1 Introduction

Digital communication has become an integral part of our lives due to increased scale of digitization in almost every sphere of our lives, including banking, defense, education, healthcare, entertainment, e-commerce, space-exploration, and the list is endless. Hence, in the era of massive digital communication, the security of the information shared during communication is paramount. One of the important aspects of security is confidentiality, and encryption [1, 2] is a very significant countermeasure to achieve confidentiality.

Table 1 Use of chaos in cryptography
Full size table

Also, modern-day communication involves transmission of various media forms like audio, video, images, etc., besides textual data. Visual content like images forms a major proportion of transmissions happening today, including medical diagnostic images for patients, digital forensic images for investigations, satellite imagery for space exploration etc. Given the sensitive nature of such image information, it is essential to encrypt it for providing confidentiality during transmission. Lightweight cryptographic schemes are very useful for image security because of the bulky nature of such data and the fact that these days sensitive images are being frequently communicated using resource-constrained IoT (Internet of Things) devices, which are low in memory capacity, have a small chip size, and operate under power constraints.

Table 2 Measures to evaluate chaotic behaviour
Full size table

To balance the security and efficiency trade-offs in such image encryption schemes, Substitution-Permutation Network (SPN) [3] employing lightweight operations like XOR (Exclusive OR), shift, modular-arithmetic, etc. is one of the most frequently used designs. Also, these SPN-based image encryption schemes, many a time, are referred to as permutation-diffusion ciphers because of the use of permutation operation(s) followed by a substitution layer achieving diffusion. Further, chaos is commonly used in these permutation-diffusion ciphers for image security. Chaos [4] has inherent properties suitable for application in cryptosystems (outlined in Table 1). There are different measures to determine whether a non-linear dynamical system is chaotic or not, which are summarized in Table 2. Figure 1a shows the change in Lyapunov exponent [5] with change in initial parameter value for logistic map with initial condition \(x_0=0.112345\) and Fig. 1b shows the corresponding bifurcation diagram. Clearly, Lyapunov exponent is shown to attain positive value (represented by dotted line in Fig. 1) for \(r \in [3.57,4)\).

Fig. 1
figure 1

a Lyapunov exponent. b Bifurcation diagram of Logistic map with \(x_0=0.112345\)

Full size image

As a result of the above-described properties of chaos, cryptography is witnessing a significantly increased use of chaos in recent past, and its potential is noteworthy in post-quantum cryptography as well [10]. Further, the application of chaotic maps is specifically very popular in image encryption schemes. Initially, 1-D chaotic maps were frequently used, but over a period of time, multidimensional chaotic maps have gained popularity. Details of some of the popular chaotic maps are summarised in the Table 3.

Table 3 Some popular chaotic maps
Full size table

Due to chaos-generated sequences being random-like, they are frequently used as key-streams for substitution/permutation steps during the encryption process (Fig. 2).

Fig. 2
figure 2

SPN structure employing chaos for encryption

Full size image

In the ever-evolving landscape of information security, besides proposing new encryption schemes, researchers are also equally focusing on the cryptanalysis of existing schemes with an intention to enhance security. Cryptanalysis involves analyzing cryptographic systems to uncover potential vulnerabilities or weaknesses in their design to breach security. The primary objectives of cryptanalysis are:

  • Exploiting weaknesses: Identifying flaws in cryptographic algorithms or protocols that can be leveraged to bypass their security measures.

  • Key recovery: Attempting to deduce cryptographic keys fully/partly from available information.

  • Breaking encryption: Attempting to decrypt the targeted ciphertext without knowledge of the corresponding decryption key to recover fully/partly the plaintext.

Cryptanalysis plays a vital role in evaluating the security of cryptographic systems, identifying potential weaknesses, and driving improvements in their design. As technology evolves, new attack techniques, computational advancements, or mathematical breakthroughs may make existing schemes more vulnerable [18]. Researchers continuously work to analyze and discover potential weaknesses in existing cryptographic algorithms [19,20,21], which leads to the improvement of existing designs or the development of new more secure schemes [22]. Table 4 summarizes few of the basic cryptanalytic attacks.

Table 4 Cryptanalytic attacks
Full size table
Table 5 Comparative analysis of our review with other similar articles in literature
Full size table

It is identified that existing literature lacks systematic reviews focusing on the cryptanalysis of image encryption methods. To the best of our knowledge, there is only one review article in existing literature that provides a review on cryptanalysis of image encryption schemes, that too of schemes published only during the year 2018 [24]. Also, though not cryptanalysis, a recent paper [25] performed key-space analysis of various image encryption schemes. Table 5 shows the comparative analysis between [24, 25] and our review paper.

Clearly, there was a gap in the literature for comprehensive reviews on cryptanalysis of image encryption schemes over a broader time frame. This motivated us to carry out this systematic review on cryptanalysis of image encryption schemes for the last 5 years, i.e., 2019–23. This review focuses on identifying and highlighting the strengths and weaknesses of image encryption schemes. It also suggests improved designs, and provides an excellent and comprehensive resource for researchers working in the area of image encryption development and cryptanalysis. Following are the research objectives of this systematic review:

  1. RO1

    To present the state-of-the-art in the domain of image encryption schemes and their cryptanalysis.

  2. RO2

    To identify and highlight the weak designs of existing image encryption schemes.

  3. RO3

    To provide suggestions/improvements to mitigate the identified weaknesses to avoid potential cryptanalytic attacks.

The relevance of reviews in the area of image security is highlighted by the ongoing research advancements in this area. New encryption schemes [27, 28] are actively being proposed by researchers, and new cryptanalytic attacks [29,30,31,32,33,34] are also emerging in parallel, as is evident from the most recent literature. While these developments are continuous and also extend beyond the time frame covered in this review, they emphasize the ongoing need for robust security measures in image encryption.

Section 2 presents the methodology used. Section 3 gives discussion on the cryptanalysis techniques used in the research articles included as part of this review. Section 4 presents our findings along with the details of our suggestions on improving future designs of image encryption schemes. Further, Sect. 5 discusses the limitations of this review. Lastly, Sect. 6 gives the conclusion.

2 Methodology

To carry out an extensive review of the existing literature, a systematic approach [26] was taken. This systematic review incorporates diverse viewpoints and a wide range of scholarly contributions in the field of cryptanalysis of image encryption schemes. To search for relevant articles, reputable electronic databases, namely Web of Science and Scopus were searched. Firstly, to understand the overall publication trend as per the existing literature, the keywords searched were “cryptanalysis”, “cryptanalysis AND encryption scheme”, “cryptanalysis AND image encryption scheme”, whose query results are shown in Table 6. This publication trend is also depicted graphically in Fig. 3.

Table 6 Keywords and search results
Full size table
Fig. 3
figure 3

Publication trend (as on date 22, December 2023)

Full size image

Since, the scope of this review is on cryptanalysis of image encryption schemes, hence, we restricted our search for relevant articles (to be included in this review) to the keyword “cryptanalysis AND image encryption scheme”. Further, we included articles published during 2019–23 as part of this review. The articles that were found to be duplicates or irrelevant were manually excluded. Figure 4 shows the PRISMA flow diagram for selecting the relevant articles for this review, starting from the ones searched with the keyword “cryptanalysis AND image encryption scheme” over the period 2019–23. Figure 5 shows the year-wise count of cryptanalysis articles that are included as the part of this review.

Fig. 4
figure 4

PRISMA flow diagram

Full size image

3 Cryptanalysis techniques

During the review, we found that different types of cryptanalytic attacks on the original or reduced equivalent simpler image encryption schemes have been proposed in literature. For better understanding, the classification hierarchy of cryptanalysis articles along with the count of the included articles for each classification is presented in Fig. 6.

Not only the relevant papers on cryptanalysis included in this review were studied, but also the corresponding original image encryption schemes were referred to, during the review. It is observed that the original schemes could be classified on the basis of mathematical primitives, plaintext sensitivity in keys, structure of the schemes based on different combinations of permutation (P) and substitution (S) operations, and number of rounds used in the schemes. Figure 7 shows the classification hierarchy along with the count of referred original image encryption schemes for each classification.

Fig. 5
figure 5

Year-wise count of included cryptanalysis articles (as on date 22, December 2023)

Full size image
Fig. 6
figure 6

Classification of included cryptanalysis articles

Full size image
Fig. 7
figure 7

Classification of cryptanalysed image encryption schemes

Full size image

Further, we present the cryptanalysis of these schemes as per the broad three categories, namely, chaos-based, hybrid (using chaos and other mathematical primitives), and others (without chaos). Among the image encryption schemes included in our review, the majority, i.e., 26 schemes, are chaos-based. Additionally, there are 14 schemes that utilise a hybrid approach, i.e. combining chaos with other mathematical primitives. And, only a single scheme is based on non-chaotic mathematical primitives. This observation highlights the prevalent use of chaos in image encryption schemes, with hybrid approaches also being relatively common.

3.1 Cryptanalysis of chaos-based schemes

In existing image encryption schemes, chaos is majorly utilized for generating key-streams/pseudo-random numbers utilized during encryption process. This subsection focuses on the cryptanalysis of chaos-based image encryption schemes.

Literature reveals that most of the chaos-based schemes are cryptanalysed through chosen-plaintext attack [19,20,21, 35,36,37,38,39,40,41,42,43,44,45,46,47,48,49,50,51,52,53,54,55] in which the all-zero plain image is one of the most common chosen plain images used to perform the attack [35, 41, 42, 46, 47, 50, 51, 53, 54, 56]. This is because, very commonly, only XOR is used for achieving diffusion after permutation operation(s) in image encryption schemes. And, in an all-zero image, the effect of permutation is nullified, and the obtained ciphertext is the recovered equivalent diffusion key-stream itself as demonstrated using an example in Fig. 8. Like, Zhang et al. [35] cryptanalysed an image encryption scheme [57] which consists of a single round of multiple operations like rotation for permutation and ciphertext feedback-based diffusion through substitution. Also, few researchers have demonstrated chosen-ciphertext attack [35, 49, 56], differential attack [48] and brute-force attack [46] to cryptanalyse the schemes. Besides a chosen-plaintext attack, Zhang et al. [35] also proposed a chosen-ciphertext attack using plaintext/ciphertext differentials to recover the plain image and the equivalent key-streams.

Fig. 8
figure 8

Example of chosen-plaintext attack to recover substitution key sequence and permuted plaintext (encrypted using a single round SPN)

Full size image

Further, after recovering the diffusion key-streams and performing the inverse diffusion operation, generally, the permutation mapping between the plain image pixels/bits and the cipher image pixels/bits is recovered with different approaches. It is observed that in most of the cryptanalysed schemes under review, due to weak permutation and diffusion, one plain image pixel contributes to only one cipher image pixel. Hence, not only recovering the diffusion key-stream becomes easy, but recovering the permutation mapping also becomes effortless. For doing this, one of the most common type of attacks on pixel-wise permutation operation is like the one as done by Chen et al. [51]. In this attack (Fig. 9a), multiple chosen plain images having all-zero pixels except one pixel per chosen image are created. All these chosen plain images have the non-zero pixel (say value 1) at different pixel positions, which, after encryption, clearly show their corresponding permuted positions in the obtained respective ciphertexts. Thus, the permutation mapping is easily constructed. An alternate way to recover permutation mapping is proposed by Mukherjee et al. [56]. Here, an \(m \times n\) plain image with pixel values ranging from 1 to (mn) is chosen. Comparing the positions of the same pixel values in a plain image and corresponding permuted image provides the permutation key matrix (or mapping). Another approach [50, 54] extracts the permutation rule using \(q \ge \lceil log_L(m \times n) \rceil \) number of chosen plain images, where L is equal to \(2^k\) for k-bit pixels. In this approach, for example, for a \(256 \times 256\) sized plain image, two chosen plain images, \(I_1\) and \(I_2=I_1^T\) are used. For \(I_1\), the first row’s pixel values are 0, the second row’s pixel values are 1, and so on until 255. The comparison of \(I_1\) and \(I_2\) with their corresponding permuted plain images provides the required permutation matrix. To recover the bit scrambling sequence for a bit-wise permutation operation, Zhang [53] proposed the use of eight (for \(L=8\)) chosen plain images (\(TP_i\)) to attack the permutation operation of the scheme [58]. Each chosen plain image \(TP_i\) has all pixel values as \(2^{i-1}\), where i is ranging from 1 to 8. The original scheme [58] employs permutation at pixel level as well as bit level. By virtue of having all same pixel values in each \(TP_i\), the pixel-permutation effect is nullified during encryption, and the bit level comparison of chosen plain images’ pixels and their corresponding bit-scrambled images’ pixels provides the bit scrambling sequence (Fig. 9b).

Fig. 9
figure 9

a Example of chosen-plaintext attack to recover pixel-wise permutation rule. b Flowchart for chosen-plaintext attack to recover bit-wise permutation rule

Full size image

As stated earlier, it is highlighted that many of the cryptanalysts have reduced the original encryption schemes into corresponding equivalent encryption schemes for performing cryptanalysis [19, 35, 36, 38, 41, 46, 47, 51,52,53,54,55], due to their weak per-round operations. For example, some schemes employ multiple consecutive permutation/substitution operations in each round, which actually provide the strength corresponding to only one equivalent permutation/substitution operation. It is also observed that the schemes employing only a single round [57,58,59,60,61,62,63,64,65,66,67,68,69,70,71,72,73,74,75,76,77] are frequently targeted for cryptanalysis, while few schemes with two rounds [78, 79] or multiple rounds [80, 81] have also been cryptanalysed due to their poor confusion/diffusion properties. In fact, our review revealed that there are some of the original schemes [61, 80] that had multiple weaknesses and not one, and hence, multiple cryptanalytic attacks were proposed by one or more cryptanalysts [35, 36, 39, 40].

Most cryptanalysed schemes use a single chaotic map to generate key-streams [57, 59, 62, 65, 66, 68,69,70,71,72,73,74, 77, 79, 80], however, some schemes have used multiple chaotic maps as well [58, 60, 61, 63, 64, 67, 75, 76]. It is highlighted that irrespective of whether a single chaotic map or multiple chaotic maps is/are used to generate key-streams, the more important aspect is to utilize the generated key-streams effectively during the permutation/substitution operations for providing the desired confusion/diffusion properties [55]. However, use of multiple chaotic maps for the key-stream generation can add to the resistance against brute-force attack by way of increasing the key-space size.

3.2 Cryptanalysis of hybrid schemes (other mathematical primitives along with chaos)

For the purpose of enhancing security, some researchers have proposed the use of other mathematical primitives like DNA [82, 83], Brownian motion [84], fractals [85] and many more, along with chaos. Despite the use of multiple mathematical primitives, cryptanalysts have been able to break such schemes due to their poor design. Panwar et al. [86] cryptanalysed the scheme [87] which employs one round of DNA encoding, diffusion, permutation, diffusion, and DNA decoding steps in this order. Kumar and Shankar [88] cryptanalysed the scheme [89] which uses Hill cipher. \(C=(AP+X_0) ~mod ~256\) generates cipher image, where \(X_0\) is a column matrix generated using piecewise linear chaotic map (PWLCM). All-zero plain image nullifies the effect of multiplication with A and provides the key \(X_0\) itself. Then, an identity matrix is chosen as a plain image to extract A. So, Kumar and Shankar demonstrated full recovery of the key which subsequently can be used to decrypt/recover the plaintext.

Figure 10 shows the block diagram for a general attack on a typical hybrid scheme that involves other mathematical primitives along with chaos to recover the plaintext corresponding to the targeted ciphertext.

Fig. 10
figure 10

Block diagram for chosen-plaintext attack on a typical hybrid scheme

Full size image

It is observed that all the cryptanalysed hybrid schemes under review [82,83,84,85, 87, 89,90,91,92,93,94,95,96,97] used single round of operations, may be for efficiency purposes. However, use of single round makes it easier for cryptanalysts to breach the security [86, 88, 98,99,100,101,102,103,104,105,106,107,108,109,110]. Some schemes use substitution operations only [84, 93, 95] and are also easily cryptanalysed, like Munir et al. [100] cryptanalysed the scheme [84] which employs only one round of diffusion (substitution) operation. The authors [100] fully recovered the key and the plain image by using known-plaintext attack, chosen-plaintext attack, and chosen-ciphertext attack. As part of the known-plaintext attack, only XOR operation is sufficient to be performed between one known plain image and its corresponding cipher image to recover the entire diffusion key-stream. Further, chosen-plaintext/chosen-ciphertext attack requires a single chosen all-zero plain image/cipher image whose encryption/decryption reveals the entire diffusion key-stream in the form of the obtained cipher image/plain image. While doing cryptanalysis, Munir et al. assumed the effect of the Brownian motion on the generated key-stream to be fixed, whereas the authors of the original scheme Khan et al. [84] specified the effect of the Brownian motion to be time-varying; hence, we find that the cryptanalysis is successful only under the above-mentioned specific assumption. In another work, Zhang et al. [108] cryptanalysed Xu et al.’s scheme [111] which uses logistic map and initial keys to generate Latin cubes. For cryptanalysis a chosen-plaintext attack is performed which recovers the equivalent key-streams by utilising the identified mathematical relationships between the permuted images and the corresponding intermediate ciphertexts.

Also, some of these hybrid schemes utilise plaintext-sensitive keys [82, 87, 92, 94] with an intent to offer higher resistance against cryptanalysis, but they have still been cryptanalysed [20, 86, 104, 106].

Like chaos-based image encryption schemes, most of the hybrid schemes have also been cryptanalysed using chosen-plaintext attacks [86, 88, 98,99,100,101,102,103,104,105,106,107,108,109] and, only a few known-plaintext attacks [100, 102, 107] and chosen-ciphertext attacks [100, 109] have been successfully demonstrated in literature.

3.3 Cryptanalysis of scheme without chaos

During our review, we came across only a single image encryption scheme [112] that did not use chaos and only used other mathematical primitives, which has been broken. This scheme uses the Elliptic Curve Cryptography (ECC) for key-matrix generation for the Hill cipher. As the key-space of the original scheme is effectively \(2^{32}\), hence Lone et al. [22] suggested a brute-force attack to recover the necessary secret keys. Also, Lone et al. suggested an improvised scheme by firstly replacing Hill cipher by Affine Hill cipher, and then performing permutation and diffusion steps. The key-streams for these permutation and diffusion steps are generated using a 3D variant of Arnold map.

3.4 Summarised observations

The details of the above-mentioned original image encryption schemes and the corresponding cryptanalytic attacks are summarised in tables 7,8,9. Table 7 outlines the design specifications, including the mathematical primitives used, the number of rounds applied, etc., of the cryptanalysed original image encryption schemes. In addition, Table 8 provides the details of the corresponding cryptanalytic attacks. Further, Table 9 specifies the weaknesses of the cryptanalysed image encryption schemes and suggestions as proposed by the corresponding cryptanalysts.

Table 7 Design specifications of cryptanalysed image encryption schemes
Full size table
Table 8 Details of cryptanalytic attacks
Full size table
Table 9 Weaknesses of cryptanalysed schemes and suggestions proposed by corresponding cryptanalysts
Full size table

Most of the original scheme articles do not reveal details like the key generation procedure, key sizes, etc., except for a few, due to which their implementation for thorough security analysis becomes difficult. Also, some cryptanalysis papers have hidden assumptions made for the attack [100] which questions the viability of the attack and can also hamper reproducibility for further analysis. Further, many cryptanalysis papers do not perform computational complexity analysis to assess the practicality of the attack in real-world scenarios. It is observed that the original scheme, employing specific round structures like substitution-only (S) and single permutation followed by single substitution (PS), more specifically with simple XOR for substitution, were commonly the ones being cryptanalysed. Additionally, most of the attacked schemes use single-round operations, except a few. Also, most cryptanalysed encryption schemes over-rely on the strength of chaos being used as a mathematical primitive in them. Some schemes also superficially incorporate additional mathematical operations/primitives like Latin cubes, DNA encoding and decoding, matrix multiplication etc. with an aim to enhance security, but to no avail.

4 Results and our contributions

In this section we provide our analysis of the articles made part of this review. Besides presenting the state-of-the-art in the area of image encryption and its cryptanalysis, this review paper has two more major contributions. Firstly, we present our identified weak designs for image encryption schemes which should be avoided in future. Secondly, we propose suggestions for more secure designs. Our findings and suggestions are as under.

4.1 Findings on weak designs in image encryption schemes

We identified weak designs in image encryption schemes prevalent in existing literature which make them vulnerable to cryptanalysis. Following are our findings in this regard:

  1. a

    Bulkiness and high redundancy are attributed to the image data, so, for efficiency reasons, a majority of the image encryption schemes use chaos to enhance security. But, many a time, there is overreliance on the strength of chaotic systems to add to the security. Due to this overreliance, there is overlooking on part of careful designing of such encryption schemes which leads to their cryptanalysis.

  2. b

    It is identified that the most common attacks used to cryptanalyse schemes are chosen/known plaintext/ciphertext attacks. These attacks become successful due to the lack of diffusion property, and poor operation designs, which in turn lead to ineffective contribution of key-stream bits in generating the ciphertext. Ultimately, the cipher image pixels do not take contribution from multiple plain image pixels and key-stream bytes.

  3. c

    To balance the trade-off between security and efficiency, most image encryption schemes opt for a single round of operations. However, relying solely on a single round makes these schemes vulnerable to being reduced to breakable simpler forms susceptible to cryptanalysis. In simpler terms, using just one round of operations might make encryption faster, but it also makes it easier for cryptanalysts to break such a cryptosystem.

  4. d

    Many cryptanalysts use all black image (all zero image) as chosen plaintext, to perform cryptanalysis. This kind of image nullifies the pixel-wise permutation. Alternatively, they sometimes choose other special plain images to nullify bit-wise permutation (Sect. 3.1). Subsequently, substitution pattern is identified. Such attacks are easy for schemes employing single or small (and fixed) number of rounds.

  5. e

    For the resistance against chosen/known plaintext/ciphertext attacks many of the schemes, nowadays, utilise plaintext sensitivity in key-stream(s) generation. As per conventional symmetric encryption, the key should be plaintext-independent [1, 104]. Hence, relying security on plaintext-sensitive keys is debatable. Also, there is extra plaintext-specific information which is required to be communicated to the receiver for decryption, which is an extra overhead and hence should be avoided. The design of schemes and mathematical operations themselves should provide proper confusion and diffusion properties without reliance on plaintext-sensitive keys.

  6. f

    Further, it is observed that despite efforts to use plaintext-sensitive keys as a countermeasure against chosen-plaintext attacks, some of such encryption schemes have been cryptanalysed successfully. It implies that the plaintext-sensitivity, if used, should be used appropriately.

  7. g

    Also, many encryption schemes in their original forms appear to involve complex substitution/permutation operations, but they were easily reducible to simpler equivalent forms. These equivalent forms are then prone to cryptanalysis.

  8. h

    Some authors have proposed use of multiple consecutive permutation and/or multiple consecutive substitution operations performed during each round to claim higher strength. However, their cryptanalysis reveal that such use of multiple substitution/permutation operations only adds to computational expense and do not add to the security of the encryption process because many a times such designs are reducible to equivalents with single permutation and/or substitution operation.

  9. i

    Some researchers have explored use of other mathematical primitives with/without chaos, like DNA encoding/decoding. However, it is observed that including such encodings in the encryption process do not effectively add any security or enhance the confusion and diffusion properties, unless it is intertwined with thoughtfully designed operations. Additionally, while such incorporation (like DNA encoding) during encryption might apparently seem novel, but it need not necessarily make the encryption process stronger and remain as an unnecessary superficial add-on adding just to computational expense and not security.

  10. j

    The authors of most of the original image encryption schemes under study, did not consider and discuss the resistance of their proposed schemes against popular attacks like brute-force attack, known/chosen-plaintext attack, chosen-ciphertext attack etc. which makes the security analysis of such schemes incomplete.

For better understanding, we outline the weaknesses observed in the cryptanalysed image encryption schemes in Fig. 11.

Fig. 11
figure 11

Findings on weak designs in image encryption schemes

Full size image

4.2 Suggestions for image encryption scheme designs

Following are our suggestions aimed at avoiding potential vulnerabilities or weaknesses in future designs of image encryption schemes. These suggestions offer valuable insight for designing more robust schemes that can resist cryptanalysis.

\(\checkmark \):

It is crucial to employ carefully designed operations which are not only superficially complex but add to the overall security. Every operation and mathematical primitive should add to the proper confusion and/or diffusion property.

\(\checkmark \):

Overreliance on properties of chaos without careful design of the encryption schemes and their operations should be avoided.

\(\checkmark \):

Overreliance on plaintext-sensitivity of keys should be avoided. Further, it is highlighted that plaintext-sensitivity adds unnecessary overhead during communication of the key and hence, it should anyways be avoided. Also, traditionally, the encryption key is defined to be independent of the plaintext [1, 104].

\(\checkmark \):

Though discouraged, however, under any circumstance, if the scheme designer still chooses to use plaintext-sensitivity for keys, it should be used in an adequate manner so that plaintext information used to provide sensitivity changes apparently randomly with any change in the plaintext. That is, such chosen plaintexts should not be easily identifiable which would contribute same plaintext-sensitivity to the key as the original plaintext (being attacked). Like, use of hash value of the plain image would be better than sum of its pixel values for offering plaintext-sensitivity.

\(\checkmark \):

A small number of rounds and the use of multiple consecutive permutations and/or multiple consecutive substitutions should be avoided. This is because encryption designs based on such approaches are easily reducible to equivalent simpler forms that are then easier to break. Also, such approaches decrease efficiency without adding much to the security.

\(\checkmark \):

The design of the permutation and substitution operations of the scheme should ensure that each cipher image pixel receives contribution from multiple plain image pixels and key-stream bytes, so as to resist one of the most widely used chosen-plaintext attacks like the one with all-black chosen image. In short, the relationship between cipher image pixels with the plain image pixels and the key-stream bytes should be non-linear and sufficiently complex.

\(\checkmark \):

Ensuring the scheme exhibits the avalanche property is also crucial to ascertain that the scheme possesses effective confusion and diffusion properties. Additionally, performing thorough efficiency and security analysis is of utmost importance to balance the computational performance and strength of schemes.

\(\checkmark \):

The scheme designers should also ensure and demonstrate resistance of the proposed schemes against well-known attacks like brute-force attack, known/chosen-plaintext attack, chosen-ciphertext attack etc. as part of the security analysis itself.

On the basis of the above-mentioned suggestions, we provide a checklist of guidelines (Table 10) which can be followed by researchers while designing new image encryption schemes in future. This would help the future schemes to not carry the same weaknesses as identified in existing cryptanalysed schemes (Sect. 4.1).

Table 10 Checklist of guidelines for image encryption scheme design
Full size table

5 Limitations

While we attempted to provide a comprehensive review but there have been few limitations as well. This review incorporated all relevant articles from Web of Science and Scopus published during 2019–23. Other databases like ACM and IEEE Xplore were also searched, but since mostly duplicate articles were identified, hence, the articles from these databases were entirely skipped. That is, manual shortlisting of every article was not carried out for search results obtained on ACM and IEEE Xplore. Also, though it has been a conscious effort to present our findings and observations objectively, despite every effort to avoid it, there could still be some personal and confirmation biases involved.

6 Conclusion

This paper provides an extensive review of cryptanalytic attacks on the image encryption schemes published during 2019–23. Analysis shows that lightweight applications often face a trade-off between efficiency and security. The number of rounds in the encryption schemes should not be very small, and it should be appropriate in accordance with the per-round operations used, so as to balance the security and efficiency aspects. Also, the undue heavy reliance on plaintext-sensitive keys/chaos to provide security without thoughtful design raises concerns about the robustness of such cryptographic schemes. Though discouraged, even if plaintext-sensitive keys are used, the plaintext-related information should be such that identifying chosen plaintexts offering the same plaintext-sensitivity should not be possible, so that the corresponding key-streams generated should not be the same. Finally, security should not solely depend on the plaintext-sensitive nature of the key, and a holistic approach to encryption scheme design is essential. This paper provides valuable insights for researchers to consider in future work, especially in designing more robust image encryption schemes and devising methods to attack the existing ones. Essentially, this review offers a comprehensive resource for researchers interested in strengthening encryption methods and for those looking to cryptanalyse and uncover vulnerabilities in the existing schemes.