# Keyspace in Encryption using Chaotic Maps

I wish to encrypt an image using Logistic map. A Logistic map can be specified with the Equation:

$$x_{n+1} = r\,x_n (1-x_n).$$

Now, according to the Kerckhoff principle, the entire system's security is dependent on the key. Perfect chaos can be achieved with a fixed control parameter ($$r$$) and initial condition ($$x_0$$). How can the authors identify the initial conditions ($$x_0$$) and control parameter($$r$$) as the secret key? The parameters must be accessible to the public in order to generate "perfect chaotic values", which will be used to encrypt the image. However, if the parameter and the initial condition are known, any attacker can reproduce the "perfect chaotic values." Can anyone throw some light in this concept? What am I missing?

I wish to encrypt an image using Logistic map.

There is nothing special about image encryption. In the digital world, image is data (typically, compressed using jpeg or the like) like any other. Thus the rest of this answer is about using the logistic map for cryptography.

According to the Kerckhoff principle, the entire system's security is dependent on the key.

In modern terms, Kerckhoffs's (second) principle states that the key is the only element in a cryptosystem which secrecy must be insured in order to achieve security of the cryptosystem. In the context: achieve secrecy of the image; and perhaps integrity, if we want authenticated encryption, as we should.

How can the authors identify the initial conditions ($$x_0$$) and control parameter($$r$$) as the secret key?

Without a link to the article, we can only guess. But at least that's feasible, essentially with some ad-hoc scaling. For example, if we have a 128-bit key $$k$$ assimilated to an integer in $$[0,2^{128})$$, then define (publicly) $$x_0=(k+2^{127})/2^{129}$$ and $$r=4-(k+2^{127})/2^{135}$$, such that $$x_0\in[1/4,3/4)$$ and $$r\in(3.9882,3.9961)$$. Under the (nearly true) hypothesis that in the stated range of $$r$$ the logistic map is always chaotic, then $$b_i\gets\lfloor x_{i+32}\,2^{48}\rfloor\bmod2$$ for $$i\in\mathbb N$$ mathematically defines a PRNG, and that theoretically can be used to encrypt a (single) image by merely XORing the data representing the image with the bitstream, with some plausible level of security.

Problem is, computing the first $$n$$ bits $$b_i$$ requires precision increasing linearly with $$n$$, making things slow, and computing exactly untenable beyond some kilobytes. Many parodies of scientific articles on the use of the logistic map for cryptography pull this under the rug, typically just approximating $$x_i$$ using some (often unstated) floating-point approximation (sometime IEEE-754 double precision, which in our setup is insufficient to reliably compute even $$b_0$$). The approximation made changes not only the result, but the security properties. In particular, proofs of chaotic behavior are invalidated; it's much harder to prove that it's unlikely that the generator becomes stuck in a relatively short loop (and with IEEE-754 than might well happen in practice); and ad-hoc attacks are to fear. If we compute $$x$$ exactly to say 256-bit, perhaps we get something secure. But I would not bet the house on that: the only sure thing is poor speed when implemented in software, compared to a modern ARX cipher like chacha.

Bottom line: the logistic map is not a useful construct for practical cryptography. No wonder there's essentially no article about it in peer-reviewed IACR publications (the one exception I know is this publication at Eurocrypt 1991, broken in time for the conference).

Update:

$$x_0$$ and $$\mu$$ are used as keys for the logistic maps. They have used 64-bit double precision number. The range of $$\mu$$ is mentioned be $$0.43 \times 10^{15}$$. From where this number came?

Quoting the article

The computational precision of 64-bit double-precision number is about $$10^{15}$$. Therefore, the $$K_p$$ parameters and $$x_0$$ can be any value among $$10^{15}$$ numbers. $$\mu$$ can have any number from $$0.43\times10^{15}$$ values.

I think the $$0.43$$ is the width of the range of $$\mu$$ stated in section 3.1.2:

The system is chaotic for $$\mu\in[3.57,4]$$

As of $$10^{15}$$, my guess is the authors used the power of ten below $$2^{52}$$, where $$52$$ is the number of bits in the mantissa in an IEEE-754 64-bit floating point number†. This errs comfortably on the safe side, and happens to more than compensate the error made by simply multiplying $$0.43$$ and $$10^{15}$$, ignoring that for a value $$\mu\in[3.57,4)$$, the two high-order bits of the mantissa always are set. There are actually about $$2^{52}\times0.43/(4-2)\approx0.968\times10^{15}$$ distinct IEEE-754 64-bit float in $$[3.57,4)$$.

Why are they not restricting the space for the initial value?

In the standard logistic map $$x_{n+1} = r\,x_n (1-x_n)$$, for at least most $$r$$ in range $$[3.57,4)$$ and $$x_0\in(0,1]$$, the behavior is chaotic (that is, a small change in $$x_0$$ amplifies as we iterate). My restriction of $$x_0$$ to $$[1/4,3/4)$$ is chiefly to avoid $$x_0=0$$ and $$x_0=1$$, which get stuck to $$0$$. I can't tell for the 2D hyper-chaotic system used in the article. At least, using two variables vastly increases the state space, which is dangerously small with a single IEEE-754 64-bit float.

† which I linked to before the article was stated, because it's so typical of work using the logistic map for encryption. This one is representative of a sub-genre of the cryptographic literature: encryption specialized to digital image for no discernible reason, with visual illustrations as security argument (often complemented by some statistical indicator). There's no sufficiently precise description to exactly replicate the system, which is a strong guarantee that it won't be attacked. Many similar articles are cited, and the article itself gets highly cited, which seems to be part of the game played.

• Thanks for clearing things out. As much as I can understand chaos is present in a certain range of r and $x_0$. So, we make this range public, and the initial condition and the control parameter are selected randomly from this publicly-known range. I was trying to figure out the keyspace presented in this paper. Dec 14, 2022 at 5:45
• $x_0$ and $\mu$ are used as keys for the logistic maps. They have used 64-bit double precision number. The range of $\mu$ is mentioned be $0.43 \times 10^{15}$. I was not able to figure this out. (Section 5.1.1). From where this number came? Why are they not restricting the space for the initial value? Dec 14, 2022 at 5:50
• I just wish to know how keyspace for Logistic map is computed ---- $0.43 \times 10^{15} \times 10^{15}$. The $\mu$ is between (3.57,4) this gives idea about 0.43. How the rest of the figures derived? Dec 14, 2022 at 9:27
• @nivedita: you'll have to do with the explanation in version 10 of the answer, which will become clear after you understand how floating point numbers work. If you use them for cryptography (contrary to established practice and common wisdom), at least you have to study their inner format. The "keyspace of the logistic map" can't be defined rigorously without adding a ton of details about the definition of the cryptosystem considered, that most article (including the one you read) pull under the rug.
– fgrieu
Dec 14, 2022 at 9:40

ow can the authors identify the initial conditions ($$x_0$$) and control parameter($$r$$) as the secret key? The parameters must be accessible to the public in order to generate "perfect chaotic values", which will be used to encrypt the image.

The 'logistic map' is a symmetric key cryptosystem (or rather, part of one; somehow we use the generated $$x_i$$ values to encrypt - that would need to be specified, however that detail is not important to your question).

As a symmetric key cryptosystem, there are two standard ways of handling the key:

• As a secret key system; that is, the encryptor picks secure $$x_0, r$$ values and gives them to the decryptor (which may be the encryptor at a later point in time), in addition to using those values to encrypt the image. It is assumed that the legitimate decryptor (and no one else) gets these values (and it's not the cryptosystems business how this is done)

• As a part of a public key system; that is, the encryptor picks secure $$x_0, r$$ values, and encrypts them with the decryptor's public key (in addition to using those values to encrypt the image); the encryptor then publishes both the encrypted image and the encrypted keys. The decryptor (because he has the corresponding private key) and decrypt the keys, and then use those keys to decrypt the image.

On a side note, this 'logistic map' is not likely to result in a secure cryptosystem (for one thing, adjacent $$x_i$$ values are correlated); feel free to play around with it, however I personally wouldn't use it for anything that actually needs to be secure.