1. Optimal XOR based (2,n)-Visual Cryptography Schemes
Feng Liu and Chuankun Wu
SKLOIS, IIE, CAS
6/2/2019

2. Contents Introduction Preliminaries
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with largest contrast given optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with smallest pixel expansion given optimal contrast
Equivalence between 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 and binary code
6/2/2019

3. Introduction Why XOR? How to realize 𝑿𝑶𝑹 based 𝑽𝑪𝑺?
Semi-group VS. GF(2)
Better visual quality and smaller pixel expansion
How to realize 𝑿𝑶𝑹 based 𝑽𝑪𝑺?
Mach-Zehnder Interferometer [Lee2002]
Polarization property of liquid crystal displays [Tuyls2002,PCT2003]
Copy machine with the reversing function [Viet2004]
Why 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹 ?
For(𝑘,𝑛)−𝑉𝐶𝑆𝑋𝑂𝑅 ,many Mach-Zehnder Interferometers or liquid crystal displays or reversing copies make the decoding system complicated.
There are mainly two models in the visual cryptography. OR based model and the XOR based model. Most studies focused on the OR based model. However, from the mathematical view point, the OR based model only form a semi-group, whereas the XOR based model form a Galois Field. And this is the very reason why XOR based VCS often has better visual quality and smaller pixel expansion.
Until now, there are mainly three methods to realize the XOR based VCS. Several Korea researchers proposed using Mach-Zehnder Interferometer to realize the XOR operation in 2002, however there method is rather complex. I think their method is only suitable for (2,n)-VCS. Tuyls et al. proposed another model to realize XOR based VCS in the same year, they also applied several international patent on behalf of the Philips company. Their method is to make use of the polarization property of light where two liquid crystal displays are needed. In 2004 two Japanese researchers introduced the VCS model with reverse operation, which is in fact the NOT operation, we found that the XOR operation can be achieved by using OR and NOT operations after a several steps.
For the first two methods, it in fact only suitable for (2,n)-VCS, for the reason that the devices will be rather complex for general (k,n) access structure. And the third method can realized the general (k,n) access structure theoretically. But the number of steps will increase exponentially.
Hence, we would like to say the current models of XOR based VCS are only suitable to (2,n)-VCS from the practical sense.
6/2/2019

4. Contents Introduction Preliminaries
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with largest contrast given optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with smallest pixel expansion given optimal contrast
Equivalence between 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 and binary code
6/2/2019

5. Formal definition of (𝒌,𝒏)−𝑽𝑪𝑺
Definition 1. Let k, n, m, l and h be non-negative integers satisfying 2≤ k≤n and 0 ≤ l < h ≤m. The two sets of 𝑛 ×𝑚 Boolean share matrices (C0, C1) constitute a (k, n)-VCS if the following properties are satisfied:
1. (Contrast) For any s ∈ C0, the “” operation of any k out of the n rows of s, is a vector v that, satisfies w(v) ≤ l.
2. (Contrast) For any s ∈C1, the “” operation of any k out of the n rows of s, is a vector v that, satisfies w(v)≥h.
3. (Security) For any i1< i2<…<it in {1, 2,…, n} with t < k, the two collections of 𝑡 ×𝑚 matrices D0 and D1 obtained by restricting each 𝑛 ×𝑚 matrix in C0and C1to rows i1, i2,…,it, are indistinguishable in the sense that they contain the same matrices with the same frequencies.
For a general (k,n)-VCS the definition contains three parts, two contrast condition and the security condition. The contrast conditions means for a qualified set of participants, they can see the secret images. And the security condition means a forbidden set of participants can not get any information about the secret image, other than the image size.
6/2/2019

6. Basis matrix of 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
Definition 2. Let 𝑛, 𝑚 and ℎ be positive integers satisfying 0 < ℎ ≤ 𝑚. An 𝑛 × 𝑚 binary matrix M is called a basis matrix for a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 if it satisfies the following contrast condition: the weight of the XOR (denoted by ⊕) of any 2 out of n rows in M satisfies: 𝑤 𝑗 𝑖 1 ⊕ 𝑗 𝑖 2 ≥ℎ, where 𝑗 𝑖 (𝑖= 1,…, 𝑛) is a row of M and ℎ≥1.
Boolean share matrices (C0, C1)
𝐶 0 = 𝐴 𝑗 1 ,…,𝐴 𝑗 𝑛 𝑗 1 ,…, 𝑗 𝑛 are the n rows of M
𝐶 1 = 𝑀 0 ,𝑀 1 ,𝑀 2 ,…,𝑀(𝑛−1)
A(r) is the 𝑛×𝑚 matrix for which each row equals to r
M(i) is the 𝑛×𝑚 matrix obtained by cyclicaly shift the rows of M over i positions.
Usually, researchers prefer using basis matrix of VCS to simplify their constructions.
In this paper, we introduce an special definition for the XOR based (2,n)-VCS, it contains only one basis matrix, and can generate two collections of C0 and C1 which satisfies the traditional definition of VCS, like the Definition 1.
6/2/2019

7. 𝑀=
𝟐,𝟑 − 𝑽𝑪𝑺 𝑿𝑶𝑹
𝑪 𝟎
𝑪 𝟏
6/2/2019

8. Average contrast for 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
The contrast is 𝜶= 𝒉−𝒍 𝒎 = 𝒉−𝟎 𝒎 = 𝒉 𝒎 ,
Average contrast is 𝜶 = 𝒉 − 𝒍 𝒎 ,
ℎ (resp. 𝑙 ) is the average value of darkness level in collection 𝐶 1 (resp. 𝐶 0 )
ℎ = 𝑀∈ 𝐶 1 ℎ 𝑀 𝐶 1 , ℎ 𝑀= 1≤𝑖<𝑗≤𝑛 𝑤( 𝑟 𝑖 ⊕ 𝑟 𝑗 ) 𝑛 2
𝑙 = 𝑀∈ 𝐶 0 𝑙 𝑀 𝐶 0 , 𝑙 𝑀= 1≤𝑖<𝑗≤𝑛 𝑤( 𝑟 𝑖 ⊕ 𝑟 𝑗 ) 𝑛 2
ℎ 𝑀(resp. 𝑙 𝑀) is the average value of darkness level of M
Researchers often make use of contrast to measure the visual quality of the recovered secret image. According the traditional definition, the contrast of the proposed Definition 2 is \alpha=h/m, because the whiteness level of VCS under Definition 2 is 0. However, sometimes, the contrast cannot reflect the visual quality faithfully, because h only is the lower bound of the darkness level of M. We hence make use of the average contrast. The definition of average contrast in this paper is as follows. Because we generate the share images pixel by pixel, we can figure out the value of the average contrast by the basis matrix M directly.
6/2/2019

9. Contents Introduction Preliminaries
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with largest contrast given optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with smallest pixel expansion given optimal contrast
Equivalence between 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 and binary code
6/2/2019

10. Theorem 1. The optimal pixel expansion of the 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 is 𝑚 ∗ = log 2 𝑛 .
Proof: Assume that there exists a the 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with pixel expansion 𝑚< log 2 𝑛 , and denote 𝑀 as the basis matrix for a black secret pixel, then there must exist two identical rows in the basis matrix. And the weight of the vector of the sum of the two identical rows is 0, which is in contradiction with the contrast condition of 𝑀. Hence we must have that 𝑚≥ log 2 𝑛 .
Theorem 2. The largest possible contrast of the 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 given the optimal pixel expansion is 𝛼 𝑋𝑂𝑅 = 1 log 2 𝑛 .
We prove this theorem by reduction to absurdity
It’s contrast will be the reciprocal of log 2 𝑛 . The proof will also be given by reduction to absurdity just as that of Theorem 1.
6/2/2019

11. Theorem 3. There exists a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with the optimal pixel expansion 𝑚 ∗ = log 2 𝑛 and the largest average contrast 𝛼 𝑋𝑂𝑅= 2 𝑛/2 𝑛/2 𝑛(𝑛−1) , and it is achieved if and only if all the rows of the basis matrix are different vectors and all the columns of the basis matrix have Hamming weight 𝑛/2 𝑜𝑟 𝑛/2
Construction: 𝑛=5, 𝑚 ∗ =3,𝛼= 1 3 , 𝛼 𝑋𝑂𝑅= 3 5
𝑀′=
𝑀′′=
Remove one complementary row vector pairs randomly
We then talk about he average contrast of our VCS with optimal pixel expansion. Read the Theorem. The proof is simple. Let me give an example for this theorem. Let n be 5 and m* be 3. There are 8 different vectors of length 3 in total. We combine these 8 vectors as rows to form a matrix. Then we remove one complementary row vector pairs randomly, and remove one row randomly again. At this time the matrix will only has 5 rows. For each column, it has only 2 or 3 1’s. We can calculate the contrast and average contrast of M. That is….
Remove one row randomly 𝑀=
{0 1 1}
6/2/2019

12. Contents Introduction Preliminaries
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with largest contrast given optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with smallest pixel expansion given optimal contrast
Equivalence between 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 and binary code
6/2/2019

13. Optimal contrast of 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
Theorem 4. The contrast for a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 satisfies α𝑋𝑂𝑅≤ 2 𝑛/2 𝑛/2 𝑛(𝑛−1) , and equality holds if and only if all the columns have weight 𝑛/2 𝑜𝑟 𝑛/2 and the Hamming weight of the ⊕ of any two rows of the basis matrix is exactly 2 𝑛/2 𝑛/2 𝑛(𝑛−1) ∙𝑚, where m is the pixel expansion of the scheme.
Proof: Consider when the unavoidable patterns and reach its maximum
Theorem 5. The basis matrix of an optimal contrast 2,𝑛 − 𝑉𝐶𝑆 𝑂𝑅 for the black secret pixel is also the basis matrix of an optimal contrast 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 . Hence the smallest pixel expansion for the optimal contrast 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 is no larger than that of optimal contrast 2,𝑛 − 𝑉𝐶𝑆 𝑂𝑅 .
Proof: The proof follows directly from property 2 of Lemma 4.3 in [Blundo1999], which pointed out that each unavoidable pattern and appears 𝑛/2 𝑛/2 𝑛(𝑛−1) ∙𝑚 times for optimal OR based VCS.
[Blundo1999] also proved that α𝑂𝑅≤ 𝑛/2 𝑛/2 𝑛(𝑛−1) ,
We then talk about the optimal contrast of (2,n)-VCS_XOR. This theorem tells us that the largest possible contrast of (2,n)-VCS_XOR will be this value. Note it not average contrast, and this value is regardless of the pixel expansion. The proof is also simple and quite similar with that of Theorem 3.
The Theorem 5 tells that…. This theorem also tells us that the construction of OR based VCS and XOR based VCS for optimal contrast can be exactly the same.
We also note that the contrast for the XOR based VCS is twice of that of OR based VCS. That makes sense, because, the unavoidable pattern and both cause the contrast in XOR based (2,n) VCS, but only one of them caused the contrast in the OR based (2,n) VCS.
Then we turn to talk about the lower bounds of the pixel expansion
Theorem 5 also tells us that, the smallest pixel expansion of XOR based VCS is also smaller than that of the OR based VCS. Blundo et al. have already gave the smallest pixel expansion given the optimal contrast for the OR based VCS. But I will a bit complex for the XOR based VCS especially when n is even.
6/2/2019

14. Structural properties of 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
𝑆 𝑖
Column reverse property
𝑀=( 𝑠 1 ,…, 𝑠 𝑖 ,…, 𝑠 𝑚 )
𝑀′=( 𝑠 1 ,…, 𝑠 𝑖 ,…, 𝑠 𝑚 )
Same Contrast
We first give two structural properties for the 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹 , the first is the…, and the second is …. The proofs of the two properties are easy. But they are very important. Since they are only valid for the XOR based VCS.
𝑀= 𝑟 1 ⋮ 𝑟 𝑛
𝑀′= 𝑟 1 +𝑟 ⋮ 𝑟 𝑛 +𝑟
Row shift property 𝑟
6/2/2019

15. Bounds for the pixel expansion when n is odd (given optimal contrast)
Lemma 1. For an odd 𝑛 (≥3), if there exists a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with the optimal contrast α ∗ 𝑋𝑂𝑅 and denote its pixel expansion as 𝑚, then we have 𝑛|𝑚.
Lemma 2. For a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with 𝑛≡1 𝑚𝑜𝑑 4 and optimal contrast α ∗ 𝑋𝑂𝑅= 2 𝑛/2 𝑛/2 𝑛(𝑛−1) = 𝑛+1 2𝑛 , the pixel expansion of such scheme satisfies 𝑚≠𝑛.
Corollary 1. For 𝑛≡1 𝑚𝑜𝑑 4, the smallest pixel expansion 𝑚 𝑐 ∗ of a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 given optimal contrast is 2𝑛.
We first consider the case for n is odd. We first have the Lemma 1, which tell n can be divided by m. And the Lemma 2 tells us that for the case 𝑛≡1 𝑚𝑜𝑑 4, m does not equal to n. At this time, we have that, the smllest pixel expansion is at least 2n. Blundo has proved in 1999 that, for the OR based VCS for the case 𝑛≡1 𝑚𝑜𝑑 4, the smallest pixel expansion is exactly 2n. Consider Theorem 5, we have that the smallest pixel expansion for the case 𝑛≡1 𝑚𝑜𝑑 4, is 2n.
6/2/2019

16. Deduce from odd n to even (The most important lemma of this paper)
Lemma 3. Denote M as an 𝑛×𝑚 binary matrix which satisfies:
𝑛 is odd
the minimum Hamming distance of any two rows of M is 𝑛+1 𝑚 2𝑛
each column of M has the same hamming weight 𝑛−1 2 (𝑜𝑟 𝑟𝑒𝑠𝑝. 𝑛+1 2 )
then all the rows of M will also have the same hamming weight 𝑛−1 𝑚 2𝑛 (𝑜𝑟 𝑟𝑒𝑠𝑝. 𝑛+1 𝑚 2𝑛 )
We first give the following lemma
6/2/2019

17. Proof :
For an equidistant binary code (rows of M) with parameters: code length 𝑚, cardinality 𝑛 (odd number), distance 𝑑, and each column has 𝑘 1’s. If a row of M has the hamming weight 𝑤, we note that its sum of distances with the remaining n-1 rows, will equal to the number of unavoidable patterns in M:
𝑑 𝑛 − 1 = 𝑤 𝑛 − 𝑘 + 𝑚 − 𝑤 𝑘 (1) Hence:
𝑑 𝑛 − 1 − 𝑚𝑘 = 𝑛 − 2𝑘 𝑤 (2) Consider a general binary code with the minimum Hamming distance d, then the equation (1) will be changed as follows: 𝑑(𝑛 − 1)≤ 𝑤(𝑛 − 𝑘)+ (𝑚 − 𝑤)𝑘 (3) Since 𝑑= 𝑛+1 𝑚 2𝑛 𝑎𝑛𝑑 𝑘= 𝑛−1 2 , substitute them in (3), we have:
6/2/2019

18. w≥ 𝑑 𝑛−1 −𝑚𝑘 𝑛−2𝑘 = 𝑛−1 𝑚 2𝑛 (4)
Denote 𝑤 𝑖 as the Hamming weight of the 𝑖𝑡ℎ row of M, 𝑖 = 0, 1, · · · , 𝑛 − 1, then the total number of 1’s in M is: (by adding all rows)
𝑖=0 𝑛−1 𝑤 𝑖 ≥ 𝑛−1 𝑚 (5) meanwhile, by adding all columns:
𝑘𝑚= 𝑛−1 𝑚 (6) combine (4), (5), and (6),we have
𝑤= 𝑛−1 𝑚 2𝑛
6/2/2019

19. 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹 and 𝟐,𝒏+𝟏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
Theorem 6. For an odd n, there exists a 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with the optimal contrast α ∗ 𝑋𝑂𝑅= 𝑛+1 2𝑛 and pixel expansion m if and only if there exists a 2,𝑛+1 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast same as α ∗ 𝑋𝑂𝑅= 𝑛+1 2𝑛 and the same pixel expansion m.
Proof:
Note that: 2 𝑛/2 𝑛/2 𝑛(𝑛−1) = 𝑛+1 2𝑛 = 2 (𝑛+1)/2 (𝑛+1)/2 𝑛(𝑛+1) , the sufficiency is easy.
Necessity: transform M into M’ with constant weight of columns using column reverse property. And according Lemma 3, the rows will have constant weight of 𝑛−1 𝑚 2𝑛 (𝑜𝑟 𝑟𝑒𝑠𝑝. 𝑛+1 𝑚 2𝑛 ), by adding an all 1 row (resp. 0), we generate a 2,𝑛+1 2,𝑛+1 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast 𝑛+1 2𝑛 .
Note that, this equation holds for n is odd. The sufficiency hence is easy, for that, one only needs to choose the first n rows of a 2,𝑛+1 − 𝑉𝐶𝑆 𝑋𝑂𝑅 , the proof is done.
For the necessity, according the column reverse property, we transform the basis matrix M into M’
6/2/2019

20. Constructions for even number rows
When n is even, take 𝑛=4 as an example.
Basis Matrix for 2,3 −𝑉𝐶𝑆𝑋𝑂𝑅
𝑀’=
Adjust columns
Adjust columns
𝑀’’=
𝑀’’=
Add all 1 row
Add all 0 row 𝑀= 𝑀=
6/2/2019
Basis Matrix for 2,4 −𝑉𝐶𝑆𝑋𝑂𝑅

21. Constructions for the smallest pixel expansion 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹 given optimal contrast
(Theorem 4.7 of [Blundo1999]) Assuming that 𝑛≡3 𝑚𝑜𝑑 4 and there exists a 2,𝑛 − 𝑉𝐶𝑆 𝑂𝑅 with pixel expansion m and contrast α ∗ 𝑂𝑅= 𝑛/2 𝑛/2 𝑛(𝑛−1) . Then 𝑚≥𝑛 𝑎𝑛𝑑 𝑚=𝑛 if and only if there exists a 𝑛, 𝑛−1 2 , 𝑛−3 4 −𝐵𝐼𝐵𝐷 (or equivalently, a Hadamard matrix of order n+1).
(Theorem 4.8 of [Blundo1999]) Assuming that 𝑛≡1 𝑚𝑜𝑑 4 and there exists a 2,𝑛 − 𝑉𝐶𝑆 𝑂𝑅 with pixel expansion m and contrast α ∗ 𝑂𝑅= 𝑛/2 𝑛/2 𝑛(𝑛−1) . Then 𝑚≥2𝑛 𝑎𝑛𝑑 𝑚=2𝑛 if and only if there exists a 𝑛, 𝑛−1 2 , 𝑛−3 2 −𝐵𝐼𝐵𝐷 or an 𝑛+1, 𝑛+1 2 , 𝑛−1 2 −𝐵𝐼𝐵𝐷.
6/2/2019

22. The smallest possible pixel expansion of 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹 given the optimal contrast
Theorem 7: OR
XOR
𝑛=2 2 1
𝑛≡3 𝑚𝑜𝑑 4 𝑛
𝑛≡0 𝑚𝑜𝑑 4
𝟐𝒏−𝟐
𝒏−𝟏
𝑛≡1 𝑚𝑜𝑑 4 2𝑛
𝑛≡2 𝑚𝑜𝑑 4
2𝑛−2
6/2/2019

23. Contents Introduction Preliminaries
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with largest contrast given optimal pixel expansion
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with optimal contrast
2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 with smallest pixel expansion given optimal contrast
Equivalence between 2,𝑛 − 𝑉𝐶𝑆 𝑋𝑂𝑅 and binary code
6/2/2019

24. 𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹 and binary code
Odd 𝒏
Optimal contrast
𝜶 ∗ 𝑿𝑶𝑹= 𝒏+𝟏 𝟐𝒏
𝟐,𝒏+𝟏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
(𝐦, 𝜶 ∗ 𝑿𝑶𝑹𝐦)
binary code
Equivalent
𝟐,𝒏 − 𝑽𝑪𝑺 𝑿𝑶𝑹
(𝐦, 𝒏+𝟏 𝒎 𝟐𝒏 , 𝒏±𝟏 𝒎 𝟐𝒏 )
binary constant weight code
𝒏= 𝟐 𝒌 −𝟏
𝒏 period m-sequence
6/2/2019

25. Full version available at:
Thank you very much!
Full version available at:
6/2/2019