Cryptanalysis of Image Cryptosystem via Finite-Time Projective Synchronization in Fractional-Order Inertial Memristive Neural Networks

This paper presents a systematic structural cryptanalysis of a color-image cryptosystem based on finite-time projective synchronization in fractional-order inertial memristive neural networks. By examining the algebraic structure and plaintext–ciphertext dependencies of its encryption pipeline, several attack-relevant structural properties are identified, including plaintext-independent sequence reuse, algebraically redundant XOR operations, shared encryption material across RGB channels, and the absence of interpixel diffusion. Under a fixed secret configuration and a bijective spatial disruption map, the complete encryption process is shown to reduce to $C_c\left(i\right)=P_c\left(\pi \left(i\right)\right)\oplus K\left(i\right)$, where $\pi$ denotes a reusable spatial permutation and K is an equivalent XOR mask obtained by combining the two nominal diffusion sequences. At the image layer, this representation shows that encryption is determined by the induced permutation and equivalent mask. Exploiting these properties, a chosen-plaintext attack is developed to recover the equivalent mask using an all-zero image and reconstruct the spatial permutation through base-256 position encoding. The implemented two-query construction supports up to $2^{24}$ pixels, whereas an optimal two-query design supports up to $2^{40}$ pixels; one query suffices for at most $2^{16}$ pixels. A differential chosen-plaintext attack further recovers the equivalent key by eliminating the mask through related plaintext differences. In addition, a known-plaintext attack reconstructs the permutation using mask-invariant positional fingerprints under explicit uniqueness conditions, while chosen-ciphertext attacks enable direct plaintext recovery with one nonchallenge query or equivalent-key recovery with two queries. The two-query CPA is also evaluated through an encryption-oracle-only interface. Experimental results on $512\times 512$ RGB images confirm exact equivalent-key recovery and lossless plaintext reconstruction. All eight tested image cases yield exact recovery under the fixed context, with seven repeated runs per case used to summarize timing, and six heterogeneous known plaintext–ciphertext pairs suffice for exact recovery in the principal experiment. In general, known-plaintext recovery identifies the permutation when the positional fingerprints are unique. Finally, an invertible, module-wise proof-of-concept design is specified for context-dependent sequence generation, cross-channel coupling, bijective spatial disruption, and independent bidirectional feedback diffusion; its relation to the attacks analyzed in this paper is assessed structurally.