A general multi-secret visual cryptography scheme

Optics Communications 283 (2010) 4949–4962

Contents lists available at ScienceDirect

Optics Communications j o u r n a l h o m e p a g e : w w w. e l s ev i e r. c o m / l o c a t e / o p t c o m

A general multi-secret visual cryptography scheme Ching-Nung Yang ⁎, Ting-Hao Chung Department of Computer Science and Information Engineering, National Dong Hwa University, Taiwan

a r t i c l e

i n f o

Article history: Received 2 April 2010 Received in revised form 10 June 2010 Accepted 21 July 2010 Keywords: Visual cryptography Visual secret sharing Multiple secret images

a b s t r a c t In a (k, n) visual cryptography scheme (VCS), a secret image is encoded into n shadow images that are distributed to n participants. Any k participants can reveal the secret image by stacking their shadow images, and less than k participants have no information about the secret image. In this paper we consider the case when the secret image is more than one, and this is a so-called multi-secret VCS (MVCS). The previous works on MVCS are all the simple 2-out-of-2 cases. In this paper, we discuss a general (k, n)-MVCS for any k and n. This paper has three main contributions: (1) our scheme is the first general (k, n)-MVCS, which can be applied on any k and n, (2) we give the formal security and contrast conditions of (k, n)-MVCS and (3) we theoretically prove that the proposed (k, n)-MVCS satisfies the security and contrast conditions. © 2010 Elsevier B.V. All rights reserved.

1. Introduction A (k, n)-threshold visual cryptography scheme (VCS) is an approach to encrypt a secret image into noise-like shadow images (shadows). One can visually decode the secret via the human visual system by directly stacking k shadows, but (k − 1) or fewer shadows gain no information about secret. The beauty of VCS is the stacking-tosee property that the decryption requires neither the knowledge of cryptography nor the complex computation. Due to the ease of decoding, VCS provides new and secure imaging applications, e.g., visual authentication, steganography, and image encryption. The first VCS encrypted a black-and-white secret image into noiselike shadows [1] by expanding a secret pixel into m (referred to as the pixel expansion) subpixels. In the reconstructed image, the different whiteness (the number of white subpixels in an m-subpixel block) is used to distinguish the black color from the white color. Actually, the sizes of the pixel and the subpixel are equal. There is no difference between the pixel and the subpixel except that the “pixel” is the secret pixel in a secret image, while the “subpixel” is the pixel located in shadows. Therefore, the shadow size is m times expanded. The visual quality of a reconstructed image in VCS is degraded by a large pixel expansion, and thus most studies try to enhance the visual quality or reduce the pixel expansion [2–5]. Besides, other gray VCS, chromatic VCS, extended VCS, XOR-based VCS, specific-feature VCSs (e.g., cheating prevention, keeping the aspect ratio invariant) were given in [6–15]. Most VCSs shares one secret only, and this limits its possible applications. A so-called multi-secret VCS (MVCS) was then proposed to explore the possibilities of sharing multiple secret images. Let (k, n,

s)-MVCS be a (k, n)-MVCS, which shares s secret images. A (2, 2, 2)MVCS [16] revealed a secret by stacking two shadows. When reversing one of two shadows, the other secret can be recovered. Hsu et al. used ringed shadows to construct a (2, 2, 2)-MVCS [17]. Two secret images can be, respectively, reconstructed by rotating a shadow with a fixed angle and stacking them. Afterward, the same authors enhanced the number of secret images from 2 to 4, and constructed a (2, 2, 4)-MVCS [18], by flipping one shadow image and also rotating at an angle. A circular shadow was used in a (2, 2, 2)-MVCS [19]; two secrets can be reconstructed by rotating one circular shadow at an angle. Two (2, 2, s)-MVCS were proposed in [20,21] for any s (≥2), where their shadow types are circular and ringed, respectively. The previous works [16–21] on MVCS are all simple 2-out-of-2 cases. In this paper, we consider a general (k, n, s)-MVCS for any k, n and s. Our (k, n, s)-MVCS can be easily implemented on basis of a conventional (k, n)-VCS. For the special case k = n = 2, the pixel expansion of our MVCS is same to the previous MVCS. Both circular and ringed shadows could embed secret images into different angles of shadows rather than specific angles (0°, 90°, 180°, 270°) in rectangular shadows. However, circular shadows result in distortion in a reconstructed image due to its sectorial subpixels. This distortion appearance won't occur in the ringed shadows, and thus our (k, n, s)-MVCS is implemented by ringed shadows. The rest of this paper is organized as follows. Section 2 describes the previous (2, 2, s)-MVCS using ringed shadows. Our (k, n, s)-MVCS is introduced in Section 3. Experiment and comparison are given in Section 4, and Section 5 concludes the paper. 2. Preliminaries

⁎ Corresponding author. Department of Computer Science and Information Engineering, National Dong Hwa University, #1, Sec. 2, Da Hsueh Rd., Hualien, Taiwan. Tel.: + 886 3 8634025; fax: + 886 3 8634010. E-mail address: [email protected] (C.-N. Yang). 0030-4018/$ – see front matter © 2010 Elsevier B.V. All rights reserved. doi:10.1016/j.optcom.2010.07.051

In this section, we deal with some VCSs [1,3,5,21]. We use Naor et al.'s VCS [1] to briefly describe the constructions and properties of (k, n)-VCS, which is a basis of our new (k, n, s)-MVCS. Although our

4950

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

scheme is based on the conventional VCS, however its probabilistic nature is more similar to the probabilistic VCS. Therefore, we introduce the probabilistic (k, n)-VCS [3,5]. Our scheme is implemented on ringed shadows, and thus a ring-based Feng et al.'s (2, 2, s)-MVCS [21] is described to allow a better understanding of our construction. 2.1. Naor et al.'s VCS Naor et al.'s VCS in [1] used a whiteness to distinguish the black color from the white color, i.e., “m − h”B“h”W (respectively, “m − l”B“l”W) represents a white (respectively, black) secret pixel, where h and l are referred to as the whiteness of the white and black colors, respectively, and 0 ≤ l b h ≤ m. A (k, n)-VCS can be designed using two base n × m matrices B0 and B1 with elements “0” and “1” denoting white and black subpixels, respectively. When sharing a white (respectively, black) secret pixel, a dealer randomly chooses m subpixels in one row of a matrix in the set C0 (respectively, C1) which includes all matrices obtained by permuting the columns in B0 (respectively, B1) to a relative shadow. Let ORðBi jr Þ, i = 0, 1, denote an OR-ed vector of any r rows in Bi, and H(⋅) be the Hamming weight function. Then, the base matrices of a (k, n)-VCS should satisfy the following conditions. (V-1) H ðORðB1 jr ÞÞ = H ðORðB0 jr ÞÞ for r ≤ (k − 1). (V-2) H ðORðB1 jr ÞÞ≥ðm–lÞ and HðORðB0 jr ÞÞ≤ðm–hÞÞ for r = k, where 0 ≤ l b h ≤ m. Condition (V-1) is often referred to as a security condition and assures a (k, n)-VCS of perfect secrecy. Condition (V-2) is a contrast condition, in which the different contrasts are used to distinguish between the black and white colors. A secret image can be the successfully recognized through their different contrasts in the reconstructed image. Example
1.  Construct
a (2,  2)-VCS of h = 1, l = 0 and m = 2 using 10 10 B0 = and B1 = . 10 01 Obviously, H ðORðB1 j2ÞÞ = 2, H ðORðB0 j2ÞÞ = 1, and H ðORðB1 j1ÞÞ = H ðORðB0 j1ÞÞ = 1, satisfy (V-1)  and (V-2)  conditions. For simplicity, we x

use xByW to represent

y

1⋯1; 0⋯0

and its permutations. In a

reconstructed image, a black color is 2B0W and a white color is 1B1W. Since every 2-subpixel block in shadows is 1B1W, shadows are noise-like. By the previous theoretical contrast definition αV = (h−l)/ m in [1], the contrast for this (2, 2)-VCS is αV = 1/2. □

 ′   ′   Since  ′ the  set OR C1 j2 is {1, 1} and  the  ′ setOR C0 j2 is {1, 0}, so P OR C1 j2 = P ðf1; 1gÞ = 0 and P OR C0 j2 = P ðf1; 0gÞ = 1 = 2    satisfy the contrast condition (P-2). On the other P OR C1′ j1 =   hand,   P ðf0; 1gÞ = P ðf1; 0gÞ = 1 = 2 a n d P OR C0′ j1 = P ðf1; 0gÞ = P ðf1; 0gÞ = 1 = 2 satisfy the security condition (P-1). The contrast of a conventional VCS αV =(h − l) / m =(h /m) − (l/ m) is similar to the difference of the whiteness probabilities between white color and black color; therefore the    contrast   of aprobabilistic (k, n)-VCS is defined as αP = P OR C0′ jk −P OR C1′ jk . This probabilistic (2, 2)-VCS has the   ′     contrast αP = P OR C0 j2 −P OR C1′ j2 = 1 = 2 − 0 = 1 = 2. □ When using a printed-text image as a secret in Examples 1 and 2, the reconstructed image of a (2, 2)-VCS and a probabilistic (2, 2)-VCS are shown in Fig. 1(a) and (b). The probabilistic (2, 2)-VCS has no pixel expansion (i.e., the size of shadow image and secret image are same), while the shadow size of (2, 2)-VCS is expanded two times. However, the contrast of Fig. 1(a) is better than that of Fig. 1(b). The detailed edge of in Fig. 1(b) is blurred. 2.3. The (2, 2, s)-MVCS In [20,21], the authors showed the (2, 2, s)-MVCS with sharing secrets on circular and ringed shadows, respectively. Consider two shadows (S1, S2) and s secret images (P1, P2, …, Ps) in a (2, 2, s)-MVCS. We can reveal the secret Pi, 1 ≤ i ≤ s, by stacking S1 and Γ(S2) (or S2 and Γ(S1)), where Γ(⋅) denotes some operations, say reversing or rotating, on shadow. 2.3.1. Security and contrast conditions of a (2, 2, s)-MVCS Actually, the (2, 2, s)-MVCS should have the similar security and contrast conditions as (V-1) and (V-2) of VCS. However, the required conditions of a (2, 2, s)-MVCS were not described in the previous paper. Here, we formally define security and contrast conditions of the (2, 2, s)-MVCS. Define the Hamming function — Him(⋅): the Hamming weight function for every m-subpixel block in the stacked result and the corresponding secret pixel for these m subpixels is white (i = 0) and black (i = 1), respectively. Let {S2} θi be a operation to rotate S2 with an angle θi, where θi = (360°/s) × (i − 1), 1 ≤ i ≤ s. Let Π(⋅) be the stack operation, e.g., Π(S1, {S2} θi) is to stack two shadows S1 and {S2} θi. The security condition and the contrast condition of the (2, 2, s)-MVCS are then defined as follows. 0 1 ð Si Þ = Hm ðSi Þ,1≤ i ≤ s. (M-1) Hm



 1 0 Π S1 ; fS2 gθi ≥ðm–lÞ and Hm Π S1 ; fS2 gθi ≤ðm–hÞÞ (M-2) Hm

where 0 ≤ l b h ≤ m, 1 ≤ i ≤ s.

2.2. Probabilistic VCS By selecting every column vector in Bi as a one-column matrix, we form the sets C ′i , i = 0, 1, including n × 1 column Boolean matrices. A probabilistic (k, n)-VCS [3,5] is then designed as follows. When sharing a black (respectively, white) pixel, the dealer randomly chooses one-column matrix in C1′ (respectively C ′0 ), and then selects the row element of this column matrix to a     relative shadow. Let OR C1′ jr and OR C0′ jr ) denote the sets containing the results of “OR”-ed r rows in the column matrices of C1′ and C 0′ , and P(⋅) be the appearance probabilities of the “0” (whiteness) in a set. Then, base matrices of the probabilistic (k, n)VCS should satisfy the following conditions.

Condition (M-1) is the security condition that all m-subpixel blocks in shadows have the same Hamming weight (the same intensity). Rotating a shadow does not change any information in a shadow. So condition (M-1) makes sure that the shadow cannot disclose the secret. As shown in condition (M-2) is a contrast condition, the contrasts of the black and white colors in a reconstructed image Π(S1, {S2} θi) are different, and thus one can visually decode the secret image Pi. For example, in a (2, 2, 2)-MVCS, the first secret can be reconstructed through Π(S1, {S2 } θ1 )=Π(S1, {S2} 0°) = Π(S1, S2). Rotating S 2 X°

      (P-1) P OR C1′ jr = P OR C0′ j r for r ≤ (k − 1).   ′    ′  (P-2) P OR C1 jr bP OR C0 jr for r = k. ′ Example 

2. Construct
a (2,
2)  probabilistic VCS using C0 = 1 0 0 1 ; and C1′ = ; . 1 0 1 0

Fig. 1. The reconstructed image of two VCSs using a printed-text image as the secret: (a) the (2, 2)-VCS in Example 1 (b) the probabilistic (2, 2)-VCS in Example 2.

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

4951

Fig. 2. Decryption in a (2, 2, 2)-MVCS: (a) using circular shadows (b) using ringed shadows.

clockwise can reveal the second secret. The decryption process of (2, 2, 2)-MVCS using circular and ringed shadows are shown in Fig. 2(a) and (b), respectively. 2.3.2. Feng et al.'s (2, 2, s)-MVCS In [21], the authors enhance the number of secret images in a ring-shadow-based (2, 2, 2)-MVCS [17], to share s secret images in two shadows S1 and S2. By Π(S1, {S2} θi), the secret Pi, 1 ≤ i ≤ s, can be revealed. In Feng et al.'s (2, 2, s)-MVCS, the authors designed four 3pixel blocks — the effective block Be = (101), the ineffective block Bi = (110), the white block Bw = (101), and the black block Bb = (011). It is evident that Bi ⊗ Bw = Bi ⊗ Bb = (111), Be ⊗ Bw = (101), and Be ⊗ Bb = (111), where ⊗ is the OR-ed operation. Suppose 3B0W and 2B1W denote the black color and the white color, respectively, in a reconstructed image. Therefore, the ineffective block Bi works like a masking block which the color cannot pass through. Only the black color 3B0W will be shown. On the other hand, the color of Bb

and Bw will pass through the effective block Be. By processing s secret pixels in each secret image, Feng et al.'s (2, 2, s)-MVCS could share s secret images into two shadows S1 and S2. Process every s secret pixels (pi,1, pi,2, …, pi,s) in each row of a secret image Pi, where 1 ≤ i ≤ s, in sequence. We first use Bb and Bw to represent the black white secret pixels to gain new secret images Pˆ i , which every s 3pixel blocks is represented as (Bi,1, Bi,2, …, Bi,s). Encryption process for (s × s) secret pixels in s secret images is shown in Fig. 3. Collect all s × s blocks (each block has 3 subpixels) in two shadows at the angle θi = (360°/s) × (i − 1), 1 ≤ i ≤ s. Generate the (s × s) block [ai,j] in S1 and the (s × s) block [bi,j] in S2 where ai,j ∈ {Be, Bi} and bi,j ∈ {Bb, Bw} for 1 ≤ i, j ≤ s, as follows.



ai; j = Be fori = j; otherwise ai;j = Bi ; bi; j = B1+ðð j−iÞ mod sÞ; i :

ð1Þ

Fig. 3. Encryption of (s × s) secret pixels in Feng et al.'s (2, 2, s)-MVCS: (a) generation of two shadows (b) stacking two shadows at θi, 1 ≤ i ≤ s (c) permutation on the corresponding blocks.

4952

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

The result of Eq. (1) is shown in Fig. 3(a). It is observed that the stacked results by stacking two shadows at an angle θi really reveal the ˆ secret blocks (Bi,1, Bi,2, …,
Bi, s) for P i , 1 ≤ i ≤ s (see Fig. 3(b)). We then a1;1 a2;1 … as;1 by Perm½⋅ (Fig. 3(c)) to permute the columns in b1;1 b2;1 … bs;1 assure the security, and then put back to the corresponding subpixels in S1 and S2. Example 3. Construct Feng et al.'s (2, 2, 3)-MVCS. Suppose 9 secret pixels in P1, P2 and P3 are (p1,1, p1,2, p1,3) = (101), (p2,1, p2,2, p2,3) = (001) and (p3,1, p3,2, p3,3) = (100). We first gain (B1,1, B1,2, B1,3) = (Bb, Bw, Bb), (B2,1, B2,2, B2,3) = (Bw, Bw, Bb) and (B3,1, B3,2, B3,3) = (Bb, Bw, Bw). Then generate two (ms) × s subpixels in two shadows S1 and S2 as follows. 2 Be h i ai;j = 4 Bi Bi

Bi Be Bi

3 2 B1;1 Bi h i 5 Bi ; bi;j = 4 B3;2 B2;3 Be

B2;1 B1;2 B3;3

3 2 B3;1 Bb 5 B2;2 = 4 Bw B1;3 Bb

Bw Bw Bw

3 Bb Bw 5: ð2Þ Bb

By binary representation Be = (101), Bi = (110), Bw = (101), and Bb = (011), we have h

2

101 i ai;j = 4 110 110

3

2

110 110 h i 011 101 101 110 5; bi;j = 4 101 101 110 101 011 101

3

011 101 5: 011

ð3Þ


 a a2;1 a3;1 Permute the corresponding subpixels by Perm 1;1 , b1;1 b2;1 b3;1

 a a a2;2 a3;2 a2;3 a3;3 , and Perm 1;3 . Suppose the Perm 1;2 b1;2 b2;2 b3;2 b1;3 b2;3 b3;3 permutation order in

is (1,0,3,8,5,6,4,2,7). We then have

two permuted shadows as follows. h

a′i; j

i

2

011 = 4 001 111

3 2 111 111 h i 101 011 010 101 5; b′i; j = 4 110 110 101 100 011 110

3 101 110 5: 011

ð4Þ

When stacking [a′i, j] and [bi,′ j] at θ1 = 0°, θ2 = 120° and θ3 = 240°, respectively, we have 8 22 3 2 011 111 111 101 011 > hh i h ii > > ′ ′ > 4 4 Π ai; j ; bi; j = Π 001 010 101 5; 4 110 110 > > > > 111 101 100 011 110 > > > 2 3 > > > 111 111 111 > > > > = 4 111 110 111 5; ð5  1Þ > > > > 111 111 > > 22 111 3 2 > >
h i nh io  011 111 111 011 > > 120˚ > ′ ′ > 4 4 > = Π 001 010 101 5; 4 110 Π ai; j ; bi; j > > < 111 101 100 110 2 3 > 011 111 111 > > > > = 4 111 110 111 5; ð5  2Þ > > > > 111 > > 22 111 111 3 2 > > 011 111 111 101 > >
h i nh io240˚  > ′ ′ > 4 4 > = Π 001 010 101 5; 4 110 Π ai; j ; bi; j > > > > 111 101 100 011 > > > 2 3 > > 111 111 111 > > > > = 4 111 110 111 5:ð5  3Þ > > : 111 111 110

33 101 110 55 011

33 101 101 110 110 55 011 011

33 101 011 110 110 55 011 110

In every 9-pixel block of two shadows (see Eq. (4)), we have same Hamming weight (6B3W), so it satisfies the security condition (M-1). In

Eq. (5), it is observed that the black color and the white color are represented as 9B and 8B1W, and the contrast in the reconstructed image is 1/9. Π[[a′i, j], [b′i, j]], Π[[a′i, j], {[b′i, j]} 120°], and Π[[a′i, j], {[b′i, j]} 240°] actually reveal the secret (p1,1, p1,2, p1,3) = (101), (p2,1, p2,2, p2,3) = (001) and (p3,1, p3,2, p3,3) = (100), respectively. □ 3. The proposed (k, n, s)-MVCS Most MVCSs cannot share any s secret images [16–19]. Two previous MVCS share s secret images [20,21], but they are only (2, 2, s)-MVCSs. Actually, all previous MVCSs [16–21] are the simple 2out-of-2 cases. In this paper, we consider a general (k, n, s)-MVCS for any k, n and s. Our (k, n, s)-MVCS can be easily implemented based on a conventional (k, n)-VCS. For the special case k = n = 2, the proposed (2, 2, s)-MVCS has the lesser shadow size than Feg et al.'s (2, 2, s)-MVCS [21]. When compared with Shyu et al.'s (2, 2, s)-MVCS [20], our (2, 2, s)-MVCS has the same shadow size as Shyu et al.'s (2, 2, s)-MVCS. However, the sectorial subpixel of Shyu et al.'s (2, 2, s)-MVCS distorts the reconstructed image, while this distortion won't occur in our scheme. 3.1. The model 3.1.1. Decryption When  stacking any k shadows in a general (k, n, s)-MVCS, there are n total ways to select any k shadows   from n shadows. We should k n carefully design how to stack any (Si1, Si2, …, Sik) with a specific k rotation angles (θi1, θi2, … θik) to reveal s secret images Π[{Si1} θi1, {Si2} θi2, …, {Sik} θik]. So, the difference of rotation angles between two shadows is as maximal as possible, and makes the rotation and superimposition easy for revealing secrets. In the (2, 2, s)-MVCSs [20,21], one shadow is rotated (360°/s) × (i − 1) clockwise and then is stacked with the other shadow to gain the secrets Pi, 1 ≤ i ≤ s. These s staking ways, Π[S1, S2], Π[S1, {S2} 360° / s], …, and Π[S1, {S2} (360° / s) × (s − 1)], could reconstruct s secret images. About our (k, n, s)-MVCS, we should especially consider the number of shadows. A rotation operation ∡ {S1, S2, …, Sn} θi, where θ = 360° / (s × (n − 1)), is defined as follows. θi

∡ fS1 ; …; Sj ; …; Sn g ði−1Þ×θ

= fS1 ; fS2 g

ð6Þ ði−1Þ×ð j−1Þθ

; …; fSj g

ði−1Þ×ðn−1Þθ

; …; fSn g

gfor 1 ≤i≤s:

The rotation in Eq. (6), (i − 1) × ( j − 1) × 360° / (s × (n − 1)), will be reduced to (360°/s) × (i − 1) of a (2, 2, 2)-MVCS for j = n = 2. The operation process of ∡ {S1, S2, …, Sn} θi is diagrammatically shown in Fig. 4. Let Πr(⋅) denote stacking any r shadows. An example of the (3, 4, 4)-MVCS is shown in Fig. 5. We can recover four secret images P1, P2, P3, P4 by the following stacking ways. 8 P1 = Π3 h½S1 ; S2 ; S3 ; S4 ; > i > > 30 60 90 > > < P2 = Π3 S1 ; fS2 g ˚ ; fS3 g ˚ ; fS4 g ˚ ; h i P3 = Π3 S1 ; fS2 g60˚ ; fS3 g120˚ ; fS4 g180˚ ; > > > h i > > : P = Π S ; fS g90˚ ; fS g180˚ ; fS g270˚ : 4 3 1 2 3 4

ð7Þ

As an example, consider the decryption of P3. A stacking way is that we do not move the first shadow S1, and then rotate S2 and S3 clockwise 60° and 120°, respectively. However such stacking position

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

4953

h i θi θi θ2 θ ðn−1Þ×θ Fig. 4. A rotation ∡fS1 ; S2 ; …; h Sn g , 1 ≤ i ≤ s, in decryptioni of the proposed (k, n, s)-MVCS: h (a) ∡fS1 ; S2 ; …; Sn g = Π ½S1 ; S2i; …; Sn  (b) ∡fS1 ; S2 ; …; Sn g = Π fS1 g; fS2 g ; …; fSn g θ3 2θ ðn−1Þ×2θ θs ðs−1Þ×θ ðn−1Þ×ðs−1Þ×θ (c) ∡fS1 ; S2 ; …; Sn g = Π fS1 g; fS2 g ; …; fSn g ; …; fSn g (d) ∡fS1 ; S2 ; …; Sn g = Π S1 ; fS2 g .

is a relative position. For example, one can rotate S3 and S1 60°, clockwise and anticlockwise, and do not rotate S2 to gain the secret P3.

3.1.2. Security and contrast conditions The proposed (k, n, s)-MVCS has the similar probabilistic performance like the probabilistic VCS. The term “probabilistic” implies that our MVCS distinguishes the color in the reconstructed image through the difference of the frequency of the whiteness in black and white areas. Based on the probability of whiteness, we define the security and contrast conditions of the proposed (k, n, s)-MVCS as follows, where m′ is the pixel expansion of a (k, n, s)-MVCS. (M′-1)



 φ1 1 PðHm ; fS2 gφ2 ; …; fSn gφn Þ ′ Πr fS1 g  0 

 φ1 ; fS2 gφ2 ; …; fSn gφn Þ = P Hm ′ Πr fS1 g

for r≤(k−1), where 0°≤φi ≤360°.

h i

h i θi θi 1 0 (M′-2) P Hm bP Hm ′ Πr ∡ðS1 ; S2 ; …; Sn Þ ′ Πr ∡ðS1 ; S2 ; …; Sn Þ

for r=k, where 1≤i≤s. Security condition (M′-1) implies that we have the same probability of whiteness in black and white areas for stacking any less than k shadows rotated by any angles. As shown in condition (M′-2), when stacking k shadows with the specific corresponding angles in ∡ {S1, S2, …, Sn} θi, one can decode the secret Pi through the different probabilities of whiteness.

3.2. Construction of general (k, n, s)-MVCS In this paper, we construct the (k, n, s)-MVCS with the pixel expansion (s × mV) from a (k, n)-VCS of the pixel expansion mV. Our scheme has the higher whiteness probabilities in white area than the black area in a reconstructed image. Encoding and decoding of the proposed (k, n, s)-MVCS are, respectively, shown in Algorithm 1 and Algorithm 2. Table 1 is the description and diagrammatical representation of notation used in our algorithms.

Algorithm 1. Encryption of (k, n, s)-MVCS. Process blocks (s × m subpixels) in a (k, n, s)-MVCS by encrypting a secret pixel in Pi to m subpixels at the i-th row in the block Bkj . Input: Pi, i ∈ [1, s]; base matrices B0 and B1 of a (k, n)-VCS with the pixel expansion mV. Output: Sj, j ∈ [1, n]. (Step 1) For every pixel in s secret images, collect all the corresponding blocks Bkj for all i ∈ [1, s], j ∈ [1, n], and k ∈ [1, x × y]; initially set all elements in Bkj to “0”. (Step 2) for k=1, …, (x × y) do for i = 1, …, s do e 1, – e 2 , …, – en ; E(pi,k) to gain – e 2 ; …; bki;n ← – e n: bki;1 ← e1 ; bki;2 ← – – for j = 1, …, n do put bki, j into Bkj ; P[bki, 1,..., bi,k n]. k rotate {bki, j} 360° − ωi, j to obtain Bˆ j ; /* assure rotating ωi, j degree of shadow Sj clockwise for recovering secret Pi, we should rotate bki, j at a degree ωi, j anticlockwise (i.e., rotate (360°−ωi, j) clockwise) */ end for end for end for. k (Step 3) Put back all blocks Bˆ j according to the corresponding θi position in ∡ {S1, S2, …, Sn} . (Step 4) Output ringed shadows S1, S2, …, Sn.

Algorithm 2. Decryption of (k, n, s)-MVCS. Input: any k shadows (Si1, Si2, …, Sik) from Sj, j ∈ [1, n]. Output: s secret images Pi, i ∈ [1, s]. for i = 1, …, s do find the rotation angles (θi1, θi2, …, θik) of (Si1, Si2, …, Sik) in ∡ {S1, S2, …, Sn} θi; Pi = Π({Si1} θi1, {Si2} θi2, …, {Sik} θik); /* stack the rotated shadows in a suitable position to visually decode the secret */ end for

h h ∘ ∘ ∘i ∘ ∘ ∘i F i gh. 5 . D e c r y p t i o n of ( 3i, 4 , 4 ) - M V C S : ( a ) P1 = Π3 ½S1 ; S2 ; S3 ; S4  ( b ) P2 = Π3 S1 ; fS2 g30 ; fS3 g60 ; fS4 g90 ( c ) P3 = Π3 S1 ; fS2 g60 ; fS3 g120 ; fS4 g180 ( b ) P4 = ∘ ∘ ∘ Π3 S1 ; fS2 g90 ; fS3 g180 ; fS4 g270 .

4954

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

Table 1 Description and diagrammatical representation of notation used in encryption algorithm. Notation

Description

Pi

Pi, i ∈ [1, s], are the secret images having the pixels pi,k, where k ∈ [1, x × y].

Diagrammatical representation

Sj, j ∈ [1, n], are the shadows of size (x × y) × (s × mV) subpixels (note: in VCS we should arrange every (s × mV) subpixels into an (mx × my)-sized rectangle to approximate the aspect ratio of the original image, where s × mV = mx × my.

Sj

bki, j

P[⋅]

bki, j is the mV-subpixel block in Sj shadow for encrypting the k-th secret pixels in Pi; E(⋅) is to encode a secret pixel by a (k, n)-VCS, and mV subpixels of E(⋅) to the j-th shadow is –e j , 1 ≤ j ≤ n.

P[bki, 1,..., bi,k n] is the operation to randomly permute the corresponding subpixels in all n blocks bi,k j, j ∈ [1, n], into a (mx × my)-sized rectangle, where s × mV = mx × my.

3 bk1;j 7 6 k 360° − ωi, j 7 Bkj = 6 is to rotate a block bki, j by 360° − 4 ⋮ 5, and {bi, j} k bs;j 2

Bkj ωi;j k

Bˆ j

ωi, j clockwise, where {S1, …, Sn} θi = {{S1} ωi, 1, …, {Sn} ωi, n}, to make

sure all blocks will be at right positions in n shadows 2 k ω1;j fb1;j g 6 k θi ˆ (2 {S1, S2, …, Sn} ) for reconstruction. Also, Bj = 6 ⋮ 4 fbks;j gωs;j

3 7 7. 5

Next, we show the calculation of the whiteness probability for stacking any r w-out-of-m constant weight binary vector, which will be used to prove that the proposed (k, n, s)-MVCS satisfies

security and contrast conditions. We first show a lemma that determines the weight distribution of stacking two m-bit binary vectors.

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

Lemma 1. Let two m-bit binary vectors u̲1, u̲2 with Hamming weights w1 and w2, respectively, where w1 N w2. Then the binary vector (u̲1 ⊗ u̲2) with Hamming weight (w1 + i) has the probability  qw1

+ i

=

m! ðw1 −w2 + iÞ! × ðw2 −iÞ! × i! × ðm−w1 −iÞ!     m m  ; 0 ≤ i ≤ wmin ; where wmin × w1 w2

ð

(1) (1) By Lemma 1, we have q(1) 2 , q3 , q4 (q2, q3 and q4 for Case (1))



 4! 0! × 2! × 0! × 2!   4! = 1= 6 × 1! × 1! × 1! × 1!   4! = 1= 6 × 2! × 0! × 2! × 0!

ð1Þ

= = =

q2 = 1 = 6 ×



ð1Þ

q3

Þ

4955

ð1Þ

q4

4 2 4 2 4

!

4

×

2

!

4

×

2

!

2

4

×

2

! = 1 = 6 × 1 = 6 = 1 = 36; ! = 1 = 6 × 2 = 3 = 1 = 9; ! = 1 = 6 × 1=6 ¼ 1=36:

= minfm − w1 ; w2 g: Case (2) stacking a vector v3 with vector v′ of H(v′) = 3: ð2Þ

Proof. The vector (u̲1 ⊗ u̲2) stacked in the following form

ð2Þ

w1 −w2 + i

u1 = – u2 = –

z}|{ 1⋯1 ⇕ 0⋯0

w2 −i

z}|{ 1⋯1 ⇕ 1⋯1

q4

m−w1 −i

i

z}|{ 0⋯0 ⇕ 1⋯1

z}|{ 0⋯0 ; ⇕ 0⋯0



 4! 1! × 2! × 1!   4! = 2= 3 × 2! × 1! × 1!

m : ðw1 −w2 + iÞ! × ðw2 −iÞ! × i! × ðm−w1 −iÞ!

Thus, the value of q w 1 + i is then determined as =      m m m = × :The w1 w2 ðw1 −w2 + iÞ! × ðw2 −iÞ! × i! × ðm−w1 −iÞ! proof is completed. □ 

Example 4. Consider stacking r 2-out-of-4 (w = 2 and m = 4) constant weight binary vectors. Determine the probabilities of q2, q3 and q4. When stacking two vectors v′ = (v̲1 ⊗ v̲2), by Lemma 1 we then have  =

     4! 4 4 = × ; 0 ≤ i ≤ 2: 2 2 ðiÞ! × ð2−iÞ! × i! × ð2−iÞ!

So, the probabilities of q2, q3 and q4 of v′ are shown below 

 4! q2 = 0! × 2! × 0! × 2!   4! q3 = 1! × 1! × 1! × 1!   4! q4 = 2! × 0! × 2! × 0!

= = =

4 3 4 2 4 2

! × ! × ! ×

4 2 4 2 4 2

3 4 2

! × ! ×

4 2 4 2

! = 2 = 3 × 1 = 2 = 1 = 3; ! = 2 = 3 × 1 = 2 = 1 = 3:

Case (3) stacking a vector v3 with vector v′ of H(v′) = 4:

w2 − i) + (w2 − i) + i = have the Hamming weight H(u̲ 1 ⊗ u̲2) = (w  1 + m m and possible vectors for u̲1 (w1 + i). Obviously, there are w1 w2 and u̲2. The total number of (u̲1 ⊗ u̲2) in Eq. (8) is

+ i

4

ð8Þ 

ð3Þ

q2

= =

q3 = 2 = 3 ×

! = 1 = 6; ! = 2 = 3; ! = 1 = 6:

Stack another 2-out-of-4 vector v̲3 on v′ to gain v″ = (v̲3 ⊗ v̲′). To determine the probabilities of q2, q3 and q4 of v″, we should consider three cases. Case (1) stacking a vector v̲3 with vector v′ of H(v′) = 2:

     4! 4 4 × = 2 = 3 × 1 = 1 = 6: 4 2 2! × 2!

q4 = 1 = 6 ×

=

(1)

From Cases (1)–(3) the probabilities of v″ are q2 = q2 = 1/36, (1) (2) (1) (2) (3) q3 = q3 + q3 = 1/9 + 1/3 = 4/9, q4 = q4 + q4 + q4 = 1/36 + 1/3 + 1/6=19/36. As shown in the above, by Lemma1, we can determine the probabilities of q2, q3 and q4, recursively, when stacking r 2-out-of-4 vectors. □ Suppose r w-out-of-m constant weight binary vectors are v̲1, v̲2, …, v̲r. The probabilities of qw, qw + 1, …, and qm can be obtained by recursively using Lemma 1. Then, the average whiteness probability for stacking r w-out-of-m constant weight vectors is calculated in Eq. (9) (note: for the vector with Hamming weight “i” (i.e. iB(m−i)W) has the whiteness (m−i)/m).

P



v 1 ⊗⋯⊗ – vr –



m

= ∑ qi × ðm−iÞ = m:

ð9Þ

i = w1

Theorem 2. The scheme from Algorithm 1 is a (k, n, s)-MVCS satisfying the security and contrast conditions. Also, the contrast of the proposed (k, n, s)-MVCS is αM = (h − l) / m′. Proof. For a proof of the security condition

h (M′-1), we consider i θi 1 = two

cases:

h (1) we firstiprove P Hm′ Πr ∡ðS1 ; S2 ; …; Sn Þ

θi 0 P Hm ′ Πr ∡ðS1 ; S2 ; …; Sn Þ

for r ≤ (k − 1) with the specific rotation  1  φ1 angles θi, 1 ≤ i ≤ s. (2) we then proveP Hm ; fS2 gφ2 ; …; ′ Πr fS1 g   φn φ1 φ2 φn 0 fSn g ÞÞ = P Hm′ Πr fS1 g ; fS2 g ; …; fSn g ÞÞ for r ≤ (k − 1) with angles φi that are different to the angles in Case (1). Case (1): In such stacking Πr[∡ (S1, S2, …, Sn)θi], 1 ≤ i ≤ s, the i-th row in Bkj has the same whiteness in m subpixels (since the m subpixels are generated by a (k, n)-VCS). Let this probability of whiteness be p0. Other (s − 1) rows have the same whiteness probability since it is the case that randomly stacking any r constant weight binary vectors. Suppose this probability of whiteness is p′0, which can be obtained from Eq. (9). In our (k, n, s)-MVCS, every block is permuted by P[bki, 1,..., bki, n]. The probability of whiteness for the permuted block is then   determined as p0 + ðs−1Þ × p′0 = s. This probability of whiteness for the permuted block will be the same no matter

the h block is locatediin  the

θi 1 = black areas. So, iwe

or white h  have P Hm′ Πr ∡ðS1 ; S2 ; …; Sn Þ θi 0 P Hm′ Πr ∡ðS1 ; S2 ; …; Sn Þ , where m′ = (s × mV) in our (k, n, s)-MVCS.

4956

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

Case (2):  

 φ1 1 Consider P Hm ; fS2 gφ2 ; …; fSn gφn Þ , which stacks less ′ Πr fS1 g than k shadows with arbitrary angles. For this case, all rows in Bkj have the same probability of whiteness since it is the case that randomly stacking any r constant weight binary vectors. The probability of whiteness for the permuted block will be the same no matter

theh block is located iin the 1 black or white areas, and we have P H Πr ∡ðS1 ; S2 ; …; Sn Þθi = ′

h i m θi 0 ′ = p0 . P Hm′ Πr ∡ðS1 ; S2 ; …; Sn Þ  1 

 φ1 Cases (1) and (2) imply P Hm ; fS2 gφ2 ; …; fSn gφn Þ = ′ Πr fS1 g  0 

 P Hm′ Πr fS1 gφ1 ; fS2 gφ2 ; …; fSn gφn Þ for r ≤ (k − 1), with any angles φi where 0° ≤ φi ≤ 360°. This proves the first part of the theorem. Consider proving the contrast condition (M′-2). When stacking k shadows with the specific corresponding angles satisfying the angle in ∡ {S1, S2, …, Sn} θi, 1 ≤ i ≤ s, the i-th row in Bkj has the l “0” and h “0” of m subpixels for the black color and the white color (since the mV subpixels are generated by a (k, n)-VCS). So we have the whiteness probabilities in black color and white color l/mV and h/mV , respectively. As described above, other (s − 1) rows have the same whiteness probability p″0 (note: it is the case that randomly stacking any k constant weight binary vector, and the value can be obtained from Eq. (9)). Then the whiteness probability of the permuted block Bkj in the black area (respectively, the white area) is ðl = mV +   ðs−1Þ × p″0 Þ = s (respectively, h = mV + ðs−1Þ × p″0 = s). Since m′ = (s × mV), we finally have

ð

′

Sn Þ Þ = ðh−lÞ = m .

1

1

By putting these values in the first row of B11, B12, and B13, we have 2

b11;1

3

2

0 6 7 6 7 = 6 b12;1 7 = 4 − 4 5 − b13;1 2 1 3 2 b1;3 1 6 7 1 6 1 7 B3 = 6 b2;3 7 = 4 − 4 5 − 1 b3;3

1 B1

2

3

b11;2

3

2 3 1 1 1 0 1 6 7 1 6 7 1 − − 5; B2 = 6 b2;2 7 = 4 − − − 5; 4 5 − − − − − b13;2 3 1 0 − − 5: − −

ð10  1Þ

Encrypt p2,1, p3,1, and put the results into the 2nd row and 3rd row in Eq. (10-1) to obtain the final B11, B12, and B13, as shown in Eq. (10-2). 2

1 B1

0 = 40 1

2

h i 

θi 1 0 Since l b h, we then have P Hm bP Hm ′ Πk ∡ðS1 ; S2 ; …; Sn Þ ′

h i θi , for 1 ≤ i ≤ s, and the contrast of the proposed Πk ∡ðS1 ; S2 ; …; Sn Þ θi

1

b1;1 = – e 1 = ð011Þ; b1;2 = – e 2 = ð101Þ; b1;3 = – e 3 = ð110Þ:

1 1 1

3 2 1 1 1 1 5; B2 = 4 1 0 1

3 2 1 1 1 1 5; B3 = 4 1 0 1

0 0 1

1 1 1

3 0 0 5: 0

ð10  2Þ

By the same approach to encrypt other secret pixels, we have other blocks Bk1, Bk2, Bk3, 2 ≤ k ≤ 6.

8

h i

 1 θi ′ ″ > < P Hm = s × l = m + ðs−1Þ × p0 = s; ′ Πk ∡ðS1 ; S2 ; …; Sn Þ

h i

 > : P H 0 ′ Π ∡ðS ; S ; …; S Þθi = s × h = m′ + ðs−1Þ × p″ = s: 0 k 1 2 n m

(k, n, s)-MVCS is

When encrypting p1,1, we use black base matrix B1 in (2, 3)-VCS to gain e̲1 = (011), e̲2 = (101), and e̲3 = (110). Then, we have



h i  1 θi 0 αM = P Hm −P Hm ′ Πr ∡ðS1 ; S2 ; …; Sn Þ ′ ðΠr ½∡ðS1 ; S2 ; …;

0 1

1

6 3 B1 = 4 1

□

0 2

2

3

2

1

7 6 0 5; B22 = 4 1

1

7 6 0 5; B23 = 4 1

7 1 0 5;

1

0

1

1

1 0

1

1

0

7 3 6 1 0 5; B2 = 4 1 1

7 3 6 0 5; B3 = 4 1

1

7 0 5;

1 1

1

1

1

0

1 0

1

3

2

1 1

0

1 0 3

2

3

2

3

1

1 0

3

0

0 1 2

3

1

6 B21 = 4 1 1

1

2

3

3

Example 5. Construct the proposed (2, 3, 3)-MVCS by using a (2, 3)2 3 2 3 110 011 4 5 4 VCS of B0 = 110 and B1 = 101 5, with h = 1, l = 0 and mV = 3. 110 110

0 6 4 B1 = 4 0

1 1

1 0 7 4 6 1 1 5; B2 = 4 1 0

1

1 7 4 6 1 5; B3 = 4 1

1

0

1

7 0 5;

1

1 0

0

1

0

Three secret images can be reconstructed from P1 = Π2[S1, S2, S3], P2 = Π2[S1, {S2} 60°, {S3} 120°], and P3 = Π2[S1,{S2} 120°,{S3} 240°].

1 6 5 B1 = 4 0

1

1

0

1

2 1 7 5 6 1 5; B2 = 4 1

1

7 0 5;

0

1

1

1

0 0 0

To demonstrate the reconstruction, we should use a simple example, which processes 6 secret pixels in every secret image (since 360B = ððn−1Þ × sÞ=60°). Suppose 6 secret pixels in P1, P2 and P3 are, respectively, (p1,1, p1,2, p1,3, p1,4, p1,5, p1,6) = (110100), (p2,1, p2,2, p2,3, p2,4, p2,5, p2,6) = (100110), and (p3,1, p3,2, p3,3, p3,4, p3,5, p3,6) =(011010). Consider the first secret pixel (p1,1, p2,1, p3,1) in three secret images. We first collect the corresponding blocks B11, B12 and B13 at the position in three shadows S1, S2 and S3, as shown in Fig. 6.

Fig. 6. Decryption of the proposed (2,h 3, 3)-MVCS: (a)i P1 = Π2 ½S1 ; S2 ; S3  h i B B B B (b) P2 = Π2 S1 ; fS2 g60 ; fS3 g120 (c) P3 = Π2 S1 ; fS2 g120 ; fS3 g240 .

2

2

6 B1

1 6 = 41

1

1

0

0

1 1 3

0

2 1 7 5 6 1 5; B3 = 4 1

0

1

1

1 3

2

1

0

1 3

2

1

1

1 7 6 6 0 5; B2 = 4 1

1

1 1 7 6 6 0 5; B3 = 4 1 1

1

0

1

0

1

2

0

3

B11

1 1

B21

B31

B41

B51

ð10  3Þ

3

3

7 0 5:

B61

3

6 1 7 2 3 4 5 67 From (10), all blocks 6 4 B2 B2 B2 B2 B2 B2 5 is given in B13 B23 B33 B43 B53 B63 Appendix Eq. (A-1). Permute the columns in {bki, 1, bki, 2, h corresponding i bki, 3}, 1 ≤ i ≤ 3 and 1 ≤ k ≤ 6, by P bki;1 ; bki;2 ; bki;3 , and the permuted result is shown in Eq. (A-2). Next, we rotate the corresponding blocks bki, j at a degree ωi, j anticlockwise (i.e., rotate (360°-ωi, j) by {bki, j} 360° − ωi, j, where the angles are determined in ∡ {S1, …, Sn} θi = {{S1} ωi, 1, …, {Sn} ωi, n}. In (2, 3, 3)-MVCS, ω1, 1=ω1, 2= ω1, 3= 0°, ω2, 1=0°, ω2, 2=60°, ω2, 3=120°, ω3, 1=0°, ω3, 2=120°, ω3, 3=240°. For example, in Eq. (A-2), we should rotate b22, 1, b22, 2, and b22, 3, as follows: fb2;1 g

2

360B−ω2;1

= fb2;1 g

2

360B−ω2;2

= fb2;2 g

fb2;2 g

2

360B−0B

2

360B−60B

2

↦b2;1 ðno rotationÞ; 2

300B

= fb2;2 g

1

↦b2;2 ;

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

4957

Table 2 The whiteness of black and white areas in reconstructed image for different stacking ways. P1

pB

pW

(pB–pW)

P2

pB

pW

(pB–pW)

P3

pB

pW

(pB–pW)

Π[S1, S2] Π[S1, S3] Π[S2, S3] Average

1/27 3/27 0/27 4/81

3/27 5/27 5/27 13/81

2/27 2/27 5/27 9/81

Π[S1, {S2} 60°] Π[S1,{S3} 120°] Π[{S2} 60°,{S3} 120°] Average

3/27 2/27 1/27 6/81

6/27 4/27 5/27 15/81

3/27 2/27 4/27 9/81

Π[S1,{S2} 120°] Π[S1,{S3} 240°] Π[{S2} 120°,{S3} 240°] Average

0 4/27 1/27 5/81

7/27 5/27 7/27 19/81

7/27 1/27 6/27 14/81

2

360B−ω2;3

fb2;3 g

2

360B−120B

= fb2;3 g

2

1

2

2

240B

= fb2;3 g 3

4

5

6

↦b2;3 : 6

Bˆ 1 Bˆ 1 Bˆ 1 Bˆ 1 Bˆ 1 Bˆ 1

3

6 7 6 1 2 3 4 5 67 7 The rotated result 6 6 Bˆ 2 Bˆ 2 Bˆ 2 Bˆ 2 Bˆ 2 Bˆ 2 7 of Eq. (A-2) is shown 4 5 in Eq. (A-3). 1 2 3 4 5 6 Bˆ 3 Bˆ 3 Bˆ 3 Bˆ 3 Bˆ 3 Bˆ 3 In every 9-pixel block (m′ = (s × mV) = 9) of three shadows (see Eq. (A-3)), we have same Hamming weight (6B3W). The probabilities of whiteness in black and white areas are all 3/9 = 1/3, and thus satisfy security condition (M′-1). Consider decoding, we can decrypt three secrets by P1 = Π2[S1, S2, S3], P2 = Π2[S1,{S2} 60°,{S3} 120°], and P3 = Π2[S1,{S2} 120°,{S3} 240°], respectively. All possible stacked results are shown below.

image is pB (respectively, pW). From Eq. (11), all pB and pW for P1, P2, in P3 are calculated (Table 2). It is observed that our (2, 3, 3)-MVCS actually have the difference of black and white areas even in this simple example (only 6 pixels in each secret image). The average contrast differences of P1, P2 and P3 are 9/81, 9/81 and 14/81. The theoretical contrast difference of the proposed (k, n, s)-MVCS is αM = (h − l)/(s × mV) = 1/9 for this example. Based on this difference of probability, we can distinguish between the black and white colors as a probabilistc VCS. □ 4. Experiment and comparison 4.1. Experimental results Three experiments are conducted to show the generality (any k, n and s), and also evaluate the performance of the proposed (k, n, s)-MVCS. The pixel expansion and the contrast in the reconstructed images are also examined. Experiment #1: (2, 2, 3)-MVCS is the scheme like (2, 2, 3)-MVCSs in [20,21]. Experiment #2: (2, 3, 3)MVCS demonstrates the generality of our construction, which is not only for the simple 2-out-of-2 scheme. Experiment #3: (3, 3, 3)-MVCS show the effectiveness of our construction for k N 2. In these three experiments, we take the printed texts , , , as three secret images, as shown in Fig. 7. All experiments show the effectiveness of our construction; we really decode the secrets by human visual sight. Example #1. Construct the proposed (2, 2, 3)-MVCS based on a (2, 2)VCS in Example 1. Since 360B = ððn−1Þ × sÞ = 120B, so we could reconstruct three secrets by h i θ P1 = Π ∡ðS1 ; S2 Þ 1 = Π½S1 ; S2 ;

h i h i θ 120B ; P2 = Π ∡ðS1 ; S2 Þ 2 = Π S1 ; fS2 g

To evaluate the probabilistic performance of black and white areas, half the secret pixels in this example ae black (note: secret pixels are (■■□■□□) in P1, (■□□■■□) in P2, (□■■□■□) in P3). Let the whiteness of a black (respectively, white) area in a reconstructed

Fig. 7. Three printed-text secret images in experiments: (a) P1 = (c) P3 = .

(b) P2 =

4958

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

h i h i θ 240B : P3 = Π ∡ðS1 ; S2 Þ 1 = Π S1 ; fS2 g

h i h i θ 120B 240B P3 = Π2 ∡ðS1 ; S2 ; S3 Þ 3 = Π2 S1 ; fS2 g : ; fS3 g

Fig. 8 shows the reconstructed images when stacking two ringed shadows. We can visually reveal the secrets , , in Fig. 8 (a–c), respectively. The pixel expansion and the contrast of the proposed (2, 2, 3)-MVCS is 6 and 1/6 (the probabilistic difference). The circular (2, 2, 3)-MVCS [20] also has the pixel expansion and the contrast 6 and 1/6 (the deterministic difference). Although the deterministic performance is better than our probabilistic performance, it will be distorted due to the different sizes of sectorial subpixels. The other ringed (2, 2, 3)-MVCS [21] having the pixel expansion and the contrast 9 and 1/9 is worse than our (2, 2, 3)MVCS. □

Fig. 9 shows the reconstructed images when stacking two out of three ringed shadows. We can visually reveal the secrets , , in Fig. 9(a–c), respectively. The pixel expansion and the contrast of the proposed (2, 3, 3)-MVCS is 9 and 1/9. □

Example #2. Construct the proposed (2, 3, 3)-MVCS based on a (2, 3)-VCS. The detailed encoding is given in Example 5. Three secrets can be reconstructed by

Example #3. Construct the proposed (3, 3, 3)-MVCS based on a (3, 2 3 2 3 0110 1001 4 5 4 3)-VCS of B0 = 1010 and B1 = 0101 5, where h = 1, l = 0 and 1100 0011 m = 4. Since 360B = ððn−1Þ × sÞ is also 60°, the stacking positions of shadows are the same to the (2, 3, 3)-MVCS. The difference is that we need all three shadows for reconstruction in (3, 3, 3)-MVCS. We could reconstruct three secrets by

h i θ P1 = Π2 ∡ðS1 ; S2 ; S3 Þ 1 = Π2 ½S1 ; S2 ; S3 ;

h i θ P1 = Π2 ∡ðS1 ; S2 ; S3 Þ 1 = Π½S1 ; S2 ; S3 ;

h i h i θ 60B 120B ; P2 = Π2 ∡ðS1 ; S2 ; S3 Þ 2 = Π2 S1 ; fS2 g ; fS3 g

h i h i θ 60B 120B ; P2 = Π2 ∡ðS1 ; S2 ; S3 Þ 2 = Π S1 ; fS2 g ; fS3 g

Fig. 8. Reconstructed images of the proposed (2, 2, 3)-MVCS: (a) P1 = Π½S1 ; S2  =

h i B (b) P2 = Π S1 ; fS2 g120 =

h i B (c) P3 = Π S1 ; fS2 g240 =

.

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

Fig. 9. Reconstructed images of the proposed (2, 3, 3)-MVCS: (a) P1 = Π2 ½S1 ; S2 ; S3  =

h i h i θ 120B 240B P3 = Π2 ∡ðS1 ; S2 ; S3 Þ 3 = Π S1 ; fS2 g ; fS3 g : Fig. 10 shows the reconstructed images when stacking all three , , ringed shadows. We can visually reveal the secrets in Fig. 10(a–c), respectively. Since the pixel expansion and the contrast of the proposed (3, 3, 3)-MVCS is 12 and 1/12, it is observed that the visual quality of the reconstructed image is degraded when compared with the proposed (2, 2, 3)-MVCS and (2, 3, 3)-MVCS. □ 4.2. Comparison and discussion 4.2.1. Comparison From experimental results, Table 3 summarizes the comparison of MVCSs for the following items — the visual distortion, the shadow shape, the generality (construction method can be applied on any k and n), the number of secrets, the pixel expansion, the whiteness in a reconstructed image, and the contrast. Our MVCS and the MVCSs in [12,18,20] have ringed shadows, where the sizes of all subpixels are same, so that the shape won't be distorted save the aspect ratio. However, in the circular MVCS [20], the sectorial subpixel near the center of a circle is smaller than others and this will cause distortion. All previous MVCSs are simple 2-out-of-2 schemes, while the proposed MVCS can be applied on any k and n. Some MVCSs are only designed for the particular number of secret images. The scheme in [17] encrypts two secrets, while the scheme in [18] encrypts four secrets. The MVCSs [20,21] and our MVCS could work on s secrets, where s ≥ 2. Our pixel expansion is lesser than all previous MVCSs. Nevertheless, the proposed (k, n, s)-MVCS performs like a probabilistic VCS , but other MVCSs are all deterministic VCSs.

h i B B (b) P2 = Π2 S1 ; fS2 g60 ; fS3 g120 =

4959

h i B B (c) P3 = Π2 S1 ; fS2 g120 ; fS3 g240 =

.

Furthermore, a comparison between our scheme and the existing (2, 2, 2)-MVCS, (2, 2, 4)-MVCS and (2, 2, s)-MVCS [17,18,20,21] is also given in Table 4 to examine the pixel expansion and the contrast. 4.2.2. Discussion Next, we discuss the following issues for the proposed (k, n, s)MVCS more in detail: (1) probabilistic nature, (2) alignment problem and (3) application. Probabilistic nature: In the conventional (k, n)-VCS, every black m-subpixel block has (m − l)BlW while white m-subpixel block has (m − h)BhW. It assures the (k, n)-VCS of a deterministic contrast in a reconstructed image. For example, a (2, 3)-VCS in Example 5 uses 3B0W and 2B1W to represent the black and white secret pixels, respectively. On the other hand, the probabilistic (k, n)-VCS has the non-expanded shadow size but its probabilistic nature will diminish the visual quality as discussed in [3,5]. Even though our encryption is based on a deterministic (k, n)-VCS, our scheme performs like a probabilistic VCS. The probabilistic (k, n)-VCS barters for the advantage (non-expanded shadow) with its contrast, while our (k, n, s)-MVCS trades the contrast for the generality (any k and n) and the multi-secret feature. As shown in Eq. (9), the average whiteness probability for stacking r constant weight

 vector P – v ⊗⋯⊗ v approaches to zero for large r. Table 5 shows the 1 –r average whiteness probability for stacking two 1-out-of-2 vectors, three 2-out-of-3 vectors, three 2-out-of-4 vectors in Experiments #1–#3, respectively.

 For example, in the (3, 3, 3)-MVCS, the P v ⊗ v ⊗ v is only –1 –2 –3 1/8, and thus the influence of the uncertainty is reduced when stacking three 2-out-of 3 vectors. Therefore, our probabilistic weakness will be mitigated for large k, and the proposed (k, n, s)-

4960

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

Fig. 10. Reconstructed images of the proposed (3, 3, 3)-MVCS: (a) P1 = Π½S1 ; S2 ; S3  =

MVCS will be more similar to a (k, n)-MVCS with the deterministic contrast (h − l) / (s × m V ). Al so, it i s observed that the

P v ⊗ v ⊗ v of (2, 3, 3)-MVCS is 1/27, and this implies that –1 –2 –3 the reconstructed image will be clearer when stacking three shadows. As shown in Fig. 11, the reconstructed image =

h i B B (b) P2 = Π S1 ; fS2 g60 ; fS3 g120 =

h i B B (c) P3 = Π S1 ; fS2 g120 ; fS3 g240 =

Π½S1 ; S2 ; S3  has the clear edge than = Π2 ½S1 ; S2 ; S3  (see Fig. 9 (a)) in the (2, 3, 3)-MVCS. Alignment problem: The shadow alignment problem in applying VCS is a major concern all the time. Compare our ring-based (k, n, s)-MVCS with the conventional (k, n)-VCS, there are two different

Table 3 Comparison between the proposed (k, n, s)-MVCS and other MVCSs. The proposed (k, n, s)-MVCS Distortion No Shadow shape Ringed The generality (any k and n) Yes Number of secrets s≥2 Pixel expansion s × mV The whiteness in reconstructed image Probabilistic Contrast (h − l) / (s × mV)

Circular (2, 2, s)-MVCS [20] Ringed (2, 2, s)-MVCS [21] Ringed (2, 2, 2)-MVCS [17] Ringed (2, 2, 4)-MVCS [18] Yes Circular No (k = n = 2) s≥2 s×2 Deterministic 1/ (2s)

No Ringed No (k = n = 2) s≥2 s×3 Deterministic 1/ (3s)

No Ringed No (k = n = 2) s=2 4 Deterministic 1/4

No Ringed No (k = 2, n = 4) s=4 9 Deterministic 2/9

Table 4 Comparison of the pixel expansion and the contrast for MVCSs for k = n = 2. The proposed (k, n, s)-MVCS Circular (2, 2, s)-MVCS [20] Ringed (2, 2, s)-MVCS [21] Ringed (2, 2, 2)-MVCS [17] Ringed (2, 2, 4)-MVCS [18] The pixel expansion s = 2 s=4 any s The contrast s=2 s=4 any s

4 8 s×2 1/4 1/8 1/(s × 2)

4 8 s×2 1/4 1/8 1/(s × 2)

.

6 12 s×3 1/6 1/12 1/(s × 3)

4 – – 1/4 – –

– 9 – – 2/9 –

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

4961

Table 5 Average whiteness probabilities for stacking two 1-out-of-2 vectors, three 2-out-of-3 vectors, three 2-out-of-4 vectors. (k, n, s)-MVCS

r

q1

q2

q3

q4

Pðv1 ⊗⋯⊗ vr Þ

(2, 2, 3)-MVCS

1 2 1 2 3 1 2 3

1 (1B1W) 1/2 (1B1W) – – – – – –

0 1/2 (2B0W) 1 (2B1W) 1/3 (2B1W) 1/9 (2B1W) 1 (2B2W) 1/6 (2B0W) 1/36 (2B0W)

– – 0 2/3 8/9 0 2/3 4/9

– – – – – 0 1/6 (4B0W) 19/36 (4B0W)

1/2 1/4 1/3 1/9 1/27 1/2 1/4 1/8

(2, 3, 3)-MVCS

(3, 3, 3)-MVCS

alignment scenarios. First, consider the shadow type. In fact rotating ringed shadows with a precise angle is not so hard as stacking two rectangular shadows. When stacking two rectangular shadows, we often keep to one side and then shift one shadow along another direction for stacking them. In such case, stacking rectangular shadows is similar to rotating ringed shadow. Second, consider the number of shadows. Recovering more than one secret image in our MVCS is indeed difficult than recovering one secret image from the conventional VCS. However, for every secret reconstruction, both (k, n)-VCS and (k, n, s)-MVCS need stacking k shadows. Actually, MVCS rotates multiple ringed shadows at different angles is not that easy as stacking multiple rectangular shadows. Fortunately, there are two VCSs in [22,23] that can resolve alignment problem. Two kinds of alignment problems were considered. The scheme in [22] considers the misalignment with integer number of subpixels, while the scheme in [23] tolerates the misalignment within less than one subpixel. Both schemes are not necessary to align the shadows precisely. One can still decode the secret image visually even though there is misalignment. When encountering the alignment problem in practical implementation, we can apply the approaches in [22,23] on all VCSs including our MVCS to mitigate this problem. Application: The property of sharing multiple secrets really indicates the wide range of potential applications. To explicitly address the potential applications of MVCS, some concrete application examples are shown as follows to illustrate the real cases. (1) In general, the (k, n)-threshold scheme can be applied in a distribution system, where n shadows are delivered and stored in distributed storage nodes. Owing to the threshold property, the failure of (n − k) shadows during transmission does not affect the reconstruction phase. When processing lots of secret images, the conventional VCS should use lots of shadows for different secret images during transmissions since it deals with only one secret image. In such application,

(3B0W) (3B0W) (3B1W) (3B1W)

MVCS sends less number of shadows and will be more efficient than VCS. (2) Except that extended VCS has the meaningful images on shadows, most VCSs have noise-like shadows. Such shadows are difficult for management. For the same amount of secret image, VCS needs more shadows than MVCS, and will have more serious management problem. (3) VCS only has one decoding way that reveals either the entire image or nothing when achieving the threshold. In some cases, we may require different decoding ways to reveal different secret images gradually. Suppose all images are alphanumerical secrets, and these secrets can be combined in a specific order to yield a password. Therefore, the knowledge of combining these alphanumerical secrets in which order will enhance the secrecy in VCS-based visual authentication system [24–26]. (4) If the secret images have relations and are considered as a unity, we should embed them into a same scheme. For example, a secret image is too large to share by VCS. We could dived it into several secret images and then embed them by MVCS. Then, the reconstruction of all secret images can be combined to yield a large secret image. Another example may be that a secret image is a watermark for other secret images, and this application scenario also needs MVCS.

From the above description, the property of sharing multiple secrets has intended applications. We believe that our (k, n, s)MVCS with the generality (k ≥ 2) will serve as a basis for more applications. 5. Conclusion In this paper we discussed the general (k, n, s)-MVCS, which can be applied on any k and n. Also, we define the formal security and contrast conditions of (k, n)-MVCS. The proposed (k, n, s)-MVCS can be easily implemented on basis of a conventional (k, n)-VCS. Our main contribution is theoretically to prove this (k, n, s)-MVCS satisfying the security and contrast conditions. However, our scheme is a probabilistic (k, n, s)MVCS. Construction of a (k, n, s)-MVCS with the deterministic contrast is interesting and deserves further studying. We leave this as an open problem. Acknowledgement

Fig. 11. Reconstructed image P1 = Π½S1 ; S2 ; S3  =

in the proposed (2, 3, 3)-MVCS.

This work was supported in part by Testbed@TWISC, National Science Council under the Grant NSC 99-2219-E-006-011.

4962

C.-N. Yang, T.-H. Chung / Optics Communications 283 (2010) 4949–4962

Appendix A. 2

2

B11

6 1 6B 4 2 B13

2

B21

B31

B41

B51

B2

2

B2

3

B2

4

B2

B23

B33

B43

B53

6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 3 6 B61 6 7 6 67 B2 5 = 6 6 6 6 6 B3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4

5

B11 6 1 6B 4 2

B21

B31

B41

B51

2 B2

3 B2

4 B2

5 B2

1 B3

2 B3

3 B3

4 B3

5 B3

b11;1

2

b12;1 =

6 7 6 7 6 011 7 4 5

1

b12;2 =

3

110

b13;1 b1;2

011

b21;1

2

b22;1 =

6 7 6 7 6 110 7 4 5

3 101 6 7 6 7 6 101 7 4 5

2

b1;2

1

3 101 6 7 6 7 6 110 7 4 5

6 6 ˆ1 ˆ2 ˆ3 ˆ4 ˆ5 6 B2 B2 B2 B2 B2 4 1 2 3 4 5 Bˆ 3 Bˆ 3 Bˆ 3 Bˆ 3 Bˆ 3

b32;1 =

6 7 6 7 6 110 7 4 5

2

110

3

011

3

b1;2

2

b42;1 =

6 7 6 7 6 011 7 4 5

3 110 6 7 6 7 6 110 7 4 5

4

b1;2

3

b51;1

3

3

011

b53;1 b51;2

b61;1

3 110 6 7 6 7 6 101 7 4 5

b62;1 =

6

b1;2 b62;2 =

101

5

6

b3;2

b3;2

b3;2

b3;2

b3;2

b3;2

b21;3

b31;3

b41;3

b1;3

5

b61;3

b12;3 = b13;3

2

3 110 6 7 6 7 6 110 7 4 5 110

2

6 6 6 6 6 6 6 6 6 6 6 6 6 6 6 3 6 B61 6 h i 6 7 k k k 67 6 B2 5 P bi;1 ; bi;2 ; bi;3 = 6 6 6 → 6 B3 6 6 6 6 6 6 6 6 6 6 6 6 6 6 4

2

3 110 6 7 6 7 6 110 7 4 5

b22;3 =

110

b23;3

2

b12;1 =

6 7 6 7 6 011 7 4 5

6 6 6 6 6 6 6 6 6 6 6 6 6 6 3 6 ˆB6 6 1 6 7 6 k 360B−ωi;j 67 =6 = fbi;j g Bˆ 2 7 6 5 → 6 6 6 6 Bˆ 3 6 6 6 6 6 6 6 6 6 6 6 6 6 4

3

6 7 6 7 6 011 7 4 5

3

110

101

2

b32;1 =

6 7 6 7 6 101 7 4 5

3

110

3

3 110 6 7 6 7 6 110 7 4 5 110

b53;3

b31;1

110

2

b52;3 =

b62;3 = b63;3

b41;1

2

b42;1 =

6 7 6 7 6 101 7 4 5

110

3

5

b1;1 5

b2;1 =

011

4

2

101

ðA  1Þ

b61;1

3

6 7 6 7 6 101 7 4 5

b62;1 =

110

5

6

b3;1

b3;1

b3;1

b3;1

b3;1

1 b1;2

2 b1;2

3 b1;2

4 b1;2

5 b1;2

6 b1;2

1 b2;2

2 =

3 011 6 7 6 7 6 110 7 4 5

2 b2;2

101

2 =

3 110 6 7 6 7 6 011 7 4 5

3 b2;2

110

2

3 110 6 7 6 7 6 101 7 4 5

=

011

4 b2;2

2 =

3 101 6 7 6 7 6 011 7 4 5 011

b52;2

b3;2

b3;2

b3;2

b3;2

b53;2

1 b1;3

2 b1;3

3 b1;3

4 b1;3

b51;3

1

2

2

1

b2;3 =

3 110 6 7 6 7 6 101 7 4 5

6 7 6 7 6 011 7 4 5

2

2

b2;3 =

3

011

3

011 2

3 110 6 7 6 7 6 101 7 4 5 101

2

b22;1 =

6 7 6 7 6 011 7 4 5

3

b2;2 =

b42;3 = b63;3

011

3

101 2

3

101

3

110

3

011

2

b32;1 =

6 7 6 7 6 101 7 4 5

2

3 101 6 7 6 7 6 110 7 4 5 101

References [1] M. Naor, A. Shamir, Lecture Notes in Computer Science 950 (1995) 1. [2] R. Ito, H. Kuwakado, H. Tanaka, IEICE Trans. on Fund. of Elect. Comm. and Comp. Sci. E82-A (1999) 2172. [3] C.N. Yang, Pattern Recognition Letters 25 (2004) 481. [4] C.N. Yang, T.S. Chen, IEICE Trans. on Fund. of Elect. Comm. and Comp. Sci. E89-A (2006) 620. [5] S. Cimato, R. De Prisco, A. De Santis, The Computer Journal 49 (2006) 97. [6] C.C. Lin, W.H. Tsai, Pattern Recognition Letters 24 (2003) 349. [7] J.C. Hou, Pattern Recognition 36 (2003) 1619. [8] S.J. Shyu, Pattern Recognition 39 (2006) 866. [9] C.N. Yang, T.S. Chen, Pattern Recognition 41 (2008) 3114. [10] G. Ateniese, C. Blundo, A. De Santis, D.R. Stinson, Theoretical Computer Science 250 (2001) 143. [11] C.N. Yang, T.S. Chen, International Journal of Pattern Recognition and Artificial Intelligence 21 (2007) 879. [12] F. Liu, C.K. Wu, X.J. Lin, The Computer Journal 53 (2010) 107. [13] P. Tuyls, H.D.L. Hollmann, J.H. Van Lint, L. Tolhuizen, Designs, Codes and Cryptography 37 (2005) 169.

110

3

110 2

b42;2 =

6 7 6 7 6 011 7 4 5

2

b52;3 = b13;3

110

3

011

3 b1;3

2

4

b2;3 =

3 011 6 7 6 7 6 110 7 4 5

3 110 6 7 6 7 6 011 7 4 5 101

2

b42;1 =

6 7 6 7 6 101 7 4 5

3

011 2

b52;2 =

6 7 6 7 6 110 7 4 5

b41;3 b62;3 = b23;3

3

101

b63;2 2

3 011 6 7 6 7 6 011 7 4 5 011

6

b2;2 =

011

6

b3;2 6 b1;3

2

5

3 101 6 7 6 7 6 011 7 4 5

6

b2;3 =

101

5

b51;1 5

b2;1 =

2

6

101

3

110 2

b62;2 =

6 7 6 7 6 011 7 4 5

b51;3 b12;3 = b33;3

3

101

b13;2 2

3 101 6 7 6 7 6 101 7 4 5 101

b61;1 b62;1 = b63;1

b51;2

101

3 37 7 6 77 6 77 6 011 7 7 4 57 7 101 7 7 7 7 7 7 2 37 110 7 7 6 77 6 77 7: 6 011 7 7 4 57 7 101 7 7 7 7 7 7 2 37 110 7 7 6 77 6 77 6 011 7 7 4 57 7 101 5 2

110

b3;3

6 7 6 7 6 101 7 4 5

b53;1

b41;2

101

=

3 101 6 7 6 7 6 110 7 4 5

b3;3

b41;1

110

2

b2;3 =

011

4

b43;1

b31;2

b53;2

4

b3;3

b31;1

b33;1

6 7 6 7 6 101 7 4 5

b43;2 b21;3

3 110 6 7 6 7 6 101 7 4 5

b3;3

b21;1

2 b1;2

2

b2;3 =

011

2

b23;1

6 7 6 7 6 011 7 4 5

b33;2 1 b1;3

101

101

b13;1

b2;2 =

2

3 101 6 7 6 7 6 011 7 4 5

b3;3

b12;1 =

1 b1;2

3

2

b2;3 =

101

1

2

b53;3

b22;1 = 2

3 110 6 7 6 7 6 110 7 4 5

b43;3

2

011

2

b42;3 =

110

b3;1

b11;1

3

110

b21;1

101

1

3 110 6 7 6 7 6 110 7 4 5

b33;3

b11;1

101

2

b32;3 =

3 37 7 6 77 6 77 6 110 7 7 4 57 7 110 7 7 7 7 7 7 2 37 110 7 7 6 77 6 77 : 6 110 7 7 4 57 7 7 110 7 7 7 7 7 7 2 37 110 7 7 6 77 6 7 6 110 7 7 4 57 7 7 110 5 2

b63;1

2

b52;2 =

110

110

6 7 6 7 6 011 7 4 5

5

3 101 6 7 6 7 6 101 7 4 5

4

2

b2;1 =

2

b42;2 =

101

011

110

b43;1

2

b32;2 =

b41;1

b11;3

2

1 2 3 4 5 Bˆ 1 Bˆ 1 Bˆ 1 Bˆ 1 Bˆ 1

2

101

b3;3

2

b31;1

b33;1

2

b22;2 =

110

3

011

b23;1

2

011

6

b1;2 1

b2;2 = b23;2 b61;3 b22;3 = b43;3

3 37 7 6 77 6 77 6 011 7 7 4 57 7 101 7 7 7 7 7 7 2 37 110 7 7 6 77 6 77 6 110 7 7 7: 4 57 7 110 7 7 7 7 7 7 2 37 110 7 7 6 77 6 7 6 011 7 7 4 57 7 7 011 5 2

ðA  2Þ

110

ðA  3Þ

[14] D.S. Tsai, T.H. Chen, G. Horng, Pattern Recognition 40 (2007) 2356. [15] C.N. Yang, T.S. Chen, Pattern Recognition 39 (2006) 1300. [16] K.Y. Chen, W.P. Wu, C.S. Laih, Proceedings of International Computer Symposium Workshop on Cryptography and Information Security, 2000, p. 73. [17] H.C. Hsu, T.S. Chen, Y.H. Lin, Proceedings of IEEE International Conference on Networking, Sensing & Control, 2004, p. 996. [18] J. Chen, T.S. Chen, H.C. Hsu, Y.H. Lin, The Image Science Journal 57 (2009) 101. [19] H.C. Wu, C.C. Chang, Computer Standards & Interfaces 28 (2005) 123. [20] S.J. Shyu, S.Y. Huang, Y.K. Lee, R.Z. Wang, K. Chen, Pattern Recognition 40 (2007) 3633. [21] J.B. Feng, H.C. Wu, C.S, Tsai, Y.F. Chang, Y.P. Chu, Pattern Recognition 41 (2008) 3572. [22] F. Liu, C.K. Wu, X.J. Lin, Designs, Codes and Cryptography 50 (2009) 215. [23] C.N. Yang, A.G. Peng, T.S. Chen, Signal Processing 89 (2009) 1602. [24] M. Naor, B. Pinkas, Lecture Notes in Computer Science 1294 (1997) 322. [25] H. Yamamoto, Y. Hayasaki, N. Nishida, Optics Letters 28 (2003) 1564. [26] P. Tuyls, T. Kevenaar, G.J. Schrije, A.A.M. Staring, M. Van Dijk, Lecture Notes in Computer Science 2802 (2003) 271.