Chaotic Image Encryption by Intra-Channel Diffusion and Inter-Channel Confusion

Abstract

Most image encryption schemes exhibit one or more of the following limitations: keystream bias, high residual pixel correlation, pattern leakage, low sensitivity to key changes, or a security-efficiency trade-off. We present a robust image encryption framework based on a chaotic system that operates across the red, green, and blue color channels and mitigates all of the above vulnerabilities. The scheme consists of a novel integration of strong bidirectional modular diffusion, inter-channel confusion using a six-state permutation table, and Secure Hash Algorithm 256-based key derivation. Thus, we achieve the following: lossless reconstruction, near-ideal entropy, negligible adjacency correlation, high sensitivity to infinitesimal changes in both the plaintext and the secret key, a complete diffusion effect confirmed by standard differential metrics, and resilience against known- and chosen-plaintext attacks. Furthermore, the results comply with the National Institute of Standards and Technology randomness tests. These results are obtained with competitive encryption times (∼0.37 s for 512 × 512 images) without any code optimization. All of these features make the scheme promising for secure real-time visual data transmission, particularly in telemedicine and Internet of Things surveillance.

1. Introduction

In current digital communications, characterized by a continuous data exchange across critical infrastructures, telemedicine services, satellite networks, and internet of things surveillance systems [1], protecting visual information has become an imperative. Unlike plaintext, digital images are highly redundant and present pronounced spatial correlation among adjacent pixels. These features pose challenges for conventional cryptographic standards, including AES (Advanced Encryption Standard), RC4 (Rivest Cipher 4), RSA (Rivest–Shamir–Adleman), and DES (Data Encryption Standard), which, although secure in general-purpose contexts, are not inherently optimized for the structured, high-dimensional, and often parallel nature of image data. Thus, applying these methods directly to image encryption may lead to detrimental performance, especially when no hardware acceleration is used [2].

This limitation led to alternative paradigms. Chaos-based cryptography gained particular relevance among them due to its sensitivity to initial conditions, ergodicity, and complex dynamical behavior, ideal properties for generating pseudo-random cryptographic sequences [3].

Early approaches relied on low-dimensional chaotic maps, such as Logistic and Tent systems [4,5], which were later shown to be weak due to their limited key space and dynamical degradation (e.g., periodic windows). Later works incorporate higher-dimensional and hybrid chaotic systems, including hyperchaotic attractors, coupled map lattices, and spatiotemporal models that are designed to enhance unpredictability and expand the effective key space [2,6].

In parallel, researchers have been exploring structural augmentations that embed chaos within broader mathematical or algorithmic frameworks, such as group theory with laser-based dynamical systems and Wavelet Packet transforms for robustness against signal degradation [7]. More recent contributions extend this trend through quantum-inspired circuits [8], elliptic curve constructions [9], and fractional-order dynamical systems exhibiting coexisting attractors.

At the same time, the design of encryption architectures has undergone significant improvements. The confusion–diffusion paradigm remains foundational, but its implementation has diversified considerably. Enhancements include cross-channel permutation [10], second-order cellular automata for diffusion reinforcement [11], and hybrid key generation mechanisms assisted by hash functions [12].

To further improve security and efficiency, researchers have proposed parallelization strategies, such as bit-plane processing [13] and the use of quasigroup transformations or Fibonacci-based mappings [14]. Meanwhile, the integration of neural synchronization schemes [15] and multi-map compositions [16,17] reflects a trend toward multi-layered encryption frameworks. Despite these advances, several schemes still exhibit vulnerabilities like keystream bias, residual pixel correlation, insufficient key sensitivity, or pattern leakage. In many cases, mitigating these issues results in increased algorithmic complexity or computational cost, thereby limiting practical deployment in real-time environments.

This work proposes a unified encryption framework that addresses these challenges through a tightly coupled architectural design. The scheme integrates a two-dimensional delta-kicked oscillator with Secure Hash Algorithm (SHA)-256-based key derivation to enhance pseudo-randomness and parameter sensitivity. This foundation supports a set of coordinated confusion and diffusion mechanisms that operate across spatial and inter-channel domains. The resulting system achieves lossless reconstruction (Structural Similarity Index Measure, SSIM = 1), near-ideal entropy ($H>7.99$), negligible adjacency correlation ($\left|r\right|<0.002$), high sensitivity to infinitesimal variations in both plaintext and key, and a complete diffusion effect validated by standard differential metrics. Additionally, the output passes the National Institute of Standards and Technology randomness tests, while maintaining competitive execution times (0.37 s for Lena $512\times 512$) without code optimization. These properties position the proposed method as a promising candidate for secure, real-time visual data transmission, specifically in telemedicine and IoT surveillance, where conventional standards like AES in CBC mode are less parallelizable or more hardware-dependent.

The following section provides a brief description of the encryption method, the chaotic functions used as pseudo-random number generators, and the encryption key. We then describe the encryption mechanisms and their reversibility. Finally, we present results that demonstrate the security of our method, as well as its competitiveness compared to the results reported in recent publications.

2. Overview of the Method

The proposed algorithm uses quasi-random chaotic functions to encrypt images of arbitrary size and color. The user enters the image (I) to be encrypted and a secret key. The program separates the R, G, and B channels and applies strong forward and backward modular addition diffusion processes to each of them, using matrices whose entries are chaotic values within the same value range as the layers. Subsequently, the architecture applies inter-channel confusion, using another matrix of chaotic values that controls the permutations between the already diffused channels. Finally, the encrypted RGB image ($I_c$) is rearranged and delivered. The complete procedure flowchart is shown in Figure 1.

Figure 1. Complete flowchart of the RGB image encryption process. Source: the authors.

3. Dynamical Analysis for the Chaotic Functions

The proposed scheme uses a two-dimensional discrete-time map derived from the dynamics of a delta-kicked oscillator. The transformation can be interpreted as the composition of a nonlinear shear in the y-direction followed by a rigid rotation:

$$\begin{array}{cc}\hfill x_{n+1}& =x_n\cos \gamma -\left(y_n+k\sin \left(x_n\right)\right)\sin \gamma ,\hfill \end{array}$$

(1)

$$\begin{array}{cc}\hfill y_{n+1}& =x_n\sin \gamma +\left(y_n+k\sin \left(x_n\right)\right)\cos \gamma .\hfill \end{array}$$

(2)

where $x_n,y_n\in \mathbb{R}$ denote the state variables at iteration n, $k\in \mathbb{R}$ controls the strength of the nonlinear shear, and $\gamma \in [0,2\pi )$ is the rotation parameter at each iteration. More specifically, k determines the amplitude of the nonlinear term $k\sin \left(x_n\right)$ added to the y-coordinate before the rotation is applied. For $k=0$, the system reduces to rigid rotation and exhibits regular dynamics. For higher values of $\left|k\right|$, the nonlinear shear becomes stronger, increasing the stretching and mixing of trajectories in the phase space and favoring chaotic behavior. Therefore, k acts as a control parameter for the degree of nonlinearity and the resulting pseudo-randomness of the generated chaotic sequences.

In the proposed encryption scheme, the key-derived values of the nonlinear parameter are restricted to the interval $k\in [0.1,9.9]$. Therefore, the dynamical behavior is not assessed from a single isolated value of k, but from the full operating range used by the algorithm. Representative values such as $k=0.1$, $k=2.0$, $k=5.0$, and $k=9.9$ illustrate the transition from weak nonlinear shear to stronger stretching and mixing.

Together, k and $\gamma$ determine the global dynamical regime of the system, including its mixing properties and the onset of chaotic behavior. In contrast, the initial values $(x_0,y_0)$ act as seeds: once $(k,\gamma )$ are fixed, they select the particular orbit from which the chaotic sequence is generated. Thus, the control parameters determine the structure of the dynamics, whereas the initial values determine the specific trajectory within that structure.

The Jacobian matrix of the map defined by Equations (1) and (2), with respect to the variables $(x_n,y_n)$, is

$$J(x_n,y_n)=\left(\begin{array}{cc}\cos \gamma -k\cos \left(x_n\right)\sin \gamma & -\sin \gamma \\ \sin \gamma +k\cos \left(x_n\right)\cos \gamma & \cos \gamma \end{array}\right).$$

(3)

It is important to emphasize that $J(x_n,y_n)$ is not a trajectory by itself, but a local linearization of the nonlinear map at the current state $(x_n,y_n)$. Along an orbit generated from an initial condition $(x_0,y_0)$, the Jacobian changes at each iteration according to $J_n=J(x_n,y_n).$ Thus, the sequence $J_0,J_1,J_2,\dots$ describes how small perturbations are locally stretched, contracted, or rotated along the trajectory of the chaotic map. The accumulated effect of these local Jacobians determines the sensitivity to initial conditions and is quantified by the Lyapunov exponents. In this sense, the discussion concerns the evolution of the linearized dynamics along the trajectory of the system.

From (3), we find:

$$detJ(x_n,y_n)=\left(\cos \gamma -k\cos \left(x_n\right)\sin \gamma \right)\cos \gamma +\sin \gamma \left(\sin \gamma +k\cos \left(x_n\right)\cos \gamma \right)=1.$$

(4)

Hence, the value of the Jacobian determinant is equal to one for all $(x_n,y_n)$ and for all admissible parameter values. Consequently, the map is area-preserving. This phase-space volume conservation classifies the system as a conservative nonlinear map.

The eigenvalues of the Jacobian matrix are obtained from the characteristic polynomial

$${\lambda }^2-\mathrm{tr}\left(J\right)\lambda +det\left(J\right)=0.$$

Since $det\left(J\right)=1$, $\mathrm{tr}\left(J\right)=2\cos \gamma -k\cos \left(x_n\right)\sin \gamma ,$ those eigenvalues are:

$${\lambda }_{\pm }={\displaystyle \frac{2\cos \gamma -k\cos \left(x_n\right)\sin \gamma \pm \sqrt{{\left(2\cos \gamma -k\cos \left(x_n\right)\sin \gamma \right)}^2-4}}{2}}.$$

(5)

Thus, the eigenvalues depend on the current state $x_n$ and on the control parameters k and $\gamma$. We note that the signs of the eigenvalues depend on the value of the trace $\mathrm{tr}\left(J\right)=2\cos \gamma -k\cos \left(x_n\right)\sin \gamma .$ In fact, since $det\left(J\right)=1$, the eigenvalues satisfy ${\lambda }_{+}{\lambda }_{-}=1.$ Therefore, when the eigenvalues are real, they have the same sign. More precisely,

$$\left\{\begin{array}{cc}\mathrm{tr}\left(J\right)>2,\hfill & {\lambda }_{+}>0,{\lambda }_{-}>0,\hfill \\ \mathrm{tr}\left(J\right)<-2,\hfill & {\lambda }_{+}<0,{\lambda }_{-}<0,\hfill \\ \left|\mathrm{tr}\right(J\left)\right|<2,\hfill & {\lambda }_{\pm }\mathrm{are}\mathrm{complex}\mathrm{conjugates}\mathrm{and}\mathrm{no}\mathrm{real}\mathrm{sign}\mathrm{can}\mathrm{be}\mathrm{assigned},\hfill \\ \mathrm{tr}\left(J\right)=2,\hfill & {\lambda }_{+}={\lambda }_{-}=1,\hfill \\ \mathrm{tr}\left(J\right)=-2,\hfill & {\lambda }_{+}={\lambda }_{-}=-1.\hfill \end{array}\right.$$

The case in which one eigenvalue is positive and the other is negative cannot occur for this map, as that would require ${\lambda }_{+}{\lambda }_{-}<0$, which in turn implies $det\left(J\right)<0$. However, as we have shown before, $det\left(J\right)=1$ for all states and all admissible parameter values. Therefore, real eigenvalues must be either both positive or both negative, whereas in the complex case no positive or negative sign can be assigned to the individual eigenvalues.

Thus, the signs of the eigenvalues are not fixed globally; they depend on the local state $x_n$ and on the control parameters k and $\gamma$.

From the previous analysis, we conclude that the proposed map is a conservative, area-preserving two-dimensional system. Since $det\left(J\right)=1$, the local expansion in one direction is exactly balanced by contraction in the other direction. When $\left|\mathrm{tr}\right(J\left)\right|>2$, the eigenvalues are real and reciprocal, corresponding to local hyperbolic behavior with stretching and compression. When $\left|\mathrm{tr}\right(J\left)\right|<2$, the eigenvalues are complex conjugates with modulus one, corresponding to local rotation-like behavior. Therefore, the nonlinear term controlled by k produces regions of stretching and mixing without changing phase-space area.

Therefore, the system used in the proposed encryption scheme is chaotic, not hyperchaotic. There is an additional reason to deduce that the system is not hyperchaotic: its strictly two-dimensional and area-preserving nature. If one Lyapunov exponent is positive, the other must be negative. Hyperchaos requires at least two positive Lyapunov exponents, something impossible in a two-dimensional map. Furthermore, preservation of the area implies that the Lyapunov spectrum satisfies ${\lambda }_1+{\lambda }_2=0$, so if ${\lambda }_1>0$, then necessarily ${\lambda }_2=-{\lambda }_1<0$. Therefore, the relevant quantitative indicator of sensitivity to initial conditions is the largest Lyapunov exponent.

To quantify this sensitivity in the operating regime used by the encryption algorithm, we numerically evaluated the largest Lyapunov exponent over the parameter domain $k\in [0.1,9.9]$, and $\gamma \in [1,2)$, which is the region to which the key-derived parameters are constrained by construction. Figure 2 shows the resulting Lyapunov map.

Figure 2. Largest Lyapunov exponent over the parameter domain of the encryption scheme. Computed on the region $k\in [0.1,9.9]$ and $\gamma \in [1,2)$, to which the key-derived control parameters are restricted by construction. Positive values dominate almost the entire sampled domain, indicating sustained sensitivity to initial conditions in the operating regime used for mask generation.

In the sampled grid, the fraction of points with positive largest Lyapunov exponent is $0.998125$, with minimum value $-1.69\times {10}^{-4}$, maximum value $1.618078$, and mean value $0.806573$. Hence, the parameter region used during encryption is overwhelmingly contained in a chaotic regime. The small negative values observed near zero are numerically negligible and are consistent with finite-time estimation near the transition boundary between very weak chaos and non-chaotic behavior. Figure 2 reveals an extended domain with positive largest Lyapunov exponent, rather than isolated chaotic pockets. This is particularly relevant for our encryption scheme, as the control parameters are selected from this region after the key-derivation stage. Consequently, the chaotic generator operates, by design, in a parameter regime that exhibits high sensitivity to initial conditions and robust mixing properties throughout almost the entire parameter domain, as desirable for pseudo-random mask generation.

3.1. Encryption Key and Chaotic Arrays

The external secret key $\left(K_{\mathrm{ext}}\right)$ consists of a 22-character input: a 10-character main key and two independent 6-character auxiliary strings $S_1$ and $S_2$: $K_{\mathrm{ext}}=K_0\parallel S_1\parallel S_2,$ where $K_0$ is the main secret key and ‖ denotes concatenation. The complete string $K_{\mathrm{ext}}$ is encoded as a byte sequence using a fixed 8-bit character encoding.

The function IntroKey applies the SHA-256 to $K_{\mathrm{ext}}$ to generate deterministic internal key material. More precisely, the first digest is computed as

$$h_0=\mathrm{SHA}256\left(K_{\mathrm{ext}}\right).$$

(6)

Since one SHA-256 digest produces 256 bits, additional internal values are obtained by iterating the hash function in chained form:

$$h_j=\mathrm{SHA}256(h_{j-1}\parallel K_{\mathrm{ext}}\parallel j),j=1,2,\dots ,$$

(7)

where the iteration counter j is encoded in a fixed and reproducible byte format, to avoid repetition. The resulting digests are concatenated to form a deterministic byte stream:

$$\mathcal{H}=h_0\parallel h_1\parallel h_2\parallel \cdots .$$

(8)

Each SHA-256 digest $h_j$ has a fixed length of 256 bits. In the implementation, the internal numerical values are obtained from 32-bit words. Since 84 numerical values are required, the method uses $84\times 32=2688$ bits. Therefore, eleven SHA-256 digests are concatenated, producing a hash-derived word $\mathcal{H}$ of length $11\times 256=2816$ bits. The first 2688 bits are partitioned into 84 words of 32 bits, while the remaining 128 bits are not used.

This iterative hashing step is included to obtain a sufficiently long and reproducible hash-derived byte stream to generate the internal chaotic parameters and masks. It is not an encryption step and it does not increase the entropy of the original secret key; its role is key derivation, dispersion, and reproducible parameter generation.

This hash-derived stream is then partitioned and transformed into 84 numerical values, which are mapped into the admissible ranges of the chaotic map, including initial conditions and control parameters. In particular, the key-derived control parameters are constrained to the operating region used in the Lyapunov analysis. This procedure does not increase the entropy of the original 22-character input; the maximum entropy remains bounded by the entropy of $K_{\mathrm{ext}}$. However, SHA-256 provides a strong avalanche effect: a small change in $K_{\mathrm{ext}}$ produces a substantially different sequence of digests and, consequently, different chaotic parameters, diffusion masks, and inter-channel permutation masks.

3.2. Chaotic Arrays Generation

The 84 numerical values (digits) generated by IntroKey are divided into two equal groups. The first parameterizes the chaotic system associated with the diffusion stage. This group is used to initialize a chaotic process that produces a $6\times 42$ table. Each table row is then used to re-derive the parameters for six subsequent executions of the chaotic generator. The executions produce two diffusion masks for each RGB channel, all with the same spatial dimensions $X\times Y$ as the input image. These masks are not additional external keys, but deterministic arrays generated from the internal material derived from SHA-256.

The same SHA-256-derived internal material also determines the boundary values used to initialize the recursive diffusion process. In particular, as detailed in the diffusion subsection, the first value of the forward diffusion mask, $k_1^{\left(1\right)}$, modifies the first pixel, while the last value of the backward diffusion mask, $k_N^{\left(2\right)}$, initializes the reverse propagation from the last pixel. These values are not additional external keys or manually chosen constants; they are entries of the chaotic masks generated deterministically from $K_{\mathrm{ext}}$ and are therefore regenerated during both encryption and decryption.

In these generations, the output quantization parameter is fixed at $NF=256$, so that each mask contains values in $\{0,1,\dots ,255\}$. Hence, the masks naturally operate on uint8 images through modular pixel sums over ${\mathbb{Z}}_{256}$, without numerical loss.

The reason for using two masks for each color channel is the bidirectional nature of the diffusion stage. For a mask K, the corresponding chaotic generator is initialized with one of the parameter sets derived from the preliminary table $6\times 42$ and then iterated $N=X\times Y$ times to produce a chaotic sequence $z_1,z_2,\dots ,z_N$. The chaotic outputs $z_n$ are normalized real numbers in [0, 1]. For a real chaotic output z, the quantization function ${\mathcal{Q}}_{256}$ is defined by

$${\mathcal{Q}}_{256}\left(z\right)=⌊256\left\{z\right\}⌋,$$

(9)

where $\left\{z\right\}=z-\lfloor z\rfloor$ denotes the fractional part of z. By definition of the fractional part, $0\le \left\{z\right\}<1$ for any real value z. Therefore,

$$0\le 256\left\{z\right\}<256.$$

Since the floor function maps any real number to the greatest integer less than or equal to it, it follows that

$$⌊256\left\{z\right\}⌋\in \{0,1,\dots ,255\}.$$

Consequently, ${\mathcal{Q}}_{256}\left(z\right)$ is always an 8-bit integer value. Thus, each real value $z_n$ is converted into an 8-bit integer $k_n\in \{0,1,\dots ,255\}$.

$$k_n={\mathcal{Q}}_{256}\left(z_n\right),n=1,\dots ,N.$$

(10)

The mask K is then obtained by reshaping the vector of quantized values into the spatial dimensions of the image:

$$K={vec}^{-1}(k_1,\dots ,k_N)\in {\{0,1,\dots ,255\}}^{X\times Y}.$$

(11)

The second group of 42 numerical values produced by IntroKey is assigned to the chaotic generator responsible for inter-channel confusion. This stage is controlled by a permutation mask (Π). The chaotic generator associated with the confusion is iterated N times, producing a sequence $u_1,u_2,\dots ,u_N.$ This sequence is then quantized with $NF=6$, so that each output value, ${\pi }_n$, belongs to the set $\{0,1,\dots ,5\}$. If ${\mathcal{Q}}_6$ denotes the quantization rule used to map chaotic outputs into six discrete classes, then

$${\pi }_n={\mathcal{Q}}_6\left(u_n\right),n=1,\dots ,N,$$

(12)

The vector $({\pi }_1,\dots ,{\pi }_N)$ is then reshaped into a matrix $X\times Y$:

$$\mathsf{\Pi }={vec}^{-1}({\pi }_1,\dots ,{\pi }_N).$$

(13)

Each entry $\mathsf{\Pi }(i,j)$ selects one of the six possible permutations of the RGB triplet at pixel $(i,j)$. The correspondence between the values $0,\dots ,5$ and the six permutations of $(R,G,B)$ is given in Table 1. Therefore, the mask $\mathsf{\Pi }$ encodes a pixelwise channel-reordering rule. Since each local operation is a permutation, the process is exactly reversible by applying the inverse permutation to the same value $\mathsf{\Pi }(i,j)$.

Table 1. Assignment of the 3! = 6 possible permutations to digits [0, 5].

Digit c	0	1	2	3	4	5
Output $(R^{\prime },G^{\prime },B^{\prime })$	(R,G,B)	(R,B,G)	(G,R,B)	(G,B,R)	(B,R,G)	(B,G,R)

In Algorithm A2, ${\mathcal{Q}}_{256}$ denotes the quantization rule that maps chaotic outputs into the set $\{0,1,\dots ,255\}$, whereas ${\mathcal{Q}}_6$ maps chaotic outputs into $\{0,1,\dots ,5\}$. Therefore, the six masks $R_1,R_2,G_1,G_2,B_1,B_2$ are used as 8-bit diffusion masks in the modular sums over ${\mathbb{Z}}_{256}$, while $\mathsf{\Pi }$ is used as a discrete permutation mask. Each entry $\mathsf{\Pi }(i,j)$ selects one of the six possible permutations of the RGB triplet at pixel $(i,j)$, according to Table 1.

We emphasize that the $k_i$ values are not retrieved by inverting the SHA-256 function. SHA-256 is used only as a deterministic key-derivation mechanism. During decryption, the receiver provides the same external secret key $K_{\mathrm{ext}}$. The IntroKey procedure is then executed again with the same fixed encoding, chaining rule, counter format, partitioning rule, and parameter-mapping procedure. As a result, the same hash-derived byte stream $\mathcal{H}$ is obtained, and the same internal numerical values, chaotic parameters, diffusion masks, and permutation mask reconstructed. The reversibility of the proposed encryption scheme relies on the deterministic regeneration of the same masks from the same secret key and on the bijective structure of the modular diffusion and inter-channel permutation operations.

4. Encryption Mechanism

4.1. Strong Diffusion by Bidirectional Modular Sum

The first stage of encryption is a strong bidirectional diffusion per channel (R, G, B) in 8-bit modular arithmetic (MOD = 256), naturally suited for uint8 images without introducing loss. Two chaotic masks $K^{\left(1\right)}$ and $K^{\left(2\right)}$, of the same size as the image $[X,Y]$ and with values quantized in the interval $[0,255]$, are generated for each channel. Starting from the intensity plane $P\in {\{0,\dots ,255\}}^{X\times Y}$, the algorithm applies two chained scans over the vectorized version $p=\mathrm{vec}\left(P\right)$ (raster scan), of length $N=X·Y$. In the forward scan, the intermediate output $c^{\left(1\right)}$ is obtained as:

$$c_1^{\left(1\right)}=(p_1+k_1^{\left(1\right)})\mathrm{mod}256,$$

(14)

$$c_i^{\left(1\right)}=(p_i+k_i^{\left(1\right)}+c_{i-1}^{\left(1\right)})\mathrm{mod}256,i=2,\cdots ,N.$$

(15)

Equation (14) explicitly defines the initialization of the forward recursive diffusion. Since there is no previous encrypted sample for $i=1$, the first mask value $k_1^{\left(1\right)}$ acts as the key-dependent initialization value that modifies the first pixel. Equivalently, this formulation can be interpreted as a recursion with boundary condition $c_0^{\left(1\right)}=0$, where the first pixel is initialized through the chaotic mask value $k_1^{\left(1\right)}$. Therefore, no additional external initialization value is required.

This chaining makes each sample explicitly dependent on the immediate history, so that a minimal variation in p or in the mask propagates cumulatively along the channel (1D avalanche effect). A backward scan (second pass) is then applied to force propagation from the opposite end of the vector, generating the final output $c^{\left(2\right)}$:

$$c_N^{\left(2\right)}=(c_N^{\left(1\right)}+k_N^{\left(2\right)})\mathrm{mod}256,$$

(16)

$$c_i^{\left(2\right)}=(c_i^{\left(1\right)}+k_i^{\left(2\right)}+c_{i+1}^{\left(2\right)})\mathrm{mod}256,i=N-1,\dots ,1.$$

(17)

Similarly, Equation (16) defines the initialization of the backward recursive diffusion. In this case, the last mask value $k_N^{\left(2\right)}$ acts as the key-dependent boundary value for the last pixel, since there is no subsequent encrypted sample for $i=N$. Equivalently, the backward scan may be interpreted as using the boundary condition $c_{N+1}^{\left(2\right)}=0$, with $k_N^{\left(2\right)}$ initializing the recursive propagation from the opposite end.

The forward + backward combination increases the effective diffusion by imposing causal dependencies in both scanning directions: a local change influences both subsequent pixels (first pass) and previous pixels (second pass), reinforcing statistical delocalization without altering the range or the data type.

Thus, the initialization values that modify the boundary pixels are explicitly defined within the diffusion equations themselves: $k_1^{\left(1\right)}$ modifies the first pixel in the forward scan, and $k_N^{\left(2\right)}$ modifies the last pixel in the backward scan. Both values are entries of the chaotic masks generated deterministically from $K_{\mathrm{ext}}$, and therefore they are unique for each key and image size and are exactly regenerated during decryption.

4.2. Confusion Stage, Inter-Channel Permutation

After diffusion, we introduce an inter-channel confusion that does not alter the numerical values of the pixels (makes no additions, quantizations, or arithmetic operations on intensities), but rather relabels the triplet $(R,G,B)$ at each position. For this purpose, the chaotic generator produces a matrix $CCM\in {\{0,1,2,3,4,5\}}^{X\times Y}$, quantized with $N_F=6$ and reduced by $mod6$. Thus, each entry $CCM(i,j)=c$ receives a discrete index that selects one of the $3!$ possible permutations of the elements $(R,G,B)$. At each pixel, the vector $v=\left[R\right(i,j),G(i,j),B(i,j\left)\right]$ is constructed and reordered according to the code c, producing $[R^{\prime }(i,j),G^{\prime }(i,j),B^{\prime }(i,j)]$. This breaks the inter-channel correlation and redistributes, locally and in a controlled manner, the contribution of each channel in the encrypted image.

The permutation rule is completely specified in Table 1.

4.3. Reversibility of the Proposed Scheme

In this subsection we establish the reversibility of the proposed scheme for the bidirectional diffusion, the inter-channel confusion, and the complete encryption map.

4.3.1. Reversibility of the Strong Diffusion

The strong diffusion implements a deterministic transformation with exact encryption/decryption symmetry, bounded within the natural algebra of uint8. Thanks to that, the scheme is reversible under the same modulus, as shown below.

Proposition 1

(Reversibility of the strong diffusion). Let $P\in {\{0,\dots ,255\}}^{X\times Y}$ be one color channel of the original image, and let $p=\mathrm{vec}\left(P\right)$ be its raster-scan vectorization of length $N=X·Y$. Let $K^{\left(1\right)},K^{\left(2\right)}\in {\{0,\dots ,255\}}^{X\times Y}$ be the two chaotic masks associated with that channel, and let $k^{\left(1\right)}=\mathrm{vec}\left(K^{\left(1\right)}\right)$ and $k^{\left(2\right)}=\mathrm{vec}\left(K^{\left(2\right)}\right)$. Define the forward diffusion by Equations (14) and (15) and the backward diffusion by Equations (16) and (17). Then the transformation $P\mapsto C^{\left(2\right)}$, where $C^{\left(2\right)}={\mathrm{vec}}^{-1}\left(c^{\left(2\right)}\right)$, is bijective. Its inverse is uniquely determined by

$$c_N^{\left(1\right)}=(c_N^{\left(2\right)}-k_N^{\left(2\right)})mod256,$$

(18)

$$c_i^{\left(1\right)}=(c_i^{\left(2\right)}-k_i^{\left(2\right)}-c_{i+1}^{\left(2\right)})mod256,i=N-1,\dots ,1,$$

(19)

followed by

$$p_1=(c_1^{\left(1\right)}-k_1^{\left(1\right)})mod256,$$

(20)

$$p_i=(c_i^{\left(1\right)}-k_i^{\left(1\right)}-c_{i-1}^{\left(1\right)})mod256,i=2,\dots ,N.$$

(21)

Proof. 

Each step of the forward scan is a modular addition in ${\mathbb{Z}}_{256}$ and is therefore invertible once the previous output is known. Likewise, each step of the backward scan is invertible once the subsequent output is known. Hence, the backward pass can be undone recursively from $i=N$ down to $i=1$, recovering $c^{\left(1\right)}$ uniquely from $c^{\left(2\right)}$, and then the forward pass can be undone recursively from $i=1$ up to $i=N$, recovering p uniquely from $c^{\left(1\right)}$. Therefore, the strong diffusion defines a bijection on the set of channel images.    □

4.3.2. Confusion Reversibility

The confusion operation is reversible because each rule is a bijective permutation of the triplet $(R,G,B)$, and therefore admits a unique inverse.

Proposition 2

(Reversibility of the inter-channel confusion). Let $v(i,j)=\left[R\right(i,j),G(i,j),B(i,j\left)\right]$ be the RGB triplet at pixel $(i,j)$ after the diffusion stage. Let $\mathrm{CCM}(i,j)\in \{0,1,2,3,4,5\}$ select one of the six permutations listed in Table 1, and let $v^{\prime }(i,j)=[R^{\prime }(i,j),G^{\prime }(i,j),B^{\prime }(i,j)]$ be the permuted triplet obtained at that pixel. Then the inter-channel confusion map is bijective, and its inverse is obtained by applying, at each pixel, the inverse permutation associated with the same value $\mathrm{CCM}(i,j)$, as listed in Table 2.

Table 2. Inverse permutations corresponding to each control digit.

Digit c	0	1	2	3	4	5
Output $(R,G,B)$	(R’,G’,B’)	(R’,B’,G’)	(G’,R’,B’)	(B’,R’,G’)	(G’,B’,R’)	(B’,G’,R’)

Proof. 

For each fixed pixel $(i,j)$, the transformation from $v(i,j)$ to $v^{\prime }(i,j)$ is one of the six permutations of the triplet $(R,G,B)$. Every permutation is a bijection and has a unique inverse. Since the confusion stage acts independently on each pixel, the global inter-channel confusion is the product of pixelwise bijections, and is therefore itself bijective.    □

This proposition guarantees the inter-channel confusion invertibility at every pixel. Table 2 makes this explicit by listing, for each control value $\mathrm{CCM}(i,j)$, the corresponding inverse permutation that restores the original RGB ordering from the encrypted triplet.

Theorem 1

(Exact reversibility of the complete encryption scheme). The complete encryption procedure, consisting of strong bidirectional diffusion applied independently to the R, G, and B channels, followed by the inter-channel confusion controlled by $\mathrm{CCM}$, is bijective. Consequently, for the correct key, the original RGB image is recovered exactly by first applying the inverse inter-channel confusion and then the inverse strong diffusion to each channel.

Proof. 

By the previous two propositions, the strong diffusion applied to each channel is bijective and the inter-channel confusion is also bijective. Since the composition of bijections is again a bijection, the complete encryption map is bijective, and its inverse is obtained by composing the inverse confusion with the inverse channelwise diffusion.    □

5. Results

All simulations and experiments were implemented in MATLAB R2025b on a workstation Intel(R) Core(TM) Ultra 7 155H (1.40 GHz), RAM 32 GB. Unless otherwise stated, all images were processed in RGB format and the encrypted outputs were stored in a lossless format to avoid compression artifacts affecting the statistical analyses.

The security analysis follows Kerckhoffs’s principle: the encryption and decryption algorithms are assumed to be public, whereas the external secret key, auxiliary salt strings, SHA-256-derived internal parameters, chaotic diffusion masks, and inter-channel permutation mask remain unknown to the attacker. Under this model, the adversary may observe ciphertexts and may also have access to plaintext–ciphertext pairs or chosen plaintexts, as considered in the KPA and CPA experiments. The objective of the evaluation is therefore to determine whether the encrypted outputs reveal exploitable statistical, structural, differential, or key-dependent information under these attack scenarios.

We tested our algorithm on standard images from public repositories [18,19] of different pixel sizes and formats (png, bmp, jpg, tif…)—see Figure 3. That allows comparing our method with similar proposals. Since the method is reversible, the recovery quality is always $\mathrm{SSIM}=1$; consequently, the analyses focus on the security of the method. It should be noted that when processing images in compressed formats such as jpg (lossy), the memory occupied by the encrypted image may increase, because it is stored in a lossless format such as png. In other cases, there is no change in the memory occupied by the encrypted image.

Figure 3. Example RGB images, with 512 × 512 pix per side, from USC-SIPI Image Database [18].

5.1. Histograms

The intensity distribution per channel is rarely uniform in natural images: they present pronounced peaks due to lighting conditions, the scene, and the spectral correlation between components. Figure 4, top row, shows the R, G, and B histograms of Lenna with these typical peaks. The contrast with a uniform model is extreme (very high ${\chi }^2$ statistics and p-value $\approx 0$; see Table 3). If the encryption preserved the histogram shape, this would be a potential source of statistical leakage.

Figure 4. Histograms for the R, G, and B channels of the image Lenna. Before encryption, the probability to find a pixel with a specific value of intensity between 0 and 255 is completely uneven (left side plots). After encryption (right plots), such probability is nearly equal for all intensities. The scheme removes all traces of the original distribution and makes it impossible for an attacker to infer spatial structures or recover the plaintext through histogram analysis.

Table 3. Histogram statistics per channel for $I_c$ (8 bits, 256 bins; ${\chi }^2$ vs. uniform).

Channel	$\mathit{\mu }$	$\mathit{\sigma }$	$\mathit{\mu }$ Norm	$\mathit{\sigma }$ Norm	${\mathit{\chi }}^2$ vs. Uniform	p (val)
R	127.586	73.990	0.500	0.290	254.578	0.4957
G	127.435	73.885	0.500	0.290	337.408	4.11 × 10−4
B	127.436	73.875	0.500	0.290	221.602	0.9356

As shown in Figure 4, encryption with our method flattens histograms in all channels, proving an effective elimination of traces of the original distribution. The mean per-channel stabilizes around the midpoint of the range (≈127.5 in 8 bits, i.e., ≈0.5 normalized): ${\mu }_R=127.59,\left(0.5003\right)$, ${\mu }_G=127.44,\left(0.4997\right)$ and ${\mu }_B=127.44,\left(0.4997\right)$ (see Table 3). Statistically, the result behaves as a noise-like distribution, with minimal exploitable global biases. Furthermore, a measure of the deviation of the unencrypted Lena histogram from a theoretical flat histogram–black lines in Figure 4, using the Normalized Root Mean Square Error (NRMSE), yields a value close to one (0.930113), revealing a very large dispersion from the ideal value. In contrast, the same deviation calculated for the encrypted image is close to zero (0.029965). This indicates that the encryption process successfully redistributes pixel intensities in a nearly uniform way, reduces statistical leakage, and shows resistance against histogram-based statistical attacks. Consistently, when compared against the theoretical uniform probability histogram $P_{\mathrm{ideal}}=1/256=0.00390625$, the plaintext image showed high deviations from flatness. In particular, the probability-based chi-square-like deviations were 0.97021, 0.43461, and 1.31350 for the R, G, and B channels, respectively, with corresponding NRMSE values of 0.98499, 0.65925, and 1.14610.

Additionally, the dispersion in the encrypted image, measured by the standard deviation, is very close to that of a discrete uniform distribution in $[0,255]$: theoretical $\sigma \approx 73.90$, compared to ${\sigma }_R=73.99$, ${\sigma }_G=73.89$, and ${\sigma }_B=73.88$ (see Table 3). This corroborates the histogram’s uniformity and quantitatively shows that the variability per bin is compatible with a nearly equiprobable distribution of gray levels in each channel, as intended in robust encryption to mitigate histogram analysis attacks and other distributional approaches.

To quantitatively compare the encrypted histograms with the theoretical uniform distribution, the RGB channel histograms were evaluated using several factors. The encrypted channels showed very small deviations from the ideal flat distribution, with MAD (Maximun Amplitude Deviation) values below $3.93\times {10}^{-4}$, TVD (Total Variation Distance) values close to 0.012, and ${\chi }^2$ p-values of 0.653862, 0.711564, and 0.549636 for R, G, and B, respectively. Therefore, the encrypted image histograms are statistically close to the theoretical uniform histogram.

Histogram uniformity is a first-order indicator. Next sections report spatial-dependence metrics, differential-sensitivity measures, and KPA/CPA scenarios to characterize higher-order properties.

5.2. Shannon Entropy

Shannon entropy quantifies the statistical randomness of the ciphertext in the intensity domain. For a channel $c\in R,G,B$, the entropy is estimated as:

$$H_c=-\sum _x\left[p\left(x\right)\right]{\log }_{2}p\left(x\right),$$

(22)

where $p\left(x\right)$ represents the empirical probability of level x. In 8-bit per channel images, the theoretical maximum ($H=8$ bits) occurs when the intensity distribution is uniform. The entropies of images encrypted with this method are very close to that limit. Original images, on the other hand, present lower and content-dependent entropies, with differences between channels, reflecting the natural structure of the intensities (see Table 4).

Table 4. Shannon entropy per channel in the original images (RGB set 1–10).

Image	Size	${\mathit{H}}_{\mathit{I}\left(\mathit{R}\right)}$	${\mathit{H}}_{\mathit{I}\left(\mathit{G}\right)}$	${\mathit{H}}_{\mathit{I}\left(\mathit{B}\right)}$	${\overline{\mathit{H}}}_{\mathit{I}}$
Lenna.tif	512 × 512	7.253102	7.594038	6.968427	7.271856
Peppers.tif	512 × 512	7.338827	7.496253	7.058306	7.297795
Mandrill.tif	512 × 512	7.706672	7.474432	7.752217	7.644440
AirplaneF16.tif	512 × 512	6.717765	6.798979	6.213774	6.576839
Barbara.bmp	576 × 720	7.706913	7.527473	7.587596	7.607327
BoatOnLake.tif	512 × 512	7.312388	7.642854	7.213642	7.389628
Splash.tif	512 × 512	6.948061	6.884455	6.126452	6.652989
House.tif	256 × 256	6.431052	6.538931	6.232038	6.400674
GoldHill.bmp	576 × 720	7.610077	7.554413	7.553960	7.572817
Boats.bmp	576 × 787	7.391248	7.082562	6.968714	7.147508

Where ${\overline{H}}_I={\displaystyle \frac{1}{3}}{\sum }_{c\in R,G,B}{H}_{I\left(c\right)}$. The values obtained after processing, close to 8 bits in the three channels (see Table 5) suggest high uniformity of the encryption histograms, which reduces first-order information leakage. This confirms that our combination of diffusion and confusion increases the marginal randomness per channel and attenuates statistical traces associated with the content.

Table 5. Shannon entropy after encryption, RGB mean entropy ${\overline{H}}_{I_c}$, mean RGB entropy increase $\overline{\mathsf{\Delta }H}={\overline{H}}_{I_c}-{\overline{H}}_I$, and computation time per image.

Image	${\mathit{H}}_{{\mathit{I}}_{\mathit{c}}\left(\mathit{R}\right)}$	${\mathit{H}}_{{\mathit{I}}_{\mathit{c}}\left(\mathit{G}\right)}$	${\mathit{H}}_{{\mathit{I}}_{\mathit{c}}\left(\mathit{B}\right)}$	${\mathit{I}}_{\mathit{c}}{\mathit{H}}_{\mathbf{enc}}$	$\overline{\mathsf{\Delta }\mathit{H}}$	Time (s)
Lenna	7.999299	7.999073	7.999391	7.999254	0.727399	0.370
Peppers	7.999282	7.999258	7.999193	7.999245	0.701449	0.462
Mandrill	7.999266	7.999246	7.999244	7.999252	0.354812	0.444
Airplane	7.999217	7.999358	7.999156	7.999244	1.422404	0.512
Barbara	7.999602	7.999522	7.999551	7.999558	0.392231	0.958
BoatOnLake	7.999312	7.999225	7.999306	7.999281	0.609653	0.588
Splash	7.999371	7.999319	7.999292	7.999327	1.346338	0.638
House	7.997127	7.997274	7.996933	7.997111	1.596437	0.136
GoldHill	7.999618	7.999561	7.999580	7.999586	0.426770	0.901
Boats	7.999639	7.999606	7.999623	7.999623	0.852115	0.960

Table 6 confirms the increase in entropy after encryption and the drastic reduction in inter-image variability, consistent with the statistical homogenization sought in cryptography. The average encryption time per image was $0.597\pm 0.272$ s (range $[0.136,0.960]$ s) for the evaluated resolutions: a promising time compared to other methods (see for instance [20]) and considering that no optimization has been performed yet. These values suggest viability for batch processing, without degrading the statistical behavior of the output.

Table 6. Aggregate entropy statistics (mean ± standard deviation and range) for the RGB batch.

Channel	$\overline{\mathit{I}\pm \mathit{\sigma }}$ (bits)	I Range	$\overline{{\mathit{I}}_{\mathit{c}}\pm \mathit{\sigma }}$ (bits)	${\mathit{I}}_{\mathit{c}}$ Range
R	7.2416 ± 0.4247	[6.4311, 7.7069]	7.9992 ± 0.0007	[7.9971, 7.9996]
G	7.2594 ± 0.3977	[6.5389, 7.6429]	7.9991 ± 0.0006	[7.9973, 7.9996]
B	6.9675 ± 0.5990	[6.1265, 7.7522]	7.9991 ± 0.0008	[7.9969, 7.9996]
$\overline{RGB}$	7.1562 ± 0.4550	[6.4007, 7.6444]	7.9991 ± 0.0007	[7.9971, 7.9996]

To contextualize the flatness observed in the encrypted image, the same statistical analysis was applied to the unencrypted Lena image, with a size of 512 × 512 × 3 and 8-bit quantization. In contrast to the encrypted image, the plaintext image exhibits the typical non-uniformity of natural images: its channel-wise entropies were 7.2531 (R), 7.5940 (G), and 6.9684 (B), significantly below the theoretical maximum of 8 bits. This reflects an intensity distribution characterized by redundancy and dominant gray-level values.

In contrast, for the encrypted Lena image, the entropy values were 7.9993, 7.9991, and 7.9994 bits for the R, G, and B channels, respectively. The corresponding probability-based deviations analogous to chi-square statistics were 0.00087347, 0.00089596, and 0.00092465, while the NRMSE values were 0.029555, 0.029933, and 0.030408 for the R, G, and B channels, respectively.

5.3. Correlation of Adjacent Pixels

The residual spatial redundancy of the scheme was evaluated using Pearson’s correlation between pairs of adjacent pixels in three directions: horizontal $(i,j)-(i,j+1)$, vertical $(i,j)-(i+1,j)$, and diagonal $(i,j)-(i+1,j+1)$. The coefficient r was calculated per channel $(R,G,B)$ using $r=\mathrm{cov}(x,y)/\left({\sigma }_x{\sigma }_y\right)$, where x and y correspond to the vectors formed by all valid adjacent pairs in each direction. The results were obtained from three images (512 × 512) and their respective encrypted versions generated with the same algorithm configuration.

In natural images, r values are usually close to 1 due to the strong local dependence between pixels. An effective encryption must destroy this dependence and force $r\approx 0$, which suggests the absence of linear structure exploitable by neighborhood-based statistical analysis. The r coefficients obtained for each image, disaggregated by channel and direction, are presented in Table 7 (original) and Table 8 (encrypted). To facilitate global comparison between domains, the $\overline{RGB}$ per direction is additionally reported in Table 9.

Table 7. Mean adjacent pixel correlation (r), by channel and by direction for original images I.

I	$\mathit{r}\left({\mathit{R}}_{\mathit{H}}\right)$	$\mathit{r}\left({\mathit{R}}_{\mathit{V}}\right)$	$\mathit{r}\left({\mathit{R}}_{\mathit{D}}\right)$	$\mathit{r}\left({\mathit{G}}_{\mathit{H}}\right)$	$\mathit{r}\left({\mathit{G}}_{\mathit{V}}\right)$	$\mathit{r}\left({\mathit{G}}_{\mathit{D}}\right)$	$\mathit{r}\left({\mathit{B}}_{\mathit{H}}\right)$	$\mathit{r}\left({\mathit{B}}_{\mathit{V}}\right)$	$\mathit{r}\left({\mathit{B}}_{\mathit{D}}\right)$
Lenna	0.9798	0.9893	0.9697	0.9691	0.9825	0.9556	0.9327	0.9576	0.9183
Peppers	0.9635	0.9663	0.9564	0.9811	0.9818	0.9687	0.9665	0.9664	0.9478
Mandrill	0.9231	0.8660	0.8543	0.8655	0.7650	0.7348	0.9073	0.8809	0.8399

Table 8. Mean adjacent pixel correlation (r), by channel and by direction for encrypted images $I_c$.

${\mathit{I}}_{\mathit{c}}$	$\mathit{r}\left({\mathit{R}}_{\mathit{H}}\right)$	$\mathit{r}\left({\mathit{R}}_{\mathit{V}}\right)$	$\mathit{r}\left({\mathit{R}}_{\mathit{D}}\right)$	$\mathit{r}\left({\mathit{G}}_{\mathit{H}}\right)$	$\mathit{r}\left({\mathit{G}}_{\mathit{V}}\right)$	$\mathit{r}\left({\mathit{G}}_{\mathit{D}}\right)$	$\mathit{r}\left({\mathit{B}}_{\mathit{H}}\right)$	$\mathit{r}\left({\mathit{B}}_{\mathit{V}}\right)$	$\mathit{r}\left({\mathit{B}}_{\mathit{D}}\right)$
Lenna	−0.0020	0.0001	0.0027	−0.0009	−0.0024	0.0012	0.0004	−0.0011	−0.0014
Peppers	0.0001	0.0003	−0.0040	0.0024	−0.0002	−0.0015	−0.0001	0.0005	0.0009
Mandrill	0.0017	−0.0027	0.0008	0.0020	−0.0010	−0.0022	0.0016	0.0022	0.0045

Table 9. Correlations by direction, averaged over the three channels, in the original and ciphered domains.

I	$\overline{{\mathit{r}}_{\mathit{I}}\left({\mathit{RGB}}_{\mathit{H}}\right)}$	$\overline{{\mathit{r}}_{\mathit{I}}\left({\mathit{RGB}}_{\mathit{V}}\right)}$	$\overline{{\mathit{r}}_{\mathit{I}}\left({\mathit{RGB}}_{\mathit{D}}\right)}$	$\overline{{\mathit{r}}_{{\mathit{I}}_{\mathit{c}}}\left({\mathit{RGB}}_{\mathit{H}}\right)}$	$\overline{{\mathit{r}}_{{\mathit{I}}_{\mathit{c}}}\left({\mathit{RGB}}_{\mathit{V}}\right)}$	$\overline{{\mathit{r}}_{{\mathit{I}}_{\mathit{c}}}\left({\mathit{RGB}}_{\mathit{D}}\right)}$
Lenna	0.960528	0.976471	0.947842	−0.000844	−0.001146	0.000832
Peppers	0.970387	0.971512	0.957610	0.000814	0.000192	−0.001547
Mandrill	0.898630	0.837286	0.809664	0.001700	−0.000489	0.001032

While in the original domain the aggregate r remains close to unity (high redundancy), in the encrypted domain the averages are all on the order of ${10}^{-3}$ (consistent with uncorrelated noise). This demonstrates the effectiveness of the method in breaking the spatial structure, suppressing linear correlation in the three channels, and hindering statistical attacks based on neighborhood relationships.

5.4. Key Space and Computational Security Against Brute-Force Attacks

In a brute-force attack under Kerckhoffs’s principle, where the algorithm is public and only the secret key remains unknown, the effective key space of the proposed scheme is $2^{176}$. Therefore, a guessing adversary would require, on average, $2^{175}$ attempts to recover the correct key or produce an equivalent decryption. This exceeds the $2^{128}$ brute-force search threshold commonly associated with AES-128; however, this comparison is made only in terms of exhaustive-search complexity and should not be interpreted as a claim of AES-equivalent cryptographic security. The value $2^{176}$ is only a theoretical measure of resistance against exhaustive key search under the assumed key-generation model. Practical security also depends on the structure of the encryption algorithm, the quality and independence of the SHA-256-derived chaotic masks, the effectiveness of the bidirectional diffusion and inter-channel confusion stages, resistance to known-plaintext and chosen-plaintext attacks, key sensitivity, absence of statistical leakage, and implementation details. The key-space analysis is considered only one component of the overall security evaluation, complemented here by histogram uniformity, entropy, adjacent-pixel correlation, NPCR/UACI, KPA/CPA tests, NIST randomness tests, and wrong-key decryption analysis.

Additionally, the feasibility of an exhaustive attack depends on the cost per attempt. Let $\tau$ be the time required to execute a complete key testing cycle, including (i) parameter derivation, (ii) regeneration of chaotic masks, and (iii) execution of inter-channel diffusion and confusion operations, followed by an acceptance criterion (e.g., exact matching under known plaintext or statistical/visual verification under ciphertext only). The time to success is $T_{\mathrm{bf}}\approx 2^{175}\tau$. The most optimistic lower bound (ideal attacker) is obtained by replacing $\tau$ with the inverse of the test throughput per second. Even assuming high attack capabilities (${10}^{12}$ tests/s in parallel infrastructure), the time to traverse $2^{176}$ keys remains overwhelming: $2^{176}/{10}^{12}\mathrm{s}\approx 9.6\times {10}^{40}$   s (≈10³³ years). In realistic scenarios, $\tau$ is considerably larger than one cryptographic operation per block, since each test involves computing chaotic arrays and performing two-dimensional sweeps over all pixels; therefore, the effective cost of exhaustive search is even higher.

A large effective key space is vital to prevent different keys from leading to identical parameters after quantization or rounding (collisions). Our derivation based on SHA-256 and the subsequent digit/parameter assignment (Section 3.2) decouples the human-readable key from the chaotic parameters, increasing sensitivity to minimal input changes and reducing the likelihood of weak structures or collisions. Although the internal parameterization uses quantized numbers (e.g., decimal fractions), the security against brute-force attacks is dominated by the input entropy (22 bytes), while the KDF acts as a deterministic diffusion and expansion mechanism, without artificially increasing entropy.

Consequently, and under standard cryptographic analysis assumptions, the key space size ($2^{176}$), together with the computational cost per attempt, supports robust resistance against brute-force attacks. This is consistent with observations from key sensitivity and wrong-key tests, where small perturbations in the input produce decryptions that are statistically indistinguishable from noise, preventing an attacker from reducing the search space through heuristics based on spatial structure or residual correlations.

5.5. Known Plaintext and Chosen Plaintext Attacks (KPA/CPA)

We evaluated the robustness of our encryption method against known plaintext attacks (KPA) and chosen plaintext attacks (CPA) on the ten selected images. A single key was used for the entire batch to maintain comparability between scenarios.

5.5.1. KPA Results

In KPA attacks, the adversary knows some original and encrypted image pairs $(I,I_c)$. To prevent direct leaks, there must be no linear relationship between the intensities of the original image and the ciphertext. Table 10 shows correlations around zero for all $(I,I_c)$ samples, implying the absence of exploitable linear dependencies.

Table 10. KPA: Pearson correlation between original image (I) and encrypted ($I_c$) by channel. The values are expressed with a common factor ${10}^{-3}$. The set average is included.

Image	Correlation $\mathit{r}\left({\mathit{I}}_{\mathit{c}}\right)\times {10}^{-3}$
	$\mathit{R}$	$\mathit{G}$	$\mathit{B}$	$\overline{\mathit{RGB}}$
Lenna.tif	−3.646	3.601	0.526	0.161
Peppers.tif	−1.792	−2.831	1.273	−1.117
Mandrill.tif	0.743	−2.507	−1.915	−1.226
Airplane.tiff	−0.336	0.739	0.955	0.453
Barbara.bmp	−0.590	−0.187	−2.153	−0.976
BoatOnLake.tiff	1.737	0.812	3.278	1.943
Splash.tiff	1.366	−3.483	0.825	−0.431
House.tiff	−2.742	5.183	−0.588	0.618
GoldHill.bmp	−0.688	1.343	1.014	0.556
Boats.bmp	0.521	1.845	−0.790	0.525
Media	−0.543	0.452	0.243	0.050

5.5.2. CPA Results

In CPA tests, attackers can choose plaintexts, observe their ciphers, and try to deduce patterns. Standard structured images (constant image at 0, constant at 255, gradient, and checker) were encrypted to verify if $I_c$ preserves regularities. As shown in Table 11, CPA tests fail to provide any insights on the structure of the images or the ciphering procedure. Encrypted images maintain entropies, ${\chi }^2$ and adjacent pixel correlations consistent with pseudorandom behavior.

Table 11. CPA: Metrics on ciphers of chosen patterns (entropy and $\overline{RGB}$ adjacent correlation).

Pattern	$\overline{{\mathbf{H}}_{{\mathbf{I}}_{\mathbf{c}}}\left(\mathbf{RGB}\right)}$	$\overline{{\mathit{\chi }}_{{\mathit{I}}_{\mathit{c}}}^2\left(\mathit{RGB}\right)}$	$\overline{{\mathit{r}}_{{\mathit{I}}_{\mathit{c}}}\left({\mathit{RGB}}_{\mathit{H}}\right)}$	$\overline{{\mathit{r}}_{{\mathit{I}}_{\mathit{c}}}\left({\mathit{RGB}}_{\mathit{V}}\right)}$	$\overline{{\mathit{r}}_{{\mathit{I}}_{\mathit{c}}}\left({\mathit{RGB}}_{\mathit{D}}\right)}$
$P{0}_{all\text{-}0}$	7.9993	259.83	−0.001714	0.001333	0.000264
$P{1}_{all\text{-}255}$	7.9994	230.42	0.000393	−0.00044	0.000645
$P{2}_{gradient}$	7.9993	240.04	−0.000948	−0.001277	−0.000411
$P{3}_{checker}$	7.9992	279.30	0.000765	−0.001865	0.000362

5.6. Differential Attack and NPCR/UACI Metrics

We evaluated the scheme’s resilience against differential attacks as follows: for each test image I, we generated a perturbed image $I^{\prime }$ differing from the original by a single pixel. We obtained the encrypted images $I_c$ and $I_c^{\prime }$, using the same key and system parameters. We then quantified the avalanche effect by measuring the statistical change between $I_c$ and $I_c^{\prime }$. We report here the values corresponding to ten repetitions of this procedure for each image, with random selection of the perturbation position $(r,c)$. We used the NPCR (Number of Pixel Change Rate) and UACI (Unified Average Changing Intensity) metrics. NPCR is the percentage of pixels that differ between $I_c$ and $I_c^{\prime }$, while UACI is the normalized mean of $|I_c-I_c^{\prime }|$ with respect to the dynamic range L ($L=255$ for 8-bit outputs). Both metrics were calculated per channel (R, G, and B) and for the $\overline{RGB}$.

Two complementary perturbation levels were considered: (i) BIT mode, in which a single bit was inverted in a single channel of the selected pixel (minimal change), and (ii) PIXELRGB mode, in which the same bit was inverted in all three channels of the pixel (change at the RGB pixel level). The second corresponds to the scenario closest to classic differential attack on color images, while the first allows observation of the degree of propagation induced by a strictly local change.

The overall statistics (mean ± standard deviation, considering all images and repetitions) are presented in Table 12 (NPCR) and Table 13 (UACI). These results allow for comparison of the system’s behavior under fine perturbations and at the pixel level.

Table 12. NPCR (%) global per channel and $\overline{RGB}$ (mean ± $\sigma$).

Mode	R	G	B	$\overline{\mathit{RGB}}$
BIT	33.2602 ± 0.0549	33.2517 ± 0.0823	33.2719 ± 0.0722	33.2613 ± 0.0397
PIXELRGB	99.7838 ± 0.1190	99.7838 ± 0.1190	99.7838 ± 0.1190	99.7838 ± 0.1190

Table 13. UACI (%) global per channel and $\overline{RGB}$ (mean ± $\sigma$).

Mode	R	G	B	$\overline{\mathit{RGB}}$
BIT	10.8628 ± 2.6244	10.8725 ± 2.6210	10.8772 ± 2.6227	10.8708 ± 2.6225
PIXELRGB	32.6063 ± 7.8658	32.6113 ± 7.8672	32.6028 ± 7.8703	32.6068 ± 7.8677

Consistent with the expected criterion for strong diffusion ciphers, Table 13 shows that, in PIXELRGB mode, UACI approaches the theoretical reference range (∼33% for 8-bit images), indicating average intensity changes compatible with a pseudo-random distribution of the differential error.

In PIXELRGB mode, the NPCR reaches values close to $99.8\%$ in all three channels and the average, with reduced standard deviations (<0.2%). This reveals a robust avalanche effect: minimal changes in I generate large differences in $I_c$, making local inferences from the original perturbation difficult.

In this proposal, diffusion operates within the channel affected by the disturbance, and inter-channel confusion reorders the (R,G,B) triplets at the pixel level, without numerically combining the values between channels. Consequently, after encryption, the differential discrepancy tends to occupy approximately one of the three channels per pixel on average, which is reflected in the ∼1/3 level observed in BIT mode, producing NPCR ≈ 33% and UACI ≈ 10.9%. This is not a vulnerability but a consequence of the design. An attacker cannot exploit this without knowing the permutation matrix, which would require breaking the key space, as it is derived from the same SHA-256-seeded chaotic generator.

The overall per-channel comparison of NPCR for both modes is illustrated in Figure 5, where the gap between the minimum change (BIT) and the pixel-level change (PIXELRGB) is evident, along with the low dispersion of the latter case.

Figure 5. Average NPCR (%) per channel (mean ± std dev) for BIT and PIXELRGB modes. In both cases the values are very close to the ideal figures ≈33.33% and 99.609%, respectively. In other words, a minimum change in a plaintext leads to a radically different ciphertext. This suggests the scheme may be resistant to attacks in which ciphertext variations are used to reverse-engineer the key or the plaintext.

Similarly, Figure 6 presents UACI per channel, showing that the PIXELRGB mode falls within the expected range for 8 bits, while the BIT mode maintains lower differential intensities by restricting the disturbance to a single channel.

Figure 6. Average UACI (%) per channel (mean ± std dev) for BIT and PIXELRGB modes are close to the ideal values (≈33.46% and 10.87%, respectively). This indicates the diffusion mechanism is strong and successful, helping prevent differential attacks.

The stability of NPCR (RGB average) across the image set is shown in Figure 7. The corresponding PIXELRGB curve remains virtually constant, supporting the consistency of the avalanche effect across images.

Figure 7. NPCR ($\overline{RGB}$) per image for BIT and PIXELRGB modes.

To complete the image reading, Figure 8 shows UACI (RGB average) in both modes; again, PIXELRGB remains around 32.6%, confirming a uniform average intensity change between images.

Figure 8. UACI ($\overline{RGB}$) per image for BIT and PIXELRGB modes.

The results of NPCR/UACI under pixel-level perturbation (PIXELRGB) demonstrate high differential sensitivity and effective diffusion, suitable for mitigating differential attacks on image ciphers.

Although the inter-channel permutation contributes to confusion by locally reordering the RGB triplet, it should not be interpreted as an independent source of strong cryptographic security. Since only $3!=6$ channel permutations are possible at each pixel, its standalone local permutation space is limited to ${\log }_2\left(6\right)\approx 2.58$ bits per pixel. In the proposed architecture, this stage is an additional confusion layer applied after the bidirectional modular diffusion. The security of the scheme relies on the combination of this step with the forward/backward diffusion process, the SHA-256-derived chaotic masks, and the key sensitivity of the generated parameters. Under the considered threat model, KPA/CPA experiments, differential tests, key-sensitivity analysis, wrong-key decryption, and NIST tests on ciphertext-derived sequences are jointly used to evaluate whether exploitable statistical or structural information remains in the encrypted output.

5.7. NIST STS Battery Applied to Encryption

The statistical randomness of the cryptogram was also evaluated using the NIST SP 800-22 Statistical Test Suite (STS), employing 1000 binary sequences constructed from the encrypted dataset. The results (see Table 14) show a globally satisfactory behavior. The fundamental tests related to balance and local structure, such as Frequency, Block Frequency, Cumulative Sums, Runs, Longest Run, Rank, and FFT, simultaneously satisfy the criteria for both the proportion of passing sequences and the uniformity of p-values. This behavior indicates that, at short and intermediate scales, the cryptogram does not exhibit evident biases or dominant periodic patterns, which constitutes favorable evidence regarding the statistical quality of the encryption process.

Table 14. Results of the NIST STS battery.

Test Family	p-Value Range	Proportion Range	Meet NIST?
Frequency	0.375313	991/1000	Yes
BlockFrequency	0.729870	996/1000	Yes
CumulativeSums	0.360287–0.986227	992–993/1000	Yes
Runs	0.566688	992/1000	Yes
LongestRun	0.266235	990/1000	Yes
Rank	0.668321	987/1000	Yes
FFT	0.941144	987/1000	Yes
NonOverlappingTemplate	0.002598–0.993226	981–999/1000	Yes a
OverlappingTemplate	0.672470	990/1000	Yes
Universal	0.134944	991/1000	Yes
ApproximateEntropy	0.684890	995/1000	Yes
RandomExcursions	0.004533–0.799916	615–627/631	No b
RandomExcursionsVariant	0.011187–0.990149	617–628/631	Yes
Serial	0.281232–0.395940	992–993/1000	Yes
LinearComplexity	0.360287	990/1000	Yes

^a Some individual subtests exhibited p-values below 0.01, but the overall evaluation remains acceptable under recommended NIST guidelines. ^b At least one subtest failed with p-value < 0.01 and the passing proportion was below the required threshold (617/631).

The behavior of particularly relevant test families, such as Overlapping Template, Universal, Approximate Entropy, Serial, and Linear Complexity, is also satisfactory. Taken together, the results form Table 14) indicate that the encrypted sequence exhibits statistical complexity consistent with randomness, no evidence of periodic or repetitive structures, and adequate entropy preservation across block sizes. Consequently, the cryptogram satisfies several properties commonly expected in high-quality pseudorandom sequences, especially in the tests typically used as benchmarks in the evaluation of digital encryption schemes.

The main nonconformity in the analysis corresponds to the Random Excursions family. There, at least one subtest exhibited a p-value below 0.01 and a passing proportion below the minimum threshold required for 631 valid sequences. Thus, it is not fully satisfactory under the standard NIST criterion. Nevertheless, this result does not discredit the method. The Random Excursions family is exceptionally sensitive to the effective number of valid trajectories and is more prone to sample-set fluctuations than other NIST tests. Consequently, a failure in this family—particularly with finite sequence lengths—does not undermine the overall statistical quality of the encryption scheme.

5.8. Sensitivity Test and Wrong Key Proof

To quantify key sensitivity (i.e., how minimal perturbations in the key produce macroscopic changes in the encrypted images), each image was encrypted with the nominal key K and with a perturbed key $K^{\prime }$, which differs from the nominal key by a single symbol. The ciphers $I_{c\left(K\right)}$ and Table $I_{c\left(K^{\prime }\right)}$ were then compared. Table 15 (NPCR) and Table 16 (UACI) summarize the results per channel and on average, reporting the mean, standard deviation and range in the evaluated set of ten images.

Table 15. NPCR statistics (%) between $I_{c\left(K\right)}$ and $I_{c\left(K^{\prime }\right)}$ (key sensitivity).

Channel	Mean	$\mathit{\sigma }$	Min	Max
R	99.60650	0.01188	99.58496	99.62196
G	99.59658	0.01437	99.57275	99.61830
B	99.60591	0.00864	99.59412	99.62288
$\overline{RGB}$	99.60299	0.00709	99.59386	99.61484

Table 16. UACI statistics (%) between $I_{c\left(K\right)}$ and $I_{c\left(K^{\prime }\right)}$ (key sensitivity).

Channel	Mean	$\mathit{\sigma }$	Min	Max
R	33.444654	0.078913	33.280682	33.539788
G	33.455307	0.038631	33.385834	33.502745
B	33.469574	0.099794	33.221585	33.584773
$\overline{RGB}$	33.456512	0.054117	33.308901	33.495049

Consistently, the average values reach $NPC{R}_{\overline{RGB}}=99.60299\%$, ($\sigma =0.00709$) and $UAC{I}_{\overline{RGB}}=33.45651\%$ ($\sigma =0.05412$), which indicates a high cryptographic avalanche: a minimal change in the key induces massive differences in the encryption. This trend is visualized in Figure 9 and Figure 10, which show the averages per channel with their variability.

Figure 9. In this scheme, minimal changes in the encryption key lead to nearly ideal changes in the values of pixels, as shown by the mean NPCR (%) per channel and the RGB average of an image encrypted with two keys $C\left(K\right)$ and $C\left(K^{\prime }\right)$ differing in only one symbol (bars with std dev).

Figure 10. The average UACI (%) per channel between $C\left(K\right)$ and $C\left(K^{\prime }\right)$ (bars with std. dev.), suggest that the scheme is very sensitive to minimal changes in the encryption key.

To verify that decryption with an incorrect key does not reveal structural information about the plaintext, the encrypted images $I_{C\left(K\right)}$ were subjected to decryption with a perturbed key: $Dec(I_{c\left(K\right)},K^{\prime })$. For each image, the mean square error (MSE), peak signal-to-noise ratio (PSNR), and percentage of pixels identical to the original were calculated. Table 17 presents the aggregate statistics for the evaluated set and includes, as a consistency check, the case of correct decryption $Dec(I_{C\left(K\right)},K)$.

Table 17. Decrypted with correct key vs. incorrect key: aggregate statistics.

Case	$\overline{\mathbf{MSE}}\pm \mathit{\sigma }$	$\overline{\mathbf{PSNR}}\left(\mathbf{dB}\right)\pm \mathit{\sigma }$	$\overline{\mathbf{Identical}\mathbf{Pixels}\mathbf{(}\mathbf{\%}\mathbf{)}}\pm \mathit{\sigma }$	Comments
$Dec(I_{C\left(K\right)},K)$	0	∞	$100.000\pm 0.000$	Perfect reconstruction
$Dec(I_{C\left(K\right)},K^{\prime })$	$9549.6\pm 910.8$	$8.349\pm 0.409$	$0.389\pm 0.008$	Highly distorted output

As shown in Table 17, correct decryption produces a 100% match and infinite PSNR, confirming the scheme reversibility. In contrast, decryption with the wrong key yields an average PSNR of 8.349 dB and a match rate of only 0.389%, suggesting that the output behaves like noise and does not preserve any spatial structure from the plaintext. The distribution of the percentage of identical pixels per image is shown in Figure 11, demonstrating the stability of the adverse behavior under the wrong key throughout the test set.

Figure 11. The gray bars show the percentage of identical pixels per image after decryption with a key incorrect by just one symbol. The dotted line represents the average. The probability of correct pixel recovery remains very low for all tested images.

The results for key sensitivity and wrong key sensitivity show that the method has marked avalanche properties and a strong key dependency: minimal perturbations in the cryptographic input induce massive changes in the ciphertext, and decryption with a close but incorrect key offers no partial reconstructions or residual patterns.

Although entropy, histogram uniformity, adjacent-pixel correlation, NPCR, and UACI are widely used indicators in image-encryption analysis, they should not be interpreted as complete proof of practical security. High-quality statistical values indicate that the ciphertext has noise-like first- and second-order behavior, but they do not by themselves exclude weaknesses under known-plaintext, chosen-plaintext, key-reuse, implementation, or structural attacks. Therefore, the proposed scheme was also evaluated from complementary perspectives, including known-plaintext attack analysis, chosen-plaintext tests with structured inputs, key sensitivity, wrong-key decryption behavior, exact recovery quality, and computational cost. This broader validation provides a more complete picture of the practical performance of the method.

5.9. Floating Frequency

In addition to conventional metrics and statistics, a floating-point frequency analysis was performed to assess the local uniformity of the encrypted text. A set of 20 encrypted of varying sizes, taken from [19] was used. Each file was read as an RGB array, and only the encrypted values from the R, G, and B channels were extracted. Consequently, the analysis was carried out on the pixel values of the ciphertext, rather than on headers, metadata or internal bytes associated with the PNG container.

Using the encoded RGB matrices, an analysis stream of 229,715,019 bytes was organized, corresponding to the combined RGB set. In addition, the R, G, and B channels were evaluated independently, each comprising 76,571,673 bytes. Sliding windows of 1 MB with a shift of 0.5 MB were applied to each stream. For each window, the empirical frequency of the 256 possible values was calculated and compared with the ideal uniform distribution, in which each symbol has an expected probability of 1/256. The evaluation included the maximum absolute deviation, the total variation distance, the chi-square, the p-value and the proportion of windows that do not reject the uniformity hypothesis for $\alpha =0.01$.

This test verifies whether the uniform distribution of the ciphertext is preserved locally when the ciphertext stream is examined using sliding subsets. Unlike robustness tests against noise or occlusion, in this analysis the ciphertext is neither modified nor is the recovery of the original image evaluated. It aims to identify if concentrations of byte values, local biases, or frequency patterns remain hidden in a global analysis. The main quantitative results are presented in Table 18.

Table 18. Floating frequency analysis.

Stream	MIB	Windows	${\mathit{\chi }}^2$ Av.	p Av.	MAD Av.	MAD. Max	TVD Av.	Pass Ratio
Combined RGB	219,073	437	254.9479	0.4993	0.000187	0.000288	0.006219	0.9908
Canal R	73,024	145	258.8577	0.4612	0.000188	0.000243	0.006262	0.9724
Canal G	73,024	145	259.4006	0.4497	0.000187	0.000271	0.006278	0.9724
Canal B	73,024	145	53.3290	0.5267	0.000186	0.000261	60.006199	0.9862

A total of 437 sliding windows were obtained in the combined RGB stream. The mean value of ${\chi }^2$ was 254.9479, very close to the expected value for a chi-squared test with 255 degrees of freedom. The mean p-value was 0.4993 and the median was 0.5017, which shows no systematic tendency towards rejecting the uniformity hypothesis. The average maximum absolute deviation was 0.000187, while the worst case observed was 0.000288; both values are small compared to the ideal probability of 0.00390625 associated with each symbol.

The behavior of the R, G, and B channels was consistent with that observed in the combined RGB stream. The mean ${\chi }^2$ values remained close to 255, and the mean p-values remained within a range consistent with normal statistical fluctuations. The acceptance rates were 0.9908 for the combined RGB stream, 0.9724 for the R channel, 0.9724 for the G channel and 0.9862 for the B channel. Although some individual windows exhibit p-values below 0.01, this behaviour is to be expected when evaluating a large number of sliding windows and does not, in itself, constitute evidence of a persistent bias. The local frequency distribution for the combined RGB stream is shown in Figure 12. In this map, each row represents a sliding window and each column corresponds to a byte value between 0 and 255. The absence of dominant vertical bands indicates that no ciphered symbol persistently exhibits anomalous frequencies throughout the analyzed stream.

Figure 12. Floating-point frequency map of the combined RGB stream. Each row corresponds to a sliding window and each column to a byte value between 0 and 255.

The stability of the distribution is also verified by the maximum absolute deviation from 1/256, shown in Figure 13 for the R, G, and B channels and their combination. The curves show limited variations with no upward trends, confirming that local deviations remain within a narrow range throughout the entire course of the encrypted stream.

Figure 13. Maximum absolute deviation from 1/256 for the combined RGB signal and for the R, G, and B channels.

This floating-frequency analysis shows that the statistical uniformity of the ciphertext does not depend solely on global averages, but is preserved when examining moving subsets of the encrypted RGB stream. The closeness of the ${\chi }^2$ values to the expected value, the p-values centered around 0.5, the small deviations from 1/256, and the absence of persistent clusters in the frequency map support the ability of the proposed scheme to distribute the ciphertext values in a locally uniform manner across images of arbitrary size.

5.10. Analysis of Computational Complexity, Scalability, and Memory Usage

Let N = H × W be the number of pixels in an image of size H × W. In the proposed scheme, the initial derivation of the key using SHA-256 and the generation of the chaotic parameters have a constant cost relative to the image size. The dominant stages correspond to the generation of the chaotic masks, the forward and backward diffusion in each RGB channel, the generation of the inter-channel confusion matrix, and the pixel-by-pixel permutation between the R, G, and B layers. Each of these operations traverses the image a fixed number of times; therefore, the overall time complexity of the encryption process is O(N), given that the number of channels is constant and equal to 3.

The algorithm does not use global sorting, exhaustive searches, or pixel-pair comparisons, thereby avoiding O($NlogN$) or O($N^2$) time complexities. This feature enhances the method’s scalability for higher-resolution images and large image datasets, as the runtime increases proportionally with the number of pixels processed. In the experimental implementation, all simulations were carried out in MATLAB R2025b on a workstation with an Intel(R) Core(TM) Ultra 7 155H processor running at 1.40 GHz and 32 GB of RAM. Under these conditions, the average encryption time for the 512 × 512-pixel Lena RGB image was 0.37 s, considering the cryptographic core comprising chaotic mask generation, diffusion and inter-channel permutation.

From a spatial perspective, the method also has O(N) complexity, as the main data structures correspond to RGB channels, chaotic masks, and intermediate matrices with the same dimensions as the original image. The MATLAB implementation retains several intermediate matrices in double precision to facilitate experimental validation and process traceability; however, the scheme does not require dense matrices of size $N^2$. In optimized implementations, memory consumption can be reduced through channel-by-channel processing, buffer reuse, storage of masks quantized to 8-bit integers, and incremental writing of the encrypted image.

For large image datasets, the method can be run independently on each image, without the need to load the entire dataset into memory. This allows for a sequential or batch processing strategy, where only the current image, the necessary masks, and the buffers associated with the diffusion and permutation stages are kept in memory. Consequently, the scheme is scalable for large databases and can be adapted to environments with memory constraints through a data-flow-oriented implementation.

6. Comparisons

Table 19 compares our results with representative chaotic image-encryption schemes recently published, including entropy, NPCR, UACI, key space, mean adjacent-pixel correlation, NIST testing, recovery quality, and encryption time per image. All values are reported as averages when multiple images or channels are available, except for the encryption time, which is preferably reported for Lena 512 × 512 or, when unavailable, as the average time over 512 × 512 images. The Table 19 distinguishes whether the NIST test was applied to chaotic sequences or directly to ciphertext-derived sequences, since these two cases have different implications for assessing the randomness of the final encrypted output.

Table 19. Recent publications: comparative data.

Ref.	Entropy	NPCR (%)	UACI (%)	Key Space	Correl $\mathit{r}<{10}^{-4}$	NIST Test on Ciphertext	Recovery Quality	Encryp. Time (s)
[2]	7.9994	99.5995	33.4390	${10}^{960}$ (Ch. Sec.)	No	No *	NR	1.1796 (Av.)
[3]	7.9992	99.6078	33.4714	$2^{384}$	NR	No *	1	1.3012 (Av.)
[16]	7.5971	99.5995	32.7793	NR	No	No	NR	22.5937 (Lena)
[17]	7.9993	99.61	33.47	$2^{256}$	NR	Yes	1	NR
[21]	7.9993	99.601	33.425	$2^{575}$	NR	No *	NR	0.5779 (Barbara)
[22]	7.9983	99.6221	33.4642	$2^{365}$	No	No	NR	0.156 (Av.)
[23]	7.9992	99.612	49.976	$2^{768+\left({512}^2\right)}$ (Ch. Sec.)	No	No *	NR	0.8 (Av.)
[24]	7.9994	99.6051	33.4575	$2^{417}$	No	No *	NR	0.39 (Av.)
[25]	7.993	99.6077	33.4504	$2^{689}$	NR	No *	NR	NR
[26]	7.9946	99.3375	31.1625	$2^{2048}$	NR	No *	NR	NR
[27]	7.9977	99.6087	33.4362	${10}^{840}$	No	No	NR	NR
[28]	7.9998	99.6093	33.4675	$2^{512}\times {10}^{75}$	No	No *	NR	4.755 (Av.)
[29]	7.9991	99.8950	33.3117	${10}^{308}$	No	Yes	0.998	0.015747 (Av.)
[30]	7.9961	99.6093	33.4634	$2^{256}$	No	No *	NR	NR
Ours	7.9991	99.7838	32.6068	$2^{176}$	Yes	Yes	1	0.37 (Lena)

Notes: Correl $r<{10}^{-4}$: “No” means value ≥ 0.0001, “NR” means not reported. NIST Test on Ciphertext: “No” indicates not reported, “No *” indicates the NIST tests were performed on the chaotic sequences, not on the ciphertext. Recovery Quality: “NR” means not reported. Encryp. “NR” stands for: not reported.

The comparative Table 19 shows that this method goes far beyond incremental improvements in any single metric. Instead, it constitutes a novel contribution that balances statistical performance, encryption quality, and computational efficiency, while achieving a level of overall security and effectiveness that none of the other analyzed methods attain.

All values are reported as averages when the corresponding works provide results for several images, channels, or directions, except for the encryption time. For encryption time, the value for Lena 512 × 512 is preferentially reported; when unavailable, the average time over 512 × 512 images is used. Computational complexity was not included as a separate column because it is not consistently reported in most compared studies and is often mixed with empirical encryption time. Therefore, encryption time per image is used here as the practical indicator of computational efficiency. As summarized in the comparative table, most reported applications of the NIST test suite assess the statistical properties of the underlying chaotic sequences rather than those of the resulting ciphertext. This is an important methodological distinction, since randomness in the chaotic source does not guarantee that the final encrypted output preserves comparable statistical properties. Applying NIST tests directly on the ciphertext is preferable because it evaluates the encryption scheme as a whole, reflecting its real-world security against statistical attacks. In contrast, the present work applies the NIST tests directly to the ciphertext, offering a more stringent and practically relevant validation of the proposed cryptosystem. Therefore, the favorable NIST results reported here represent a comparative strength of the method, as they confirm the pseudorandom behavior of the actual encrypted data produced by the scheme.

Although the proposed method does not claim the largest key space among the compared schemes, it provides a balanced performance: near-ideal entropy, high NPCR, low adjacent-pixel correlation, exact lossless recovery, ciphertext-based NIST validation, and competitive encryption time for Lena 512 × 512.

In Table 20 the deviations are expressed in percentage points, and the ideal values correspond to the expected behavior of two independent uniformly distributed 8-bit ciphertext images. Therefore, they are used as reference values rather than exact targets. The proposed method shows NPCR above the theoretical reference and UACI close to the ideal value, indicating strong differential sensitivity.

Table 20. Comparisons with ideal index.

Metric	Ideal 8-Bit Value	Proposed Method	Absolute Deviation	Interpretation
NPCR [%]	99.6094	99.7838	+0.1744	Slightly higher than ideal reference; strong perturbation propagation
UACI [%]	33.4635	32.6068	−0.8567	Close to ideal; slightly lower average intensity variation

To benchmark the differential performance, the obtained NPCR and UACI values were compared with the theoretical expectations for an ideal 8-bit cipher. The ideal NPCR is $99.6094\%$, while the ideal UACI is approximately $33.4635\%$. In the PIXELRGB perturbation mode, the proposed method achieves $NPCR=99.7838\%$ and $UACI=32.6068\%$, corresponding to deviations of $+0.1744$ and $-0.8567$ percentage points, respectively. The NPCR value is slightly higher than the ideal reference, indicating that a one-pixel RGB perturbation propagates to almost the entire ciphertext. The UACI value remains close to the theoretical expectation, although slightly lower, which is consistent with the deterministic bidirectional modular diffusion and the reversible inter-channel permutation stage. Since the theoretical values assume independent uniformly distributed ciphertexts, exact equality is not expected; instead, these values serve as reference benchmarks for evaluating differential sensitivity.

7. Conclusions

We presented a reversible chaotic encryption scheme for images of arbitrary size that combines (i) intra-channel diffusion via strong bidirectional modular addition and (ii) inter-channel confusion via pixel-wise permutations of the $(R,G,B)$ triplet controlled by a six-state chaotic matrix. The proposed architecture achieves exact lossless recovery with the correct key (SSIM = 1.0) and provides a large effective key space ($2^{176}$). Security evaluation shows that the ciphertext exhibits noise-like behavior in both first-order and spatial statistics. Per-channel histograms are substantially flattened and consistent with a uniform model (low ${\chi }^2$ and corresponding p-values), Shannon entropies remain near the theoretical maximum (∼8 bits), and adjacent-pixel correlations in horizontal/vertical/diagonal directions are reduced to values close to zero. Robustness against statistical and differential analysis is supported by KPA/CPA tests (including degenerate patterns) and by strong plaintext/key sensitivity: single-pixel perturbations yield benchmark-level NPCR/UACI, and one-symbol key perturbations produce competitive NPCR/UACI with narrow dispersion; moreover, wrong-key decryption outputs are non-informative (PSNR $\approx 8.35$ dB; pixel coincidence $\approx 0.389\%$). All of this is achieved within competitive times [20].

The reported indicators (entropy∼8, correlation∼0, and NPCR/UACI), together with the compliance with NIST tests performed on the resulting ciphertext rather than on chaotic sequences, place the method among strong recent chaos-based RGB encryption proposals. In addition, the joint validation protocol adopted here—including ${\chi }^2$ tests with p-values, multi-image KPA/CPA experiments, and explicit key-sensitivity and wrong-key analyses—provides a transparent and reproducible assessment supporting the practicality of the proposed scheme for secure real-time visual-data protection.

This scheme addresses several vulnerabilities common to previous cryptographic procedures and offers competitive advantages specifically in telemedicine and teleradiology applications, in which medical images must be transmitted over public networks and recovered without any loss or distortion. Unlike other alternatives, our scheme is parallelizable and achieves exact lossless reconstruction (SSIM = 1.0), while maintaining encryption times below one second for standard 512 × 512 images. In contrast, AES in CBC mode is not natively parallelizable and may introduce latency in software-only implementations. This proposal is also relevant for IoT-based surveillance systems (e.g., residential security cameras or drones), for which computational resources are limited and power consumption is critical. Our method operates with a short user key (22 bytes) and lightweight chaotic masks, requiring no hardware acceleration (such as AES-NI) to achieve high throughput. Its intrinsic pixel-wise parallelism makes it particularly suitable for edge devices where real-time encryption is required without dedicated cryptographic hardware.

A limitation of the current implementation is its software-only design, which has not yet been optimized for GPU or FPGA acceleration. Future work includes subjecting the scheme to machine-learning-based cryptanalysis, exploring hardware acceleration for real-time video encryption, and extending the inter-channel confusion to multispectral images. These tasks remain open for further research and do not compromise the validity of the security assessments presented here.