Resistance of the double random phase encryption against various attacks

doi:10.1364/OE.15.010253

« Show journal navigation

Resistance of the double random phase encryption against various attacks

Yann Frauel, Albertina Castro, Thomas J. Naughton, and Bahram Javidi »View Author Affiliations

Optics Express, Vol. 15, Issue 16, pp. 10253-10265 (2007)
http://dx.doi.org/10.1364/OE.15.010253

View Full Text Article

Acrobat PDF (320 KB)

Journal Search
Article Lookup

Article Tools

Citations

Alert me when this article is cited
Export Citation/Save

Full Text
Article Info
References (32)
Cited By
Figures (6)
Metrics

Abstract

Several attacks are proposed against the double random phase encryption scheme. These attacks are demonstrated on computer-generated ciphered images. The scheme is shown to be resistant against brute force attacks but susceptible to chosen and known plaintext attacks. In particular, we describe a technique to recover the exact keys with only two known plain images. We compare this technique to other attacks proposed in the literature.

1. Introduction

Over the past few decades, the inherent parallelism of optics has prompted a great deal of research on optical information processing. Among all the possible applications, a very promising direction is optical encryption [1

Ph. Réfrégier and B. Javidi, “Optical image encryption based on input plane and Fourier plane random encoding,” Opt. Lett. 20, 767–769 (1995). [CrossRef] [PubMed]

]–[24

H. Suzuki, M. Yamaguchi, M. Yachida, N. Ohyama, H. Tashima, and T. Obi, “Experimental evaluation of finger-print verification system based on double random phase encoding,” Opt. Express 14, 1755–1766 (2006). [CrossRef] [PubMed]

]. With their pioneering work on double random phase (DRP) encoding, Réfrégier and Javidi [1

Ph. Réfrégier and B. Javidi, “Optical image encryption based on input plane and Fourier plane random encoding,” Opt. Lett. 20, 767–769 (1995). [CrossRef] [PubMed]

] paved the way for many following proposals of optical security and encryption systems. This very DRP scheme has spawned several variation techniques and has been applied in many situations [11

L. G. Neto and Y. Sheng, “Optical implementation of image encryption using random phase encoding,” Opt. Eng. 35, 2459–2463 (1996). [CrossRef]

]–[24

]. However only recently has the security of DRP started to be thoroughly analyzed and a few weaknesses have started to appear [25

A. Carnicer, M. Montes-Usategui, S. Arcos, and I. Juvells, “Vulnerability to chosen-cyphertext attacks of optical encryption schemes based on double random phase keys,” Opt. Lett. 30, 1644–1646 (2005). [CrossRef] [PubMed]

]–[29

X. Peng, H. Wei, and P. Zhang, “Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain,” Opt. Lett. 31, 3261–3263 (2006). [CrossRef] [PubMed]

]. Carnicer et al. presented a chosen ciphertext attack where an attacker can retrieve the key by inducing a legitimate user in deciphering many specially crafted ciphered images [25

]. Gopinathan et al. [27

U. Gopinathan, D. S. Monaghan, T. J. Naughton, and J. T. Sheridan, “A known-plaintext heuristic attack on the Fourier plane encryption algorithm,” Opt. Express 14, 3181–3186 (2006). [CrossRef] [PubMed]

] and Peng et al. [28

X. Peng, P. Zhang, H. Wei, and B. Yu, “Known-plaintext attack on optical encryption based on double random phase keys,” Opt. Lett. 31, 1044–1046 (2006). [CrossRef] [PubMed]

] described two techniques to recover the key knowing a single plain image and the corresponding ciphered image. In the first case the key is obtained through a simulated annealing process, while in the second case a phase retrieval algorithm is used. A variant of the DRP encryption is also attacked in [29

X. Peng, H. Wei, and P. Zhang, “Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain,” Opt. Lett. 31, 3261–3263 (2006). [CrossRef] [PubMed]

]. In this paper, we comment on several possible attacks on the DRP encryption scheme and in particular we present a known plaintext attack that requires two known plain images [26

Y. Frauel, A. Castro, T. J. Naughton, and B. Javidi E. M. Carapezza, “Security analysis of optical encryption,” inUnmanned/ Unattended Sensors and Sensor Networks II, ed., Proc. SPIE 5986, 25–34 (2005).

], but that is able to retrieve the exact key rather than an approximation of it as in Refs. [27

] and [28

X. Peng, P. Zhang, H. Wei, and B. Yu, “Known-plaintext attack on optical encryption based on double random phase keys,” Opt. Lett. 31, 1044–1046 (2006). [CrossRef] [PubMed]

]. We demonstrate the feasibility of the proposed attacks using computer-generated images.

Fig. 1. Principle of the double random phase encryption scheme.

In section 2, we recall the principle of the double random phase encryption. In section 3 we consider brute force attacks to the system. In sections 4 and 5 we describe chosen plaintext attacks and known plaintext attacks respectively. Section 6 gives a discussion of the various attacks presented in this and other papers. Conclusions are presented in Section 7.

2. Overview of the double random phase encryption scheme

The original double random phase encryption technique was proposed in [1

Ph. Réfrégier and B. Javidi, “Optical image encryption based on input plane and Fourier plane random encoding,” Opt. Lett. 20, 767–769 (1995). [CrossRef] [PubMed]

]. It is described in Fig. 1. The image to be encrypted, or plain image P, is immediately followed by a first random phase mask, which is the first key X. Both the image and the mask are located in the object focal plane of a first lens. In the image focal plane of this lens is therefore obtained the Fourier transform (FT) of the product P· X. This product is then multiplied by another random phase mask that is the second key Y. Lastly, another FT is performed by a second lens to return to the spatial domain. Since the last FT does not add anything to the security of the system, we will perform all our analyses in the Fourier plane. The ciphered image C is then

C = Y \cdot 𝓕 (P \cdot X),

(1)

where 𝓕 stands for the Fourier transform operation. In most of the paper, we will assume that P is a gray-level image — the so-called amplitude encoding. However, the last attacks we will present also work with the phase encoding variant [12

N. Towghi, B. Javidi, and Z. Luo, “Fully phase encrypted image processor,” J. Opt. Soc. Am. A 16, 1915–1927 (1999). [CrossRef]

] where the image is pure phase (see Section 6).

3. Brute force attacks

3.1. Exact decryption

The first obvious attack against any encryption system consists of trying every possible key until finding the correct one. Assuming that both phase masks have a size of √N×√N pixels and that each pixel has L possible phase values, the number of attempts required to retrieve both keys is of the order of L^2N . For any practical values of L and N, this number is huge and it increases exponentially with the number of pixels N which makes this attack computationally intractable. For instance, let us fix L=16 phase levels and N=100×100 pixels. Then the number of keys to try would be 16²⁰⁰⁰⁰~10²⁴⁰⁰⁰, which is inconceivable. In practice, however, it is not always necessary to consider all of these combinations.

Thus, in the most common case of amplitude encoding [1

Ph. Réfrégier and B. Javidi, “Optical image encryption based on input plane and Fourier plane random encoding,” Opt. Lett. 20, 767–769 (1995). [CrossRef] [PubMed]

], we do not need to know the first key X to decipher an image C. Indeed, if we know the second key Y, we can find

P \cdot X = 𝓕^{- 1} (C \div Y)

(2)

where 𝓕^-1 denotes the inverse Fourier transform and ÷ stands for the point-by-point division. Now because P is a pure magnitude function and X is a pure phase function, the plain image is easily recovered by

P = ∣ P \cdot X ∣ = ∣ 𝓕^{- 1} (C \div Y) ∣,

(3)

where ‖ is the modulus. This property leads to the first reduced brute-force attack:

Attack 1: Try every possible instance of the second key Y, while ignoring the first key X.

The number of trials required by this attack is L^N instead of L^2N . This represents a great simplification since the number of combinations is reduced by a factor L ^N . In the case of the numerical example used above, the number of trials is 16 ¹⁰⁰⁰⁰~10¹²⁰⁰⁰.

3.2. Approximate decryption

In addition to attack 1, it is possible to look for an approximate version of the key Y instead of its exact value. The first possible simplification consists of reducing the number of phase levels, at the cost of a loss of quality in the decrypted image. For instance, we can look for keys with only two phase levels.

Attack 2: Try only binary phase keys for the second key Y; ignore the first key X.

The number of possible combinations is then 2 ^N instead of L^N . For the example of section 3.1, the number of combinations to try would be 2 ¹⁰⁰⁰⁰~10³⁰⁰⁰. Figure 2 shows the result of decrypting two 100×100 images with various reductions of phase levels of the key Y. The original key has 16 phase levels but the original image is recognizable even with a binarized phase key. However, the fewer phase levels, the more noise is introduced in the reconstruction.

Another possible simplification is to retrieve a partial window of the key Y instead of the full key [25

, 26

, 29

X. Peng, H. Wei, and P. Zhang, “Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain,” Opt. Lett. 31, 3261–3263 (2006). [CrossRef] [PubMed]

]. Since the pixels outside the window are then ignored, deciphering with the partial window amounts to applying a low-pass filter to the deciphered image. The details of the original image are thus lost but large features can be recognized.

Attack 3: Brute force search of a partial window of the second key Y; ignore the first key X. If the window has a total of N_r < N pixels, then the number of combinations to try is L^Nr instead of L^N . Figure 3 presents decryptions of two 100×100 images using partial windows of the ciphered image with various sizes. In this case, retrieving a 30×30 window of the second key is sufficient to recognize the plain image, although the details are lost. The number of combinations is thus reduced to 16⁹⁰⁰~10¹⁰⁸⁰.

Additionally, it is possible to combine Attacks 2 and 3 as follows:

Attack 4: Brute force search of a partial window of the second key Y trying a small number of phase levels; ignore the first key X.

For instance, if we use only three phase levels then the number of combinations to try is 3 Nr instead of the original _LN . Figure 4 presents decrypted images using ternary phase levels for the second key and various window sizes. It can be seen that a gray-level image with details deteriorates faster than a binary image with a low-level of detail. In the case of Fig. 4(e), the number of trials would be 3⁹⁰⁰~10^429, while the image is still recognizable. Although that number represents a dramatic reduction from the original 10 ²⁴⁰⁰⁰ attempts, the number of trials remains huge. Therefore we can conclude that brute force attacks are intractable. However it should be kept in mind that the nominal security of the scheme is lower than one may naively expect.

Fig. 2. Decryption of images encrypted with 16-level phase keys. (a)–(b) 16-level decryption key, (c)–(d) 4-level decryption key, and (e)–(f) 2-level decryption key.

Fig. 3. Decryption using partial windows of the original 100×100 key. (a)–(b) 50×50 window, (c)–(d) 40×40 window, and (e)–(f) 30×30 window.

Fig. 4. Decryption using partial windows of the original 100×100 key and reduction to three phase levels. (a)–(b) 50×50 window, (c)–(d) 40×40 window, and (e)–(f) 30×30 window.

4. Chosen plaintext attacks

We now assume that the attacker has the ability to trick a legitimate user of the system into encrypting particular images. In this case, as mentioned in [25

] and [26

], a very simple and yet very effective attack can be mounted:

Attack 5: Obtain the ciphered image corresponding to a Dirac delta function as plain image.

In other terms, the plain image is entirely black except for a single pixel. If the non-black pixel is centered, it is straightforward to see from Eq. (1) that the resulting ciphered image is — to a constant phase factor — the second key Y [26

]. If the non-black pixel is not centered, then the ciphered image is the second key Y multiplied by a linearly varying phase. Since this linear phase is known (it only depends on the position of the non-black pixel), it is possible to extract the key Y. Thus, the system can be easily broken by encrypting a single chosen plain image. It can be argued that such a plain image can look suspicious to the authorized user that is to encrypt it. A variant can therefore be used:

Attack 6: Obtain and subtract the ciphered images corresponding to two plain images whose difference is a delta function.

This attack is made possible because the encryption scheme is linear. Indeed, If P₁, P₂ are two plain images with corresponding ciphered images C₁, C₂ , and α, β are two scalar coefficients, it is easy to see from Eq. (1) that αP₁+β P₂ is encrypted to αC₁+βC₂ . In the case of Attack 6, if P₁-P₂=δ then C₁–C₂ is the ciphered image of a delta function—that is the second key Y — as in Attack 5. In order to disguise the attack even further, it is possible to use an arbitrary number of plain images (instead of just two) for which a particular linear combination gives a delta function. It is then sufficient to compute the corresponding linear combination of the ciphered images to obtain the key.

Note that Attack 5 is not applicable in the case of the phase-encoded variant of the encryption scheme [12

N. Towghi, B. Javidi, and Z. Luo, “Fully phase encrypted image processor,” J. Opt. Soc. Am. A 16, 1915–1927 (1999). [CrossRef]

]. This is because it is impossible to obtain zero-valued pixels in this case, thus forbidding the formation of a delta function. However, Attack 6 remains possible. For instance, let us assume that amplitude images with values between 0 and 1 are encoded to phases between 0 and 2π. Now we choose amplitude Image 1 to be uniformly zero and amplitude Image 2 to also be uniformly zero except in the center (0,0) where it takes a value of 0.5. Then the corresponding phase encoded plain images will be P₁ that is uniformly 1 (phase 0) and P₂ that will be uniformly 1 except in the center where it takes a value of -1 (phase π). The difference P₁-P₂ is therefore 0 at every pixel except in the center where it take the value 1-(-1)=2. Therefore we can see that P₁-P₂=2δ and Attack 6 is applicable. It has to be noted that, since the plain images are phase coded, the knowledge of the first key X is necessary to complete the decryption process. Fortunately, this key can be recovered with a single additional plain-ciphered image pair.

Attack 7: Employ Attack 5 or 6, and further obtain the ciphered image corresponding to a uniform image as plain image; deduce the first key X.

Indeed, if P₃ is a uniform (spatially constant) image, with its corresponding ciphered image C₃ , then Eq. (2) gives

P_{3} \cdot X = 𝓕^{- 1} (C_{3} \div Y),

(4)

and since P₃ is constant, the first key is directly recovered as

X \propto 𝓕^{- 1} (C_{3} \div Y)

(5)

To sum up, with at most three chosen plain-ciphered image pairs, it is possible to recover the two encryption keys and break the system.

5. Known plaintext attacks

We now assume that the attacker knows several plain images with their corresponding ciphered images. The plain images do not have to have very specific forms so they do not have to be chosen by the attacker.

5.1. Vectorial notation

For the following analysis, we consider that P, C, X and Y are discrete (pixelized) and spatially bounded. This is always the case in practice, given that even continuous images and phase keys can be adequately sampled. We therefore represent these four two-dimensional functions by four arrays. The total number of pixels of each array is N. We re-arrange each array into a vector with N components; this vector is formed by sequentially appending each column of the original array. The four vectors are called P, C, X and Y. The linearity of the encryption scheme (see Section 4) means that the transformation between the plain image vector P and the ciphered image vector C can be represented by a matrix-vector product as follows

C = T P,

(6)

where T is the N×N transformation matrix that characterizes the encryption process.

5.2. Using a base of the vector space

As a linear operation in a vector space of dimension N, the encryption is fully defined by its operation on a base of the vector space (that is, a set of N linearly independent vectors).

Attack 8: Obtain the ciphered images corresponding to N known linearly independent plain images; retrieve the key by matrix inversion.

An N×N matrix P can be formed, using as columns the vectors P₁, …P _N that correspond to the N plain images. Similarly, an N×N matrix C can be formed with the vectors corresponding to the ciphered images. The process of encrypting all the plain images can be written as

C = T P,

(7)

where T is the same encryption matrix as in Eq. (6). Now, P and C are known to the attacker, and P is invertible because its columns are linearly independent. So, the encryption matrix can be computed by

T = C P^{- 1},

(8)

with P ^-1 the inverse of P. At this stage the system is compromised because knowing the encryption matrix T is equivalent to knowing the keys. Indeed, from Eq. (6), we see that any unknown plain image P can be obtained from the ciphered image C by

P = T^{- 1} C,

(9)

where T ^-1 is the inverse of T.

Note that the attack presented in this subsection is quite general and would work for any linear encryption technique [30

H. Beker and F. Piper, Cipher systems (Van Nostrand, London, 1982).

, 31

S. R. Blackburn, S. Murphy, and K. G. Paterson, “Comments on ‘Theory and applications of cellular automata in cryptography’,” IEEE Trans. Comp. 46, 637–638 (1997). [CrossRef]

]. In practice, this attack is not very useful because it requires one to know a huge number of plain images, for instance 10000 images if each image has 100×100 pixels.

5.3. Using two known images

Here we assume that the attacker knows two plain images P and P′ with their corresponding ciphered images C and C′.

Attack 9: Obtain the ciphered images corresponding to 2 known plain images and deduce the keys by solving a linear system of equations.

Let us express the encryption operation in terms of p_i, p′_i, c_i, c′_i, x_i and yi, the elements of the vectors P, P′, C, C′, X and Y, respectively. For the first image, we can write

c_{i} = y_{i} \sum_{j = 1}^{N} F_{ij} x_{j} p_{j} with 1 \leq i \leq N,

(10)

where F_ij is the matrix that characterizes the FT operation. Note that, although it operates on vectors, it does not represent a one-dimensional FT but rather a two-dimensional FT on the images before they are re-arranged in vector form. For the second image, we can write similarly

c_{i}^{'} = y_{i} \sum_{j = 1}^{N} F_{ij} x_{j} p_{j}^{'} with 1 \leq i \leq N .

(11)

Now, it is possible to eliminate the elements of the second key yi by cross-multiplying Eqs. (10) and (11). We get

c_{i} \sum_{j = 1}^{N} F_{ij} x_{j} p_{j}^{'} = c_{i}^{'} \sum_{j = 1}^{N} F_{ij} x_{j} p_{j} with 1 \leq i \leq N,

(12)

hence

\sum_{j = 1}^{N} F_{ij} x_{j} (c_{i} p_{j}^{'} - c_{i}^{'} p_{j}) = 0 with 1 \leq i \leq N .

(13)

In Eq. (13), the only unknown variables are the components of the first key x_j . We thus rewrite this equation as

\sum_{j = 1}^{N} S_{ij} x_{j} = 0 with 1 \leq i \leq N,

(14)

where S_ij=F_ij(cip′_j-c′_ip_j) is known. Equation (14) represents a system of N linear equations with N unknown variables. This system has a trivial solution x_i =0 for every i. This solution is not the one we are looking for because we know that the first key is not zero. Therefore there has to be another solution to this system. This is only possible if the determinant of the matrix S is zero, that is if the N equations are not linearly independent. The interpretation of this property is that the keys are defined up to a constant phase factor. We can thus arbitrarily choose the value of one pixel of the key and this will fix the values of the rest of the pixels. We decide to fix xN=1. We can also eliminate the last equation of the system, because it is a linear combination of the other equations. With these modifications, Eq. (14) is transformed to

\sum_{j = 1}^{N - 1} S_{ij} x_{j} = - S_{iN} with 1 \leq i \leq N - 1 .

(15)

This new system of N-1 equations with N-1 variables can be solved by classical system solving techniques such as Gauss elimination or LU decomposition [32

W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery, Numerical recipes in C (Cambridge University Press, Cambridge, 1992), Chap. 2.

]. Of course, the resolution is only possible if the determinant of this new system is not zero. In practice, this condition is not very restrictive and it is easy to find two images for which it holds. Once the first key is known, the second key is easily retrieved using for instance Eq. (10) by

y_{i} = \frac{c_{i}}{\sum_{j = 1}^{N} F_{ij} x_{j} p_{j}} with 1 \leq i \leq N .

(16)

An example of this attack is presented in Fig. 5. The known plain images P and P′ are shown in Figs. 5(a) and 5(b) respectively. From these two images and their corresponding ciphered images, the keys X and Y are found. These recovered keys are then used to decrypt the unknown ciphered image shown in Fig. 5(c). The result of the decryption is given in Fig. 5(d). As can be seen, the plain image is successfully decrypted.

Fig. 5. Decryption using Attack 9. (a) and (b) are the two known plain images. (c) Ciphered image corresponding to an unknown plain image. (d) Unknown image decrypted using the keys retrieved by Attack 9.

The attack presented in this section requires solving a system of about N equations. The complexity of this attack is thus O(N²) in space and O(N³) in time. This polynomial complexity makes the problem tractable. For the 100×100 images of Fig. 5, the keys were found in 2 hours 15 minutes on a desktop computer (Pentium 4 HT, 3.0 GHz, 2 GB RAM) using Gaussian elimination with backsubstitution.

Note that all the variables involved in the attack can be complex-valued. The only restrictions are that all x_i , all y_i and a sufficient number of p_i and p′_i be different from 0. This situation means in particular that p_i can take complex values as happens in the phase-encoded encryption. The attack therefore works without any modification in this latter case. It would even be applicable to a mixed amplitude-phase encoding. Also, the encryption keys need not be pure phase to be recovered.

5.4. Effect of noise

In all the attacks described above, we have assumed that the ciphered images are known without error. This might not be the case in practice. In this section, we assume that the ciphered images are known up to an additive gaussian noise. We have already said that Attacks 1–4 are not practical. For Attack 5–7, it is not difficult to see that the error on the retrieved key is proportional to the noise on the ciphered images. Attacks 8 and 9 are more heavily affected by noise since the linear system resolutions involved in the key recovery process amplify the errors. Let us focus on the most interesting case of Attack 9. Figure 6(a) presents six plain images, of which the two leftmost are supposed to be known. The corresponding ciphered images are degraded by a 5% additive gaussian noise. We apply Eqs. (15) and (16) to recover the keys from the two known images, as in Section 5.3. Figure 6(b) shows the images decrypted with the recovered keys. It can be seen that, even with this low noise, the images are not recognizable, except maybe the ones that were used to compute the keys.

In order to more accurately retrieve the encryption keys in spite of the noise, we need to use more than two plain-ciphered image pairs. We now assume that we know four such pairs, although the process can be generalized to any number of pairs. The four known plain images P¹, P², P³, P⁴ are the four leftmost images in Fig. 6(a). For any two pairs of known plain-ciphered images (P^α,C^α ) and (P^β,C^β ), we can obtain a system of equations identical to Eq. (14):

\sum_{j = 1}^{N} S_{ij}^{αβ} x_{j} = 0 with 1 \leq i \leq N,

(17)

where S^αβ _ij=F_ij(c^αip^β _j-c^β _ip^α _j) and p^α _j, p^β _j, c^α _i and c^β _i are the pixels of P^α, P^β, C^α and C^β respectively. Equation (17) can also be written in matrix form as

S^{αβ} X = 0,

(18)

where S^αβ is the N×N matrix that contains the S^αβ _ij , X is a N×1 vector that contains the unknown pixels of the first key, and the right-hand term is a N×1 vector of zeros. Now we can associate the four known images in six different ways in order to obtain six different versions of Eq. (18) with varying values of α and β. These six equations, together with the condition xN=1 that avoids the trivial solution X=0 (see Section 5.3), can be combined into a single equation:

[\begin{matrix} S^{12} \\ S^{13} \\ S^{14} \\ S^{23} \\ S^{24} \\ S^{34} \\ 0 & \dots & 0 & 1 \end{matrix}] x = [\begin{matrix} 0 \\ ⋮ \\ 0 \\ 1 \end{matrix}],

(19)

where the left-hand term is the product of a (6N+1)×N matrix by a N×1 vector, and the right-hand term is a (6N+1)×1 vector. Equation (19) defines an overdetermined system of equations. A least-square solution of this system can be found by classical techniques such a QR decomposition or singular value decomposition [32

W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery, Numerical recipes in C (Cambridge University Press, Cambridge, 1992), Chap. 2.

]. The obtained key X is still noisy; in particular it is not pure phase as it is supposed to be. We can enforce this property by normalizing the amplitude of each pixel:

{\hat{x}}_{i} = \frac{x_{i}}{∣ x_{i} ∣} with 1 \leq i \leq N .

(20)

Fig. 6. Decryption of noisy ciphered images using an adaptation of Attack 9. (a) Plain images. (b) Decrypted images using the keys retrieved by simple system solving. (c) Decrypted images using the keys retrieved by least-square solving.

We now need to recover the second key Y from the first (normalized) key X̂. Rather than a direct derivation from a single image using Eq. (16), it is more accurate to find again a least-square solution using the four known images. Since the x̂ _i are now known, Eq. (10) for image α can be rewritten as

λ_{i}^{α} y_{i} = c_{i}^{α} with 1 \leq i \leq N,

(21)

where

{λ_{i}}^{α} = \sum_{j = 1}^{N} F_{ij} {\hat{x}}_{j} p_{j}^{α} .

(22)

Equation (21) can be written in the following matrix form

Λ^{α} Y = C^{α},

(23)

where Λ ^α is a diagonal matrix given by

Λ^{α} = [\begin{matrix} λ_{1}^{α} \\ ⋱ \\ λ_{N}^{α} \end{matrix}] .

(24)

The four known images provide four different versions of Eq. (23) that can be combined into a single equation:

[\begin{matrix} Λ^{1} \\ Λ^{2} \\ Λ^{3} \\ Λ^{4} \end{matrix}] Y = [\begin{matrix} C^{1} \\ C^{2} \\ C^{3} \\ C^{4} \end{matrix}] .

(25)

Again, Eq. (25) can be solved in a least-square sense by classical algorithms and the obtained Y can be normalized by

{\hat{y}}_{i} = \frac{y_{i}}{∣ y_{i} ∣} with 1 \leq i \leq N .

(26)

Figure 6(c) presents the images decrypted using the retrieved keys X̂ and Ŷ. The results are now very satisfactory, including for the two rightmost images that were not used in the key recovery process. These results demonstrate that a good approximation of the keys was found. If the noise were stronger, it would be necessary to incorporate more known images in the key estimation process.

6. Discussion

This paper presents an analysis of the theoretical—rather than practical—security of the DRP technique. The various presented attacks assume an abstract version of the technique where all data is available in digital form. In a real optical implementation, the difficulty to manipulate and measure the involved physical quantities adds some challenges to the attacker.

We have shown that Attacks 1 through 4 are intractable, which makes the DRP encryption resistant to brute force attacks. Attack 8 requires a very large number of known plain images and is therefore quite impractical. On the other hand, Attacks 5 to 7 are surprisingly easy and effective if the attacker is able to choose images to be encrypted. If this possibility does not exist, Attack 9 is still very powerful as a known plain image attack which only requires two known images. The DRP technique must therefore be considered potentially insecure against chosen and known plaintext attacks. Its main weakness lies in its linearity.

The attacks presented in this paper have some advantages over other attacks proposed recently. For instance, the attack described in [29

X. Peng, H. Wei, and P. Zhang, “Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain,” Opt. Lett. 31, 3261–3263 (2006). [CrossRef] [PubMed]

] requires access to an encryption machine and uses a large number of chosen plain images, which makes it impractical. Similarly, the technique in [25

] requires access to a decryption machine and a large number of chosen ciphered images. In addition, the latter paper mentions an attack with a centered delta function as input image. In this paper we have shown that a non-centered delta function will also suffice, as will any set of innocuous images whose linear combination is a shifted delta function. This latter attack defeats the defense proposed by Carnicer et al. [25

]. Further, we have shown that with the possibility of a second chosen image (an image with constant complex amplitude) the first phase mask can also be found, allowing complex-valued inputs to be decrypted.

The attacks presented in [27

] and [28

X. Peng, P. Zhang, H. Wei, and B. Yu, “Known-plaintext attack on optical encryption based on double random phase keys,” Opt. Lett. 31, 1044–1046 (2006). [CrossRef] [PubMed]

] use heuristic approaches and result in an approximated recovery of the keys and the decrypted images are quite noisy. Actually, Ref. [28

X. Peng, P. Zhang, H. Wei, and B. Yu, “Known-plaintext attack on optical encryption based on double random phase keys,” Opt. Lett. 31, 1044–1046 (2006). [CrossRef] [PubMed]

] does not show the decryption of an unknown image. On the other hand, our Attacks 5 to 9 are based on a mathematical analysis of the DRP technique and they are able to recover the exact keys and therefore provide a perfect decryption of unknown images. Additionally, it is important to note that the attacks proposed in [25

, 27

, 28

X. Peng, P. Zhang, H. Wei, and B. Yu, “Known-plaintext attack on optical encryption based on double random phase keys,” Opt. Lett. 31, 1044–1046 (2006). [CrossRef] [PubMed]

, 29

X. Peng, H. Wei, and P. Zhang, “Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain,” Opt. Lett. 31, 3261–3263 (2006). [CrossRef] [PubMed]

] only work for the case of amplitude-coded plain images. In our proposal, Attacks 6 through 9 are perfectly applicable to phase-encoded images so they can be used against the full phase DRP encryption [12

N. Towghi, B. Javidi, and Z. Luo, “Fully phase encrypted image processor,” J. Opt. Soc. Am. A 16, 1915–1927 (1999). [CrossRef]

A variant of the DRP encoding that uses keys in the Fresnel domain has been proposed in [14

O. Matoba and B. Javidi, “Encrypted optical memory system using three-dimensional keys in the Fresnel domain,” Opt. Lett. 24, 762–764 (1999). [CrossRef]

]. Optical encoding using keys in the Fresnel domain will be substantially more secure as any attack requires a search in 3D domain to locate the precise Fresnel location of the keys. Therefore, various attacks presented in the literature which use the linearity property will not be very practical. Also, other encryption techniques based on fractional Fourier transform have been proposed [8

B. M. Hennelly and J. T. Sheridan, “Image encryption and the fractional Fourier transform,” Optik 114, 251–265 (2003). [CrossRef]

, 16

G. Unnikrishnan, J. Joseph, and K. Singh, “Optical encryption by double-random phase encoding in the fractional Fourier domain,” Opt. Lett. 25, 887–889 (2000). [CrossRef]

, 18

S. Liu, L. Yu, and B. Zhu, “Optical image encryption by cascaded fractional Fourier transforms with random phase filtering,” Opt. Commun. 187 57–63 (2001). [CrossRef]

, 23

X. Wang, D. Zhao, and L. Chen, “Image encryption based on extended fractional Fourier transform and digital holography technique,” Opt. Commun. 260, 449–453 (2006). [CrossRef]

]. The most effective attacks presented in this paper are not directly applicable to these variant schemes using Fresnel domain keys and fractional Fourier transform. These variant schemes should therefore be preferred to the original DRP encryption.

7. Conclusion

In this paper we have described several ways to attack the double random phase encryption technique, some of which are impractical and other are very effective. We have shown that an exhaustive search of the key is generally intractable, even when applying some simplifications to reduce the number of combinations. However, we have presented chosen and known plaintext attacks that are able to efficiently recover the keys of the system. The most dangerous attack only requires two known plain images. We have studied the effects of noise on this attack and proposed a way to reduce them. We have also provided a comparison of the proposed attacks to other techniques described in the literature. Given the risks involved with the presented attacks, it is recommendable to be extremely cautious when using the double random phase encryption. Large keys of at least 1000×1000 pixels should be used and, if possible, it should be avoided to re-use the same keys for different images, as in a one-time pad approach. Also, a safer alternative to the original double random phase encryption is to use variant schemes such as keys in the Fresnel domain or fractional Fourier transform encryption.

Acknowledgments

The authors are grateful to the anonymous reviewers for their useful comments. Y. Frauel, A. Castro and T. J. Naughton acknowledge support from Enterprise Ireland and Science Foundation Ireland.

References and links

1.	Ph. Réfrégier and B. Javidi, “Optical image encryption based on input plane and Fourier plane random encoding,” Opt. Lett. 20, 767–769 (1995). [CrossRef] [PubMed]
2.	B. Javidi and E. Ahouzi, “Optical security system with Fourier plane encoding,” Appl. Opt. 37, 6247–6255 (1998). [CrossRef]
3.	J.-W. Han, C.-S. Park, D.-H. Ryu, and E.-S. Kim, “Optical image encryption based on XOR operations,” Opt. Eng. 38, 47–54 (1999). [CrossRef]
4.	J. L. Horner and B. Javidi, Opt. Eng. 38, Special issue on Optical security, 1999. [CrossRef]
5.	S. Lai and M. A. Neifeld, “Digital wavefront reconstruction and its application to image encryption,” Opt. Commun. 178, 283–289 (2000). [CrossRef]
6.	Y. Li, K. Kreske, and J. Rosen, “Security and encryption optical systems based on a correlator with significant output images,” Appl. Opt. 39, 5295–5301 (2000). [CrossRef]
7.	X. Peng, Z. Cui, and T. Tan, “Information encryption with virtual-optics imaging system,” Opt. Commun. 212, 235–245 (2002). [CrossRef]
8.	B. M. Hennelly and J. T. Sheridan, “Image encryption and the fractional Fourier transform,” Optik 114, 251–265 (2003). [CrossRef]
9.	O. Matoba and B. Javidi, “Secure three-dimensional data transmission and display,” Appl. Opt. 43, 2285–2291 (2004). [CrossRef] [PubMed]
10.	B. Javidi, ed., Optical and Digital Techniques for Information Security (Springer Verlag, New York, 2005). [CrossRef]
11.	L. G. Neto and Y. Sheng, “Optical implementation of image encryption using random phase encoding,” Opt. Eng. 35, 2459–2463 (1996). [CrossRef]
12.	N. Towghi, B. Javidi, and Z. Luo, “Fully phase encrypted image processor,” J. Opt. Soc. Am. A 16, 1915–1927 (1999). [CrossRef]
13.	O. Matoba and B. Javidi, “Encrypted optical storage with wavelength-key and random phase codes,” Appl. Opt. 38, 6785–6790 (1999). [CrossRef]
14.	O. Matoba and B. Javidi, “Encrypted optical memory system using three-dimensional keys in the Fresnel domain,” Opt. Lett. 24, 762–764 (1999). [CrossRef]
15.	E. Tajahuerce and B. Javidi, “Encrypting three-dimensional information with digital holography,” Appl. Opt. 39, 6595–6601 (2000). [CrossRef]
16.	G. Unnikrishnan, J. Joseph, and K. Singh, “Optical encryption by double-random phase encoding in the fractional Fourier domain,” Opt. Lett. 25, 887–889 (2000). [CrossRef]
17.	G. Unnikrishnan and K. Singh, “Optical encryption using quadratic phase systems,” Opt. Commun. 193, 51–67 (2001). [CrossRef]
18.	S. Liu, L. Yu, and B. Zhu, “Optical image encryption by cascaded fractional Fourier transforms with random phase filtering,” Opt. Commun. 187 57–63 (2001). [CrossRef]
19.	J. Ohtsubo and A. Fujimoto, “Practical image encryption and decryption by phase-coding technique for optical security systems,” Appl. Opt. 41, 4848–4855 (2002). [CrossRef] [PubMed]
20.	H. T. Chang, W. C. Lu, and C. L. Kuo, “Multiple-phase retrieval for optical security systems by use of randomphase encoding,” Appl. Opt. 41, 4825–4834 (2002). [CrossRef] [PubMed]
21.	B. Zhu, H. Zhao, and S. Liu, “Image encryption based on pure intensity random coding and digital holography technique,” Optik 114, 95–99 (2003). [CrossRef]
22.	G. Situ and J. Zhang, “Double random-phase encoding in the Fresnel domain,” Opt. Lett. 29, 1584–1586 (2004). [CrossRef] [PubMed]
23.	X. Wang, D. Zhao, and L. Chen, “Image encryption based on extended fractional Fourier transform and digital holography technique,” Opt. Commun. 260, 449–453 (2006). [CrossRef]
24.	H. Suzuki, M. Yamaguchi, M. Yachida, N. Ohyama, H. Tashima, and T. Obi, “Experimental evaluation of finger-print verification system based on double random phase encoding,” Opt. Express 14, 1755–1766 (2006). [CrossRef] [PubMed]
25.	A. Carnicer, M. Montes-Usategui, S. Arcos, and I. Juvells, “Vulnerability to chosen-cyphertext attacks of optical encryption schemes based on double random phase keys,” Opt. Lett. 30, 1644–1646 (2005). [CrossRef] [PubMed]
26.	Y. Frauel, A. Castro, T. J. Naughton, and B. Javidi E. M. Carapezza, “Security analysis of optical encryption,” inUnmanned/ Unattended Sensors and Sensor Networks II, ed., Proc. SPIE 5986, 25–34 (2005).
27.	U. Gopinathan, D. S. Monaghan, T. J. Naughton, and J. T. Sheridan, “A known-plaintext heuristic attack on the Fourier plane encryption algorithm,” Opt. Express 14, 3181–3186 (2006). [CrossRef] [PubMed]
28.	X. Peng, P. Zhang, H. Wei, and B. Yu, “Known-plaintext attack on optical encryption based on double random phase keys,” Opt. Lett. 31, 1044–1046 (2006). [CrossRef] [PubMed]
29.	X. Peng, H. Wei, and P. Zhang, “Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain,” Opt. Lett. 31, 3261–3263 (2006). [CrossRef] [PubMed]
30.	H. Beker and F. Piper, Cipher systems (Van Nostrand, London, 1982).
31.	S. R. Blackburn, S. Murphy, and K. G. Paterson, “Comments on ‘Theory and applications of cellular automata in cryptography’,” IEEE Trans. Comp. 46, 637–638 (1997). [CrossRef]
32.	W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery, Numerical recipes in C (Cambridge University Press, Cambridge, 1992), Chap. 2.

OCIS Codes
(070.2580) Fourier optics and signal processing : Paraxial wave optics
(070.4560) Fourier optics and signal processing : Data processing by optical means
(200.4740) Optics in computing : Optical processing

ToC Category:
Fourier Optics and Signal Processing

History
Original Manuscript: February 23, 2007
Revised Manuscript: April 27, 2007
Manuscript Accepted: May 10, 2007
Published: July 30, 2007

Citation
Yann Frauel, Albertina Castro, Thomas J. Naughton, and Bahram Javidi, "Resistance of the double random phase encryption against various attacks," Opt. Express 15, 10253-10265 (2007)
http://www.opticsinfobase.org/oe/abstract.cfm?URI=oe-15-16-10253

Sort: Year | Journal | Reset

References

Ph. Réfrégier and B. Javidi, "Optical image encryption based on input plane and Fourier plane random encoding," Opt. Lett. 20,767-769 (1995). [CrossRef] [PubMed]
B. Javidi and E. Ahouzi, "Optical security system with Fourier plane encoding," Appl. Opt. 37,6247-6255 (1998). [CrossRef]
J.-W. Han, C.-S. Park, D.-H. Ryu, and E.-S. Kim, "Optical image encryption based on XOR operations," Opt. Eng. 38,47-54 (1999). [CrossRef]
J. L. Horner and B. Javidi, Opt. Eng. 38, Special issue on Optical security, 1999. [CrossRef]
S. Lai and M. A. Neifeld, "Digital wavefront reconstruction and its application to image encryption," Opt. Commun. 178,283-289 (2000). [CrossRef]
Y. Li, K. Kreske, and J. Rosen, "Security and encryption optical systems based on a correlator with significant output images," Appl. Opt. 39,5295-5301 (2000). [CrossRef]
X. Peng, Z. Cui and T. Tan, "Information encryption with virtual-optics imaging system," Opt. Commun. 212,235-245 (2002). [CrossRef]
B. M. Hennelly and J. T. Sheridan, "Image encryption and the fractional Fourier transform," Optik 114,251-265 (2003). [CrossRef]
O. Matoba and B. Javidi, "Secure three-dimensional data transmission and display," Appl. Opt. 43,2285-2291 (2004). [CrossRef] [PubMed]
B. Javidi, ed., Optical and Digital Techniques for Information Security (Springer Verlag, New York, 2005). [CrossRef]
L. G. Neto, and Y. Sheng, "Optical implementation of image encryption using random phase encoding," Opt. Eng. 35,2459-2463 (1996). [CrossRef]
N. Towghi, B. Javidi, and Z. Luo, "Fully phase encrypted image processor," J. Opt. Soc. Am. A 16,1915-1927 (1999). [CrossRef]
O. Matoba and B. Javidi, "Encrypted optical storage with wavelength-key and random phase codes," Appl. Opt. 38,6785-6790 (1999). [CrossRef]
O. Matoba and B. Javidi, "Encrypted optical memory system using three-dimensional keys in the Fresnel domain," Opt. Lett. 24,762-764 (1999). [CrossRef]
E. Tajahuerce and B. Javidi, "Encrypting three-dimensional information with digital holography," Appl. Opt. 39,6595-6601 (2000). [CrossRef]
G. Unnikrishnan, J. Joseph, and K. Singh, "Optical encryption by double-random phase encoding in the fractional Fourier domain," Opt. Lett. 25, 887-889 (2000). [CrossRef]
G. Unnikrishnan and K. Singh, "Optical encryption using quadratic phase systems," Opt. Commun. 193,51-67 (2001). [CrossRef]
S. Liu, L. Yu, B. Zhu, "Optical image encryption by cascaded fractional Fourier transforms with random phase filtering, " Opt. Commun. 18757-63 (2001). [CrossRef]
J. Ohtsubo and A. Fujimoto, "Practical image encryption and decryption by phase-coding technique for optical security systems," Appl. Opt. 41,4848-4855 (2002). [CrossRef] [PubMed]
H. T. Chang, W. C. Lu, and C. L. Kuo, "Multiple-phase retrieval for optical security systems by use of randomphase encoding," Appl. Opt. 41,4825-4834 (2002). [CrossRef] [PubMed]
B. Zhu, H. Zhao, and S. Liu, "Image encryption based on pure intensity random coding and digital holography technique," Optik 114,95-99 (2003). [CrossRef]
G. Situ and J. Zhang, "Double random-phase encoding in the Fresnel domain," Opt. Lett. 29,1584-1586 (2004). [CrossRef] [PubMed]
X. Wang, D. Zhao, L. Chen, "Image encryption based on extended fractional Fourier transform and digital holography technique," Opt. Commun. 260, 449-453 (2006). [CrossRef]
H. Suzuki, M. Yamaguchi, M. Yachida, N. Ohyama, H. Tashima, and T. Obi, "Experimental evaluation of fingerprint verification system based on double random phase encoding," Opt. Express 14,1755-1766 (2006). [CrossRef] [PubMed]
A. Carnicer, M. Montes-Usategui, S. Arcos, and I. Juvells, "Vulnerability to chosen-cyphertext attacks of optical encryption schemes based on double random phase keys," Opt. Lett. 30,1644-1646 (2005). [CrossRef] [PubMed]
Y. Frauel, A. Castro, T. J. Naughton, and B. Javidi, "Security analysis of optical encryption," in Unmanned/Unattended Sensors and Sensor Networks II, E. M. Carapezza, ed., Proc. SPIE 5986, 25-34 (2005).
U. Gopinathan, D. S. Monaghan, T. J. Naughton, and J. T. Sheridan, "A known-plaintext heuristic attack on the Fourier plane encryption algorithm," Opt. Express 14,3181-3186 (2006). [CrossRef] [PubMed]
X. Peng, P. Zhang, H. Wei, and B. Yu, "Known-plaintext attack on optical encryption based on double random phase keys," Opt. Lett. 31,1044-1046 (2006). [CrossRef] [PubMed]
X. Peng, H. Wei, and P. Zhang, "Chosen-plaintext attack on lensless double-random phase encoding in the Fresnel domain," Opt. Lett. 31,3261-3263 (2006). [CrossRef] [PubMed]
H. Beker and F. Piper, Cipher systems (Van Nostrand, London, 1982).
S. R. Blackburn, S. Murphy, and K. G. Paterson, "Comments on ’Theory and applications of cellular automata in cryptography’," IEEE Trans. Comp. 46,637-638 (1997). [CrossRef]
W. H. Press, S. A. Teukolsky, W. T. Vetterling, and B. P. Flannery, Numerical recipes in C (Cambridge University Press, Cambridge, 1992), Chap. 2.

Cited By

Alert me when this paper is cited

OSA is able to provide readers links to articles that cite this paper by participating in CrossRef's Cited-By Linking service. CrossRef includes content from more than 3000 publishers and societies. In addition to listing OSA journal articles that cite this paper, citing articles from other participating publishers will also be listed.

Click here to see a list of articles that cite this paper