ITW 1998.Killarney. Ireland.

On Visual Cryptography Schemes

AlfreJo De Santk
Dipartimento di !,lformatica ed Applicazioni
Universitb di Salerno, 5 ~ 9 8 1
Flaronissi (SA), Italy
e-mail: ads@dia.unisa.it UX: Er.!p://”””.unisa.it/Nads/

Abstract - We c o n s i d e r visual c r y p t o g r a p h y A? pixel expansion and on the contrast. Some of the recent
s c h e m e s in w h i c h t w o pixels c o m b i n e in XI a r b i t r a i y ’ucunds in the literature can be seen as corollaries of our result.
way. We a n a l y z e t h e pixel e x p a n s i o a a n d the contwcst
of ( 2 , n)-threshold visual c r y p t o g r a p h y s c h e m e s , tIiat 11. THEMODEL
is s c h e m e s i n w h i c h a n y p a i r of n shares can visually Tr’e assume that the secret image consists of a collection
r e c o n s t r u c t t h e s e c r e t image, but a n y s i n g l e s h a r e has or black m d white pixels. Each pixel appears in n ver-
110 i n f o r m a t i o n o n t h e s e c r e t image. sions called shares, one for each transparency. Each share
is a coliection of m black and white subpixels. The result-
I. INTRODUCTION ing structure can be described by an n x m Boolean matrix
S = [ s , ~ ] where sl,, = 1 iff the j - t h subpixel in the i-th
A visual cryptography scheme for a set P of 12 participants i s ” ~ p a r e n c y i s black. Therefore the grey level of the com-
a method to encode a secret image S I into n shadow images bined share, obtained by stacking the transparencies i , j , is
called shares, where each participant receives one share. Ce7- Fropcrtbnal to the Hamming weight w(Y)of the m-vector
tain qualifiedsubsets of participants can “visually” recover die V = [ f ( s Z , isJ,i), , f ( s t , z ,s J , z ) ,. . . , f ( S t , m , s l , m ) ] , where f is
secret image, but other, forbidden, sets of participants hale no an) L.iolean function with domain {O,l}, referred to as the
information on S I . A “visual” recovery for a set S E P ccil- comtrznutzon functzon. The combination function f shows how
sists of stacking the shares given to the participants In X one the sliares combine (e.g., f could be the OR function, the >;OR
on top of the others. The participants in a qualified set A- function ..). This grey level is interpreted by the visual sys-
will be able to see the secret image without any knowledge tem c f the participants as black or as white according t o some
of cryptography and without performing any cryptograpLc rule of coiltrast. For a n y combination function f we denote
computation. The schemes we consider are unconditional se- with Jir(’) the number of ones in the truth-table o f f , that is,
cure in that any forbidden set of participants does not gain Il‘(fj = I{%, Y E {0,1} : f ( x , Y) = 111.
information about the shared image S I , even though it ha. Definition 11.1 Let n 2 2 be an integer, let P be a set of
infinite computational power. n partzcipants, and let f be a combination functzon. Two
Visual cryptography schemes are characterized by two p~ I: x m boolean matrices So and Si, referred t o as basis matri-
rameters: The pixel expansion, which is the number of sub- ces, constitute a (2, n)-threshold visual cryptography scheme
pixels each pixel of the original image is encoded into, and the with pixel expansion m and combination function f if there
contrast which measures the “difl‘erence” bet-veen a black and exist the galue CY, referred t o as the contrast, and the set
a white pixel in the reconstructed image. {(XI ~ X I } X E P . I X . I = 2satksfying:
This cryptographic paradigm was introduced by Naor and
1. Any (qualified) set X = (i,j} C P can recover the
Shamir [9]. Further results on (k,n)-threshold visual cryptog-
shared image by stacking their transparencies.
raphy schemes ((k,n)-threshold VCS, for short) can be found
Formally, the “combination” of rows i , j of S o , i.e.,
in [I, 2, 5, 4, 6, 7, 8, 101. This model has been extended in
[I, 21 to general access structures (an access structure is a i’ = [f (sl,ir sJ,i),f ( ~ , , z S, ~ , Z ) ,... , f ( s r , m r ~ > , m ) ] , satis-
specification of all qualified and forbidden subsets of partici- -
fies w ( V ) 5 t x cr. m; whereas, for S’ it results that
pants), where general techniques to construct visual cryptog-
W(V)2 tx.
raphy schemes €or any access structure have been proposed. 2. Any (forbidden) set X = {i} E P has no information
Different assumptions on the way the shares combine have on the shared image.
been proposed. In the Naor-Shamir’s model [9] it is assumed Formally, the i-th row of So is equal to the i-th row Of
that the shares combine by means of the “OR” function (i.e., if Si up to a column permutation.
we “stack” t > I pixels and at least one of them is black, then
our visual system will interpret this as black). An alternative We want the pixel expansion t o be as small as possible and
reconstruction method for visual cryptography schemes based the contrast to be as large as possible and a t least one, that
on polarized filters I31 has been recently proposed. Such a is, o 2 ajm.
model makes assumptions different from the “traditional” ones If the same column appears in both basis matrices, then by
on the way the shares combine (i e., the shares combine by removing it we obtain a scheme with smaller pixel expansion
means of the “XOR” function). and i a g e r contrast. Hence, in this paper we consider schemes
ij7e consider all the possible ways the shares combine (e.g., realized using basis matrices So and S’ in which the same
they could combine by means of any boolean function such column does not appear in both. Such basis matrices are
as the “OR“ or the “ X O R ) . TVe concentrate our attention referred to as reduced basis matrices.
on the case of the combination of only two shares by showing Let f be the complement of the bit 5 . The next lemma
that the models presented in literature [I, 3, G , 93 can be seen holds.
as a particular case of ours. Moreover, we prove bounds on

0-7803-4408-1/98/$10.00 0 1 9 9 8 IEEE 154

L e m m a 11.2 Let f be a boolean function and let a , b E {0,1}. scheme have the following form
If either f ( a , O ) = f ( a , 1) and f(?i,O) = f(Z, l), o r f ( 0 , b ) =
f ( 1 , b ) and f ( 0 , Z ) = f(1,g) then there is n o (2,2)-threshold
visual cryptography scheme with Combination function f .
An immediate consequence of the above lemma is that the
combination function f of any (2,2)-threshold visual cryp-
tography scheme satisfies M ’ ( f ) # 0 and W(f) # 4. (Oth-
erwise the reconstructed image would be either completely
white or completely black.) hloreover, when W ( f ) = 2 the
only combination functions that do not satisfy the hypothe-
sis of the above lemma are those for which f ( a , b ) = f(Z,x)
and f ( b , b ) = f ( a , 6 ) , for a , b E {0,1}. A combination func-
tion f that has either W(f) {1,3} or W(f) = 2 with
f ( a , b) = f(E,&)and f(Z, b) = f ( a ,E), for a , b E ( 0 , l ) is re-
ferred to as an allowed combination function. In the following
we show that for any allowed combination function there is a
(2, n)-threshold visual cryptography scheme.
L e m m a 11.3 Let So and SI be the reduced basis matrices of
a (2,2)-threshold zisual cryptography scheme. For i = 0 , l and
an integer t 2 1, if the column [a,bIT appears t times i n S‘,
then each of the columns [Ti, bIT and [a,&IT appears t times i n
SI-1
One immediate consequence of this lemma is the existence,
in the basis matrices So and SI,of some predefined patterns
referred to as unavoidable patterns (unavoidable patterns were
introduced in [l]).
The following characterization is a consequence of Condi-
tion 2 of Definition 11.1, Lemmas 11.2 and 11.3. Let f be an
allowed combination function and let D be a 2 x r boolean
matrix, €or some positive integer r.
If W(f) = 1 and f ( a , b ) = 1, with a , b E (0, l}, then the ba-
sis matrices of any (2,2)-threshold visual cryptography scheme
have the following form
So=[ g
v v]oDandS1=[ v v]OD, 8 E. Biham and A. Itzkovitz, “Visual Cryptography with Polar-
where o denotes the concatenation of matrices and t 2 a m.
Assume W(f) = 2 and f ( a , b ) = f(Z,6) and f(Si,b) =
f(a, b), with a , b E {0,1}. If f(a, b) = 1 then the basis ma-
trices of any (2,2)-threshold visual cryptography scheme have
the following form
So=[ v v]oDandS‘=[ g v v]OD,
-
where t 2 (a m)/2. If f ( a , b ) = 0 then the basis matrices
of any (2,2)-threshold visual cryptography scheme have the
following form
So=[ v v ]oD,andS1=[ w v]OD
t t t t
where t 2 ( 0 . m ) / 2 .
Finally, if W(f) = 3 and f ( a , b) = 0 , with a, b E (0,l}, then
the basis matrices of any (2,2)-threshold visual cryptography
So=[ v v ]oDandS1=[ 8
k/k/ ]OD,
where t 2 a .m.
There is a close relationship between ( 2 , n)-threshold visual
cryptography schemes and Sperner families over a ground set
on m elements. More precisely, the rows of the basis niatri-
ces represent a Sperner family. The following theorem is a
consequence of this connection.
T h e o r e m 11.4 For any n 2 2 and f o r any allowed combina-
tion function f there is a ( 2 , n)-threshold visual cryptography
schemes with pixel expansion m if and only if
(,,;a,).
T h e o r e m 11.5 For any n 2 2 and for any allowed combinu-
tion function f there is a ( 2 , n)-threshold visual cryptogruphy
scheme with contrast CY if and only if
where I w ( f )= 1 f o r JV(f) = 1 , 3 a n d I w ( f )= 2 for iV(f) = 2 .
There are interesting relations (see, for example, [ 6 ] ) be-
tween certain balanced incomplete block designs and (2, n ) -
threshold visual cryptography schemes having optimal con-
trast and minimum pixel expansion.
REFERENCES
G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, “Vi-
sual Cryptography for General Access Structures”, Information
and Computation, Vol. 129, No. 2, pp. 86-106, 1996.
G. Ateniese, C. Blundo, A. De Santis, and D.R. Stinson, “Con-
structions and Bounds for Visual Cryptography”, in 23rd Inter-
national Colloquium on Automata, Languages and Program-
ming, LNCS 1099, Springer-Verlag, pp. 416-428, 1996.
ization”, talk given by Biham at the “Weizmann Workshop on
Cryptography”, Weizmann Institute, Rehovot, Israel, June 8-9,
1997.
C. Blundo, P. D’Arco, A. De Santis, and D. R. Stinson, “Con-
trast Optimal Threshold Visual Cryptography Schemes”, sub-
mitted for publication, 1998.
C. Blundo, A. De Bonis, and A. De Santis, “Improved Schemes
for Visual Cryptography”, submitted for publication, 1998.
C. Blundo, A. De Santis, and D. R. Stinson, “On the Contrast
in Visual Cryptography Schemes”, To appear on Journal of
Cryptology, 1998. Available also a t Theory of Cryptography Li-
brary as ftp://theory.lcs.mit.edu/pub/tcryptol/96-13.ps,
September 1996.
S. Droste, “New Results on Visual Cryptography”, in Advances
-
in Cryptology C R Y P T 0 ’96, LNCS 1109, Springer-Verlag,
pp. 401-415,1996.
T. Hofmeister, M. Krause, and H. U. Simon, “Contrast-Optimal
k out of n Secret Sharing Schemes in Visual Cryptography” in
COCOON ’97,LNCS 1276, Springer-Verlag, pp. 176-185,199’7.
M. Naor and A. Shamir, “Visual Cryptography”, in Advances :n
-
Cryptology ECJROCRYPT ’94, LNCS 950, Springer-Verlag,
pp. 1-12, 1995.
[IO] E. R. Verheul and H. C. A. van Tilborg, “Constructions and
Properties of IC out of n Visual Secret Sharing Schemes”, in
Designs, Codes, and Cryptography, Vol. 11, No. 2,pp. 179-196,
1997.