Secure Chaotic Map Based Block Cryptosystem with Application to Camera Sensor Networks

3.1. Chosen Ciphertext Attack

A chosen-ciphertext attack [15] operates under the following model: an adversary is allowed access to plaintext-ciphertext pairs for some number of ciphertexts of his choice, and thereafter attempts to use this information to recover the key (or plaintext corresponding to some new ciphertext).

In the Wang et al. scheme, Equations (5–7) indicate that the space of the feedback message is only 64, i.e., once the secret key (μ, x₀) is determined, the key stream D_j+1 and A_j+1 are determined only by the former ciphertext f(C_j) mod 64. To illustration this security loophole, we set the secret keys μ = 4, x₀ = 0.1777 and decrypt two different ciphertext sequences. They are C1=“EAFA4D22D326D40C2960D4C5E76…” and C2=“F11ED8CA5F72155E8A99683495F…” in hexadecimal format. Each block of C_j, f(C_j) mod 64, D_j and A_j are filled into Tables 1 and 2, respectively.

The simulation results indicate that once μ, x₀ and all the former ciphertext blocks have equal f(C_j)mod 64, any ciphertext has identical sub-key D_j+1 and A_j+1. This loophole is vulnerable to CCA, one of CCA illustration can be played as follows: (they cannot be showed completely).

(1) Let $f_2^j$ denotes the 6-bit length of f(C_j)mod 64 in binary representation. For j = 1,2,⋯ select two cipher blocks:

From Equation (5), it is not difficult to see that:

To demonstrate this procedure, we fill the chosen corresponding C¹ and C² of a random selected ciphertext C = 218A916626 E5DA55… (in hexadecimal format) into Table 3.

(2) Decrypt $C^1=C_1^1{C}_2^1\cdots C_j^1\cdots$ and $C^2=C_1^2{C}_2^2\cdots C_j^2\cdots$ using the same key (μ, x₀) of C = C₁C₂ ⋯C_j ⋯, then we can get the corresponding plaintext $P^1=P_1^1{P}_2^1\cdots P_j^1\cdots$ and $P^2=P_1^2{P}_2^2\cdots P_j^2\cdots$. From Equations (6) and (12) we can deduce that C_j, $C_j^1$ and $C_j^2$ have the identical corresponding sub-keys D_j and A_j.

(3) Calculate $P_j^1\oplus P_j^2=\left(\right(C_j^1\oplus A_j)>>>D_j)\oplus \left(\right(C_j^2\oplus A_j)>>>D_j)=(C_j^1\oplus C_j^2)>>>D_j$

From Equations (10) and (11), we can obtain that:

Therefore, we can determine the value of D_j by searching the position of $f_2^{j}11f_2^j$ in $P_j^1\oplus P_j^2$.

(4) Using Equation (4) and the conquered D_j, we can calculate $A_j=(P_j^1<<<D_j)\oplus C_j^1$. To demonstrate these procedures, the chosen C¹ and C² of Table 3 are decrypted using μ = 4, x₀ = 0.1777. The corresponding plaintext blocks and sub-keys are filled into Table 4.

(5) By utilizing D_j and A_j, it is easy to figure out the plaintext

Some simulations are utilized to prove the validity of CCA. Figure 2(a–c) are the original image, the encrypted image with Wang et al’s scheme and the analyzed image of a 128 × 128 bitmap image file named Boat, where the secret key μ = 4, x₀ = 0.1777 and N₀ = 100.

3.2. Key Stream Attack

In the Wang et al. scheme [11], although a ciphertext feedback model is employed to ensure sub-keys depend on both secret key and plaintext, a fundamental flaw is unaware, i.e., the first sub-key D₁ and A₁ are independent of the plaintext and are determined only by the secret key (μ, x₀). An adversary can reconstruct the key stream sequence as an equivalent key (μ, x₀) as follows:

• Choose two pair of special messages (P_z, C_z) and (P_s, C_s), where P_z is composed of 64-bit zeros, P_s is 011…11 in binary representation, C_z and C_s are the corresponding ciphertext of P_z and P_s, respectively.

• Set P_z as the first plaintext block, then can get C_z = (P_z <<< D₁) ⊕ A₁ = A₁.

• Similarly, when set P_s as the first plaintext block, C_s = (P_s <<< D₁) ⊕ A₁, i.e., C_s ⊕ A₁ = P_s <<< D₁. Thus the position of zero in C_s ⊕ A₁ counting from rightmost bit is equal to D₁.

• Set k = 0, and define a plaintext sequence P_u = ϕ, where ϕ is a null string.

• k = k + 1. By utilizing D_k, choose $C_k=\underset{56\mathit{bits}}{\underbrace{00\cdots 0}}\underset{8\mathit{bits}}{\underbrace{c_k^8}}$ to make sure

  $$D_k^{*}=D_k+f(C_k) \text{mod} 64=0$$

  (15)

  From Equation (7), it can be seen that the sub-keys of $A_k=B_i^1{B}_i^2\cdots B_i^{64}$, $A_k^{\prime }=B_i^{65}{B}_i^{66}\cdots B_i^{70}$, $A_{k+1}=B_i^1{B}_i^2\cdots B_i^{64}$ and $A_{k+1}^{\prime }=B_i^{65}{B}_i^{66}\cdots B_i^{70}$ are continuous state bit of logistic map.

• Decrypt C_k with D_k and A_k:

  $$P_k=(C_k\oplus A_k)>>>D_k$$

  (16)

• Set P_u = P_uP_k, i.e., add P_k as the last 64 bits of P_u.

• Encrypt the 64(k + 1)-bit length plaintext sequence P^z = P_uP_z, and then obtain the corresponding ciphertext:

  $$C^z=C_1^z\cdots C_k^z{C}_{k+1}^z$$

  (17)

• Obviously, $C_1^z\cdots C_k^z{C}_{k+1}^z$ is equal to C₁ ⋯C_k when k > 1, and $C_{k+1}^z=(P_z<<<D_{k+1})\oplus A_{k+1}$. Therefore, it can be calculated that $A_{k+1}=C_{k+1}^z$.

• Encrypt another 64(k + 1)-bit length plaintext sequence P^s = P_uP_s, and then obtain the corresponding ciphertext:

  $$C^s=C_1^s\cdots C_k^s{C}_{k+1}^s$$

  (18)

  Similarly, $C_1^s\cdots C_k^s$ is equal to C₁ ⋯C_k when k > 1, and $C_{k+1}^s=(P_s<<<D_{k+1})\oplus A_{k+1}$, i.e., $C_{k+1}^s\oplus A_{k+1}=P_s<<<D_{k+1}$. Utilizing the computed A_k+1, the adversary can obtain D_k+1 by counting the position of zero in $C_{k+1}^s\oplus A_{k+1}$ from rightmost bit.

• Go to (5) if the length of the key stream sequence is not enough; otherwise, finish the attack.

For j = 1,2,⋯,k, translate decimal value D_j to the corresponding 6-bit length binary sequence $A_j^{\prime }$, and then the adversary can acquire a 70j-bit length binary key stream sequence K = (A₁A₁′) (A₂A₂′) ⋯ A_jA_j′ of secret key (μ, x₀). We denote K = B₁B₂ ⋯ B_70j.

The key stream K can be utilized to decrypt any ciphertext encrypted by (μ, x₀). To demonstrate this circumstance, ciphertext C = C₁C₂ ⋯ C_i is decrypted as follows:

• Define k = 1. Set the start point of kth sub-key in K = B₁B₂ ⋯ B_70j as n = 1.

• Obviously, the kth sub-key of C_k is B_nB_n+1 ⋯ B_n+69, i.e., A_k = B_nB_n+1 ⋯ B_n+63, D_k is the decimal value of A′_k = B_n+64B_n+65 ⋯ B_n+69. And then we can obtain the kth plaintext block:

  $$P_k=(C_k\oplus A_k)>>>D_k$$

  (19)

• If k < i, continue; otherwise, finish the decryption process.

• By utilizing the known C_k, D_k and Equations (5) and (6), it is easy to obtain the value of $D_k^{*}$. Thus, we can utilize Equation (7) to calculate the start point of (k+1)th sub-key in K = B₁B₂ ⋯ B_70j:

  $$n=n+70+D_k^{*}$$

  (20)

• Compute k = k +1and go to (2).

As a result, C = C₁C₂ ⋯ C_i is decrypted effectively with key stream sequence K = B₁B₂ ⋯ B_70j.

4.1. Secure Block Cipher Algorithm

The Wang et al. cryptosystem is cryptographically weak because information about the feedback value $D_k^{*}$ leaks into the ciphertext and the first sub-key is independent of plaintext. Except these flaws, it has some excellent benefits, such as flat ciphertext, fast encryption speed and prominent diffusion and confusion. Therefore it is valuable to propose an improved version to get rid of above flaws. As for the first flaw, it can be remedied via hiding $D_k^{*}$ from ciphertext, and the latter can be conquered by pretreating of the first plaintext block. Detail of the improvement is described as follows:

• Steps 1–4. They are the same as Wang et al. scheme described in Section 2.

• Step 5. Compute:

  $$\omega ={\tau }^{D_1}(\omega ),$$

  (21)
  $$A_0=B_i^1{B}_i^2\cdots B_i^{64}.$$

  (22)

• Step 6. Obtain the jth ciphertext block (j ≥ 1):

  $$C_j=((P_j\oplus A_{j-1})<<<D_j)\oplus A_j$$

  (23)
  $$D_j^{*}=D_j+f(A_{j-1})+f(A_j\oplus C_j) \text{mod} 64$$

  (24)
  $$\omega ={\tau }^{70+D_j^{*}}(\omega )$$

  (25)

Obviously, after the modified process, the feedback value $D_j^{*}$ is hidden from ciphertext. Encrypt P_z and P_s, then one can obtain:

Equations (26) and (27) leak noting about the key stream A₁ and D₁, so the security is enhanced in the improvement. Though it involves some computations, they are not time consuming operations. Therefore, the improved scheme does not lose the original efficiency advantage.

4.2. Architecture of Wireless Camera Sensor Networks

In this section, we introduce the developed architecture of the secure wireless camera sensor networks by utilizing the proposed chaotic block cipher. Each camera sensor node in the networks is battery-powered and has limited computation and wireless communication capabilities. The sink is a data collection center equipped with sufficient computation and storage capabilities. Camera sensor nodes periodically send the captured images to the sink node. Then the sink nodes transport this information secretly with the data process server via carrier networks. The proposed block cipher is mounting at the carrier network. Figure 3 shows the system architecture of the camera sensor network.

5.1. Information Entropy Analysis

It is known that the entropy H(m) of a message source m can be calculated by Equation (28) [8]:

When a cipher emits symbols with entropy less than N, there exists a certain degree of predictability, which threatens its security. Let us consider the ciphertext of a random text file, a Lena’s image of size 256 × 256 and a random video file encrypted using the proposed scheme. The number of occurrence of each ciphertext pixel m_i is recorded and the probability of occurrence is computed for the three files. The corresponding entropies are filled into Table 5. The test values obtained are very close to the theoretical value N = 8 for the three kinds of files. This means that information leakage in the encryption process is negligible and the encryption system is secure against the entropy attack.

5.2. Correlation of Adjacent Pixels in Encrypted Image

In order to resist statistical attacks, the ciphertext should possess certain random properties. A detail study has been explored and the results are summarized. The results of the Lena.bmp are used for illustration. For an ordinary image, each pixel is usually highly correlated with its adjacent pixels either in horizontal, vertical or diagonal directions. These high-correlation properties can be quantified as their correlation coefficients for comparison. To calculate the correlation coefficients, the following formulas are used:

It is clear that there is negligible correlation between these two adjacent pixels in the encrypted image. However, the two adjacent pixels in the original image are highly correlated. The results indicate that the proposed algorithm has successfully removed the correlation of adjacent pixels in the plain-image so that neighbor pixels in the cipher-image virtually have no correlation. That is to say, the new scheme possesses prominent diffusion property.

5.3. Sensitivity Analysis

From the cryptographical point of view, given two distinct keys, even if their difference is the minimal value under the current finite precision, the encryption and decryption results of a good cryptosystem should still be completely different. In other words, this cryptosystem should have a very high sensitivity to the secret key [14]. For testing the key sensitivity of the proposed block encryption procedure, we use the grayscale image Lena.bmp of size 256 × 256 as the test image to illustrate the result and perform the following steps:

• Lena.bmp is encrypted by using the secret key (μ = 3.998, x₀ = 0.21745) and the resultant image is referred as Ciphertext A;

• The same image is encrypted by making the slight modification in the secret key i.e., (μ = 3.998 + 10⁻¹⁵, x₀ = 0.21745) and the resultant image is referred as Ciphertext B;

• Again, the same original image is encrypted by making the slight modification in the secret key i.e., (μ = 3.998, x₀ = 0.21745 + 10⁻¹⁵) and the resultant image is referred as Ciphertext C;

• The same original image is encrypted by making the slight modification in the secret key i.e., (μ = 3.998, x₀ = 0.21745 − 10⁻¹⁵) and the resultant image is referred as Ciphertext D.

• Finally, the correlation coefficients between the corresponding pixels of the four ciphertexts A, B, C and D are computed and filled into Table 7.

It is clear from the Table 7 that no correlation exists among four encrypted images even though these have been produced by using slightly different secret keys. These results sufficiently demonstrate the proposed cryptosystem is highly key sensitive.

Another cryptographical property required by a good cryptosystem is that the encryption should be very sensitive to plaintext, i.e., the ciphertexts of two plaintexts with a slight difference should be very different [14]. Figure 5 is the bit-wise XOR of two ciphertexts when encrypting two image plaintexts with only the first bit different based on the proposed cryptosystem. The result of Figure 5 showing that the proposed encryption scheme is very sensitive with respect to small changes in the plaintext.

From the above investigation and study, we can conclude that the lack of security will discourage the use of these algorithms for secure applications. It is advisable that new chaotic cryptosystems take into account some important things: (1) the distribution of the ciphertext should be sufficiently flat in order to resist the statistics attack [8]; (2) the sub keys should depend on not only the secret key but also the plaintext to avoid key stream attack [11]; (3) the first block or sub key should be pretreated to resist some existing attacks; (4) the ciphertext should not leak out any information of the sub keys to eliminate corresponding utilizing ciphertext attacks.