A Novel Image Encryption Based on Algebraic S-box and Arnold Transform

Abstract

Recent study shows that substitution box (S-box) only cannot be reliably used in image encryption techniques. We, in this paper, propose a novel and secure image encryption scheme that utilizes the combined effect of an algebraic substitution box along with the scrambling effect of the Arnold transform. The underlying algorithm involves the application of S-box, which is the most imperative source to create confusion and diffusion in the data. The speciality of the proposed algorithm lies, firstly, in the high sensitivity of our S-box to the choice of the initial conditions which makes this S-box stronger than the chaos-based S-boxes as it saves computational labour by deploying a comparatively simple and direct approach based on the algebraic structure of the multiplicative cyclic group of the Galois field. Secondly the proposed method becomes more secure by considering a combination of S-box with certain number of iterations of the Arnold transform. The strength of the S-box is examined in terms of various performance indices such as nonlinearity, strict avalanche criterion, bit independence criterion, linear and differential approximation probabilities etc. We prove through the most significant techniques used for the statistical analyses of the encrypted image that our image encryption algorithm satisfies all the necessary criteria to be usefully and reliably implemented in image encryption applications.

1 Introduction

Increased traffic of confidential information over internet demands high level of security for safe communication. This has become the most challenging problem of the recent world to keep secret data protected from the adversaries.

Shannon [1] laid the foundation of modern cryptography. Cryptography is known as the science of changing the useful information into dummy data so that except for the intended recipient, nobody can access the secret information. Mainly there are two classes of cryptography; symmetric key cryptography and the asymmetric or public key cryptography. This classification is based on the keys. In symmetric key cryptography same key is used on both the ends to encrypt and decrypt information. However in asymmetric key cryptography there are two different keys known as the private key and the public key.

It has been established in literature that the substitution box (S-box) is a standout in symmetric key cryptography and is a widely used mechanism in any substitution-permutation network as a source to produce nonlinearity [2, 3]. Due to indispensable involvement of the S-box, many algorithms have been presented for the construction of safer and more reliable S-boxes [2, 4,5,6]. In addition, applications of S-boxes in digital image encryption, steganography and watermarking have become quite popular and influential in recent years [7,8,9].

Zhang et al. [10] studied the S-box-only encryption algorithm and proved that S-box-only cipher is cryptographically vulnerable. Keeping this fact in view, we propose an image encryption algorithm that utilizes the composition of a particular S-box along with the scrambling effect of the Arnold transform. The algorithm used for S-box is associated with the structural properties of the Galois field. The design algorithm uses the iterative applications of exponent of the primitive element of the Galois field.

In recent literature, chaos has been extensively used in construction of stronger S-boxes [8, 10,11,12,13], because of its most dominating feature of sensitivity towards the initial conditions. Our proposed strategy is also highly sensitive to the choice of the initial conditions but in our case, we reach the same performance efficiency results by applying a comparatively simple and direct method that utilizes some prime properties of the Galois field structure. We determine the cryptographic significance of this S-box by several dominating performance indices used in literature such as bit independence, strict avalanche, nonlinearity, linear and differential approximation probability tests. We compare the performance of this S-box with some prevailing algorithms also. It is however true that even depicting outstanding performance indices, the S-box-only image encryption is not efficient. We in this paper present an image encryption algorithm using the application of a highly efficient substitution followed by 10 iterations of the Arnold transform. To the best of our knowledge, the presented idea is novel and not been discussed in the existing literature. The results obtained by this strategy are tested through highly significant measures used for this purpose and we conclude that the anticipated technique is potentially strong and can be reliably used for further encryption applications.

The material distribution is as follows. Section 2 deals with the properties of the used Galois field and their application in the construction of a substitution box. In Sect. 3 we discuss and compare the cryptographic significance of the newly synthesized S-box. The basic concepts regarding the Arnold transform are presented in Sect. 4. Section 5 presents the detailed algorithm used for the image encryption. In Sect. 6 we test the strength of the proposed scheme using statistical analyses and lastly Sect. 7 presents the conclusion.

2 Algorithm for S-box

The intent of this section is to presents the design principle of our S-box. In this regard, we prefer to give a view of some fundamental facts.

Galois field $GF(p^{n})$: where p is a prime number, is expressed as a factor ring $\mathbb {F}_{p}[X]/ (f(x))$ where $f(x)\in \mathbb {F}_{p}[X]$ is a degree n irreducible polynomial. For $GF(2^{8})$ we choose a degree - 8 irreducible polynomial $f(x)=x^{8}+x^{6}+x^{5}+x^{4}+1 \in \mathbb {F}_{2}[X]$. We know that the multiplicative group G of the resultant field $GF(2^{8})$ is cyclic and hence each nonzero element of the field can be expressed as a power of the generator $g=00000010$.

Now we state the construction process for the S-box where an $8 \times 8$ S-box is a vectorial Boolean function $S: GF({2}^{8})\rightarrow GF({2}^{8})$.

In the proposed construction we use a specific non-linear, iterative map $\phi$ defined on the $GF(2^{8})$, given below:

$$\begin{aligned} \phi (x_{j}): {\left\{ \begin{array}{ll} g^{\phi (x_{j-1})}&{}:\,\,1\le j\le 254,\,\,j\ne 230,\,234,\\ g^{\phi (x_{j-1})+12}&{}: \,\,j=230,\\ g^{\phi (x_{j-1})+18}&{}: \,\,j=234,\\ 0&{}: \,\, j=255. \end{array}\right. } \end{aligned}$$

(1)

The above expression shows that the outputs of this map depend upon the chosen initial condition. This sensitivity towards the change of initial conditions makes this map compatible with the chaotic maps, however, it is clear that this map is quite straightforward and easy with the implementation and computation view point. In our calculations, we set the initial condition $\phi (x_{0})=1$. For the convenience, every element of the multiplicative cyclic group G of the associated Galois field is expressed in terms of exponents of the generator g in Table 1. Some calculations are explained below, which lead to the corresponding S-box elements (Table 2).

$$\begin{aligned} \phi (x_{0}) &= 1\quad ( {\text {the initial condition}}),\\ \phi (x_{1}) &= g^{\phi (x_{0})} = g = 2,\\ \phi (x_{2}) &= g^{\phi (x_{1})} = g^{2}=4,\\ \phi (x_{3}) &= g^{\phi (x_{2})} = g^{4}=16,\\ \phi (x_{4}) &= g^{\phi (x_{3})} = g^{16}=243. \end{aligned}$$

It is an extremely desirable feature of an S-box to be invertible so that the process could be reverted accordingly. For invertibility property, the involved Boolean function is required to be bijective. It is evident from the expression of $\phi$ that our map is bijective and hence the S-box in invertible. The inverse S-box is shown in Table 3, which is extracted from Table 2. The values in Table 2 give the outputs $\phi (x)=y$, where $0\leq x \leq 255$. Clearly, $\phi ^{-1} (\phi (x))=\phi ^{-1}(y)=x$ shows that in the inverse S-box, the value at yth position should be x. Following this rule the inverse S-box values are obtained (Table 3).

Table 1 Exponential representation and the elements of G

Table 2 S-box

Table 3 The inverse S-box

Our next goal is to analyse the cryptographic performance of the new S-box. In the following section we discuss some well-known analysis techniques to figure out the strength of our S-box.

3 Performance Analysis of S-box

In this section, we analyze the newly synthesized S-box through some widely accepted parameters including nonlinearity, bit independence, strict avalanche, linear and differential approximation probabilities. We compare the results with the prevailing S-boxes i.e., AES S-box, Affine Power Affine (APA) S-box, Gray S-box, Skipjack S-box, Xyi S-box and Residue Prime S-box.

3.1 Nonlinearity

The nonlinearity measure [6] determines the smallest distance of the reference function from all the affine functions.

The numerical values are presented in Table 4, showing an average nonlinearity value 103.5. A comparison of the nonlinearity results with other S-boxes is shown in Table 6 and Fig. 1. Clearly, the nonlinearity of the proposed S-box lies in a highly acceptable range.

Table 4 Performance Indices for S-box

Fig. 1

Nonlinearity comparison

Generally chaos-based algorithms are employed to increase the complexity and nonlinearity of the S-box. In order to prove the forte of the newly synthesized S-box, we compare its nonlinearity with some chaos-based S-boxes as well to show the effectiveness of our model (see Table 5).

Table 5 Nonlinearity comparison with chaotic models

3.2 Strict Avalanche Criterion

According to SAC, a function $S:GF(2^{n})\rightarrow GF(2^{n})$ would be regarded as reliable if the probability of change in output-bits is 1 / 2 for a single input-bit change. The results are presented in Table 4, showing that our S-box fulfils the requirements of SAC. Table 6 and Fig. 2 compare these results with other S-boxes.

Table 6 Performance comparison of different S-boxes

Fig. 2

SAC comparison

3.3 Linear and Differential Approximation Probabilities

Linear approximation probability is a measure that calculates the unevenness of an event. It is mathematically defined by:

$$\begin{aligned} LP=\underset{{\varGamma }_{x},{\varGamma }_{y}\ne 0}{\max }\left| \frac{\#\{x|x.{\varGamma }_{x}=S(x).{\varGamma }_{y}\}}{2^{n}}-\frac{1}{2}\right| , \end{aligned}$$

where x represents all possible inputs to the S-box and ${\varGamma }_{x}$ and ${\varGamma }_{y}$ give the parity of the input and output bits respectively.

The differential uniformity demonstrated by an S-box is determined through the differential approximation probability test [2]. The mathematical differential approximation probability is:

$$\begin{aligned} DP=\left[ \frac{\#\{x\in X|S(x)\oplus S(x\oplus {\Delta }x)={\Delta }y\}}{2^{n}}\right] , \end{aligned}$$

where ${\Delta }x$ and ${\Delta }y$ represent the input and output differentials respectively. The results of both LP and DP and their comparisons are given in Tables 4, 6 and Figs. 3, 4. It is evident that in the LP measure, our S-box is better than the Xyi S-box and is pretty similar to the Residue Prime S-box. However for differential approximation probability it is much better than the Residue Prime S-box and pretty close to the Skipjack and Xyi S-boxes.

Fig. 3

LP comparison

Fig. 4

DP comparison

3.4 Bit Independence Criterion

The independent behavior of the pair of variables and the changes in input bits are considered as important factors of bit independence criterion [17]. According to this criterion, input bits are transformed exclusively, and then output bits are scrutinized for their independence. Bit independence is one of the most desirable properties in any cryptographic structure. The increasing independence between bits is of great worth to attain a high level of complexity and perplexity in a system.

The results of BIC are given in Table 4 and are compared in Table 6 and Fig. 5. It is evident that, in BIC, our S-box has similarity with the Xyi S-box. By analyzing the results presented in Table 4, it is quite clear that the proposed algebraic substitution box has upended cryptographic features and can be usefully implemented in encryption applications. Table 6 witnesses that when compared with AES, APA, Gray, Skipjack, Xyi and Residue prime S-boxes, our new S-box is wisely alike the formerly prevailing S-boxes.

Fig. 5

BIC comparison

4 Arnold Transform

Arnold transform is used for encryption of digital images to increase the spread of pixel intensities [18,19,20]. For any square image of size $M \times M$, encryption using the Arnold transform can be given as:

$$\begin{aligned} \begin{bmatrix} \alpha \\ \beta \end{bmatrix}= \begin{bmatrix} \vartheta&\quad \vartheta \\ \vartheta&\quad \tau \end{bmatrix}\begin{bmatrix}x \\ y \end{bmatrix}(mod M), \end{aligned}$$

(2)

where (x, y) and $(\alpha , \beta )$ are associated pixel co-ordinates of the input image and encrypted data, such that $(\vartheta , \tau )=(1,2)$, as shown in Fig. 6.

Fig. 6

Effect of 10 iterations of Arnold transform. (a) (Plain image (Hill). (b) Arnold encryption

The Arnold transform encryption is worked on periodic boundary treatment. The n number of iterations for encrypting the image may be written as:

$$\begin{aligned} I(\alpha , \beta )^{k}={\varLambda }(x,y)^{k-1}(modM), \end{aligned}$$

where ${\varLambda }$ is the Arnold transform matrix given in (2) and I is an $M \times M$ encrypted image data for k number of iterations: $k=1,2,\ldots ,n$, such that $I(\alpha , \beta )^{0}=I(x, y)$. Periodicity of encryption is dependent on the size of a given image. The encrypted image data can be reversed on application of the inverse Arnold transform to the I with same iterations k as follows:

$$\begin{aligned} I(x,y)^{k}=I{\varLambda }^{-1} (\alpha , \beta )^{k-1}(modM). \end{aligned}$$

5 Image Encryption Scheme

Now we present the scheme used for the image encryption. It comprises of the following two steps.

• Use substitution box to partially encrypt the plain image.

• Apply 10 iterations of the Arnold transform on this partially encrypted image to obtain the fully encrypted image.

5.1 Encryption Algorithm

We selected three $512 \times 512$ benchmark images of hill, peppers and Barbara respectively. By following the above stated scheme the images are encrypted. We obtain the decrypted images by applying the inverse Arnold transform and inverse S-box respectively. Figures 7, 8, 9 and 10 show the plain images, the S-box-only encrypted images, the fully encrypted images and the decrypted images respectively. One can observe that the visual results of S-box-only encryption are not completely unintelligible however the combined effect of the S-box and Arnold transform is much better. We further examine the proposed encryption strategy through some statistical analysis.

Fig. 7

Plain Images: (a) Hill, (b) Peppers and (c) Barbara

Fig. 8

S-box encryption: (a) Hill, (b) Peppers and (c) Barbara

Fig. 9

Full encryption: (a) Hill, (b) Peppers and (c) Barbara

Fig. 10

Full decryption: (a) Hill, (b) Peppers and (c) Barbara

6 Statistical Analysis of the Proposed Method

The statistical analysis of the proposed method includes the most significant measures such as entropy, contrast, correlation, homogeneity, number of pixels change rate and unified average change intensity. We discuss these security parameters one by one and present the numerical results also.

6.1 Histogram Analysis

Histogram is a graphical representation of image-pixels distribution at each intensity level. A good encryption technique requires significant difference in the histogram of the plain and encrypted image so that the original content could not be extracted. Figures 11, 12, 13 show the respective histograms of plain, encrypted and the decrypted images. The histograms of the encrypted images, though not very uniformly distributed, but are evidently better than those, obtained by applying the encryption schemes proposed in [21, 22] and are pretty alike to [8]. The visual results obtained for histograms prove that the proposed method is stable against the histogram based attacks.

Fig. 11

Histogram of Hill’s plain, encrypted and decrypted images

Fig. 12

Histogram of Peppers’ plain, encrypted and decrypted images

Fig. 13

Histogram of Barbara’s plain, encrypted and decrypted images

6.2 Deviation from Uniform Histogram

An ideal encryption algorithm produces uniform histogram distribution. In order to determine the encryption quality of the proposed scheme we examine the deviation from the uniform histogram. The smaller the deviation, the better is encryption algorithm. The mathematical expression for the ideally uniform histogram is given by:

$$\begin{aligned} H(C_{i}): {\left\{ \begin{array}{ll} \frac{M \times N}{256}&{}:\,\,0 \le C_{i} \le 255\\ 0&{}: \,\,\text {elsewhere} \end{array}\right. } \end{aligned}$$

(3)

The deviation from the ideality can be expressed as:

$$\begin{aligned} D=\frac{\sum _{C_{i}=0}^{255}|H_{C_{i}}-H_{C}|}{M \times N}, \end{aligned}$$

where $H_{C}$ represents the histogram of the encrypted image, $H_{C_{i}}$ is the uniform histogram and $M \times N$ represents the image size. We calculate the deviation values for $512 \times 512$ images of hill, peppers and Barbara and the results are shown below in Table 7. It is quite clear that our scheme is in a good comparison with the scheme of [8], however, it is much better than [21].

Table 7 Deviation from uniform histogram

6.3 Information Entropy

Entropy analysis measures the randomness of system. The information entropy is given by,

$$\begin{aligned} H(M)=\sum P(m_{i})\text {log}_{2}\frac{1}{P(m_{i})}; \end{aligned}$$

where $M={m_{i}}$ represents the values of discrete random variable and $P(m_{i})$ is the probability at $m_{i}$. For an image with 256 gray levels, the ideal value of entropy measure is 8 and a strong cryptosystem attains entropy close to the ideal value in order to resist the entropy attacks. It has been established that the true randomness could be captured by using local entropy [23, 24]. In this regard, we select some randomly chosen, non-overlapping blocks of the encrypted images, calculate the average of the entropy measures of these blocks. For the proposed method, the numerical results for both the local and global entropy of images of hill, peppers and Barbara are shown in Table 8.

Table 8 Entropy analysis

6.4 Contrast

Contrast is a measure used to identify objects in an image. A strong encryption technique produces high level of contrast. Table 9 shows that our encryption scheme fulfills this criterion and the results obtained by the combined effect of S-box and Arnold transform are comparatively better than the individual effect of the S-box or the Arnold transform only. One can see that the proposed scheme offers a high level of contrast when compared with [25].

Table 9 Contrast analysis

6.5 Correlation

In order to examine the encryption effect of the proposed method we perform correlation analysis on both the plain and the encrypted images. It is quite clear that for an efficient encryption, the correlation between the adjacent pixels of the encrypted image should be reduced as compared to the plain image. The coefficient is given by,

$$\begin{aligned} r_{xy} = \frac{E((x-\mu _{x})(y-\mu _{y}))}{\sqrt{\delta _{x}\delta _{y}}}, \end{aligned}$$

where $\mu$ and $\delta$ represent the expected value and variance. The value of correlation coefficient close to zero guarantees better encryption quality. The analysis is performed on three images, hill, peppers and Barbara. The results arranged in Table 10 witness the effectiveness of the proposed method in comparison with [25].

Table 10 Correlation analysis

6.6 Homogeneity

Gray level co-occurrence matrix (GLCM) depicts the ability of combinations of pixel brightness results in tabular form. The closeness of the distribution in the (GLCM) to its diagonal is measured through the homogeneity analysis. The smaller is the homogeneity measure, the better is encryption. The numerical results shown in Table 11 go in favor of the proposed strategy.

Table 11 Homogeneity analysis

6.7 Differential Analysis

A desirable feature of a cryptosystem is to show high sensitivity to single-bit change in the plain image. For this purpose two measures, NPCR and UACI, are commonly used. NPCR stands for the number of pixels change rate of encrypted image as a result of one pixel change in the plain image. NPCR can be defined as the variance rate of pixels in the encrypted image that occurs through the change of a single pixel in original image. However UACI means unified average intensity of differences between the plain and encrypted images. The percentage values for both these measures are given by the following formulae.

$$\begin{aligned} NPCR&=\frac{\sum _{i,j} D_{ij}}{W \times H} \times 100, \end{aligned}$$

(4)

$$\begin{aligned} UACI&=\frac{1}{W \times H} \left[ \frac{\sum _{i,j}C_{ij}-\acute{C}_{ij}}{255} \right] \times 100. \end{aligned}$$

(5)

In above C and $\acute{C}$ represent the encrypted images obtained as a result of single bit change in the original image. In Eqs. (4) and (5), W and H represent the width and the height of the images C and $\acute{C}$.

An efficient encryption scheme is one that produces higher values of both NPCR and UACI. The results obtained in our case are shown in Tables 12 and 13 respectively which prove that our technique is quite efficient as compared to some recent methods.

Table 12 NPCR comparison

Table 13 UACI comparison

6.8 Time Analysis

The time complexity of the proposed algorithm depends linearly on the size of the input image. The action per pixel is proportional to $N^{2} \times M^{2}+ S_b + I_{A}$, where N and M are length and width of the given image, $S_b$ represent the size o S-box, and $I_A$ shows the iteration number of the Arnold transform, respectively.

The major focus of the proposed framework is the complexity of an encryption process. The computational speed of the proposed method is also reasonable. Although our scheme takes more time than [12] and [8] but offers increased security. The results presented in Table 14 show that the proposed algorithm is much faster than some recently presented chaos-based encryption techniques [21, 26], (see Table 2 of [8]). The computational cost results are obtained on three different gray test images of size $512\times 512$. The listed methods implementation are performed on processor: Intel(R) Core(TM) i5-2520M CPU @ 2.5, RAM: 8.00 GB; the run times of each method are obtained using Matlab 2015a.

Table 14 Computational cost comparison (in seconds)

7 Conclusion

In this work we propose an image encryption scheme that is extremely simple and highly effective. It has been established in some recent research work that the S-box-only encryption techniques are not secured enough for confidential communications therefore we introduce the combination of the S-box with certain number of iterations of the Arnold transform. The strength of the proposed method is then analyzed through several metric measurements. Moreover, the proposed method test evaluation for confusion creating capability is self-evident in terms of visual randomness and better values as compared to some recently presented algorithms.