequence of bit-wise shift and addition operations, e.g.

    g(x)=((x 2) + x)  1,
	
where

    x s=∑_i=0^L-s-1(x_i· 2^i+s),

x=∑_i=0^L-1x_i· 2^i, and L is the arithmetic precision. So the computational complexity of the conversion (<ref>) is proportional to m <cit.>.
In Eqs. (<ref>), (<ref>), (<ref>), (<ref>), m is set as 7 or 14. Only ⌈log_2 D ⌉ bits are useful for IEAIE, the computation spent on generating the other m⌈log_2(10)  ⌉-⌈log_2 D ⌉ bits are wasted. Taking Eq. (<ref>) as an example, the utilization
percentage of the computation cost on iterating 2D-LASM (<ref>) is only ⌈log_2 D ⌉/m⌈log_2(10)⌉=⌈log_2 256 ⌉/14·⌈log_2(10)=1/7.
In addition, the test on speed analysis in <cit.> was performed in the idea laboratory environment instead of resource-limiting real environments.




 §.§ Differential cryptanalysis


As shown in Fig. <ref>, an attacker can arbitrarily choose some plaintexts, P_1, P_2, ⋯, P_n-1, and
the corresponding ciphertexts, C_1, C_2, ⋯, C_n-1, encrypted by the same secret key K in the scenario of chosen-plaintext attack. As for differences between plaintexts P_i and P_i+1, 𝐷𝑃_1, 𝐷𝑃_2, ⋯, 𝐷𝑃_n-1, one can observe the corresponding differences between ciphertexts C_i and C_i+1, 𝐷𝐶_1, 𝐷𝐶_2, ⋯, 𝐷𝐶_n-1. The differences are defined in terms of an invertible operation used in the encryption scheme, e.g. bitwise OR and
modulo subtraction. So differential cryptanalysis can be considered as a chosen-plaintext attack on a weakened version of
the analyzed encryption scheme for some differences selected from n 2=n(n-1)/2 possible ones.
In the broadest sense, differential cryptanalysis is a cryptanalytic method studying how particular differences in plaintext pairs affect the resultant differences, which is also called differential, of the corresponding ciphertext pairs. Considering the public structure of the analyzed encryption scheme, some basic parts can be deliberately canceled and the remaining part can be broken with much less resources. By repeating the process, the equivalent secret key of the whole encryption scheme
K̃ can be recovered, which is then used to decrypt another ciphertext C_n, encrypted by the same secret key.

From the above introduction of the chosen-plaintext attack, one can see that the attack model relies on repeating usage of the secret key. So the designers of IEAIE use the information entropy of the plain-image to “affect the usage of the keystream and frustrate the chosen-plaintext and known-plaintext attacks” in <cit.>. However, based on the analysis on the insensitivity of information entropy in above sub-section, it is very easy to construct some plain-images possessing the same keystream during the encryption process of IEAIE. Observing the encryption procedure of IEAIE, one can see that its real operations are solely determined by N+1 parameters, s and {d_j}_j=1^N. Note that even when two plain-images generate different entropy values in the encryption process, their corresponding key steams are still maybe the same due to the following reasons:
1)  the modulo addition and division in Eq. (<ref>) may make different sets of (x_0, y_0, x'_0, y'_0, s) result in the same value of (x̅_0, y̅_0); 2) the quantization error of calculating log_2(·) in computer may make different combinations of {ϕ_i }_i=0^2^8-1 generate the same value of H(X); 3) Eq. (<ref>) only extract ⌈log_2(N) ⌉ bits of intermediate computing result of  𝐑_j, and may output the same value of 
d_j for different inputs of 𝐑_j. Once the dependability mechanism of the key stream of IEAIE on the plain-image is concealed, the structure of Eq. (<ref>) becomes the same as that of the main function of the image encryption scheme cryptanalyzed in <cit.>. Then, the differential cryptanalysis on IEAIE can be performed similarly.

Assume two plain-images 𝐈 and 𝐈' own the same set of s and {d_j}_j=1^N in the encryption process of IEAIE. As for their difference in terms of modulo subtraction Δ𝐈, IEAIE is degenerated to

    Δ𝐑( 𝐏(i, j ))=Δ𝐈(i, j),
    Δ𝐂(i, j)=(Δ𝐑(i, j)+ d_j ·Δ𝐂(i, j-1))  256,

where i=1∼ M, j=1∼ N, Δ𝐂 is the difference of the corresponding cipher-images of 𝐈 and 𝐈' in terms of the operator
(some components in Eq. (<ref>) are eliminated by the modulo subtraction), and Δ𝐂(i, 0)≡ 0. Observing Eq. (<ref>), one can
assure that 

    𝐏(i^*, j^*)=(i^**, j^**)

if Δ𝐈 has only one non-zero element at entry (i^*, j^*), 
where (i^**, j^**) is the entry of the first non-zero element in differential Δ_C (counted in the scan order).

Based on the above analysis, the differential cryptanalysis on one round version of IEAIE can be described as follows.


  * Step 1: Choose two plain-images of size M× N, 𝐈 and 𝐈', satisfying 

    𝐈(i^*, j^*)=a, 
    𝐈'(i^*, j^*)=b, 
    𝐈(i, j)=c, 
    𝐈'(i, j)=c,

where a, b, c are non-negative integers and #{a, b, c}=3, (i, j)∈{(1, 1),(1, 2),⋯ (M, N)}∖(i^*, j^*), and #{·} denotes the cardinality of a set. Note that (i^*, j^*) is initialized as (1, 1).


  * Step 2: Let 𝐈 and 𝐈' pass through the encryption process of IEAIE
with an unknown secret key and obtain the corresponding cipher-images, 𝐂 and 𝐂'.


  * Step 3: Get the value of 𝐏(i^*, j^*) via Eq. (<ref>).


  * Step 4: Repeat the above procedure for (i^*, j^*)=(1, 2), (1, 3) ∼(M, N-1) (selected in the scan order of a matrix of size M× N) and
get the value of  𝐏(i^*, j^*). The value of 𝐏(M, N) can be  identified as the sole unused location.


  * Step 5: Recover 𝐑 by Eq. (<ref>) and calculate

    𝐃(i, j) = ( 𝐂(i, j)-𝐑(i, j)-d·𝐂(i, j-1))  256

for i=1∼ M and j=1∼ N. 




Observing Eq. (<ref>), one can see that
𝐃={𝐃(i, j)}_i=1, j=1^M, N can work as the equivalent version of the secret key
for decryption on the diffusion encryption part. In all, two matrixes 𝐏 and 𝐃 can work as the equivalent secret key of IEAIE. 

A number of experiment were performed to verify performance of the above attacking steps. A concrete case of revealing the permutation relationship of IEAIE on a plain-image of size 8× 8 is shown in Fig. <ref>, where x_0=0.0056, y_0=0.3678, x_0'=0.6229, and y_0'=0.7676, and μ=0.8116. In this case, the same set of s and {d_j}_j=1^8 are generated for the two toy plain-images due to the quantization effect.
From Fig. <ref>, we can see that the new permuted location of the sole non-zero element at entry (1, 1) in the differential plain-image
can be observed by searching for the first different elements of the two cipher-images.

In <cit.>, two rounds of the basic operations are suggested. Here, we skip the cryptanalysis of the full version of IEAIE based on the following considerations: 1) existence of the security defects presented in the above sub-section is not related with the round number; 2) cryptanalysis of the two rounds of IEAIE involves very complex deduction and presentation; 3) the reported security defects of IEAIE are far enough to demonstrate that it cannot be fixed by simple modifications.



§ CONCLUSION


This paper analyzed the security of a chaotic image encryption algorithm based on information entropy, IEAIE. The claimed superiorities of its structure are analyzed in detail and are found incorrect. Furthermore, every used security metric is incapable to testify real security performance. To design a secure and efficient multimedia encryption scheme, the related critical factors, e.g. the special properties of multimedia data, the concrete application scenario with specified constraints, computation load, should be considered comprehensively. Much cryptanalytic works need to be done to bridge the  gap between the field of nonlinear dynamics and that of modern cryptography.





IEEEtran_doi






author-figures-pdf/


[
    < g r a p h i c s >
]Chengqing Li(M'07-SM'13)
	received his M.Sc. degree in Applied Mathematics from Zhejiang University, China in 2005 and
	his Ph.D. degree in Electronic Engineering from City University of Hong Kong in 2008. Thereafter,
	he worked as a Postdoctoral Fellow at The Hong Kong Polytechnic University till September 2010.
	Then, he worked at the College of Information Engineering, Xiangtan University, China. From April 2013 to July 2014,
	he worked at the University of Konstanz, Germany, under the support of the Alexander von Humboldt Foundation.
	Currently, he is working at School of Computer Science and Electronic Engineering,
	Hunan University as a full professor.
	
	
	Prof. Li focuses on security analysis of multimedia encryption schemes and privacy protection schemes.
	He has published about fifty papers on the subject in the past 13 years, receiving more than 2500
	citations with h-index 28.





[
    < g r a p h i c s >
]Dongdong Lin
	received his M.Sc. degree and  B.Sc. degree both in computer science at the College of Information Engineering,
	Xiangtan University, China in 2015 and 2018, respectively. Currently, he is visiting at School of Computer Science and Electronic Engineering, Hunan University, China.
	His research interests include cryptanalysis and image privacy protection.





[
    < g r a p h i c s >
]Bingbing Feng
	received his M.Sc. degree and  B.Sc. degree both in computer science at the College of Information Engineering,
	Xiangtan University in 2015 and 2018, respectively.
	His research interests include complex networks and nonlinear dynamics.


[
    < g r a p h i c s >
]Jinhu Lü(M'03-SM'06-F'13)
	received the Ph.D degree in applied mathematics from the Academy of Mathematics and Systems Science, Chinese Academy
	of Sciences, Beijing, China in 2002. Currently, he is a Professor in the Academy of Mathematics and
	Systems Science, Chinese Academy of Sciences. He was a Professor in the RMIT University, Australia
	and a Visiting Fellow in the Princeton University, USA. He is the author of three research monographs
	and more than 110 SCI journal papers published in the fields of complex networks and complex systems,
	nonlinear circuits and systems, receiving more than 8000 SCI citations with h-index 42. He is an ISI Highly Cited Researcher in Engineering.


[
    < g r a p h i c s >
]Feng Hao is a Professor of Security Engineering at the Department of Computer Science, University of Warwick. He received his PhD in Computer Security from the Computer Lab, University of
Cambridge in 2007. He worked in security industry
for several years before joining the faculty at
Newcastle University as a lecturer in 2010 and
was promoted to the readership in 2014. His
research interests include applied cryptography,
security engineering and efficient computing.

