Definition 2.1 A VCS, with n participants and pixel expansion m, is defined by two n ...... bi(2) be the vectors in the ith subset and define Bi as the 2 Ã 6 matrix with ...
OPTIMAL (2, n) VISUAL CRYPTOGRAPHIC SCHEMES
Mausumi Bose Applied Statistics Unit Indian Statistical Institute 203 B T Road Kolkata 700108, India
and
Rahul Mukerjee Indian Institute of Management Calcutta Joka, Diamond Harbour Road Kolkata 700104, India
Abstract: In (2, n) visual cryptographic schemes, a secret image(text or picture) is encrypted into n shares which are distributed among n participants. The image cannot be decoded from any single share but any two participants can together decode it visually, without using any complex decoding mechanism. In this paper, we introduce three meaningful optimality criteria for evaluating different schemes and show that some classes of combinatorial designs, such as BIB designs, PBIB designs and regular graph designs, can yield a large number of black and white (2, n) schemes that are optimal with respect to all these criteria. For a practically useful range of n, we also obtain optimal schemes with the smallest possible pixel expansion. Key words and phrases: pixel expansion, regular graph design, relative contrast, share.
1. Introduction In visual cryptography, a secret ‘image’, which may be in the form of a picture, printed or handwritten text, diagram etc., is encoded securely in such a way that the decoding may be done by the human visual system in a simple manner. In a (2, n) Visual Cryptographic Scheme (VCS), a page of the secret image is encrypted and n pages of cipher text are generated. Each cipher text is printed on a transparency sheet. The encoding is such that the image on each of these sheets is indistinguishable from random noise and hence the image cannot be recovered from a single sheet. However, if any two of these sheets are stacked, one on top of another, then the secret image is revealed and can be identified by the human eye. In practice, there are n persons or ‘participants’, each of whom is given one transparency sheet of cipher text or ‘share’. Thus, each holds a part of the secret image but cannot recover it on his own; any two participants can do so simply by stacking their sheets. Naor and Shamir(1994) introduced this interesting idea of VCS for black and white images. Such schemes are used by defense departments, financial establishments and various other organizations which handle sensitive material. The appeal of VCS is its simplicity in the sense that though it ensures complete secrecy, the final recovery can be done simply by the human eye without elaborate computations as required in traditional cryptographic schemes. For (2, n) black and white VCS, Blundo, Santis and Stinson(1999) obtained, among other things, elegant results relating to optimality in a certain sense. Adhikari and Bose(2004) and Bose and Kumar(2004) constructed (2, n) VCS using Latin squares and partially balanced incomplete block (PBIB) designs. Adhikari, Bose, Kumar and Roy(2005) extended the results of Bose and Kumar(2004). Significant contributions to this general area were also made by Koga and Yamamoto(1998), Droste(1999), Blundo, Santis and Naor(2001), Koga, Iwamoto and Yamamoto(2001), Ishihara and Koga(2002), and others. In this paper, we study schemes for black and white images and henceforth the term VCS denotes a (2, n) visual cryptographic scheme(or schemes) for such images. During encoding, each pixel of the original image is transformed or expanded into a number of subpixels in the encrypted image and the number of subpixels needed on each of the shares 1
to encode one pixel of the original image is called the ‘pixel expansion’ of the VCS. Again, the clarity with which the reconstructed image is visible is measured by the ‘relative contrast’ of the VCS. Clearly, a VCS with large relative contrast and small pixel expansion is preferred as that would give good clarity and require a small storage space for the shares. While Adhikari et al.(2005) gave VCS with higher values of relative contrasts and smaller pixel expansions than many others available in the literature, in general, it is not possible to optimize both these quantities simultaneously. In search for ‘best’ VCS, we, therefore, consider a scenario where the number of participants (n) and the allowable pixel expansion (m) are held fixed, and then optimize with respect to the relative contrasts. This approach makes practical sense since often n and m are specified by the user of the VCS from feasibility considerations. A principal new feature of the optimal VCS obtained here is that they can well be unbalanced, i.e., the relative contrasts therein can vary depending on which two participants are recovering the image. The resulting flexibility serves the following purposes: (i) entertaining smaller values of pixel expansion m while optimizing over relative contrasts (see e.g., Section 5); (ii) achieving improvement, in many situations, over every balanced VCS with regard to relative contrasts (see Example 2.1 and the discussion on Table 2). Given n and m, we first propose two criteria for comparing VCS on the basis of average relative contrast and minimum relative contrast. These take care of the average performance of the VCS and guard against the worst possible situation. Next, for VCS which are optimal with respect to both these criteria, we propose a third criterion which aims at minimizing the number of relative contrasts that equal the minimum. After presenting the preliminaries in the next section, we introduce the optimality criteria in Section 3 and obtain sufficient conditions for a VCS to be optimal with respect to one or more of these criteria. In Section 4, we construct VCS satisfying these optimality conditions and observe that combinatorial designs, such as balanced incomplete block (BIB) designs, PBIB designs and regular graph designs, play an important role in this context. Finally, in Section 5, we construct optimal VCS with the smallest possible m for 3 ≤ n ≤ 70.
2. Preliminaries Suppose the n participants/shares are labeled as 1, 2, . . . , n. Given a Boolean matrix A, let Ai denote the ith row of A and let Aij denote the Boolean ‘or’ of rows Ai and Aj . Also, let w(V ) be the number of 1’s in a Boolean vector V . We assume that the secret image consists of a collection of black and white pixels and represent a black and a white pixel by 1 and 0 respectively. Definition 2.1 A VCS, with n participants and pixel expansion m, is defined by two n × m Boolean basis matrices S 1 and S 0 , respectively for black and white pixels, such that (a) Si1 and Si0 are equal up to a column permutation, i.e., w(Si1 ) = w(Si0 ), 1 ≤ i ≤ n, 1 ) > w(S 0 ), 1 ≤ i < j ≤ n. (b) w(Sij ij It is not hard to see that the above definition is equivalent to that in Blundo et al.(1999). A VCS with basis matrices S 1 and S 0 is used to encrypt an image as follows. Let π be a random permutation of {1, . . . , m}. If a pixel in the secret image is black (white), then π is applied to the columns of S 1 (S 0 ) and row i of the permuted matrix forms the share for the ith participant. In this way, each pixel of the image is encrypted and distributed into n shares, each of which consists of m subpixels. Each share is thus a collection of black and white subpixels. The random permutation used in allocating a share to a participant together with condition (a) of Definition 2.1 guarantees that no single participant can recover the image. On the other
2
hand, for any i < j, if shares i and j are stacked together by aligning the subpixels and the combined share is obtained by taking the Boolean ‘or’ of these two shares, then condition (b) of Definition 2.1 guarantees that the grey level of a black pixel is darker than that of a white pixel and hence makes the recovered image discernible. For any i < j, the quantity 1 0 ξij = m−1 {w(Sij ) − w(Sij )},
(2.1)
which is positive in view of (b), is called the relative contrast for the recovery of image by participants i and j. We call a VCS balanced if the ξij (1 ≤ i < j ≤ n) are all equal; otherwise, it is called unbalanced. We refer to Blundo et al.(1999) and Adhikari et al.(2005) for more details on basis matrices and distribution of shares. Example 2.1 Let n = m = 5. By (2.1), the VCS with basis matrices S = 1
0 1 0 0 1
1 0 1 0 0
0 1 0 1 0
0 0 1 0 1
1 0 0 1 0
S =
,
0
1 1 1 1 1
1 1 1 1 1
0 0 0 0 0
0 0 0 0 0
0 0 0 0 0
(2.2)
has 2 1 ξ12 = ξ23 = ξ34 = ξ45 = ξ15 = , ξ13 = ξ24 = ξ35 = ξ14 = ξ25 = , 5 5 and hence is unbalanced. For n = m = 5, it follows from Theorem 3.1(b) below that min ξij ≤ 51 , so that by (2.1), any balanced VCS must have ξij = 15 for each i < j. Thus 1≤i
