RG-Based (k, n)-Threshold Visual Cryptography with Abilities of OR and XOR Decryption ^†

Abstract

A (k, n) visual cryptography (VCS) is used to build a system for secret sharing. The system divides a secret image (S) into n shares and recovers S by stacking shares bigger than or equal to k, while shares below k provide no information about S. The fundamental idea of VCS is that, rather than relying on mathematical or cryptographic skills, human vision can be used to decrypt the secret image. Typically, a Boolean OR operation can be used to indicate the stacking action in a VCS. The reconstructed secret image gradually darkens as more shares are stacked. However, this intractable issue can be overcome by designing an XOR-based VCS that uses the Boolean XOR operator rather than the OR operation. This indicates that by using the XOR-based VCS, higher image quality can be attained. Because the XOR operation requires the use of additional equipment, scholars consider that when no equipment is available, the traditional OR operation can still be used to reveal the secret images. That is, the secret image can be decrypted without a computing device by stacking enough shares, and if a lightweight computing device is available, a better-quality image can be produced via an XOR operation. In 2015, an RG-based (k, n) VCS to restore the secret image by using an OR or XOR operation was proposed. In this study, we improve the scheme and design a new (k, n) VCS, called (k, n) 2D_VCS to encrypt a secret image into n shares. The secret image can be recovered when k or more shares are gathered and stacked (OR operation) together or when an XOR procedure is utilized. Both the theoretical proof and experimental results show that the quality of the restored image obtained by our method is better than that of the previous methods.

1. Introduction

The Visual Cryptography Scheme (VCS) was suggested in 1995 for distributing secrets [1]. A binary secret image can be recovered by encrypting it into n random images (shares) and then stacking those n shares. They also developed a threshold k-out-of-n VCS method, (k, n)-threshold VCS. Encrypting a secret image in binary into n shares and then stacking any k or more than k shares (k ≤ n) can reconstruct the secret image. Fewer than k shares cannot provide any clues about the binary secret image.

Visual secret sharing (VSS) by random grids (RG) was introduced by Kafri and Keren in 1987 [2]. It eliminates the secret pixel expansion issue, and this approach does not demand codebook designs, which is the disadvantage of Naor and Shamir’s scheme [1]. Random grids mean that we obtain every pixel by randomly selecting between 1 (opaque or black) and 0 (transparent or white). In 2009, Shyu gave a scheme of (n, n) RG-based VCS [3]. Chen and Tsao constructed a (k, n) RG-based VCS [4]. Then, Guo, Liu, and Wu improved Chen and Tsao’s scheme in 2013 [5]. The stacking operation in a VCS is denoted by a Boolean OR operation. However, the more shares of stacking, the darker the reconstructed image. An XOR-based VCS can solve this problem, as a better recovered image quality can be obtained when using an XOR operation instead of an OR operation. A new idea was suggested in Ref. [6]. In their method, OR or XOR is optionally used to restore the secret image when restoring the binary secret image. As a result, the secret image can be restored when computing resources are limited by stacking k or more shares (using an OR operation). When computing resources are available, a secret image of higher quality can be obtained (using an XOR operation). We improved their scheme by designing a new (k, n) VCS that can also extract binary secret images by OR or XOR operations and achieved a better quality of restored images than their scheme.

This paper is structured as follows. The related work is presented in the next section, the suggested scheme, (k, n) 2D_VCS is presented in Section 3, and an analysis of the (k, n) 2D_VCS is shown in Section 4. Section 5 and Section 6 show the experimental results and conclusion, respectively.

2. Related Work

2.1. (2, 2) RG-Based VCS

In 1987, Kafri and Keren firstly proposed (2, 2) RG-based VCS [2], Algorithm 1, to encrypt a binary image S, and their algorithm output two shares B₁ and B₂, which looked like random grids. After superimposing them, the secret image S was reconstructed by using the Human Visual System (HVS) without specific computational and cryptographic knowledge.

Algorithm 1 KK [2]
Input:	Secret binary image S.
Output:	Two shares B1, B2.
Step 1.	Generate the first share B1 randomly selecting 0 or 1 for each pixel of B1.
Step 2.	Based on the pixels S[i, j] of S and the pixel B1[i, j] of B1, the pixel value B2[i, j] of share B2 is calculated by B2[i, j] = $\left\{\begin{array}{c}{B}_1\left[i,j\right],\hspace{1em}ifS\left[i,j\right]=0\\ \overline{B_1\left[i,j\right]},\hspace{1em}ifS\left[i,j\right]=1\end{array}\right.$.

2.2. (k, n) RG-Based VCS

As mentioned above, a scheme of (k, n) RG-based VCS, Algorithm 2, was proposed in 2011 [4]. For comparison with the proposed scheme, we rewrite their algorithm as follows. Note that it is essentially the same as their original algorithm.

Algorithm 2 CT [4]
Input:	A secret binary image S.
Output:	n shares (B1, B2, …, Bn).
Step 1.	For each position [i, j], repeat Steps 2–4:
Step 2.	Randomly select from {0, 1} to generate n random pixels b1, b2, …, bn.
Step 3.	If S[i, j] ≠ b1 ⊕ b2 ⊕ … ⊕ bk$,\mathrm{then}{b}_k=\overline{b_k}$.
Step 4.	Rearrange the above n bits b1, b2, …, bn into B1[i, j], B2[i, j], …, Bn[i, j] randomly.
Step 5.	Output (B1, B2, …, Bn).

3. Proposed Scheme

A new (k, n) RG-based VCS used with two decryption methods (OR and XOR) for binary images is presented, called (k, n) 2D_VCS. Algorithm 2 only considers the case of stacking k shares and does not consider the case of stacking more than k shares. Furthermore, additional consideration is required to fully restore the original secret image when collecting all the shares. Therefore, we add two steps, resulting in the following algorithm.

Algorithm 3 differs only in Steps 4 and 5 from Algorithm 2. These two steps lead to important consequences. Step 4 of Algorithm 3 makes the reconstructed image clearer when staking t (k < t ≤ n) shares. Step 5 of Algorithm 3 makes it possible to fully recover the secret image after collecting all n shares. Since we do not change the first k shares constructed by Algorithm 2, when Algorithm 3 stacks k shares, the quality of the reconstructed image is similar to that by Algorithm 2. When stacking t shares, the probability of recovering the secret image is 1/C(n, t) (n – k + 1), which makes the proposed scheme more clearly recover the secret using the XOR operator for tacking k < t < n shares. Therefore, compared to earlier studies, the method has a higher quality of the recovered image and improved ability to recover the secret image with both XOR and OR operations. Figure 1 depicts the suggested scheme’s schematic.

Algorithm 3 (k, n) 2D_VCS.
Input:	An $M\times N$ secret binary image S.
Output:	n shares (B1, B2, …, Bn).
Step 1.	For each position [i, j], repeat Steps 2–6.
Step 2.	Randomly select from {0, 1} to generate n random pixels b1, b2, …, bn.
Step 3.	If S[i, j] ≠ b1 ⊕ b2 ⊕ … ⊕ bk$,\mathrm{then}{b}_k=\overline{b_k}$.
Step 4.	Select a number t randomly from {k + 1, k + 2, …, n}. If S[i, j] ≠ b1 ⊕ b2 ⊕ … ⊕ bt$,\mathrm{then}{b}_t=\overline{b_t}$.
Step 5.	If S[i, j] ≠ b1 ⊕ b2 ⊕ … ⊕ bn$,\mathrm{then}{b}_n=\overline{b_n}$.
Step 6.	Randomly rearrange these n bits b1, b2, …, bn into B1[i, j], B2[i, j], …, Bn[i, j].
Step 7.	Output (B1, B2, …, Bn)

Therefore, we can directly stack enough shares (≥k) to recover the binary secret image via HVS. Computers enable us to obtain more accurate secret images. However, when less than k shares are acquired, any clue about the binary secret image cannot be found.

4. Analysis

The proposed scheme’s security is theoretically shown, and its performance is evaluated in terms of the visual aspect. First, we review useful tools and analyze the proposed scheme with these tools. We refer to definitions from previous works.

Definition 1.

(Average light transmission [3]). The probability that a given pixel, x, in the binary image X is transparent. Let Prob (x = 0) denote the light transmission of pixel x, which is shown by the symbol l[x]. The average light transmission of image X, with the size M × N, is expressed as

$$LX\hspace{1em}\frac{1}{M\times N}{\sum }_{i=1}^M{\sum }_{j=1}^{N}l\left[X\right[i,j\left]\right]$$

(1)

So, l[x] = 0 for an opaque pixel x, l[x] = 1 for a transparent pixel x. Also, we say L[B] = 1/2 for a random grid B normally.

Definition 2.

(Contrast [3]) The visual quality will determine how effectively the reconstructed image is recognized by human eyes. Contrast $\alpha$ is expressed as

$$\alpha =\frac{L\left[B\right[S\left(0\right)\left]\right]-L\left[B\right[S\left(1\right)\left]\right]}{1+L\left[B\right[S\left(1\right)\left]\right]}$$

(2)

where S(0) (S(1), respectively) stands for all of S’s transparent (opaque, respectively) pixels, and B[S(0)] (B[S(1)], respectively) for all of the encrypted pixels from S(0) (S(1), respectively).

Definition 3. 

(Visually recognizable) When L[B[S(1)]] < L[B[S(0)]], the contrast of the restored image α > 0, and the binary secret image S is recognized. Moreover, if α = 1, the recovered image B is the same as the original image S.

Definition 4. 

(Security).When L[B[S(0)]] = L[B[S(1)]], the light transmission of the transparent part of the original image is the same as that of the opaque part of the original image. That means no clue about the original secret image S can be recognized from the reconstructed image B. Therefore, if α = 0 when less than k shares are collected, the approach is secured since no information of S is retrieved.

Table 1. All possibilities b₁, b₂, b₃, b₄ for the proposed (3, 4) RG-based VCS.

S[i, j]	b1	b2	b3	b4
0	0	0	0	0
	0	1	1	0
	1	0	1	0
	1	1	0	0
1	0	0	1	0
	0	1	0	0
	1	0	0	0
	1	1	1	0

lists all possibilities for sharing pixels when k = 3 and n = 4 of the (k, n) 2D_VCS, which is used to show this scheme is secured and visually recognizable.

Lemma 1.

Algorithm 3 (k, n) 2D_VCS gives a (k, n) RG-based VCS with two decryption methods (OR and XOR) when k = 3 and n = 4. That is, Algorithm 3 satisfies the (1) security and (2) visually recognizable conditions.

Proof. 

The following is divided into two parts to prove: (1) We must prove that stacking less than k = 3 shares (including one share) fails to yield any information regarding the binary secret image. From Table 1,

Table 2. Contrast of each bit for Table 1.

S[i, j]	b1	b2	b3	b4
0	0	0	0	0
	0	1	1	0
	1	0	1	0
	1	1	0	0
1	0	0	1	0
	0	1	0	0
	1	0	0	0
	1	1	1	0
L[B[S(0)]]	0.5	0.5	0.5	1
L[B[S(1)]]	0.5	0.5	0.5	1
α	0	0	0	0

,

Table 3. Contrast of stacking any two bits using XOR operator for Table 1.

S	b1⊕2	b1⊕3	b1⊕4	b2⊕3	b2⊕4	b3⊕4
0	0	0	0	0	0	0
	1	1	0	0	1	1
	1	0	1	1	0	1
	0	1	1	1	1	0
1	0	1	0	1	0	1
	1	0	0	1	1	0
	1	1	1	0	0	0
	0	0	1	0	1	1
L[B[S(0)]]	0.5	0.5	0.5	0.5	0.5	0.5
L[B[S(1)]]	0.5	0.5	0.5	0.5	0.5	0.5
α	0	0	0	0	0	0

and

Table 4. Contrast of stacking any two bits using OR operator for Table 1.

S	B1⊗2	B1⊗3	B1⊗4	B2⊗3	B2⊗4	B3⊗4
0	0	0	0	0	0	0
	1	1	0	1	1	1
	1	1	1	1	0	1
	1	1	1	1	1	0
1	0	1	0	1	0	1
	1	0	0	1	1	0
	1	1	1	0	0	0
	1	1	1	1	1	1
L[B[S(0)]]	0.25	0.25	0.5	0.25	0.5	0.5
L[B[S(1)]]	0.25	0.25	0.5	0.25	0.5	0.5
α	0	0	0	0	0	0

are induced, where b_x⊕y means b_x ⊕ b_y, and b_x⊗y means b_x ⊗ b_y for any integers 1 ≤ x < y ≤ 4. Similar notations are used later for stacking more than two shares.

Table 2, Table 3 and Table 4 show that α is 0 for any possible case; therefore, the proposed (k, n) 2D_VCS is safe when (k, n) = (3, 4). For proving Equation (2), we need to show that stacking k = 3 or 4 shares recovers the binary secret image S.

Table 5. Contrast of stacking any three or four bits using XOR operator for Table 1.

S	b1⊕2⊕3	b1⊕2⊕4	b1⊕3⊕4	b2⊕3⊕4	b1⊕2⊕3⊕4
0	0	0	0	0	0
	0	1	1	0	0
	0	1	0	1	0
	0	0	1	1	0
1	1	0	1	1	1
	1	1	0	1	1
	1	1	1	0	1
	1	0	0	0	1
L[B[S(0)]]	1	0.5	0.5	0.5	1
L[B[S(1)]]	0	0.5	0.5	0.5	0
Average α	0.1818				1

and

Table 6. Contrast of stacking any three or four bits using OR operator for Table 1.

S	b1⊗2⊗3	b1⊗2⊗4	b1⊗3⊗4	b2⊗3⊗4	b1⊗2⊗3⊗4
0	0	0	0	0	0
	1	1	1	1	1
	1	1	1	1	1
	1	1	1	1	1
1	1	0	1	1	1
	1	1	0	1	1
	1	1	1	0	1
	1	1	1	1	1
L[B[S(0)]]	0.25	0.25	0.25	0.25	0.25
L[B[S(1)]]	0	0.25	0.25	0.25	0
Average α	0.0526				0.25

show the correctness.

According to Table 5 and Table 6, the average α all > 0, which means that the proposed (3, 4) RG-based VCS is visually recognizable. Hence, the proof is complete.□

Then, the following theorem can be obtained. Due to the page limit, we skip the proof.

Theorem 1.

Algorithm 3 (k, n) 2D_VCS is a (k, n) RG-based VCS of two decryption methods (OR and XOR).

Table 7. Contrast of the proposed (k, n) RG-based VCS using OR operator.

(k, n)	p = 2	p = 3	p = 4	p = 5	p = 6
(2, 4)	0.0606	0.1579	0.375	-	-
(3, 4)	0	0.0526	0.25	-	-
(4, 4)	0	0	0.125	-	-
(2, 5)	0.0382	0.0786	0.1154	0.2083	-
(3, 5)	0	0.0204	0.0674	0.1875	-
(4, 5)	0	0	0.0227	0.125	-
(5, 5)	0	0	0	0.0625	-
(2, 6)	0.0260	0.0492	0.0621	0.0704	0.1094
(3, 6)	0	0.0106	0.0277	0.0495	0.1042
(4, 6)	0	0	0.0074	0.0294	0.0938
(5, 6)	0	0	0	0.0099	0.0625
(6, 6)	0	0	0	0	0.0313

and

Table 8. Contrast of the proposed (k, n) RG-based VCS using XOR operator.

(k, n)	p = 2	p = 3	p = 4	p = 5	p = 6
(2, 4)	0.1111	0.1818	1	-	-
(3, 4)	0	0.1818	1	-	-
(4, 4)	0	0	1	-	-
(2, 5)	0.0674	0.0440	0.0930	1	-
(3, 5)	0	0.0690	0.1429	1	-
(4, 5)	0	0	0.1429	1	-
(5, 5)	0	0	0	1	-
(2, 6)	0.0449	0.0167	0.0220	0.0571	1
(3, 6)	0	0.0333	0.0301	0.0769	1
(4, 6)	0	0	0.0455	0.1176	1
(5, 6)	0	0	0	0.1176	1
(6, 6)	0	0	0	0	1

show the theoretical contrast of the (k, n) 2D_VCS for stacking 2 ≤ p ≤ n shares for any 2 ≤ k ≤ n ≤ 6. We obtain these two tables by analyzing each case using a method similar to that in Lemma 1, which shows nothing is found when staking less than k shares, and the secret image S is revealed when staking more than or equal to k shares.

5. Experimental Results

The results of the (k, n) 2D_VCS when (k, n) = (2, 4), (3, 4), and (3, 5) are obtained in this section. The 300 $\times$ 300 pixels images in those experiments are utilized for original secret images and shares. Figure 2 shows the result for the proposed (2, 4) 2D_VCS. Figure 2a shows the secret image S, and Figure 2b–e show the four random-noise-like shares B₁, B₂, B_3, and B₄. The recovered binary images based on the OR operator are shown in Figure 2f–h. The recovered binary images based on the XOR operator are shown in Figure 2i–k.

Similarly, the experimental findings for the suggested (3, 4) and (3, 5) 2D_VCS are shown in Figure 3 and Figure 4. Both (a) are the original binary secret images. Figure 3b–e and Figure 4b–f are random shares. Figure 3f–h and Figure 4g–j show the recovered binary images based on the OR operator. Then, Figure 3i–k and Figure 4k–n are the recovered binary images based on the XOR operator.

We present more results in

Table 9. Average contrast for five experiments of the proposed method using OR operator.

(k, n)	p = 2	p = 3	p = 4	p = 5	p = 6
(2, 4)	0.05976	0.15859	0.37504	-	-
(3, 4)	0	0.05356	0.25135	-	-
(4, 4)	0	0	0.12456	-	-
(2, 5)	0.03624	0.07584	0.11362	0.20624	-
(3, 5)	0	0.02107	0.06915	0.18865	-
(4, 5)	0	0	0.02155	0.12336	-
(5, 5)	0	0	0	0.06257	-
(2, 6)	0.02564	0.05044	0.06234	0.07023	0.1086
(3, 6)	0	0.01071	0.02679	0.04997	0.10429
(4, 6)	0	0	0.00747	0.02963	0.09385
(5, 6)	0	0	0	0.009	0.06202
(6, 6)	0	0	0	0	0.03117

and

Table 10. Average contrast for five experiments of the proposed method using XOR operator.

(k, n)	p = 2	p = 3	p = 4	p = 5	p = 6
(2, 4)	0.10901	0.18131	1	-	-
(3, 4)	0	0.18211	1	-	-
(4, 4)	0	0	1	-	-
(2, 5)	0.06857	0.04455	0.09344	1	-
(3, 5)	0	0.06945	0.14342	1	-
(4, 5)	0	0	0.14142	1	-
(5, 5)	0	0	0	1	-
(2, 6)	0.04424	0.0168	0.02187	0.05863	1
(3, 6)	0	0.03139	0.0289	0.07784	1
(4, 6)	0	0	0.04554	0.11652	1
(5, 6)	0	0	0	0.12059	1
(6, 6)	0	0	0	0	1

. Compared to Table 7 and Table 8, the theoretical analysis with the proposed method is more accurate.

6. Comparison and Conclusions

An RG-based (k, n) VCS restoring the secret image using OR or XOR operation was presented by Yan et al. [6]. We compared their scheme with the (k, n) 2D_VCS. The experimental outcome of Yan et al.’s scheme for the (k, n) = (2, 4) is shown in Figure 5. The results in Figure 2 and Figure 5 show the better visual quality of the proposed scheme, especially when staking three shares and using the XOR operator on them ((j) in both figures). Thus, an RG-based (k, n)-threshold visual cryptography with XOR and OR decryption capabilities, called (k, n) 2D_VCS, is proposed to restore the secret image in a human visual system (OR) and computer visual system (XOR). The results are better than all previous studies. Future work will be carried out to design other RG-based (k, n) threshold VCSs with better contrast of the restored image and demonstrate that the scheme is theoretically safe and correct.