1. Introduction

Optical image encryption has received increasing interests in the last two decades. It has been demonstrated that images can be encoded in the phase [1–9], polarization [10–17], and even coherence or phase-space [18–20] of a light field. In particular, random-phase encoding proposed by Refregier and Javidi [1] in 1995 has received the most attentions. It has been implemented by using the vander Lugt correlator [1] and its generalizations [2,3], and the joint-transform correlator [4,5]. Random phase encoding has also been implemented by using phase retrieval [6–9]. However, owing to the linearity [21,22] and the phase encoding nature of the methodology [23], DRPE is vulnerable to various cryptanalysis attacks. In particular, it has been demonstrated that DRPE is vulnerable to known-plaintext attack [24], chosen-plaintext attack [25], chosen-cyphertext attack [21], and cyphertext-only attack [26–28]. The generalizations of DRPE to the fractional Fourier domain [29], the Fresnel domain [30], by using the JTC architecture [31], and phase retrieval [32] are also vulnerable to phase-retrieval-based cryptanalysis. It has also been shown that by adding certain amount of time-varying noise to the random phase mask, it is possible to enhance the security [33]. More recently, Hai et al. [34] have employed the novel deep learning for cryptanalysis of the DRPE.

In contrast to the prosperous advances in the cryptanalysis on random-phase encryption, rigorous cryptanalysis of optical encryption techniques that are not based on random-phase encoding have encountered difficulties. Indeed, rather than random-phase encoding, polarization encoding makes full use of the vector characteristics of the light wave, leading to the complexity in encoding and the enlargement of the key space. Historically, polarization encryption was first proposed by Nomura and Javidi [10] in 2000, implemented in a joint-transform correlator. Early methods used only one polarization mask to modulate the polarization state [10,11] or to implement the XOR operation [12,13]. A security-enhanced version with two random polarization masks, i.e., the double-random polarization encryption method (DRPolE) was later proposed by Matoba and Javidi [14]. In DRPolE, two random polarization masks are placed at the input plane and the Fourier plane, respectively, in a 4f system, to randomly modulate the polarization state of every pixel of the input plaintext. The random polarization mask can be implemented by using a electrically addressable spatial light modulator (SLM) [15], other than a mask. This provides a reconfigurable approach for multiple-image encryption using polarization multiplexing. Polarization encryption has also been generalized to operate in the Fresnel domain [16]. In 2010, Alfalou and Brosseau proposed a dual polarization encryption scheme of images based on the Stokes-Mueller formalism and claimed that it is robust against brute force attack [17]. In 2012, the same group demonstrated that this scheme is vulnerable to known-plaintext attack and chosen-plaintext attack using a heuristic approach [35].

In this paper, we propose a chosen-plaintext attack on the DRPolE system. We show that, when one can choose the polarization state and the value of each pixel of two plaintext images and the corresponding cyphertext images, it is possible to analytically calculate the random polarization keys at both the input plane and the Fourier plane. This leads to a serious security issue that should be addressed in the design of polarization encryption systems.

2. The double random polarization encryption system

First, let us first briefly review the basic principle of the DRPolE method [14]. Its optical apparatus is schematically shown in Fig. 1. For consistency, we follow [14] and use the language of Jones matrix to describe the encryption process. The real value of the pixel $(j, k)$ of an image to be encrypted is first represented by a polarization stage, which, in terms of Jones vector, is given by $\textbf {f}(j,\;k)=[f_x(j,\;k)\quad f_y(j,\;k)]^T$, where $T$ denotes the transpose. One can refer to [11] for detailed description of this process. The input polarization stage is encoded by a set of two random polarization masks, $\textbf {P}$, and $\textbf {Q}$, located at the input plane and the Fourier plane, respectively, in a 4f system, into a random polarization stage associated with the corresponding cyphertext image. Mathematically, the polarization state at the pixel $(j,\;k)$ of the cyphertext image then can be written as [14]

 

Fig. 1. Schematic setup of the double random polarization encryption system.

Download Full Size | PDF

For decryption, we use the inverse matrices $\textbf {P}^{-1}$ and $\textbf {Q}^{-1}$ of the encryption keys $\textbf {P}$ and $\textbf {Q}$, respectively. The decryption is the inverse of the encryption and is expressed as [14]

3. Chosen-plaintext attack analysis

The purpose the proposed chosen-plaintext attack (CPA) is to deduce the polarization state of $\textbf {Q}$, i.e., the values of $a$, and $b$ at each pixel $(m,\;l)$ where $m,\;l=0,\ldots ,N-1$, and that of $\textbf {P}$. As in all the cryptanalysis, we assume that an attacker has the knowledge about the encryption method, but not the two polarization keys [21–25,27–32,35]. The proposed CPA requires the use of two known plaintext images, the polarization states which are given by $\textbf {f}_{1}$ and $\textbf {f}_{2}$, and the corresponding encrypted polarization states, $\textbf {e}_{1}$ and $\textbf {e}_{2}$, respectively. Specifically, the proposed CPA assumes that the Jones vectors of the pixel $(j,\;k)$ of the two input planetext images are $\textbf {f}_{1}(j,\;k)=[1\quad 0]^T$, and $\textbf {f}_2(j,\;k)=[0\quad 1]^T$, for all $j,\;k=0,\ldots ,N-1$. Here we describe the algorithm in detail.

Step 1. Forward transform.

After being modulated by the random phase mask $\textbf {P}$ at the input plane, the polarization states of these two plaintext images become

It is clearly seen in Eq. (5) that the y-component of $\textbf {p}_{1}(j,\;k)$ is equal to the x-component of $\textbf {p}_{2}(j,\;k)$. We will see how this symmetry leads to the calculation of the keys. The Fourier transform of $\textbf {p}_1$ and $\textbf {p}_2$ yields

Since we are assumed to know the polarization states of the two corresponding cyphertext images, $\textbf {e}_{1}(j,\;k)$ and $\textbf {e}_{2}(j,\;k)$, we can calculate the Fourier transform of $\textbf {e}_{1}(j,\;k)$ and $\textbf {e}_{2}(j,\;k)$, resulting in the polarization states

Solving $\textbf {G}_{1}(l,\;m)=\textbf {G}_{1}'(l,\;m)$ and $\textbf {G}_{2}(l,\;m)=\textbf {G}_{2}'(l,\;m)$, we have

4. Simulation results

4.1 Results

We carried out numerical simulations to demonstrate the proposed CPA method. We arbitrarily take two typical types of images, a binary and a gray tone as shown in Figs. 2(a) and 2(b), as the plainetext to examine the algorithm. The size of both the images is $100\times 100$ pixels. We will see in Sec. 4.2 that the performance of the algorithm depends on the parity of the image size. These images were first represented as polarization states according to [11]. Then we can calculate the corresponding encrypted polarization states with the same set of polarization keys $\textbf {P}$ and $\textbf {Q}$ according to Eq. (1). The inner product of the two encrypted polarization states, respectively, and $[1\quad 0]^T$ produces the corresponding cyphertext images shown in Figs. 2(c) and 2(d).

 

Fig. 2. Simulation results for $N$ being even. (a) a binary plaintext image “USTS”, (b) its cyphertext, (c) the reconstructed plaintext image “USTS” with the proposed method, (d) a gray-tone plaintext image, (e) its cyphertext, and (f) the reconstructed plaintext image with the proposed method.

Download Full Size | PDF

As described in Sec. 3., the proposed CPA requires to use two plaintext images with the polarization states of $\textbf {f}_{1}(j,\;k)=[1\quad 0]^T$ and $\textbf {f}_{2}(j,\;k)=[0\quad 1]^T$, respectively, at each pixel $(j,\;k)$, where $j,\;k=0,\ldots ,N-1$, and the corresponding encrypted polarization states $\textbf {e}_1$ and $\textbf {e}_2$. One then can retrieve the keys $\textbf {P}$ and $\textbf {Q}$, and use them to decode the secret images from their cyphertext. The results are shown in Figs. 2(e) and 2(f). To evaluate the decoding performance, we calculate the correlation coefficient between the two original secret images and the two reconstructed ones, and the values are 0.9873 and 0.8286, respectively.

4.2 Error analysis

Although the two secret images have been retrieved successfully by using the proposed CPA, it is clearly seen from Figs. 2(e) and 2(f) that the values of many pixels are deviated from the original ones. Now we proceed to analyze the reason for this to happen.

Let us consider a general situation that the size of the images is $N\times N$ pixels. When $N$ is even, as in our simulation experiments shown in Fig. 2, we will show that there are errors at the pixels of $(0,0),(0,\frac {N}{2}),(\frac {N}{2},0),(\frac {N}{2},\frac {N}{2})$ in the Fourier plane. Let us first take the pixel of $\left (0,\frac {N}{2}\right )$ as an example to analyze this error. According to Eqs. (6) and (7), we have

Following the encryption process, we can obtain a set of linear equations similar to Eq. (12)

Following the same analysis, we find that the same situation occur at the pixels of $(0,0)$, $(\frac {N}{2},0)$, and $(\frac {N}{2},\frac {N}{2})$. As a result, one has error in the estimation of the key in the Fourier domain. And this error will subsequently affect the estimate of the polarization state of each pixel of the key $\textbf {P}$ in the input domain.

When $N$ is odd, the error in $\textbf {g}$ is only found at the pixel of $(0,0)$. The polarization states at this pixel can be described as

 

Fig. 3. Simulation results for $N$ being odd. (a) a binary plaintext image “USTS”, (b) its cyphertext, (c) the reconstructed plaintext image “USTS” with the proposed method, (d) a gray-tone plaintext image, (e) its cyphertext, and (f) the reconstructed plaintext image with the proposed method.

Download Full Size | PDF

5. Conclusion

In conclusion, we have developed a theoretical model and performed numerical simulations to demonstrate that the double random polarization encryption system is vulnerable to chosen-plaintext attack (CPA). The proposed CPA method assumes an attacker is free to choose the two special plaintext images, the corresponding polarization states are $\textbf {f}_1=[1\quad 0]^T$ and $\textbf {f}_2=[0\quad 1]^T$, respectively, and obtains the corresponding encrypted polarization states $\textbf {e}_1$ and $\textbf {e}_2$. Then the proposed CPA allows him/her to deduce the two random polarization keys $\textbf {P}$ and $\textbf {Q}$. The deduced keys then can be used to decrypt any other cyphertext that was encrypted by this same set of keys in the first place. We have also analyzed the noise performance of the proposed CPA method. Although the deduced keys are slightly deviated from their ground-truth values, the plaintext images reconstructed by them are highly recognizable, as the associated correlation coefficient can be as good as larger than $0.9$, as evidenced in our simulations.