CoChat
Sign Up
PreprintCited by 0Chaos-based Image/Signal EncryptionCryptographic Implementations and SecurityCoding theory and cryptography

Cryptanalysis and design for a family of plaintext-non-delayed chaotic ciphers

Open access
Wang, Qianxue, Yu, Simin·2025·arXiv
DOI 10.48550/arxiv.2509.11158arXiv 2509.11158
Open this paper in CoChat — free accountOpen PDF

Abstract

Plaintext non-delayed chaotic cipher (PNDCC) means that in the diffusion equation, plaintext has no delay terms while ciphertext has a feedback term. In existing literature, chaotic cipher diffusions invariably take this form. Since its introduction, PNDCC has attracted attention but also doubts. Designers of chaotic ciphers usually claim PNDCC security by statistical tests, while rigorous cryptographic proofs are absent. Thus, it is necessary to re-examine its design rationale and empirical security. To address this issue, we present a typical example of a three-stage permutation-diffusion-permutation PNDCC, which contains multiple security vulnerabilities. Although all of its statistical indicators show good performance, we are able to break it using four different attacks. The first is a differential attack based on homogeneous operations; the second is an S-PTC attack; the third is a novel impulse-step-based differential attack (ISBDA), proposed in this paper, and the fourth is a novel chain attack, also introduced here. These results demonstrate that the fulfilment of statistical criteria is not a sufficient condition for the security of PNDCC. Then, based on a mathematical model of multi-stage PNDCC, we show that the proposed chain attack can successfully break a class of multi-stage PNDCCs. The key technique of the chain attack depends on how to reveal all permutations. To address this key problem, we summarize the chaining rules and show that, from the attacker's perspective, if the same decryption chain can be reconstructed then all permutations can be deciphered. To that end, the entire diffusion process can be broken by solving a system of simultaneous equations. Finally, as a secure improvement, we propose a new scheme termed plaintext-delayed chaotic cipher (PDCC) that can resist various cryptanalytic attacks.

AI snapshot

Written from the paper’s full text.

TL;DR

The paper introduces a chain attack that recovers all permutation keys and then all diffusion keys for multi-stage plaintext-non-delayed chaotic ciphers (PNDCCs), showing that passing standard statistical tests is necessary but not sufficient for security. It also proposes a plaintext-delayed chaotic cipher (PDCC) intended to resist the identified attacks.

Key findings

  • PNDCC diffusion equations lack a plaintext delay term \(P(k-1)\) but include ciphertext feedback, allowing schemes to pass histogram, correlation, NPCR, UACI, and entropy tests while remaining breakable. For a three-stage PNDCC after two rounds, ciphertext entropy is 7.9866 (Boy) and 7.9874 (Cameraman), NPCR is 99.1782% and 99.4213%, UACI is 33.4051% and 33.5664%, and ciphertext correlations are near 0.
  • ISBDA breaks a three-stage permutation-diffusion-permutation PNDCC when its diffusion satisfies the impulse-input/step-output condition; its complexity is \(M \times N + 1\) plaintext-ciphertext pairs. It successfully breaks examples with Eq. (1) and the heterogeneous composite-operation diffusion Eq. (9).
  • The chain attack first recovers all positional permutations and then all diffusion keys, with overall attack complexity remaining \(M \times N + 1\) plaintext-ciphertext pairs. It uses chosen-ciphertext positional correspondence, a complete chain of length \(M \times N\), and six linking rules; a worked example with \(M \times N = 9\) recovers the pre-, mid-, and post-permutations.
  • PDCC adds plaintext delay terms to the diffusion equations; because closed forms like Eq. (18) cannot be derived, the chain attack and codebook attacks are no longer applicable.

Methods

  • Cryptanalysis: defines PNDCCs, derives generalized decryption iterative equations and associated position expressions for multi-stage PNDCCs, proves existence of a complete chain of length \(M \times N\), and implements ISBDA and the chain attack via chosen-ciphertext perturbations and reordering.
  • Data/sample: image encryption simulations use Boy and Cameraman images for statistical indicators; the detailed chain attack example uses a five-stage PNDCC with \(M \times N = 9\) and specified permutation keys; four-stage simulation details are provided in supplementary material.
  • Design: proposes PDCC by adding plaintext delay terms \(P_1(k-1),\dots,P_1(k-n_1)\) and \(P_2(k-1),\dots,P_2(k-n_2)\) to the diffusion inverses, with heterogeneous composite iterative functions.

Limitations

  • Stated: derivations for remaining multi-stage PNDCCs and associated position expressions are omitted due to space limits; four-stage simulation results are in supplementary material.
  • Evident from text: the detailed chain attack walkthrough uses a 9-pixel five-stage PNDCC with fixed permutation keys; generalization to arbitrary \(M \times N\) and arbitrary keys is asserted but not experimentally demonstrated in the provided text.
  • Evident from text: PDCC is argued to resist chain/codebook attacks because plaintext delay prevents closed-form derivation, but the provided text gives no quantitative security analysis or implementation results for PDCC.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

DataCite · 10.48550/arxiv.2509.11158

Cites

33 of 33 references verified0 citation errors · 0 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 29 cited sources checked · 0 supported · 0 flagged

  • Findingreasoning

    Expanding C(k)=f_D(P(k),C(k-1),K(k)) yields C(k)=g_k(P(1),...,P(k)).

    “𝐶(𝑘) = 𝑓 𝐷 (𝑃 (𝑘), 𝐶(𝑘 -1), 𝐾(𝑘)) = 𝑔 𝑘 (𝑃 (1), 𝑃 (2), 𝑃 (3), ⋯ , 𝑃 (𝑘))”
    Quote in the paperSubstantial claim
  • Findingreasoning

    The entire three-stage permutation-diffusion-permutation PNDCC shown in Fig. 1 can be broken.

    “It is then clear that Eq. ( 5) and Eq. ( 6) satisfy the impulse-input/step-output condition, and thus the entire three-stage permutation-diffusionpermutation PNDCC shown in Fig. 1 can be broken.”
    Quote in the paperSubstantial claim
  • Findingcitation

    The diffusion equations of all chaotic ciphers proposed in the existing literature contain no plaintext delay term P(k-1).

    “This paper conducts an in-depth study of the above issue and, for the first time, observes that the diffusion equations of all chaotic ciphers proposed in the existing literature contain no plaintext delay term 𝑃 (𝑘 -1).”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [11]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [12]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [13]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Findingown data

    The three-stage permutation-diffusion-permutation PNDCC in Fig. 1 meets all statistical indicators after two rounds.

    “From Fig. 2 and Tabs.1-3, it is evident that the three-stage permutation-diffusion-permutation PNDCC in Fig. 1 meets all statistical indicators after two rounds.”
    Quote in the paperNot a substantial claim
  • Findingown data

    For the three-stage PNDCC in Fig. 1, the diffusion equation satisfies the impulse-input/step-output condition from P to C.

    “For the three-stage permutation-diffusion-permutation PNDCC in Fig. 1, the corresponding diffusion equation satisfies the impulse-input/step-output condition from 𝑃 to 𝐶, as shown in Fig. 3.”
    Quote in the paperSubstantial claim
  • May combine two claims. 22
  • Classified as probably not a substantial claim. 18
  • The quote only partly states this claim. 5

  • May combine two claims.

    Findingnone given

    In the diffusion equation of the three-stage PNDCC, the plaintext term has no delay, while the ciphertext has a feedback term.

    “In the diffusion equation of the three-stage permutation-diffusion-permutation PNDCC (Fig. 1), the plaintext term has no delay, while the ciphertext has a feedback term, generally expressed as 𝐶(𝑘) = 𝑓 𝐷 ( 𝑃 (𝑘), 𝐶(𝑘 -1), 𝐾(𝑘) ) .”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    The chain attack first recovers all permutation keys and then all diffusion keys; it is simple to carry out and has low attack complexity.

    “The main feature of the chain attack is that it first recovers all permutation keys and then all diffusion keys; it is simple to carry out and has low attack complexity, offering advantages unmatched by conventional cryptanalytic methods.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    According to Eq. (1), the diffusion equation is sensitive from ciphertext to plaintext but has two vulnerabilities: homogeneous operations and insensitivity from plaintext to ciphertext.

    “However, according to Eq. ( 1), although the diffusion equation is sensitive from ciphertext to plaintext, it has two vulnerabilities: homogeneous operations and insensitivity from plaintext to ciphertext.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingown data

    In all PNDCCs, the common essential characteristic is the absence of a plaintext delay term in the diffusion equation, while a ciphertext feedback term is present.

    “First, numerical simulations show that in all PNDCCs, the common essential characteristic is the absence of a plaintext delay term in the diffusion equation, while a ciphertext feedback term is present.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. The quote only partly states this claim.

    Findingreasoning

    In Sec. 3, the general iterative form of the positional decryption machine for 5-stage PNDCC is derived and given by Eq. (22).

    “In Sec. 3, we derived the general iterative form of the”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing). The quote only partly states this claim.

    Findingnone given

    The associated-position expression for the five-stage permutation-diffusion-permutation-diffusion-permutation PNDCC is given by Eq. (22).

    “Finally, the associated-position expression for the five-stage permutation-diffusion-permutation-diffusion-permutation PNDCC is given by”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning

    When a set of three ciphertext elements is adjacent to another set of three ciphertext elements, their intersection may contain only one ciphertext element or only two; which is correct must be determined by trial and error.

    “When a set of three ciphertext elements is adjacent to another set of three ciphertext elements, there are two possible outcomes for their intersection: it may contain only one ciphertext element or only two.Which is correct must be determined by trial and error.”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingreasoning

    Setting m1=m2=1 in Eq. (22) and transforming yields Eq. (23).

    “In fact, setting 𝑚 1 = 𝑚 2 = 1 in Eq. ( 22) and transforming yields”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim.

    Findingreasoning

    The associated-position expression for the three-stage diffusion-permutation-diffusion PNDCC is given by Eq. (19).

    “Based on Eqs. ( 12)-( 18), the associated-position expression for the three-stage diffusion-permutation-diffusion PNDCC is given by”
    Quote in the paperSubstantial claim

  • Classified as probably not a substantial claim. The quote only partly states this claim.

    Findingreasoning

    The associated-position expression for the four-stage permutation-diffusion-permutation-diffusion PNDCC is given by Eq. (20).

    “Similarly, the associated-position expression for the four-stage permutation-diffusion-permutation-diffusion PNDCC is given by”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Findingreasoning

    The associated-position expression for the four-stage diffusion-permutation-diffusion-permutation PNDCC is given by Eq. (21).

    “Likewise, the associated-position expression for the four-stage diffusion-permutation-diffusion-permutation PNDCC is given by”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Findingreasoning

    Both the mid-permutation fS1 and the post-permutation f^{-1}S2 in Eq. (33) are simultaneously recovered.

    “Comparing with 𝑘, we see that both the mid-permutation 𝑓 𝑆1 and the post-permutation 𝑓 -1 𝑆2 in Eq. ( 33) are simultaneously recovered.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The attacker can mount a chosen-ciphertext attack and inject perturbations at each ciphertext position to observe the corresponding plaintext responses.

  • May combine two claims.

    Findingreasoning

    When a set of two ciphertext elements is adjacent to a set of three ciphertext elements, their intersection may contain either two ciphertext elements or only one; the correct case must be confirmed by exhaustive trial and error.

    “When a set of two ciphertext elements is adjacent to a set of three ciphertext elements, their intersection may contain either two ciphertext elements or only one; the correct case must be confirmed by exhaustive trial and error.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Findingreasoning

    The last position cannot be handled by taking intersections with a subsequent item and must be discussed separately; if the last plaintext-ciphertext association corresponds to four ciphertext elements, the correct last position can be obtained directly by taking intersections and set differences, while if it corresponds to two or three ciphertext elements, exhaustive trial and error is required.

    “The last position cannot be handled by taking intersections with a subsequent item and must be discussed separately.If the last plaintext-ciphertext association corresponds to four ciphertext elements, the correct last position can be obtained directly by taking intersections and set differences.If it corresponds to two or three ciphertext elements, exhaustive trial and error is required.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    [4] found that the five encryption stages in [23] reduced to a two-stage diffusion-permutation, and the resulting aggregate diffusion stage is homogeneous, enabling a homogeneous-operation-based differential attack to break the algorithm.

    “First, [4] found that the five encryption stages in the original algorithm reduced to a two-stage diffusion-permutation, and the resulting aggregate diffusion stage is homogeneous, enabling a homogeneous-operationbased differential attack to break the algorithm.”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Premisecitation

    In the S-PTC attack, once positional correspondence is found, one must write all possible values and build a codebook between ciphertext and plaintext; with such a codebook, an attacker can obtain the corresponding plaintext for any ciphertext by lookup.

    “The difference is that in the S-PTC attack, once positional correspondence is found, one must write all possible values and build a codebook between ciphertext and plaintext.With such a codebook, an attacker can obtain the corresponding plaintext for any ciphertext by lookup.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Classified as probably not a substantial claim.

    Premisecitation

    Many reports prove the security of designed chaotic ciphers by meeting statistical indicators such as histogram, correlation, NPCR, UACI, and information entropy.

    “In particular, even to this day, there are still a large number of reports that prove the security of the designed chaotic ciphers by meeting various statistical indicators, such as histogram, correlation, NPCR, UACI, and information entropy [24][25][26].”
    Quote in the paperSubstantial claim0 of 3 sources checked
    • cites [24]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [25]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [26]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

    Premisecitation

    [4] discovered that the equivalent aggregate diffusion exhibits a unidirectional diffusion property, and by using plaintext intersection to determine the positional correspondence between the plaintext set and the ciphertext set, an S-PTC attack was pioneered to successfully break the algorithm proposed in [23].

    “Then, [4] discovered that the equivalent aggregate diffusion exhibits a unidirectional diffusion property, and by using plaintext intersection to determine the positional correspondence between the plaintext set and the ciphertext set, an S-PTC attack was pioneered to successfully break the algorithm proposed in [23].”
    Quote in the paperNot a substantial claim0 of 2 sources checked
    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [23]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationreasoning

    For the chain attack, one only needs to solve the one-dimensional problem of pixel positions first, and then break the entire diffusion by solving a system of simultaneous equations; in contrast, the S-PTC attack must handle both pixel magnitude and pixel position-two dimensions.

    “For the chain attack, one only needs to solve the one-dimensional problem of pixel positions first, and then break the entire diffusion by solving a system of simultaneous equations; in contrast, the S-PTC attack must handle both pixel magnitude and pixel position-two dimensions.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Premisecitation

    The diffusion functions in [11][12][13][14] adopt heterogeneous operations (mixtures of modular and XOR), whereas those in [15][16][17][18][19][20][21][22] adopt homogeneous operations (homogeneous modular or homogeneous XOR).

    “by analyzing the specific forms of the diffusion function 𝑓 𝐷 in [11][12][13][14][15][16][17][18][19][20][21][22], [9] and [10] observed that the diffusion functions in [11][12][13][14] adopt heterogeneous operations, namely mixtures of modular and XOR operations, whereas those in [15][16][17][18][19][20][21][22] adopt homogeneous operations, including homogeneous modular or homogeneous XOR”
    Quote in the paperSubstantial claim0 of 2 sources checked
    • cites [9]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • cites [10]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • May combine two claims.

    Interpretationcitation

    The plaintext-to-ciphertext insensitivity can be exploited by an S-PTC attack and by a chain attack.

    “The plaintext-to-ciphertext insensitivity can be exploited by two methods: the first is an S-PTC attack [4], and the second is a chain attack to be introduced in Sec. 4.”
    Quote in the paperSubstantial claim0 of 1 sources checked
    • cites [4]

      Couldn’t be matched to a paper in Crossref, so it can’t be checked.

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Interpretationreasoning

    Associated position expressions can be derived for an arbitrary number of stages by the same method.

    “By the same method, one can derive the associated position expressions for an arbitrary number of stages; due to space limits, they are omitted here.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given

    In chain attacks, one first recovers positional permutations; given these, the diffusion can be further recovered by solving the resulting systems of equations.

    “In chain attacks, one first recovers positional permutations; given these, the diffusion can be further recovered by solving the resulting systems of equations.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    If the chain head cannot be found and a complete chain of length M×N cannot be formed, the absolute positions cannot be determined, and the permutation key cannot be broken.

    “Conversely, if the chain head cannot be found and a complete chain of length 𝑀 × 𝑁 cannot be formed, the absolute positions cannot be determined, and the permutation key cannot be broken.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Eqs. (18)-(22) justify first recovering all permutations and then all diffusions, thereby providing a theoretical basis for chain attacks.

    “From an attack perspective, Eqs. ( 18)-( 22) justify first recovering all permutations and then all diffusions, thereby providing a theoretical basis for chain attacks.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    If one can prove from Eq. (22) that such a chain exists, then the attacker can locate this chain via a chosen-ciphertext attack and thus recover the corresponding permutation key.

    “If one can prove from Eq. ( 22) that such a chain indeed exists, then the attacker can locate this chain via a chosen-ciphertext attack and thus recover the corresponding permutation key.”
    Quote in the paperSubstantial claim
    • Rests on an assumption: The attacker can mount a chosen-ciphertext attack and inject perturbations at each ciphertext position to observe the corresponding plaintext responses.

  • Probably not a substantial claim: may not pass S2 (checkable), S3 (load-bearing), S4 (based).

    Interpretationnone given

    In practice, a chain can be constructed by taking intersections.

    “In practice, a chain can be constructed by taking intersections.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    In the PNDCC, diffusion keys can be solved independently because diffusion is one-way and there is no mutual coupling among keys.

    “Because the diffusion is one-way and there is no mutual coupling among keys, one can independently solve for 𝐾 2 (𝑓 -1 𝑆1 (1)), 𝐾 2 (0), 𝐾 1 (1), 𝐾 2 (𝑓 -1 𝑆1 (2)), 𝐾 2 (𝑓 -1 𝑆1 (1)), 𝐾 1 (2), 𝐾 2 (𝑓 -1 𝑆1 (𝑘)), 𝐾 2 (𝑓 -1 𝑆1 (𝑘 -1)), 𝐾 1 (𝑘) (𝑘 = 3, 4, ⋯ , 𝑀 ×𝑁), and so on.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    The proposed algorithm is also applicable to diffusion equations in the general case.

    “It should be emphasized that the proposed algorithm is also applicable to diffusion equations in the general case.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationnone given

    For a complete chain of length M×N, every element except those in the last set corresponding to the chain tail is included by at least one intersection.

    “For example, for a complete chain of length 𝑀 × 𝑁, every element except those in the last set corresponding to the chain tail is included by at least one intersection.”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Interpretationreasoning

    PDCC can resist attacks based on various cryptanalytic strategies, including algorithm-based cryptanalytic attacks.

    “the scheme can resist attacks based on various cryptanalytic strategies.”
    • Also stated in: § Acknowledgements · plain
      “and presents an improved PDCC scheme that can resist algorithm-based cryptanalytic attacks.”
    Quote in the paperSubstantial claim

  • May combine two claims.

    Interpretationreasoning

    Diffusion keys can be directly recovered by reusing the same plaintext-ciphertext pairs used for permutation recovery, so no additional plaintext-ciphertext pairs are required.

    “Since the diffusion keys can be directly recovered by reusing these pairs, no additional plaintext-ciphertext pairs are required.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    The proposed plaintext-delayed chaotic cipher (PDCC) can withstand various attacks on cryptographic algorithms.

    “we further propose, as an improved scheme, a plaintext-delayed chaotic cipher (PDCC) that can withstand various attacks on cryptographic algorithms.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationreasoning

    According to Eq. (22), one can theoretically prove the existence of a complete chain of length M×N, which establishes the prerequisite for the chain attack introduced in Sec. 4.

    “According to Eq. ( 22), one can theoretically prove the existence of a complete chain of length 𝑀 × 𝑁, which establishes the prerequisite for the chain attack introduced in Sec. 4.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S2 (checkable), S4 (based).

    Interpretationreasoning

    In general, determining whether the diffusion equation in Fig. 1 satisfies the impulse-input/step-output condition by Eq. (6) is often difficult.

    “In general, the diffusion equation in Fig. 1 may be fairly complicated, and determining whether it satisfies the impulse-input/step-output condition by the method given in Eq. ( 6) is often difficult.”
    Quote in the paperNot a substantial claim

  • May combine two claims.

    Interpretationnone given

    Each diffusion creates a complete chain; each permutation breaks the complete chain.

    “Each diffusion creates a complete chain; each permutation breaks the complete chain.”
    Quote in the paperSubstantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing), S4 (based).

    Interpretationreasoning

    The finding that meeting statistical indicators is not sufficient likewise applies to modern cryptography.

    “This finding likewise applies to modern cryptography.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Premisenone given

    Encryption and decryption are inverses.

    “Moreover, since encryption and decryption are inverses, we present the generalized decryption iterative equation; the corresponding generalized encryption equation follows by inversion.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S4 (based).

    Interpretationnone given

    The basic method of the chain attack illustrated with the five-stage permutation-diffusion-permutation-diffusion-permutation PNDCC generalizes to other multi-stage cases without loss of generality.

    “In this section, we continue to use the five-stage permutation-diffusion-permutation-diffusion-permutation PNDCC as an example to illustrate the basic method of the chain attack, which generalizes to other multi-stage cases without loss of generality.”
    Quote in the paperNot a substantial claim

  • Probably not a substantial claim: may not pass S3 (load-bearing).

    Premisenone given

    The functions g_i describe only the relationship between plaintext and ciphertext under key-fixed conditions.

    “Note that the functions 𝑔 𝑖 (𝑖 = 1, 2, … , 𝑀 × 𝑁) describe only the relationship between plaintext and ciphertext under key-fixed conditions.”
    Quote in the paperNot a substantial claim

  • The quote only partly states this claim.

    Interpretationreasoning

    Given recovered permutation keys and the chosen-ciphertext pairs C(0)=0, C(V1)=V1, and C(V2)=V2, the diffusion keys can be solved from Eq. (36).

    “Therefore, the diffusion keys can be solved from Eq. ( 36).”
    Quote in the paperSubstantial claim
41 of 41

  • The authors state this as an assumption.

    The key and initial conditions are treated as invariants throughout the cryptanalysis.

    “According to cryptanalytic convention, the key and initial conditions are treated as invariants throughout the analysis, and thus are not included explicitly in 𝑔 𝑖 .”

  • The paper relies on this without support.

    The three-stage permutation-diffusion-permutation PNDCC in Fig. 1 is representative of the class of PNDCCs.

    “through the security analysis of a representative three-stage permutation-diffusion-permutation PNDCC, we show that even when these statistical indicators are satisfied, one cannot conclude that the cipher is secure.”

  • The paper relies on this without support.

    The attacker can mount a chosen-ciphertext attack and inject perturbations at each ciphertext position to observe the corresponding plaintext responses.

    “under a chosen-ciphertext attack, the attacker injects a perturbation at each ciphertext terminal in turn and records the perturbation responses on the plaintext side”
3 of 3

Self-check

Percentages, sums and reported differences re-computed from the paper’s own numbers.

Each contradiction between two passages listed here was confirmed by an independent check.

  • The C(7) response is mislabeled as C(5)

    Minor

    The line beginning with ΔP (7) attributes its remaining nonzero positions to ΔP (5). Equation (31) instead assigns all four positions to the C(7) perturbation.

1 of 1

Cites

Flagged first, then by citations

1 of the 34 references couldn’t be matched to a known paper.

Research works printed but not linked: 1

  1. C. Li, D. Lin, and J. Lü, "Cryptanalyzing an image-scrambling encryption algorithm of pixelbits," IEEE MultiMedia, vol. 24, no. 3, pp. 64-71, 2017.

Authors
Wang, Q., & Yu, S.
Affiliations
Guangdong University of Technology (CN)
ORCID
Venue
arXiv
Publisher
arXiv
Published
2025
ISSN
2331-8422 (ISSN-L)
DOI
10.48550/arxiv.2509.11158
arXiv
2509.11158
OpenAlex
W4415087899
Semantic Scholar
75b4af51cdb1914e320d78c5e9542da7ec600be4
Cited by
0
References
34
Type
posted content
Language
en
Open access
Licence
arxiv.org/licenses/nonexclusive-distrib/1.0/
Locations
  • arXiv (Cornell University) (submittedVersion)
  • arXiv (Cornell University)
Funders
National Natural Science Foundation of China (62271157)
Topics
  • Physical Sciences › Computer Science › Computer Vision and Pattern Recognition › Chaos-based Image/Signal Encryption
  • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
  • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
Keywords
chaotic cipher, cryptanalysis, differential attack, diffusion equation

About these checks

Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-18.

Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-18.

Statistics and arithmetic are recomputed, not judged.

Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

What counts as a claim ›How we measure confidence ›How we check this ›

Are you an author, or do you see a problem with this page? Request a review