Ciphertext-Only Attack on an Image Homomorphic
Encryption Scheme with Small Ciphertext Expansion
Yunyu Li, Jiantao Zhou, and Yuanman Li
Faculty of Science and Technology, University of Macau
{mb35468, jtzhou, mb25510} @umac.mo
ABSTRACT
The paper “An Efficient Image Homomorphic Encryption
Scheme with Small Ciphertext Expansion” (In Proc. ACM
MM’13, pp.803-812) presented a novel image homomorphic
encryption approach achieving significant reduction of the
ciphertext expansion. In the current work, we study the se-
curity of this cryptosystem under a ciphertext-only attack
(COA). We show that our proposed COA is effective in gen-
erating a sketch of great fidelity of the original image. Ex-
perimental results are provided to verify the validity of the
proposed attack strategy.
Categories and Subject Descriptors
H.4 [Information Systems Applications]: Information
Systems Applications- Miscellaneous; K.6.5 [Computing
Milieux]: Metrics—Management of Computing and Infor-
mation Systems–Security and Protection
Keywords
Image homomorphic encryption, ciphertext expansion, ciphertext-
only attack
1. INTRODUCTION
Signal processing over encrypted domain (SPED) has been
receiving increasing attention in recent years, primarily driven
by the various privacy-preserving applications and the wide
adoption of cloud computing platforms [7, 2, 8]. Among
the encryption solutions enabling SPED, homomorphic en-
cryption is arguably the most popular one, as it provides a
generic framework of performing basic algebraic operations
over the encrypted domain [11, 10, 5, 6]. The existing ho-
momorphic cryptosystems can be roughly classified into two
categories: partially homomorphic schemes [5, 10] and fully
homomorphic ones [6]. The partially homomorphic schemes
support encrypted domain operations that correspond to the
addition or multiplication in the plaintext domain, while the
latter type allows both the addition and multiplication.
Permission to make digital or hard copies of all or part of this work for personal or
classroom use is granted without fee provided that copies are not made or distributed
for profit or commercial advantage and that copies bear this notice and the full cita-
tion on the first page. Copyrights for components of this work owned by others than
ACM must be honored. Abstracting with credit is permitted. To copy otherwise, or re-
publish, to post on servers or to redistribute to lists, requires prior specific permission
and/or a fee. Request permissions from Permissions@acm.org.
MM’15, October 26–30, 2015, Brisbane, Australia.
c
2015 ACM. ISBN 978-1-4503-3459-4/15/10 ...$15.00.
DOI: http://dx.doi.org/10.1145/2733373.2806406.
However, one of the major obstacles that precludes the
widespread adoption of homomorphic encryption in practice
is the huge expansion of the ciphertext. For instance, when
the Paillier cryptosystem, with modulus being 1024 bits, is
used to encrypt 8-bit image, the resulting encrypted file is
256 times larger than the original image [10]. For fully ho-
momorphic cryptosystem, the ciphertext expansion is even
much more prohibitive[6]. To deal with the ciphertext ex-
pansion problem, Trobcoso-Pastoriza proposed a packing
scheme, in which several messages are packed as a word and
encrypted together [12]. This scheme was later extended
in [4] with generalized packing basis. However, such pack-
ing makes it impossible to process each message differently,
and causes many operations, e.g., encrypted-domain DFT
[3] and DWT [13], infeasible without interactive protocol.
Recently, Zheng and Huang suggested a very promising ap-
proach for reducing the ciphertext expansion by indexing a
sequence of ciphertexts produced by the scaled-down his-
togram of the image [14]. It was claimed that significant
reduction of the ciphertext expansion can be achieved, while
not affecting the security of the image encryption system.
In this work, we evaluate the security of the image homo-
morphic encryption scheme in [14] under a ciphertext-only
attack (COA). We design a state set in which each element
represents an encrypted (quantized) pixel, and model the
image local smoothness property through a state transition
matrix describing the correlation between different states.
The statistical analysis of this transition matrix allows us to
determine, with high accuracy, which locations share simi-
lar (even identical) pixel values, and which ones more likely
lie in the edge regions. We also design a pixel value as-
signment strategy to further preserve image local smooth-
ness and enlarge the image contrast, enabling us to obtain a
sketch version of the original image of high quality. Experi-
mental results are provided to verify the effectiveness of our
proposed COA strategy.
The rest of this paper is organized as follows. Section 2
gives a concise introduction of the image homomorphic en-
cryption scheme [14]. In Section 3, we present our proposed
COA strategy. Experimental results are given in Section 4
to demonstrate the effectiveness of our method. We finally
conclude in Section 5.
2. IMAGE HOMOMORPHIC ENCRYPTION
SCHEME PROPOSED IN [14]
The idea of this image homomorphic encryption scheme
is to first generate a pixel sequence S = (S
0
, S
1
, · · · , S
K−1
)
where K is smaller than the number of pixels in the input