UNIVERSITY OF Visual Cryptography Kit CAMBRIDGE THE OLIVETTI & ORACLE Computer Laboratory RESEARCH LABORATORY http://www.cl.cam.ac.uk/~fms27/vck/ Frank Stajano 1998 Visual cryptography (invented by Naor & Shamir in 1994) is a One time pad The one time pad is the only demonstrably secure cipher, in the method for securely encrypting 010010101010111101001110010... sense that even an infinite amount messages in such a way that the plaintext = of ciphertext will not leak any bits of recipient won’t need a computer to To encrypt: xor information to the attacker about the plaintext (except the length). key = 110011010010101000010101000... decrypt them. This is because, given a ciphertext, The underlying cipher is essentially = you can choose any plaintext you want and there will always exist a the one time pad; so the system is ciphertext = 100001111000010101011011010... key that generates that ciphertext unbreakable in the information To decrypt:xor from that plaintext. Why do people ever use anything theoretical sense. key = 110011010010101000010101000... else, then? Well, the one time pad = is not very practical because it The Visual Cryptography Kit, freely requires a lot of key material (as decrypted = 010010101010111101001110010... downloadable from the URL above, many key bits as message bits). You is a Python module, based on PIL can’t ever reuse the same key bits and you must use a truly random and Tkinter, that allows easy The mechanism of the one time pad is very simple: XOR every plaintext bit with the corresponding random key bit to yield a ciphertext bit:c=p⊕ k. source; otherwise, cryptanalitic practical experimentation with this To decrypt, XOR the ciphertext with the key once more:d=c⊕ k.Thetwokeys attacks become possible. fascinating invention. will cancel out and you’ll get the plaintext. If you use a pseudo-random number d=c⊕⊕k=(p k)⊕⊕⊕⊕ k=p (k k)=p 0=p. generator, you instead obtain what is known as a stream cipher. Pixelcoding — how to make XOR out of OR On output from the decrypting XOR operation, The idea of visual cryptography is to perform a At first it appears obvious that overlay or0 1 overlay a black pixel means black and a 50% grey pixel visual one time pad by overlaying transparent will never work, because one can’t means white. This is a reduction in contrast, acetate sheets. But overlaying corresponds to make 1⊕ 1 = 0 with it. 0 01 but our eyes will easily “see” the grey as white OR, not to XOR: ink overlay ink gives ink, not 1 1 1 for free. transparent. Note that on the input to the XOR, both black This is where the clever part of Naor & But try this: use for 0 and for 1 at and white are represented as 50% grey — but Shamir’s idea kicks in: a new encoding the input; and accept both and as by two complementary greys, i.e. one grey convention for the pixels (different for the xor 0 1 overlay 0, and for 1, at the output of the pattern has black where the other has white input pixels and the output ones) that allows operation. Then note how and vice versa. So the overlap of two identical XOR to be built out of OR plus thresholding; 0 0 1 overlay = i.e. 1 ⊕ 1=0… input patterns yields the same pattern (a 50% and the thresholding can be done “for free”by 1 1 0 This clever trick, which I call pixelcoding, is grey, so logical white for output), while two our visual system! the fundamental intuition of Naor & opposite input patterns yield black everywhere. Shamir’s visual cryptography construction. This satisfies the truth table for XOR. Enciphering a bitmap image overlay (i.e. OR) pixelcode ⊕ pixelcode Between a “shaken, not stirred” and a romantic dinner, 007 gets the fax. He overlays his M chooses a size A couple of weeks acetate on it and reads M’s (width x height) for later, M must tell message. (No computers the message and 007 something needed!) He then burns both generates a random M gets the pad out really secret. He the fax and the acetate and pad of this size, of the safe and M pixelcodes the pad and gives the writes it on an M pixelcodes the outcome of the XOR, proceeds to save the world. made of black and XORs it with the result to 007 on acetate. 007 goes to image the size of obtaining a ciphertext. He faxes this to white pixels. He message. He then the Bahamas and has an active sex life the pad. 007. SPECTRE taps the fax line, but is stores it in his safe. burns the pad. as usual. none the wiser. Ha ha ha! In practice, A variant for greyscale images though, things never go as smoothly as this, neither for the monochrome nor for the greyscale variants. This is because, apart from the interaction between adjacent pixel groups, it is quite difficult to achieve proper registration over the surface of the whole picture. This is primarily due to the fact that the This artificial composite shows each acetates expand halfmoon pair on a local background in a non-uniform Halfmoons in the pad are randomly Halfmoons in the ciphertext are ...they create pie angles proportional with the intensity of the original and irregular way oriented. oriented so that, when to the pixel intensities of the plaintext pixel: the fully open pairs during the printing superimposed on the pad... plaintext. are on white, the fully closed ones process. on black..