Visual Cryptography from Halftone Error Diffusion

1.1 Introduction
Visual cryptography (VC), proposed by Naor and Shamir [19] M. Naor and A. Shamir. Visual cryptography. Advances in Cryptography: EUROCRYPT'94, LNCS, 950:1{12, 1995. in[19],[ is a paradigm for cryptographic schemes that allows the decoding of concealed images without any cryptographic computation. Particularly in a k-out-of-n visual secret sharing scheme (VSS), a secret image is cryptographically encoded into n shares.

1
Visual Cryptography from Halftone Error Diffusion
1.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1.1.1 Visual Cryptography . . . . . . . . . . . . . . . . . . . 2 1.1.2 Halftone Visual Cryptography . . . . . . . . . . . . . 3 1.1.3 Blue Noise Error Diffusion . . . . . . . . . . . . . . . . 3 1.2 Visual Secret Sharing . . . . . . . . . . . . . . . . . . . . . . 5 1.2.1 Notion and Formal Definitions . . . . . . . . . . . . . 5 1.2.2 Construction of VSS Scheme . . . . . . . . . . . . . . 8 .1.3 Halftone VSS Construction Using Error Diffusion . . . . . . 9 1.3.1 Share Structure . . . . . . . . . . . . . . . . . . . . . . 9 1.3.2 Distribution of SIPs and ABPs . . . . . . . . . . . . . 11 1.3.3 Generation of Halftone Shares via Error Diffusion . . 14 1.4 Halftone VSS Construction Using Parallel Error Diffusion . . 16 1.5 Quality of Halftone Shares . . . . . . . . . . . . . . . . . . . 17 1.6 Discussion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1.6.1 Improvement of Image Quality . . . . . . . . . . . . . 19 1.6.2 Comparison with Other Methods . . . . . . . . . . . . 19 1.6.3 Image Decoding . . . . . . . . . . . . . . . . . . . . . 19 1.7 Simulation Results . . . . . . . . . . . . . . . . . . . . . . . . 20 1.8 Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Bibliography . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

1.1 Introduction
Visual cryptography (VC), proposed by Naor and Shamir [19] M. Naor and A. Shamir. Visual cryptography. Advances in Cryptography: EUROCRYPT'94, LNCS, 950:1{12, 1995. in[19],[ is a paradigm for cryptographic schemes that allows the decoding of concealed images without any cryptographic computation. Particularly in a k-out-of-n visual secret sharing scheme (VSS), a secret image is cryptographically encoded into

n shares. Each share resembles a random binary pattern. The n shares are then xeroxed onto transparencies respectively and distributed among n participants. The secret images can be visually revealed by stacking together any k or more transparencies of the shares and no cryptographic computation is needed

by inspecting less than k shares, one cannot gain any information about the secret image, even if infinite computational power is available. Aside from the obvious applications to information hiding, VC can be applied to access control, copyright protection [10] [10] A. Houmansadr and S. Ghaemmaghami. A novel video watermarking method using visual cryptography. In Proc. IEEE Int. Conf. on Engineering of Intelligent Systems, Islamabad, Pakistan, Apr. 2006. Water marking [8] [8] M. S. Fu and O. C. Au. Joint visual cryptography and watermarking. In Proc. IEEE Int. Conf. on Multimedia and Expo, Taipei, Taiwan, Jun. 2004. visual authentication, and identification [18]. [18] M. Naor and B. Pinkas. Visual authentication and identi_cation. Crypto97, LNCS, 1294:322{340, 1997.

1.1 Introduction 1.2

Particularly in a k-out-of-n visual secret sharing scheme (VSS), a secret image is cryptographically encoded into n shares. Each share resembles a random binary pattern.

1.1.1 visual cryptography VR IS CALLED SECRET SHARING [SS]

In a conventional SS scheme, a secret image is shared among n participants in such a way that subsets of quali_ed participants can pull their shares and recover the secret but subsets of forbidden participants can obtain no information about it. The surprising novelties of a VSS scheme are in representing data as images and in an elementary realization of the reconstruction phase, consisting of just viewing the image obtained after stacking transparencies

THE VISUAL QUALITY is signeficantly better than that attained by any available VSS METHOD KNOWN TO DATE as a result, adversaries, inspecting a half tone share ,are less likely to suspect that cryptographic information is hidden . A higher security level is thus achived [26,23 ]

[23] Z.Wang and G. R. Arce. Halftone visual cryptography via error di_usion. IEEE Trans. Inf. Forensics Security, 4(3):383{396, Sep. 2009

[26] Z. Zhou, G. R. Arce, and G. Di Crescenzo. Halftone visual cryptography. IEEE Trans. Image Process., 15(8):2441{2453, Aug. 2006.
2012

For HVC construction method it is necessary to generate mutually exclusive set of pixels The method error diffusion is modified so as to produce multiple tone output pixel where the Pixels of each tone assigned to a pixel set Multi tone error diffusion is obtained by simply replacing the thresh holding block by a Multi leveled quantization in half tone error diffusion.
Multi tone error diffusion can generate multi tone images where the pixels of each tone are homogeneously distributed. The multi tone error diffusion algorithm proposed in [4] is used for generation of mutually exclusive pixel set [4] J. Bacca, G. R. Arce, and D. L. Lau. Blue noise multi tone dithering. IEEE Trans. Image Process., 17(8):1368{1382, Sep. 2008. This algorithm jointly optimizes the distribution of multi tone pixels by locating the pixels of different tones in a correlated fashion so that the mutual interference between different tones is minimized and multi tone pixels are well separated from each other. Refer to [4] for details. [4] J. Bacca, G. R. Arce, and D. L. Lau. Blue noise multi tone dithering. IEEE Trans. Image Process., 17(8):1368{1382, Sep. 2008.

1.2 Visual secret sharing Visual cryptography description is [19,2 ] on consept references [2] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Visual cryptography for general access structures. Information and Computation, 129(2):86{106, Sept. 1996. [19] M. Naor and A. Shamir. Visual cryptography. Advances in Cryptography: EUROCRYPT'94, LNCS, 950:1{12, 1995.

1.2.1 1.2.2

Notion and Formal Definitions

The principles of VSS, consider a simple 2-out-of-2 VSS scheme shown in Figure 1.3. Each pixel p taken from a secret binary image is encoded into a pair of black and white sub pixels in each of the two shares. If p is white/black, one of the first/last two columns tabulated under the white/black pixel in Figure 1.3 is selected. The selection is random such that each column is selected with a 50% probability.

Is selected with a probability .Then, the first two sub pixels in that column are assigned to share 1 and the following two sub pixels are assigned to share 2. Independent of whether p is black or white, p is encoded into two sub pixels of black-white or white-black with equal probabilities. Thus, an individual share gives no clue as to whether p is black or white [26, 25]. Now consider the superposition of the two shares as shown in the last row of Figure 1.3. If the pixel p is black, the superposition of the two shares outputs two black Sub pixels corresponding to a gray level 1. If p is white, it results in one white and one black sub pixel, corresponding to a gray level 1/2. Then by stacking two shares together, we can obtain the full information of the secret image. Figure 3.24 shows an example of the application of the 2-out-of-2 VSS scheme. Figure 1.4(a) shows a secret binary image SI to be encoded. According to the encoding rule shown in Figure 1.3, each pixel p of SI is split into two sub pixels in each of the two shares, as shown in Figure 1.4(b) and Figure 1.4(c). Superimposing the two shares leads to the output secret image FIGURE 1.4 Example of 2-out-of-2 scheme. The secret image (a) is encoded into two shares (b)-(c) showing random patterns. The decoded image (d) shows the secret image with 50% contrast loss. (Reprinted with permission from IEEE Trans. Inf. Forensics Security, vol. 4, no. 3, pp. 383{396, Sep. 2009 c IEEE 2009

Figures are on page7 of the book

The participants in X are able to observe the secret image without performing any cryptographic computation. VSS is characterized by two parameters: the pixels expansion , which is the number of sub pixels on each share that each pixel of the secret image is encoded into, and the contrast _, which is the measurement of the difference of a black pixel and a white pixel in the reconstructed image [5]. [5] C. Blundo, P. D'Arco, A. De Santis, and D. R. Stinson. Contrast optimal threshold visual cryptography schemes. SIAM J. Discrete Math., 16(2):224{261, 2003.

For each secret binary pixel p that is encoded into sub pixels in each of the n shares, these sub pixels can be described as an n_ Boolean matrix M, where a value 0 corresponds to a white sub pixel and a value 1 corresponds to a black sub pixel. The ith row of M, ri, contains the sub pixel values to be assigned to the ith share. The gray level of the reconstructed pixel p, obtained by superimposing the transparencies in a participant subset X = fii; i2; _ _ _ ; isg, is proportional to the Hamming weight w(v) of the vector v = OR(ri1 ; ri2 ; _ _ _ ; ris ), where ri1 ; ri2 ; _ _ _ ; ris are the corresponding rows in the matrix M [26, 25]. [25] Z. Zhou, G. R. Arce, and G. Di Crescenzo. Halftone visual cryptography. In Proc. IEEE Int. Conf. on Image Process., Barcelona, Spain, Sep. 2003. [26] Z. Zhou, G. R. Arce, and G. Di Crescenzo. Halftone visual cryptography. IEEE Trans. Image Process., 15(8):2441{2453, Aug. 2006.
2012

Definition 1 Let (tQual; tForb) be an access structure on a set of n partci pants Two collections of n _ Boolean matrices C0 and C1 constitute a VSS scheme if there exists a value _() and value tX for every X in Qual satisfying [3]: 1. Contrast condition: any (qualified) subset X = fi1; i2; _ _ _ ; iug 2 tQual of u participants can recover the secret image by stacking the corresponding transparencies. Formally, for a matrix M 2 Cj , (j = 0; 1) the row vectors vj(X;M) = OR(ri1 ; ri2 ; _ _ _ ; riu). It holds that: w(v 0(X;M)) _ tX _() _ for all M 2 C0 and w(v 1(X;M)) _ tX for all M 2 C1. _() is called the relative difference referred to as the contrast of the decoded image and tX is the threshold to visually interpret the reconstructed pixel as black or white. 2. Security condition: Any (forbidden) subset X = fi1; i2; _ _ _ ; ivg 2 Forb has no information of the secret image. Formally, the two collections Dj(j = 0; 1), obtained by extracting rows i1; i2; _ _ _ ; iv from each matrix in Cj , are indistinguishable.

1.2.2 Construction of VSS Scheme

If the given secret pixel p is black (white), the matrix M is randomly selected from matrices collections C1 (C0). The matrix collections can be obtained by permuting the columns of the corresponding basis matrix S0 or S1 in all possible ways [3]. The basis matrices are defined below. Definition 2 Two matrices S0 and S1 are called basis matrices, if S0 and S1 satisfy the following tow conditions [3]:

1. Contrast condition: If X = fi1; i2; _ _ _ ; iug 2 Qual, the row vectors v 0 and v1, obtained by performing OR operation on rows i1; i2; _ _ _ ; iu of S0 and S1 respectively, satisfy w(v 0) _ tX _() _ and w(v 1) _ tX. 2. Security condition: If X = fi1; i2; _ _ _ ; ivg 2 Forb, one of the two v _ matrices, formed respectively by extracting rows i1; i2; _ _ _ ; iv from S0 and S1, equals to a column permutation of other

The algorithm to construct the basis matrices for a given VSS scheme can be found in [2, 5]. See [5] for the construction algorithm of basis matrices that leads to the best contrast. As an example, the S0 and S1 in a 2-out-of-2 scheme are shown below: S0 = [ 0 1 ] S1 = [ O 1 ] [1-.3] [ 0 1 ] [ 1 0] S0 corresponds to the encoding of a white secret pixel and S1 corresponds to the encoding of a black secret pixel.

1.3 Halftone VSS ONSTRUCTION USING Error Diffusion

1.4 methods for halftone VSS are built upon the fundamental principles of conventional VSS. Given a secret halftone image and multiple gray scale images, halftone shares are generated such that the resultant halftone shares are no longer random patterns, but take meaningful visual images. Without loss of generality, the k-out-of-n scheme is described in the following.

1.3.1 Share Structure

The first step in constructing a halftone VSS scheme is to construct the underlying k-out-of-n VSS scheme where a secret image pixel is encoded into pixels in each share. is the VSS pixel expansion and only a function of (k; n).

Furthermore, in halftone VSS, a share image is divided into nonoverlapping halftone cells of size q = v1 _v 2 where q > . A secret image pixel is encoded into one halftone cell in each share. Within the q pixels in a halftone cell, only pixels called secret information pixels (SIPs) actually carry the secret information. Here is exactly the VSS pixel expansion. Since SIPs are not designed to carry share visual information, q _ 2 is desirable for good share image quality. An example of the halftone cells in a 2-out-of-2 scheme is shown in Figure 1.5 where the 1st and 2nd pixels in each cell are SIPs. The 3rd pixel in share 1 and the 4th pixel in share 2 are ABPs. When stacking two shares together, the result is a white pixel with contrast 1=4. The 4th pixel in share 1 and the 3rd pixel in share 2 are assigned values to carry visual information of the shares. They can take a value of 0 or 1, which will not a_ect the decoded image.

There should be a sufficient number of ABPs in the shares so that the visual information of one share is completely blocked by the ABPs on the other shares. Since the ABPs are not designed to carry visual information, the number of ABPs in a share is to be minimized as follows. Let p(i; j) = [p1(i; j); p2(i; j); : : : ; pn(i; j)]T be the vector where pl(i; j) is the (i; j)th pixel
2012

As another example, consider a 2-out-of-3 halftone VSS scheme where a secret image pixel is encoded into a halftone cell of size q = 12. The number of SIPs is = 6. By Eqn. 1.4, the optimal number of ABPs is x = 4. Thus, the configuration matrix T of the 6 non-SIPs is given by: T= [ 1 1 1 1 ] [ 1 1 1 1] [ 1 1 1 1] From the content of T, it is concluded that 1=3 of the pixels on a share will be ABPs.

1.3.2 Distribution of SIPs and ABPs

The locations of the SIPs do not depend on the share images or the secret image, but only on the HVC expansion q and the underlying VSS scheme. the distribution of SIPs can be generated prior to the generation of halftone shares. For security purposes, the SIPs should be randomly distributed.

To achieve good image quality, it is also desirable to distribute the SIPs homogeneously so that one SIP is maximally separated from its neighboring SIPs. Since the SIPs are maximally separated, the quantization error caused by an SIP will be diffused away before the next SIP is encountered leading to visually pleasing halftone shares. Similarly, the distribution of ABPs can also be determined a priori. As SIPs, ABPs should be distributed as homogenously as possible and maximally separated from each other. Since there is a strong correlation between the distribution of SIPs and the distribution of ABPs, the distributions of SIPs and ABPs should be optimized jointly to avoid low frequency spectral interference among them [4]. The SIPs and ABPs should also be maximally separated from each other. The jointly optimized distributions of SIPs and ABPs are generated based on a method of blue noise multi itoning as follows [4] We first construct a constant grayscale image with gray level g = w i=0 gizi, where gi is a tone arbitrarily chosen between 0 and 1 and gi 6= gj for i 6= j. zi is the pixel density for the pixels with tone gi. The value of zi, together with w, depends on q, and the structure of the configuration matrix T. By using the blue noise multi tone error diffusion, an output image with w+1 tones is produced. The distribution of pixels with tone gi indicates a pixel distribution denoted by Zi. Let z0 = =q, then Z0 indicates the distribution of SIPs. The distribution of ABPs in a share is a subset of fZig; i = 1; : : : ;w.

An example following the previous 2-out-of-3 halftone VSS example is used to illustrate how to set zi, gi, and w, where a secret image pixel is encoded into a halftone cell of size q = 12. Among the q pixels, = 6 SIPs are characterized by basis matrix S0 or S1; q = 6 non-SIPs are characterized by the configuration matrix T. Thus, the matrix Ri, i = 0; 1, is constructed

below for the q pixels ; method is given please see page 11 of the book
;below for the q pixels: Ri = [Si T] =[ [ [

1 1 1 1 ] 1 1 1 1 ]
1 1 1 1 ]

Where each row corresponds to q pixels in one share. The _ indicates the SIPs that are determined by Si. Columns of Ri are partitioned into several sets Zi, where the columns with the same configuration are assigned to the same set. where the columns with the same configuration are assigned to the same set. As shown in (1.7), columns are partitioned into 4 sets Zi, i = 0; 1; : : : ; 3. The set Z0 denotes the distribution of SIPs and contains 1=2 of all the pixels. The non-SIPs of each share are partitioned between set Z1, Z2, and Z3, where each set contains 1=6 of all the pixels. Thus, to generate Zi on the share, we can set the parameters for the multi tone error diffusion as follows: w = 3, z0 = 0:5,

and z1 = z2 = z3 = 1=6. The corresponding tone is arbitrarily chosen as: g0 = 0, g1 = 0:3, g2 = 0:6, and g3 = 0:9. By using the algorithm proposed in [4], we obtain homogenous distributions Zi, i = 0; 1; : : : ; 3. The combination of Z1 and Z2 is the distribution of ABPs of share 1; the combination of Z2 and Z3 is the distribution of ABPs of share 2; and the combination of Z1 and Z3 is the distribution of ABPs of share 3, as shown in (1.8) 8>>< >>: SIPs of all shares - Z0 ABPs of share 1 - Z1 U Z2 ABPs of share 2 - Z2 U Z3 ABPs of share 3 - Z1 U Z3: (1.8) As an example, assume the share has size 6 _ 8 and is partitioned into 4 halftone cells of size 3 _ 4, each cell corresponding to one secret image pixel. Within each cell, there are 6 SIPs and 4 ABPs. Suppose the generated distributions Zi; i = 0; 1; : : : ; 3 are shown on the up-left image in Figure 1.6. Then, as also shown in Figure 1.6, the distributions of SIPs and ABPs of each share are determined based on Zi. Note that without knowing what values the Ms carry, any two shares can be stacked together to decode the secret image pixels. we may not be able to generate an exact number of pixels as desired for sets Zi, i = 0; 1; 2; 3. However, for ABPs, as long as the membership of ABPs to the sets Zi indicated in (1.8) is maintained, a slight deviation from its desired number of pixels for Zi, i = 1; 2; 3 is allowable. The contrast condition of image decoding is still maintained. Such a point can be clearly illustrated in Figure 1.7 where the composition of each share is shown. It is clear that the relative size of Zi, i = 1; 2; 3 is not important. However, the distribution of SIPs, denoted by Z0, needs to be re_ned to guarantee that there are exactly SIPs in each halftone cell. Each halftone cell is checked to _nd out the number of pixels belonging to Z0.

Figure 1.8

visible distortion. In this way, the SIPs and ABPs are seamlessly embedded into the halftone shares generated and the halftone share is structured taking meaningful visual information. Much like the methods in [26, 25], the above procedure can be extended to an arbitrary access structure (Tual; TForb). The security of the introduced halftone VSS scheme is guaranteed by the properties of the underlying visual secret sharing scheme.

1.4 Halftone VSS Construction Using Parallel Error Diffusion

In the previous method, uniformly distributed auxiliary black pixels are introduced to satisfy the contrast condition of image decoding. The current method exploits the fact that half toning of the gray scale images alone may generate a sufficient number of black pixels to block the shared visual information from showing on the decoded image. in the current method, the shares are also divided into non overlapping halftone cells of size q = v1 _ v2. pixels within the halftone cell are SIPs carrying the secret visual information. A method based on error diffusion is used to generate the distribution of SIPs. a constant-value gray scale image of gray level z0 = =q, having the same size of a share image is first produced. This gray scale image is then half toned, producing a distribution of "1"s, denoted by Z0. Z0 determines the distribution of the SIPs. To ensure that there are exactly "1"s in each halftone cell, the error diffusion is constrained such that the values of some pixels are preset and are not modified by the error diffusion. The error e(m; n), which is the difference between the input to the thresh holding block and the resultant pixel value, is still calculated for the preset pixels and then diffused away to neighboring gray scale pixels through the error filter. this constrained error diffusion mechanism, if the current halftone cell already contains "1"s, the rest of the pixels in the halftone cell are prefixed and constrained to be "0"s. The quantization error is accumulated and diffused to gray scale pixels in neighboring cells. If the current halftone cell contains t < "1"s, and the error diffusion already proceeds to the (q t)th pixel of the current cell, then the rest of the t pixels in that cell are all constrained to be "1"s. This procedure guarantees that there are exactly SIPs in each halftone cell. Since the errors are always diffused to neighboring gray scale pixels, a homogeneous distribution of SIPs is produced, where most of the SIPs are well separated from each other. The assignment of SIPs are predetermined using the same approach as described previously

Then, the current method halftones the gray scale images in parallel to produce the halftone shares. Within the error diffusion process, all the shares re checked at each non-SIP position to see if a sufficient number of black pixels have been produced. If a sufficient number of black pixels have not yet been generated, black pixels are deliberately inserted at that position. The SIPs are again preserved and not changed. In a k-out-of-n scheme, if only _ < n k + 1 black pixels are generated by half toning at a non-SIP location (i; j), then _ = n k + 1 _ shares with the smallest magnitudes of halftone error at (i; j) are selected and black pixels are inserted at (i; j) on these shares. Thus, the contrast condition of image decoding is guaranteed. The quantization error caused by the inserted black pixels will be diffused away to neighboring gray scale pixels and pleasing

halftone shares can be obtained. Since far fewer black pixels are deliberately introduced, the second method imposes fewer constrains on the error diffusion and thus it has the potential to achieve better image quality than that of the first method. However, to achieve uniform image quality of the whole share, we need to choose the gray scale images in a selective way.

to insert a black pixel or not depends on the image content of the shares. Thus, the inserted black pixels are not evenly distributed. In some regions of the image, the error diffusion mechanism is constrained by the SIPs. In some other regions, error diffusion is constrained not only by the SIPs but also by the inserted black pixels.

Therefore, the image quality on some regions in the image may be better than the image quality on some other regions that exhibit more artifacts. The parallel approach may thus generate shares whose image quality is not consistent over the whole image. Such quality discrepancy may cause visible distortions. To mitigate such visible distortion, we need to minimize the number of black pixels inserted. An obvious way to mitigate the distortion is to select gra y scale images where the contents of some images tend to be complimentary to those of the others For example, if there is one bright (white) region on one image, there should be corresponding dark region(s) in some other image(s). Then the half toning of the gray scale images will generate most of the black pixels needed and the number of inserted black pixels will be greatly reduced, which leads to visually pleasing halftone shares. In a n-out-of-n scheme, if n _ 1, then this approach is especially effective and the visible distortion is less likely to happen.

1.5 Quality of Halftone Shares

In this section, we focus on the quality analysis of the halftone shares for the _rst method. The analysis also helps to evaluate the share image quality of the second method. With the exception of the SIPs and the ABPs, all pixels in the halftone share produced by thefirst method are assigned freely to carry the shared visual information. The proportion of these pixels governs the image quality of the resultant halftone shares. The quantity s is called the quality index of the halftone share and is represented as: s=q x q ; (1.11) where q is the halftone cell size, x is the number of ABPs in a cell, and is the number of SIPs in a cell. A large s leads to good image quality of the halftone share. However, s cannot be arbitrarily large and it can be shown that: s _ (k 1 n )( q q ) < 1: (1.12) Thus, the best image quality of a halftone share that can be achieved depends on k, n and the halftone cell size q. If k, n, and s are the design parameters,

then q is calculated as: q=d (k 1) k ns 1e: (1.13) Consider the 2-out-of-2 scheme. Assume q = 4, then it is calculated that x = 1 and s = 0:25. Since s is small, the image quality of the share is not high. If q is larger, then better image quality can be expected. Furthermore, as q ! 1, s approaches 0:5. However, a larger q leads to worse contrast loss of the reconstructed image. As will be shown later, the contrast loss of the reconstructed image can be improved by filtering. The quality of each share depends on the quality index s. We can compare the share image with the halftone image generated from the gray scale image without encoding any secret information and then compute the perceived error _ between the coded and un coded halftone image. The perceived error is calculated by employing an appropriate human visual system (HVS) model. See [11, 9] for details. For the second method, it is difficult to determine the proportion of pixels that carry visual information of the shares. However, it is clear that for n _ 1 in a n-of-of-n scheme, the quantity s approaches: s=q q ; (1.14) which indicates potentially good image quality for a sufficiently large q. Compared with methods in [26] and [22], the requirement of a complementary pair is removed and all shares generated carry natural images. From (1.12), it is clear that for the first method, the quality index is more correlated to [ k; n] in the VSS scheme. A visually pleasing halftone image share can be obtained if n _ 1 and n k is small, and if the HVC expansion q is sufficiently large. If small image quality discrepancy of the share is tolerable, then we should first consider the first method, especially if we have the flexibility to choose the gray scale images. If the gray scale images are carefully chosen, n _ 1, and n k is small, then the distortion due to image quality discrepancy will be hardly noticeable. Otherwise, only the first method should be considered since it is the only method that guarantees uniform image quality of the shares without using complimentary shares.

1.6 Discussion
1.6.1 Improvement of Image Quality
As stated previously, the quality index s heavily affects the image quality of the halftone shares. A large s leads to visually pleasing halftone shares, but it also introduces higher contrast loss in the reconstructed images. The error filter employed in the error diffusion also affects the image quality of the shares. For example, an error filter with longer weights leads to a sharper contrast in the halftone image [20, 14]. Another factor that affects the image quality is the position-dependent threshold in the thresh holding block. To achieve a visually more pleasing halftone image, output-dependent threshold modulation can be used in the error diffusion to spread the minority pixels as homogeneously as possible and suppress some unwanted textures [6]. 6] R. Eschbach, Z. Fan, K. T. Knox, and G. Marcu. Threshold modulation and stability in error di_usion. IEEE Signal Process. Mag., 20:39{50, Jul. 2003.

various methods thatcan improve the halftone image by error diffusion, refer to [20, 6, 17, 21], etc. [20] R. A. Ulichney. Dithering with blue noise. In Proc. the IEEE, volume 76, pages 56{79, Jan. 1988 [21] N. D. Venkata and B. L. Evans. Adaptive threshold modulation for error di_usion halftoning. IEEE Trans. Image Process., 10(1):104{116, Jan. 2001. [17] P. Li and J. P. Allebach. Tone-dependent error diffusion. IEEE Trans. Image Process., 13(2):201{215, Feb. 2004. . 6] R. Eschbach, Z. Fan, K. T. Knox, and G. Marcu. Threshold modulation and stability in error diffusion. IEEE Signal Process. Mag., 20:39{50, Jul. 2003. ror diffusion is employed as the half toning algorithm to generate halftone shares since error diffusion is able to generate a visually pleasing halftone image with simple computation. However, other half toning algorithms can also be applied to the second method to generate halftone shares. The DBS algorithm can be used to generate a high quality halftone image but with significant computation [1]. Note that the DBS algorithm for multi toning can also be used to generate the distributions of SIPs and ABPs.

1.6.3 Image Decoding

In the methods introduced in this chapter, a large HVC expansion is desirable to make s large. But the contrast loss of the decoded image is severe when the HVC expansion is large. However, a low contrast does not hinder the decoding of the secret image if the decoding can be performed digitally. Initially shares are supposed to be xeroxed on transparencies and decoding of the secret image involves stacking the shares physically. However, both the distribution of the
2012 by Taylor & Francis Group, LLC

20 Visual Cryptography and Secret Image Sharing shares and decoding of the secret image can be performed in a digital way where the decoding rule remains the same (OR operation). The human visual system is still the ultimate tool to identify the secret image. The robustness of the introduced scheme to the contrast loss is attributed to the fact that shares have well-defined local structure. If decoded digitally, we can measure the local intensity of the reconstructed image by filtering the data through a running window. Then we measure the local intensity of the data within the window. We can assign 1 to the current pixel if the local intensity is relatively high and assign 0 to the current pixel if the local intensity is relatively low. In this chapter, HVC construction methods based on error diffusion are introduced, which can generate shares with pleasing visual information. In the introduced methods, the pixels that carry the secret information are preset before a halftone share is generated from a gray scale image. Error diffusion is used to construct the shares so that the noise introduced by the preset pixels is diffused away when halftone shares are generated. The secret information is then naturally embedded into the halftone shares. The homogeneous and isotropic distribution of the preset pixels imposes the least noise in the error diffusion, thus leading to shares with high image quality. Our introduced methods follow the basic principle of VC, thus the security of the construction scheme is guaranteed. The introduced HVC constructions apply not only to

VSS but also to VSS used in the context of visual authentication and encryption. the first method, by using auxiliary black pixels, the contrast condition of the decoded image is satisfied. Furthermore, the shares do not suffer any interference from other shares. When auxiliary black pixels are employed, blue noise multi tone error diffusion is used to generate the distributions of the secret information pixels and black auxiliary pixels. The second method exploits the fact that half toning of the gray scale images alone can generate most of the black pixels needed. Black pixels are inserted only when a sufficient number of black pixels have not yet been produced. By carefully selecting the gray scale images, the second method can also generate shares with visually pleasing images. For both methods, the decoded image does not suffer any interference from the shared images. It is clear that there is a tradeoff_ between the shared image quality and the contrast loss of the decoded image. However, by simple linear filtering, the contrast loss can be easily recovered.

B Bibliography
[1] M. Analoui and J. P. Allebach. Model-based half toning using direct binary search. In Proc. SPIE, volume 1666, pages 96{108, Feb. 1992. [2] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Visual cryptography for general access structures. Information and Computation, 129(2):86{106, Sept. 1996. [3] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Extended capabilities for visual cryptography. Theoret. Comput. Sci., 250:143{161, 2001. [4] J. Bacca, G. R. Arce, and D. L. Lau. Blue noise multitone dithering. IEEE Trans. Image Process., 17(8):1368{1382, Sep. 2008. [5] C. Blundo, P. D'Arco, A. De Santis, and D. R. Stinson. Contrast optimal threshold visual cryptography schemes. SIAM J. Discrete Math., 16(2):224{261, 2003. [6] R. Eschbach, Z. Fan, K. T. Knox, and G. Marcu. Threshold modulation and stability in error diffusion. IEEE Signal Process. Mag., 20:39{50, Jul. 2003. [7] F. Faheem, D. L. Lau, and G. R. Arce. Digital multitoning using gray level separation. J. Imag. Sci. and Tech., 46(5):385{397, Sep. 2002. [8] M. S. Fu and O. C. Au. Joint visual cryptography and watermarking. In Proc. IEEE Int. Conf. on Multimedia and Expo, Taipei, Taiwan, Jun. 2004. [9] A. J. Gonzalez, G. R. Arce, J. Bacca Rodriguez, and D. L. Lau. Human visual alpha-stable models for digital halftoning. In Proc. 18th Annual Symp. on Electron. Imag. Sci. and Tech.: Human Vision and Electro. Imag. XI, San Jose, CA, Jan. 2006. [11] S. H. Kim and J. P. Allebach. Impact of HVS models on model-based halftoning. IEEE Trans. Image Process., 11(3):258{269, Mar. 2002. [12] D. L. Lau and G. R. Arce. Modern Digital Halftoning. Marcel Dekker, Inc, 2001. [13] D. L. Lau, G. R. Arce, and N. C. Gallagher. Green-noise digital halftoning. Proceedings of the IEEE, 86(12):2424{2444, Dec. 1998. [14] D. L. Lau, G. R. Arce, and N. C. Gallagher. Digital halftoning by means of green-noise masks. J. Opt. Soc. Am. A-Optics Image Sci. and Vis., 16(7):1575{1586, Jul. 1999. [15] D. L. Lau, G. R. Arce, and N. C. Gallagher. Digital color half toning with generalized error di_usion and multi-channel green-noise masks. IEEE

Trans. Image Processing, 9(5):923{935, May 2000. [16] D. L. Lau, R. Ulichney, and G. R. Arce. Blue- and green-noise half toning models review of the spatial and spectral characteristics of halftone textures. IEEE Signal Processing Magazine, 10(4):28{38, Jul. 2003. [17] P. Li and J. P. Allebach. Tone-dependent error diffusion. IEEE Trans. Image Process., 13(2):201{215, Feb. 2004. [18] M. Naor and B. Pinkas. Visual authentication and identification. Crypto97, LNCS, 1294:322{340, 1997. [19] M. Naor and A. Shamir. Visual cryptography. Advances in Cryptography: EUROCRYPT'94, LNCS, 950:1{12, 1995. [20] R. A. Ulichney. Dithering with blue noise. In Proc. the IEEE, volume 76, pages 56{79, Jan. 1988. [21] N. D. Venkata and B. L. Evans. Adaptive threshold modulation for error diffusion half toning. IEEE Trans. Image Process., 10(1):104{116, Jan. 2001. [22] Z. Wang and G. R. Arce. Halftone visual cryptography through error diffusion. In Proc. IEEE ICIP, Atlanta, GA, Oct. 2006. [23] Z.Wang and G. R. Arce. Halftone visual cryptography via error diffusion. IEEE Trans. Inf. Forensics Security, 4(3):383{396, Sep. 2009. [24] C. W. Wu and G. Thompson. Digital watermarking and steganography via overlays of halftone images. In Proc. SPIE, volume 5561, pages 152{ 163, Oct. 2004.
25 Zhi Zhou ,Gonzalo R.arce ,IEEE TRANSACTIONS ON IMAGE PROCESSING ,VOL,15,NO,8 ,AUGUST 2006 26 Nitty sarah alex and L.JANI ANBARASI ---------------,ENHANCED IMAGE SHARING VIA ERROR DIFFUSION IN HALFTONE VISUAL CRYPTOGRAPHY 27 - CHANG-CHOU,LIN, WEN-HSIAN TSAI / PATTERNRECOGINATION LETTERS 24 [2003 ]349-358

28 MIZUHO NAKAJIMA AND YASUSHI YAMAGUCHI .. EXTENDED VISUAL CRYPTOGRAPHY FOR NATURAL JMAGES .

Visual Cryptography and Random Grids

CONTENT
7.1 Introduction : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 185 7.2 Random Grids : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 186 7.2.1 Random Pixel, Random Grid, and Average Light Transmission : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 186 7.2.2 Superimposition of Random Grids : : : : : : : : : : : : : : : : : : : : : : 187 7.3 Visual Cryptograms of Random Grids : : : : : : : : : : : : : : : : : : : : : : : : : : : 189 7.3.1 Definition of VCRG : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 189 7.3.2 (2, 2)-VCRG Algorithms for Binary Images : : : : : : : : : : : 190 7.3.3 Experiments for (2, 2)-VCRG : : : : : : : : : : : : : : : : : : : : : : : : : : : 193 7.3.4 Definition of Light Contrast and Performance Evaluation : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 194 7.3.5 Algorithms of (n; n)-VCRG for Binary Images : : : : : : : : : 196 7.3.6 Algorithms of (n; n)-VCRG for Gray-Level and Color Images : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 206 7.3.7 Experiments for (n; n)-VCRG : : : : : : : : : : : : : : : : : : : : : : : : : : : 207 7.4 Concluding Remarks : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 219 Bibliography : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 220

7.1 Introduction
A random grid was defined by Kafri and Keren in 1987 [7] as a transparency comprising a two-dimensional array of pixels. Each pixel is either fully transparent or simply opaque and the choice between the alternatives is made by a coin-ip procedure. Thus, there is no correlation between the values of different pixels in the array. We could encrypt binary pictures or shapes into two random grids such that only the areas containing information in the two grids are inter correlated, while the others are purely random. When the two grids are superimposed together, the correlated areas will be resolved from the random background due to the difference in light transmission so that the secret picture or shape can be seen visually. Just like conventional schemes in visual cryptography, the decoding process is done by the human visual system where no computation is needed; however, no extra pixel expansion is required using random grids. Shyu [12, 13] generalized the random grids-based approaches into visual cryptograms of random grids (VCRG) for achieving visual secret sharing recently. The most appealing benefits using random grids lie in that the pixel expansion needed is merely one and no basis matrix is needed. With the same contrast in the reconstructed results, the optimal pixel expansion in (n, n)-VCS is 2n 1; while that in (n, n)-VCRG is still 1.

Section 7.2. Section 7.3 discusses how to apply visual cryptograms of random grids in visual cryptography where the formal definition of VCRG is given, and the designs, analyses, and implementations of (2, 2)-VCRGs and

(n; n)-VCRGs for binary, gray-level and color images are examined. Section 7.4 exhibits some concluding remarks.

7.2 Random Grids

7.2.1 Random Pixel, Random Grid, and Average Light Transmission
Definition 1 R is a binary random grid if each pixel r in R is a binary random pixel.

7.3 Visual Cryptograms of Random Grids

7.3 Visual Cryptograms of Random Grids

First of all, we give a formal definition to VCRG for binary images in Section 7.3.1. Section 7.3.2 presents three algorithms for producing (2, 2)-VCRGs for binary images. The implementation results of these algorithms are reported in Section 7.3.3. Section 7.3.4 evaluates the performances of these algorithms in terms of light contrast. Then, algorithms for producing (n, n)-VCRGs for binary images are discussed in Section 7.3.5. Further, those for gray-level and color images are examined in Section 7.3.6. Section 7.3.7 reports the experimental results of (n; n)-VCRGs. The correctness of these algorithms would be proved and the corresponding light contrasts would be analyzed accordingly.

7.3.1 Definition of VCRG

Consider a set of n random grids E = fR1;R2; : : : ;Rng, which are encrypted to share a a secret image B such that R1 R2 :::Rn reveals B to our eyes while any group of less than n grids obtains no information about B. We call E a set of visual cryptograms of random grids with respect to B. Let B(0) (B(1)) denote the area of white (black) pixels in B and SE [B(0)] (S[B(1)]) denotes the area of pixels in SE corresponding to B(0) (B(1)) where SE = R1R2_ _ _Rn. Formally, a set of (n, n) visual cryptograms of random grids for a binary image is now defined as follows. Definition 2 Given a binary image B, n random grids fR1;R2; : : : ;Rng comprise a set of visual cryptograms, referred to as (n; n)-VCRG of B if the following conditions hold: (1) Ri is a random grid with T (Ri) = 1=2 for 1 6 i 6 n; (2) (2) T (SD[B(0)]) = T (SD[B(1)]) where SD = Ri1 Ri2 _ _ _ Rid which is the superimposed result of some set D = fRi1 ;Ri2 ; : : : ;Ridg of d distinct random grids in E , i.e., D _ E , 2 6 d 6 n 1 and 1 6 i1 < i2 < _ _ _ < id 6 n; and (3) T (SE [B(0)]) > T (SE [B(1)]) where SE = R1 R2 _ _ _ Rn and E = fR1;R2; : : : ;Rng.

Both Conditions 1 and 2 are "security" conditions which ensure that each individual grid and the superimposed result of any group of less than n random grids are merely random grids so that no information of B can be obtained. Condition 3 is the "contrast" condition, which claims that once the light transmission of SE [B(0)] is larger than that of SE [B(1)], our visual perception is able to distinguish B(0) from B(1) by observing SE due to the difference of their light transmissions in SE . Input: A w X h binary image B where B[i, j ] 2 f0, TABLE 7.2 Encoding b into r1 and r2 and results of s = r1 r2 by Algorithms 1, 2, and 3. b Probability r1 r2 s = r1 r2 Prob (s = 0) (t (s)) Algorithm 1 _
1 2_ 12 2_

__1 __ __0 TABLE TO BE COPIED FROM BOOK

_
1 2_ 1 2_

__ Algorithm 2 _
1

2_ 12 2_

__1 __ __

_
1 4_ 1 4 1 4_ 1 4_ 1 4_

__ __

__ Algorithm 3 _
1 4_ 1 4 1 4_ 1 4_ 1 4_

__

__ __

_ _Table 7.2 summarizes the encoding process of pixel b in secret image B into r1 and r2 by Algorithms 1, 2, and 3 respectively, the result of r1 r2 and its average light transmission. Let B(0) (B(1)) denote the area of all of the transparent (opaque) pixels in B, that is, pixel b is in B(0) (B(1)) if and only if b = 0 (b = 1) where B = B(0) [ B(1) and B(0) \ B(1) = ?. We denote the area of pixels in random grid R corresponding to B(0) (B(1)) by R[B(0)] (R[B(1)]), that is, pixel r is in R[B(0)] (R[B(1)]) if and only if r's corresponding pixel b is in B(0) (B(1)). Surely, R = R[B(0)] [ R[B(1)] and R[B(0)] \ R[B(1)] = ? _
1

2_ 1 2_

__0

_1g (white or black), 16i6w and 16j6h Output: Two shares of random grids R1 and R2 which reveal B when superimposed where Rk[i, j ] 2 f0, 1g (transparent or opaque), 16i6w, 16j 6h and k 2 f1; 2g Encryption(B)

7.3.2 (2, 2)-VCRG Algorithms for Binary Images

Let random pixel (0, 1) be a function that returns a binary value 0 or 1 to represent a transparent or opaque pixel, respectively, by a coin-i procedure and R1[i; j] denote the complement of R1[i; j]. Each of the following three algorithms success fully encodes a secret binary image B into two random grids R1 and R2 which constitute a set of (2, 2)-VCRG. Algorithms 1-3. Sharing a binary image by two random grids

7.3. experiments for [2,2]-VCRG 7.3.4 Definition of Light Contrast and Performance Evaluation
To evaluate the relative difference of the light transmissions between the transparent and opaque pixels in reconstructed image S by these random grid-based algorithms, we define the light contrast of S with respect to B as follows. Definition 3 The light contrast of a set E of VCRG produced by an encryption algorithm for a binary image B is defined as \ c(E ) = T (S[B(0)]) T (S[B(1)]) \ 1 + T (S[B(1)]) to be seen from book where S is the superimposed result of all visual cryptograms in E .

7.3.4 Definition of Light Contrast and Performance Evalua-tion To evaluate the relative difference of the light transmissions between the transparent and opaque pixels in reconstructed image S by these random grid-based algorithms, we define the light contrast of S with respect to B as follows. Definition 3 The light contrast of a set E of VCRG produced by an encryption algorithm for a binary image B is defined as ] c(E ) = T (S[B(0)]) T (S[B(1)]) ] ] 1 + T (S[B(1)]) to be seen book] where S is the superimposed result of all visual cryptograms in E . 7.3.5 Algorithms of (n; n)-VCR from G for Binary Images

Algorithm 4. Encrypting a secret image into a set of (n; n)-VCRG Input: an h x w binary image B and an integer n Output: E = fR1;R2; : : : ;Rng constituting (n; n)-VCRG of B

Theorem 2 Given a binary image B, E = fR1;R2; : : : ;Rng produced by Algorithm 4 with respect to B is a set of (n; n)-VCRG of B.

7.3.6 Algorithms of (n; n)-VCRG for Gray-Level and Color Images

In Shyu [12], the encryption algorithms of (2, 2)-VCRG for gray-level and color images were generalized from those for a binary image. We apply the same reasoning and skills adopted by Shyu in [12] to extend the binary (n; n)-VCRG algorithms to cope with gray-level and color imageOur encryption algorithms can be easily hardwired by incorporating a 0/1 random number generator with T ip-ops or Exclusive-OR gates. It would be an interesting challenge to design a special VCRG hardware for image encryption. In fact, many research topics in conventional visual cryptography could be reexamined in view of random grids. Bs.

7.3.7 experiments for [n-n]-VCRG EXPERIMENTS AND FIGURES -1 TO 12

7.4 Concluding Remarks

In this chapter, we propose novel schemes for visual secret sharing using random grids. At first, we give a new de_nition for the visual cryptograms of n(> 2) random grids with respect to a binary image. Based upon the definition, we design effective algorithms, prove their correctness formally, analyze the light contrast in the reconstructed image, and demonstrate their feasibility by computer simulations. By exploiting the skills of halftone and color decomposition in Ref. [12], the enhanced algorithms are also developed and verified to deal with gray-level and color images.
2012

The proposed schemes incorporate human visual intelligence with information security in such a way that no computation but only human vision is needed in the decryption process. They provide cost effective, handy, and portable solutions to image encryption or sharing even for inexperienced users, especially for circumstances where no computer can be accessed. Since a secret image can be encrypted/shared among n(> 2) participants (instead of only two), our approaches extend and generalize the studies in Refs. [12, 7] such that the applicability of image encryption or sharing can be broadened to a greater extent. Our encryption algorithms can be easily hardwired by incorporating a 0/1 random number generator with T ip-ops or Exclusive-OR gates. It would be an interesting challenge to design a special VCRG hardware for image encryption. In fact, many research topics in conventional visual cryptography could be reexamined in view of random grids.

Bibliography

[1] C.-N. Yang and C.-S. Laih. New colored visual secret sharing schemes. Des. Codes Cryptogr., 20:325{335, 2000. [2] C.Blundo, A. De Santis, and D.R.Stinson. On the contrast in visual cryptography schemes. J. Cryptogr, 12:261{289, 1999. [3] C. Blundo, A. De Santis, and D.R. Stinson. Improved schemes for visual cryptography. Des. Codes Cryptogr., 24:255{278, 2001. [4] S. Droste. New results on visual cryptography. in: N. Koblitz (Ed.), Advances in Cryptology: CRYPTO96, Lecture Notes in Computer Science, 1109:401{415, 1996. [5] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Constructions and bounds for visual cryptography. in: F.M. auf der Heide, B.
2012 by Taylor & Francis Group, LLC

Visual Cryptography and Random Grids 221 Monien (Eds.), Automata, Languages and Programming: ICALP'96, Lecture Notes in Computer Science, 1099, Springer, Berlin:416{428, 1996. [6] Y.-C. Hou. Visual cryptography for color images. Pattern Recognition, 36:1619{1629, 2003. [7] O. Kafri and E. Keren. Encryption of pictures and shapes by random grids. Opt. Lett, 12:377{379, 1987. [8] M. Naor and B. Pinkas. Visual authentication and identi_cation. in: B.S. Kaliski Jr. (Ed.), Advances in Cryptology: CRYPTO97, Lecture Notes in Computer Science, 1294:322{336, 1997. [9] M. Naor and A. Shamir. Visual cryptography. in: A. De Santis (Ed.), Advances in Cryptology: Eurpocrypt'94, Lecture Notes in Computer Science, 950:1{12, 1995. [10] P.A. Eisen and D.R. Stinson. Threshold visual cryptography schemes with speci_ed whiteness levels of reconstructed pixels. Des. Codes Cryptogr., 25:15{61, 2002. [11] S.J. Shyu. E_cient visual secret sharing scheme for color images. Pattern Recognition, 39:866{880, 2006. [12] S.J. Shyu. Image encryption by random grids. Pattern Recognition, 40:1014{1031, 2007. [13] S.J. Shyu. Image encryption by multiple random grids. Pattern Recognition, 42:1582{1596, 2009. [14] E.R. Verheul and H.C.A. Van Tilborg. Constructions and properties of k out of n visual secret sharing schemes. Designs Codes Cryptography, 11:179{196, 1997.
2012

Visual Cryptography and Contrast Bounds

CONTENTS
8.1 Introduction : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 223 8.2 Preliminaries : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 225 8.3 Approximate Inclusion Exclusion : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 227 8.4 Designs and Codes : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 232 8.5 Optimal 3-out-of-n Schemes : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 236 8.6 Asymptotic Optimal k-out-of-n Schemes : : : : : : : : : : : : : : : : : : : : : : : : 241 8.7 Contrast Trade-O_s for Extended Visual Cryptography Schemes : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 244 8.8 Enhancing the Contrast by Nonstandard Models : : : : : : : : : : : : : : : 251 8.9 Conclusion : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 251 Bibliography : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 252

8 8.1 Introduction
To describe a visual cryptography scheme we encode the encryption of a pixel by Boolean matrices. The rows represent the slides and the columns represent the different sub pixels. Definition 1 Let T be any access structure for n persons. A visual cryptography scheme is a pair of multi sets Mb and Mw of Boolean n x m matrices. Which satisfy:

8.2 Preliminaries
For the moment we will ignore the pixel expansion and the randomness. Then contrast optimal visual cryptography schemes can be simplify ed. Lemma 1 Let be any access structure then there exists a contrast optimal visual cryptography scheme (MW ;MB) for with the property that MW is the multi set of all column permutations of a matrix MW and MB is the multi set of all column permutations of a matrix MB.

9
Visual Cryptography Schemes with Reversing
9.1 Introduction : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 255 9.2 Visual Cryptography Schemes : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 258 9.2.1 (k; k)-Threshold Visual Cryptography Schemes : : : : : : : : : 259 9.2.2 Perfect Black Visual Cryptography Schemes : : : : : : : : : : : : 260 9.3 Almost Ideal Contrast VCS with Reversing : : : : : : : : : : : : : : : : : : : : : 262 9.4 Ideal Contrast VCS with Reversing : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 265 9.4.1 A Construction Using a Binary Secret Sharing Scheme 266 9.4.2 Constructions Using Perfect Black VCSs : : : : : : : : : : : : : : : 268 9.4.2.1 The Scheme by Cimato, De Santis, Ferrara, and Masucci : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 269 9.4.2.2 The Scheme by Hu and Tzeng : : : : : : : : : : : : : : : 271 9.4.2.3 The Scheme by Yang, Wang, and Chen : : : : : : 274 9.4.2.4 Comparisons : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 276 9.4.3 A Construction Using a Nonperfect Black VCS : : : : : : : : 276 9.5 Conclusions : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 278 Bibliography : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : : 278

9.1 Introduction
A visual cryptography scheme for a set of n participants is a method to encode a secret image, consisting of black and white pixels, into n shadow images called shares, one for each participant. Each share is a collection of black and white subpixels, which are printed in close proximity to each other, so 255 that the human visual system averages their individual black/white contributions. The encoding is done in such a way that certain subsets of participants, called qualified sets, can "visually" recover the secret image, but other subsets of participants, called forbidden sets, cannot gain any information (in an information-theoretic sense) about the secret image by inspecting their shares A "visual" recover for a set of qualified participants consists of xeroxing each share onto a separate transparency, of stacking together the transparencies and projecting the result with an overhead projector. If the transparencies are aligned carefully, then the participants will be able to see the secret image (without any knowledge of cryptography and without performing any cryptographic computation cryptographic paradigm) This was cryptography paradigm introduced by Naor and Shamir [11] 11] M. Naor and A. Shamir. Visual cryptography. In Proc. of Advances in Cryptog C. Blundo, A. De Santis, and D. R. Stinson raphy-{ EUROCRYPT '94, Lecture Notes in Computer Science,volume 950, pages 1-12 1995.. They analyzed the case of (k; n)-threshold visual cryptography schemes, in which the qualified subsets of participants have cardinality k, whereas, the

forbidden subsets of participants have cardinality less than k. Some results on (k; n)-threshold visual cryptography schemes ((k; n)-threshold visual cryptography scheme (VCS), for short) can be found in [1, 2, 5, 8, 10, 12]. [12] E. R. Verheul and H. C. A. van Tilborg. Constructions and properties of k out of n visual secret sharing schemes. Designs, Codes, and Cryptography, 11(2):179, 1997 [1] G.Ateniese C. Blundo, A. De Santis, and D. R. Stinson visualcryptography for general Access structures. Information and Computation,129(2):86{106, 1996. [2] C. Blundo, P. D'Arco, A. De Santis, and D. R. Stinson. Contrast optimal threshold visual cryptography schemes. SIAM Journal on Discrete Mathematics, 16(2):224{261, 2003.ess structures [5] C. Blundo, A. De Santis, and D. R. Stinson. On the contrast in visual cryptography schemes. Journal of Cryptology, 12(8):261{289, 1999. [8] T. Hofmeister, M. Krause, and H. U. Simon. Contrast-optimal k out of n secret sharing schemes in visual cryptography. Theoretical Computer Science, 240(2):471, 2000. [10] M. Krause and H. U. Simon. Determining the optimal contrast for secret sharing schemes in visual cryptography. Combinatorics, Probability and Computing, 12(3):285{299, 2003 [12] E. R. Verheul and H. C. A. van Tilborg. Constructions and properties of k out of n visual secret sharing schemes. Designs, Codes, and Cryptography, 11(2):179, 1997.

the model by Naor and Shamir has been extended in [1] to general access structures (an acc structure is a specification of all qualified and forbidden subsets of participants), where general techniques to construct visual cryptography schemes for any access structure have been proposed.

Visual cryptography schemes are characterized by two parameters: The pixel expansion, corresponding to the number of subpixels contained in each share (transparency) and the contrast, which measures the "difference" between a black and a white pixel in the reconstructed image. Visual cryptography schemes such that, in the reconstructed image, all the subpixels associated to a black pixel are black, are referred to as visual cryptography schemes with perfect reconstruction of black pixels. reconstruction of white pixels is almost perfect, Viet and Kurosawa [13] proposed a different kind of VCS, called VCS with reversing. Such VCSs require the introduction of an extra non cryptographic operation, that participants can use to reconstruct the image. Such an operation, which can be easily performed by many copy machines, is applied to a transparency and creates another transparency in which black pixels are reversed to white pixels and vice versa.
Then, Yang et al. [14] proposed two diffierent constructions for ideal contrast VCS with reversing. In particular, one of their schemes removes the need of using as a building block a VCS with perfect reconstruction of black pixels. However, there is a loss of resolution in both their schemes. Organization. In Section 9.2 we recall the definition and security requirements of VCSs. In Section 9.3 we describe the almost i ideal contrast VCS with reversing by Viet and Kurosawa. In Section 9.4 we show and compare some ideal contrast VCSs with reversing that use as a building block any perfect black VCS. Finally, a VCS with reversing constructed upon any VCS is described in Section 9.4.3.
2012

Several visual cryptography schemes have been realized by using two n_m matrices, S0 and S1, called basis matrices. The collections C0 and C1 are obtained by permuting the columns of the corresponding basis matrix (S0 for C0, and S1 for C1) in all possible ways. This technique has been introduced in[11] .

9.2.1 (k; k)-Threshold Visual Cryptography Schemes

In a (k; k)-threshold visual cryptography scheme the secret image is visible if and only if all k transparencies are stacked together but totally invisible fewer than k transparencies are stacked together or analyzed by any other method. Naor and Shamir [11] proposed a construction for (k; k)-threshold VCSs using two basis matrices S0 and S1 defined as follows: S0 is the matrix whose columns are all the Boolean k-vectors having an even number of 1's, and S1 is the matrix whose columns are all the Boolean k-vectors having an odd number of 1's. The pixel expansion m of such a scheme is equal to 2k-1 and the relative difference (h - l `)\m between reconstructed white and reconstructed black is equal to 1/2k-1. The above construction is optimal with respect to the pixel expansion and the relative difference between reconstructed white and reconstructed black. Example 1 The basis matrices S0 and S1 Example 1 The basis matrices S0 and S1 in a (4; 4)-threshold VCS are S0 = 00001111 00110011 01010101 01101001

S0

S1

00001111 00110011 0 01010101 10010110

: The collections C0 and C1 are obtained by permuting the columns of the corresponding basis matrix (S0 for C0, and S1 for C1) in all possible ways. In this scheme each pixel of the secret image is encoded into m = 8 sub pixels. It is easy to see that the integers h = 1 and ` = 0 satisfy Property 1 of Definition 1. Let S0 be the matrix chosen by the dealer to share a white pixel; by stacking the transparencies held by all four participants we get the vector (0; 1; 1; 1; 1; 1; 1; 1; 1). On the other hand, let S1 be the matrix chosen by the dealer to share a black pixel; by stacking the transparencies held by all four participants we get the vector (1; 1; 1; 1; 1; 1; 1; 1; 1). Property 2 of Definition 1 can also be easily verified. Indeed, consider what happens when less than four participants stack their together transparencies. For example, consider the first three participants and notice that, by stacking their shares, we get the vector (0; 1; 1; 1; 1; 1; 1; 1; 1) in both cases when the shared pixel is either white or black. Thus, the participants are not able to distinguish the color of the shared pixel by inspecting their shares.

9.2.2 Perfect Black Visual Cryptography Schemes

Visual cryptography schemes such that, in the reconstructed image, all the subpixels associated with a black pixel are black, i.e., ` = 0, are referred either to as visual cryptography schemes with perfect reconstruction of black pixels or to as maximal contrast schemes.

9.3 Almost Ideal Contrast VCS with Reversing

In order to improve the contrast in VCSs, Viet and Kurosawa [13] introduced another non cryptographic operation, called reversing, which can be used by participants in the reconstruction phase. In the reconstruction phase, any qualified set of participants can recover the original secret image by performing a sequence of stacking and reversing operations on their transparencies. The construction is described in Figure 9.1.
Assume there exists a (tQual; t forb)-VCS with a perfect reconstruction of black pixels. Distribution phase. For each pixel of the secret image, the dealer: y runs c times independently of the distribution phase of the underlying (TQual; tForb)-VCS; let s l/i` i be the share distributed to participant i in the `-th run, for i = 1; : : : ; n and l ` = 1; : : : ; c; y distributes the c-tuple (s1/ii ; : : : ; sc/ii ) to participant i. Reconstruction phase. A quali_ed set fi1; : : : ; ipg of participants reconstructs the secret pixel as follows: y superimpose their shares to get _` = OR(s` : : : ; s`ip ), for ` = 1; : : : ; c; y reverse the results of the previous step to obtain _`, for ` = 1; : : : ; c; y superimpose the results of the previous step to get _ = OR(_1; : : : ; _c); y finally, reverse the result of the previous step to obtain _, which is the reconstructed pixel.

FIGURE 9.1 A construction for almost ideal contrast (

Qual;

Forb)-VCS

with reversing.

9.4 Ideal Contrast VCS with Reversing

The scheme proposed by Viet and Kurosawa [13] is said to have an almost ideal contrast because the black pixels are perfectly reconstructed, whereas, the white ones are almost perfectly reconstructed. the scheme proposed by Viet and Kurosawa [13] also has the following drawbacks: y Each participant is required to store c transparencies, where c denotes the number of runs for the underlying VCS y the size of each transparency is m times the size of the original image, where m denotes the pixel expansion of the underlying VCS; y There is a loss of resolution in the reconstructed image; y A large number of runs is required to obtain an almost ideal contrast; y The underlying VCS has to be perfect black. y

9.4.1 A Construction Using a Binary Secret Sharing Scheme

In this section we describe an ideal contrast VCS with reversing for any access structure (TQual; tForb), proposed in [6]. The scheme uses as a building block

a binary secret sharing scheme (BSS for short).

Figure 9.2
letTQual; tForb) be an access structure on a set of n participants. Let B0 and B1 be the collections of distribution functions realizing a BSS for (TQual; tForb). Let r be the size of the shares distributed by the BSS. Distribution phase. To share a white (black, resp.) pixel of the original image, the dealer has to: y randomly choose a distribution function f 2 B0 (resp. f 2 B1), y for each participant i, consider the binary representation si;1; : : : ; si;r of the share f(i) and, for each j = 1; : : : ; r, put a white (black, resp.) pixel on the transparency ti;j if si;j = 0 (si;j = 1, resp.). Reconstruction phase. Let X = fi1; : : : ; ipg 2 Qual: Participants in X reconstruct the secret image by performing the sequence of reversing and stacking operations on their transparencies, corresponding to the NOT and OR gates of the Boolean circuit computing in parallel Rec (f(i1); : : : ; f(ip)), for each pixel of the original image, where f is the distribution function chosen to share that pixel.

FIGURE 9.2 A construction for ideal contrast VCS with reversing using a BSS.

9.4.2 Constructions Using Perfect Black VCSs

In this section we describe di_erent constructions using as a building block a perfect black VCS. In particular, the solution described in Section 9.4.2.1 requires each participant to store m transparencies, where m denotes the pixel expansion of the underlying perfect black VCS, and o_ers no loss of resolution. The scheme described in Section 9.4.2.2 still o_ers no loss of resolution, but requires each participant to hold two transparencies having a large size, i.e., j 0j times the size of the secret image. Finally, the scheme in Section 9.4.2.3 reduces the number of transparencies stored by each participant to m h+1, but there is a loss of resolution on the reconstructed image. 9.4.2.1 The Scheme by Cimato, De Santis, Ferrara, and Masucci In this section we describe a general technique, due to Cimato, De Santis, Ferrara, and Masucci [6], to construct an ideal contrast VCS with reversing for any access structure (TQual; TForb). The scheme uses as a building block a VCS with perfect reconstruction of black pixels, having a certain pixel expansion m, and requires each participant to store m transparencies, each having the same number of pixels as the original image. Figure 9.3.
Let (TQual; TForb) be an access structure on a set of n participants. Let C0 and C1 be the collections of Boolean matrices constituting a (TQual; TForb)-VCS with a perfect reconstruction of black pixels and pixel expansion m. Distribution phase. To share a white (black, resp.) pixel, the dealer has to: y randomly choose a matrix S = [si;j ] in C0 (S in C1, resp.); y for each participant i, consider the m bits si;1; : : : ; si;m composing

the i-th row of S and, for each j = 1; : : : ;m, put a white (black, resp.) pixel on the transparency ti;j if si;j = 0 (si;j = 1, resp.). Reconstruction phas. Let X = fi1; : : : ; ipg 2 Qual: Participants in X reconstruct the e secret pixel by computing: y aj = OR(si1;j ; : : : ; sip;j ), for j = 1; : : : ;m; y ajj , for j = 1; : : : ;m; y B_ = OR : : : ; _m ); y b_; which is the reconstructed pixel.

FIGURE 9.3 Cimato, De Santis, Ferrara, and Masucci's ideal contrast VCS with reversing. 9.4.2.2 The Scheme by Hu and Tzeng In this section we describe an ideal contrast VCS with reversing for any access structure (tQual; TForb), due to Hu and Tzeng [9]. The construction uses the basis matrices of the Naor-Shamir's (k; k)-VCS described in Section 9.2.1 along with the properties of the XOR operator. Let S0 and S1 be the basis matrices of the Naor-Shamir's (k; k)-VCS. The key idea behind Hu and Tzeng's construction relies upon the fact that the XOR of the bits belonging to a column of S0 (S1, respectively) is zero (one, respectively). construction is described in Figure 9.4
Let (TQual; TForb) be an access structure on a set of n participants. Distribution phase. For each quali_ed set XE t0 the dealer has to: y execute the XOR-(jXj; jXj)-VCS on X to generate the subtransparency tX;i for each participant i 2 X; y for each i 62 X, generate the subtransparency tX;i consisting of all ones; y for each i 2 X, generate a subtransparency t0 X;i of the same size of the original image, having all zeros; y for each i 62 X, generate a subtransparency t0 X;i of the same size of the original image, having all ones; _ distribute to participant i the transparencies ti = tX1;i _ : : : _ tXj 0j;i and t0 i = t0 X1;i _ : : : _ t0 Xj 0j;i. Reconstruction phase. Let X = fi1; : : : ; ipg be a quali_ed set in Qual. Participants in X reconstruct the original image by computing: _ T = XOR(ti1 ; : : : ; tip ); _ T0 = OR(t0 i1 ; : : : ; t0 ip ); _ U = OR(T; T0); _ U0 = XOR(U; T0), which corresponds to the original image.

FIGURE 9.4 Hu and Tzeng's ideal contrast VCS with reversing. 9.4.2.3 The Scheme by Yang, Wang, and Chen Yang, Wang, and Chen [14] proposed a different method to construct a VCS with reversing starting from any perfect black VCS with pixel expansion m. In their scheme each participant receives m - h + 1 shares, where the _rst one corresponds to the one obtained by the underlying perfect black VCS,

whereas the i-th share is obtained by cyclically shifting the (i- 1)-th share one bit to the right, for each i = 2; : : : ;m- h + 1. Notice that the right shift operation can be implemented by means of OR and NOT operations, since OR and NOT represent a complete basis for Boolean functions.fig9.5

The scheme is shown in Figure 9.5. Fig-5

Assume there exists a (TQual; TForb)-VCS with a perfect reconstruction of black pixels. Let _(_) be a one-bit cyclical right-shift function. Distribution phase. For each pixel of the secret image, the dealer: y runs the distribution phase of the underlying (TQual; TForb)-VCS; let s1i be the share distributed to participant i, for i = 1; : : : ; n; y for each ` = 2; : : : ;m h + 1, compute s`i = _(s` 1i ); y distributes the (m h + 1)-tuple (s1i ; : : : ; sm h+1i ) to participant i. Reconstruction phase. A quali fied set fi1; : : : ; ipg of participants reconstructs the secret pixel as follows: y superimpose their shares to get _` = OR(s` i1 ; : : : ; s` ip ), for ` = 1; : : : ;m h + 1; y reverse the results of the previous step to obtain _`, for ` = 1; : : : ;m h + 1; y superimpose the results of the previous step to get _ = OR(_1; : : : ; _m h+1); y _nally, reverse the result of the previous step to obtain _, which is the reconstructed pixel.

FIGURE 9.5 Yang, Wang, and Chen's ideal contrast VCS with reversing. 9.4.2.4 Comparisons The effeciency of a VCS with reversing is evaluated according to the following parameters: the contrast, the size (expansion) and the number of the transparencies held by each participant, the number of stacking and reversing operations, and the size (expansion) of the reconstructed image. In Table 9.1 we summarize and compare the parameters of the constructions described in Sections 9.3 and 9.4.2., which are all based on perfect black VCSs for a general access structure ( Qual; Forb).

TABLE 9.1
Comparison between VCSs with reversing based on perfect black VCSs. Scheme Contrast Share Number Number Number exp Of share OR oper Not oper Fig. 9.1 Almost m c cp -1 c +1 Ideal Fig. 9.3 Fig. 9.4 Fig. 9.5 Ideal Ideal Ideal NO To j m m 2 m-1 mp -1 4p- 1 m+1 4p Secret exp. m NO NO m

(m-h+1) p-1 m-h+2

9.4.3 A Construction Using a Non perfect Black VCS

Yang, Wang and Chen [14] proposed a way to construct an ideal VCS with reversing when the difference h-l` is odd, starting from any VCS (i.e., not necessarily a perfect black) with pixel expansion m. Fig- 9.6

Assume there exists a (TQual; TForb)-VCS with pixel expansion m. Let _(_) be a one-bit cyclical right shift function and let (h - l `) be odd. Distribution phase. For each pixel of the secret image, the dealer: y runs the distribution phase of the underlying ( Qual; Forb)-VCS; let s1 i be the share distributed to participant i, for i = 1; : : : ; n; y for each ` = 2; : : : ;m, compute s` i = _(s` 1 i ); y distributes the m-tuple (s1 i ; : : : ; sm i ) to participant i. Reconstruction phase. A quali_ed set fi1; : : : ; ipg of participants reconstructs the secret pixel as follows: y _ superimpose their shares to get _` = OR(s` i1 ; : : : ; s` ip ), for ` = 1; : : : ;m; y compute _ = XOR(_1; : : : ; _m ), which is the reconstructed pixel if (m h) is even, otherwise the reconstructed pixel is _.

FIGURE 9.6 Ideal contrast VCS with reversing starting from any VCS.

9.5 Conclusions
Visual cryptography schemes are characterized by two parameters: the pixel expansion, i.e., the number of sub pixels contained in each share and the contrast, which measures the difference between a black and a white pixel in the reconstructed image. While it is possible to construct schemes with perfect reconstruction of black pixels (or white pixels, respectively), it has been shown that a perfect reconstruction of both black and white pixels is infeasible. In order to improve the contrast in VCSs, Viet and Kurosawa [13] introduced an extra non cryptographic operation: the reversing operation. Speciacaly, they showed how to construct VCSs with reversing where the reconstruction of black (white, respectively) pixels is perfect, whereas, the reconstruction of white (black, respectively) pixels is almost perfect. Afterwards, Cimato et al. [6] showed how to construct VCSs with reversing where reconstruction of both black and white pixels is perfect. Such schemes are said to have an ideal contrast. In particular, Cimato et al. [6] proposed two different constructions. One uses as a building block a VCS with perfect reconstruction of black pixels while the other construction uses as a building block a binary secret sharing scheme. Subsequently, new constructions for visual cryptography with reversing have been described in [9, 14]. In particular, [9] considered the problem of minimizing the number of the shares held by each participant while in [14] the need of using as a building block a VCS with perfect reconstruction of black pixels is removed.

Bibliography
[1] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson. Visual cryptography for general access structures. Information and Computation, 129(2):86{106, 1996.
2012 by Taylor & Francis Group, LLC

Visual Cryptography Schemes with Reversing 279 [2] C. Blundo, P. D'Arco, A. De Santis, and D. R. Stinson. Contrast optimal threshold visual cryptography schemes. SIAM Journal on Discrete

Mathematics, 16(2):224{261, 2003. [3] C. Blundo, A. De Bonis, and A. De Santis. Improved schemes for visual cryptography. Designs, Codes, and Cryptography, 24:255{278, 2001. [4] C. Blundo and A. De Santis. Visual cryptography schemes with perfect reconstruction of black pixels. Journal for Computers & Graphics, 22(4):449{455, 1998. [5] C. Blundo, A. De Santis, and D. R. Stinson. On the contrast in visual cryptography schemes. Journal of Cryptology, 12(8):261{289, 1999. [6] S. Cimato, A. De Santis, A. L. Ferrara, and B. Masucci. Ideal contrast visual cryptography schemes with reversing. Information Processing Letters, 93:199{206, 2005. [7] A. De Bonis and A. De Santis. Randomness in secret sharing and visual cryptography schemes. Theoretical Computer Science, 314(3):351{374, 2004. [8] T. Hofmeister, M. Krause, and H. U. Simon. Contrast-optimal k out of n secret sharing schemes in visual cryptography. Theoretical Computer Science, 240(2):471, 2000. [9] C.-M. Hu and W.-G.. Tzeng. Compatible ideal contrast visual cryptography schemes with reversing. In Proc. of ISC 2005, Lecture Notes in Computer Science, volume 3650, pages 300{313, 2005. [10] M. Krause and H. U. Simon. Determining the optimal contrast for secret sharing schemes in visual cryptography. Combinatorics, Probability and Computing, 12(3):285{299, 2003. [11] M. Naor and A. Shamir. Visual cryptography. In Proc. of Advances in Cryptology { EUROCRYPT '94, Lecture Notes in Computer Science, volume 950, pages 1{12, 1995. [12] E. R. Verheul and H. C. A. van Tilborg. Constructions and properties of k out of n visual secret sharing schemes. Designs, Codes, and Cryptography, 11(2):179, 1997. [13] D. Q. Viet and K. Kurosawa. Almost ideal contrast visual cryptography with reversing. In Proc. of Topics in Cryptology - CT-RSA 2004, The Cryptographers' Track at the RSA Conference 2004, Lecture Notes in Computer Science, volume 2964, pages 21{37, 2004. [14] C.-N. Yang, C.-C. Wang, and T.-S. Chen. Visual cryptography schemes with reversing. The Computer Journal, 51(6):710, 2008.
2012i