Mutual Authentication via Non-Monotonic XOR Visual Cryptography

Abstract

We propose a novel mutual authentication protocol based on an enhanced XOR-based visual cryptography scheme exhibiting a non-monotonic access structure. A secret image is split into four visual shares such that the XOR of exactly three shares reveals a clear and human-readable image, while the XOR of one, two, or all four shares produces a visually blurred result. This property is achieved through carefully designed visual cryptography basis matrices. Using this construction, we design a lightweight challenge–response mutual authentication protocol requiring minimal cryptographic operations and relying primarily on XOR operations and human visual verification while assuming a trusted authority for initial share distribution. Security analysis shows that the protocol provides resistance against impersonation and eavesdropping attacks, while replay protection can be achieved by incorporating standard session management techniques. Experimental validation confirms the effectiveness of the proposed scheme, making it suitable for human-centric and resource-constrained environments.

1. Introduction

Mutual authentication is a fundamental security requirement in modern distributed systems, ensuring that two communicating entities can reliably verify each other’s identity before exchanging sensitive information. With the rapid expansion of the Internet of Things (IoT), smart cities, industrial automation, healthcare systems, unmanned aerial vehicles, and metaverse environments, authentication protocols are increasingly required to operate under strict constraints in terms of computation, storage, energy consumption, and user interaction [1,2,3,4,5,6,7,8,9,10]. As a result, the design of lightweight and robust mutual authentication mechanisms has become a critical research challenge.

Most existing mutual authentication schemes rely on conventional cryptographic primitives, including public-key cryptography, elliptic curve cryptography, hash-based constructions, blockchain infrastructures, and even quantum-based mechanisms [5,6,7,8,9,10,11,12,13,14]. While these approaches provide strong security guarantees, they often incur significant computational and communication overhead, require complex key management, and depend on specialized infrastructure or hardware support. Such requirements may be impractical in human-centric systems and resource-constrained environments, such as wearable devices, smart home systems, drones, and edge IoT nodes [1,2,5,6,10].

To overcome these limitations, alternative authentication approaches have been explored. Among them, visual cryptography (VC), originally introduced by Naor and Shamir [15], offers a unique approach in which secret reconstruction relies on human visual perception rather than computational decryption. In classical $(k,n)$-threshold VC schemes, a secret image is divided into n shares such that stacking at least k shares reveals the secret, while fewer shares provide no information. This simplicity makes VC particularly attractive for intuitive and lightweight authentication mechanisms.

Recent works have explored the use of visual cryptography in authentication and key distribution scenarios, including IoT-cloud systems [7], ghost imaging-based key distribution [8], and secure access control mechanisms in distributed environments. However, most of these approaches inherit the monotonic reconstruction behavior of classical VC, where the visual quality of the reconstructed image improves as more shares are combined. This property is undesirable in authentication contexts, as it may lead to partial information leakage or unintended verification outcomes.

More fundamentally, classical visual cryptography is constructed according to a monotonic reconstruction principle. The basis matrices are designed so that visual information progressively emerges as additional shares are combined. Consequently, the designer has limited control over the visual behavior of individual subsets of shares. In contrast, the enhanced visual cryptography framework considered in this work removes this restriction by allowing the visual outcome of selected subsets to be explicitly controlled through basis matrix design. Depending on the chosen matrices, a subset of shares may produce either a meaningful reconstruction or a visually degraded image. This additional flexibility enables the construction of non-monotonic access structures that cannot be realized within the classical threshold framework.

XOR-based visual cryptography provides a natural foundation for such enhanced constructions. By replacing the OR operation with XOR, it becomes possible to analyze and control the Hamming-weight properties of reconstructed subsets more precisely. This flexibility allows the design of basis matrices that enforce specific visual behaviors for selected combinations of shares, including non-monotonic reconstruction patterns. In particular, XOR-based constructions enable the realization of non-monotonic reconstruction behaviors, where adding more shares does not necessarily improve visual clarity. This property is especially suitable for authentication, where successful verification must occur only under precisely defined conditions.

Motivated by this observation, we propose a mutual authentication framework based on an enhanced XOR-based visual cryptography scheme exhibiting a non-monotonic access structure. The proposed construction splits a secret image into four visual shares with the following behavior: individual shares are completely unintelligible, the XOR of two shares produces a blurred image, the XOR of exactly three shares yields a clear and human-recognizable reconstruction, and the XOR of all four shares again results in a blurred output. This controlled visual behavior enables an authentication mechanism based on visual verification rather than purely cryptographic computation.

Building on this property, we design a lightweight challenge–response mutual authentication protocol that relies on simple XOR operations and human visual inspection, while assuming a trusted authority for the initial generation and distribution of visual shares. The protocol avoids the use of computationally expensive cryptographic primitives such as public-key encryption, digital signatures, or complex key exchange mechanisms during the authentication phase.

The contributions of this work can be summarized as follows. We first introduce an enhanced XOR-based visual cryptography model in which the visual behavior of share subsets is determined through basis matrix design, and demonstrate a non-monotonic reconstruction property specifically tailored for authentication. We then propose concrete basis matrix constructions and provide a formal analysis of their Hamming weight properties to guarantee the desired visual behavior. Based on this construction, we design a lightweight mutual authentication protocol and analyze its security under a strong adversarial model. Finally, we validate the effectiveness of the proposed approach through both qualitative and quantitative experimental evaluations, demonstrating a clear perceptual distinction between valid and invalid reconstructions.

By combining the simplicity of visual cryptography with the flexibility of XOR-based reconstruction, the proposed approach illustrates how enhanced visual cryptography can be exploited for authentication-oriented applications. This makes it particularly suitable for human-centric and resource-constrained environments.

2. Related Work

Mutual authentication has been extensively studied across a wide range of application domains, including Internet of Things (IoT), smart environments, healthcare systems, unmanned aerial vehicles, and emerging virtual platforms. Existing solutions predominantly rely on conventional cryptographic primitives and infrastructure-based security mechanisms.

2.1. Traditional and Emerging Authentication Paradigms

A large body of research has explored mutual authentication mechanisms based on cryptographic primitives such as symmetric encryption, hash functions, and elliptic curve cryptography (ECC). For instance, ECC-based schemes have been proposed for smart grids [13], telecare medical information systems [14,16], and wearable devices in the Medical Internet of Things [6]. While these approaches provide strong security guarantees, they still introduce non-negligible computational and communication overhead.

In large-scale and distributed environments, additional mechanisms have been introduced to address trust and scalability issues. Consensus-based schemes [3], secure addressing mechanisms [12], and blockchain-based authentication protocols [17,18,19] aim to reduce reliance on centralized authorities and improve traceability. However, these solutions often increase system complexity, latency, and storage requirements.

Authentication protocols have also been proposed for emerging environments such as metaverse systems and distributed healthcare platforms [20,21]. In these contexts, privacy preservation and scalability are key concerns, but the reliance on cryptographic primitives remains dominant.

In resource-constrained and physically exposed environments, such as drone networks, hardware-assisted approaches have been proposed using physically unclonable functions (PUFs) and secure coprocessors [5,10,22]. Although these techniques enhance resistance to physical attacks, they require specialized hardware, limiting their applicability.

Finally, recent works have explored post-quantum and quantum-based authentication mechanisms [11,23]. While offering strong theoretical security, these approaches remain impractical for lightweight deployments due to their complexity and infrastructure requirements.

Overall, existing authentication paradigms rely heavily on cryptographic computation, hardware support, or distributed infrastructures, which motivates the exploration of alternative lightweight and human-centric solutions.

2.2. Visual Cryptography-Based Authentication

Visual cryptography (VC), introduced by Naor and Shamir [15], provides an alternative paradigm in which secret reconstruction is achieved through human visual perception rather than computational decryption. This property makes VC particularly attractive for authentication scenarios requiring simplicity and usability.

Several works have applied visual cryptography to authentication and key distribution. For example, Ehuil et al. [7] proposed a VC-based mutual authentication protocol for IoT-cloud environments, combining secret images and ticket mechanisms. Kang et al. [8] introduced a ghost-imaging-based authentication and key distribution scheme using cumulative visual cryptography.

Although these approaches demonstrate the feasibility of visual authentication, they rely on classical VC constructions with monotonic reconstruction behavior. In such schemes, the visual quality of the reconstructed image improves as more shares are combined. This property is not well-suited for authentication, as it may allow partial information leakage or unintended reconstruction with unauthorized subsets.

2.3. Positioning of the Proposed Work

The proposed work differs from existing visual-cryptography-based authentication approaches in both design and objective. Unlike many conventional authentication schemes that rely on computationally expensive public-key primitives during the authentication phase, the proposed protocol primarily employs lightweight XOR operations, session-dependent pseudorandom permutations, and human visual verification. A trusted authority is assumed only during the enrollment phase for the generation and secure distribution of visual shares and the secret seed required for session synchronization.

The enhanced visual cryptography framework considered in this work was recently proposed in the context of graphical-password authentication and smart-lock access control. Unlike classical threshold visual cryptography, this framework allows the visual behavior of selected subsets of shares to be controlled directly through basis-matrix design. The present work extends this framework to mutual authentication and demonstrates how its non-monotonic reconstruction capabilities can be exploited to achieve lightweight and session-dependent authentication [24,25].

Furthermore, in contrast to existing visual cryptography-based authentication schemes, the proposed construction enforces a non-monotonic reconstruction property. Specifically, visual clarity is achieved only when exactly three out of four shares are combined, whereas all other combinations (one, two, or four shares) produce visually blurred results. This behavior prevents partial information leakage and ensures that authentication succeeds only under strictly controlled conditions. Combined with the proposed session-dependent permutation mechanism, it further guarantees that previously recorded authentication messages cannot be reused in future sessions.

By introducing this non-monotonic access structure and integrating it into a challenge–response protocol, the proposed approach demonstrates a novel application of enhanced visual cryptography to mutual authentication. Unlike threshold-based visual cryptography, which aims to reconstruct a secret whenever a minimum number of shares is available, the proposed approach enforces authentication through carefully controlled visual behavior specified directly by the basis matrices. In addition, the incorporation of session-dependent permutations enables freshness guarantees and replay-attack resistance while preserving the lightweight nature of the protocol. The resulting framework provides a human-centric authentication mechanism that complements existing cryptographic solutions, particularly in resource-constrained environments where computational simplicity is an important requirement.

3. Enhanced Visual Cryptography

3.1. Enhancing Visual Cryptography via Non-Monotonic XOR Reconstruction

Visual cryptography (VC) enables the protection of visual information by decomposing an image into multiple shares that reveal the secret only through visual reconstruction. Since its introduction by Naor and Shamir in 1994 [15], the classical $(k,n)$-threshold model has been widely studied and extended. In this framework, a secret image is reconstructed once at least k out of n shares are superimposed, while fewer shares leak no information. A key strength of VC lies in its simplicity: reconstruction requires no cryptographic keys or complex computation, relying solely on human visual perception.

Despite these advantages, classical visual cryptography schemes exhibit a monotonic reconstruction behavior, meaning that the visual quality of the reconstructed image improves as more shares are combined. While this property is appropriate for secret sharing, it is unsuitable for authentication scenarios, where visual information must be revealed only under strictly controlled conditions.

To overcome this limitation, XOR-based visual cryptography replaces the logical OR operation with XOR, enabling more flexible access structures. In particular, XOR-based schemes allow the design of non-monotonic reconstruction behaviors, where adding more shares does not necessarily improve visual quality. Such behavior is especially attractive for authentication purposes.

In contrast to classical threshold visual cryptography, where basis matrices are designed to guarantee reconstruction whenever a threshold number of shares is reached, the enhanced XOR-based framework considered in this work aims to control the visual behavior of arbitrary subsets of shares. More precisely, the basis matrices are constructed so that selected subsets produce a positive contrast difference, while other subsets produce zero contrast. This allows the realization of non-monotonic access structures that cannot be obtained through conventional threshold-based constructions.

As a particular instance of this framework, we construct a four-share scheme in which each individual share is visually random, the XOR of exactly two shares produces a blurred image, the XOR of exactly three shares reveals a clear reconstruction of the secret image, and the XOR of all four shares again yields a blurred result.

3.2. Formal Model and Definitions

Let M be an $n\times m$ Boolean matrix, where each row corresponds to a visual share and each column represents a subpixel. For any subset $X\subseteq \{1,\dots ,n\}$, we denote by $M\left[X\right]$ the submatrix formed by the rows indexed by X. Let $M_X$ denote the Boolean vector obtained by applying the XOR operation to all rows of $M\left[X\right]$. The function $w\left(M_X\right)$ denotes the Hamming weight of $M_X$, i.e., the number of black subpixels.

In the visual cryptography framework, each pixel of the secret image is encoded using two $n\times m$ Boolean basis matrices:

$$S^0(\mathrm{white}\mathrm{pixel}),S^1(\mathrm{black}\mathrm{pixel}).$$

It is important to distinguish between the basis matrices and the visual shares. The matrices $S^0$ and $S^1$ define the encoding rules for white and black pixels, respectively. During the share generation process, columns from these basis matrices are distributed to produce the individual visual shares $S_1,S_2,S_3,$ and $S_4$ that are later used in the authentication protocol.

Definition 1

(Enhanced XOR-Based Visual Cryptography). An XOR-based visual cryptography scheme with four shares is said to be enhanced if its basis matrices $S^0$ and $S^1$ satisfy the following condition for every subset $X\subseteq \{1,2,3,4\}$: either (i) there exists a constant $\alpha >0$ such that

$$w\left(S_X^1\right)-w\left(S_X^0\right)\ge \alpha m,$$

where $w(·)$ denotes the Hamming weight, or (ii) the restricted submatrices $S^0\left[X\right]$ and $S^1\left[X\right]$ are identical up to a permutation of columns.

This definition generalizes the classical $(k,n)$-threshold model by allowing non-monotonic reconstruction behavior. In classical threshold visual cryptography, all subsets containing at least k shares are associated with a positive contrast difference, resulting in monotonic reconstruction. The enhanced framework removes this restriction and allows arbitrary visual behaviors to be specified directly through the basis matrices. This additional flexibility is particularly suitable for authentication-oriented applications, where visual information must be revealed only under precisely controlled conditions.

3.3. Practical Basis Matrix Construction

We now present a concrete construction of basis matrices that satisfies the enhanced XOR-based visual cryptography definition and realizes the intended non-monotonic reconstruction behavior.

Example

$$S^0=\left(\begin{array}{cccccc}1& 1& 1& 0& 0& 0\\ 1& 1& 0& 1& 0& 0\\ 1& 0& 1& 1& 0& 0\\ 0& 1& 1& 1& 0& 0\end{array}\right),S^1=\left(\begin{array}{cccccc}1& 0& 0& 0& 1& 1\\ 0& 1& 0& 0& 1& 1\\ 0& 0& 1& 0& 1& 1\\ 0& 0& 0& 1& 1& 1\end{array}\right).$$

From Table 1, we observe that for all unauthorized subsets (i.e., $\left|X\right|=1,2,$ or 4), the Hamming weights of $S_X^0$ and $S_X^1$ are identical. Consequently, the corresponding contrast difference is given by Equation (1):

$$w\left(S_X^1\right)-w\left(S_X^0\right)=0.$$

(1)

which implies zero contrast difference between white and black pixel encodings. Consequently, the corresponding XOR reconstructions are visually indistinguishable and reveal no perceptual information about the secret image.

Table 1. Hamming weights for the proposed construction.

$\left|\mathit{X}\right|$	$\mathit{w}\left({\mathit{S}}_{\mathit{X}}^0\right)$	$\mathit{w}\left({\mathit{S}}_{\mathit{X}}^1\right)$
1	3	3
2	2	2
3	1	5
4	4	4

In contrast, when $\left|X\right|=3$, the corresponding contrast difference is given by Equation (2):

$$w\left(S_X^1\right)-w\left(S_X^0\right)=5-1=4.$$

(2)

Equation (2) establishes a strictly positive contrast gap, ensuring that only three-share XOR combinations yield a clear and human-recognizable reconstruction of the secret image.

Importantly, the four-share combination ($\left|X\right|=4$) again produces zero contrast, confirming the non-monotonic reconstruction property: visual clarity emerges exclusively for the authorized three-share subsets, while all other combinations remain perceptually ambiguous.

3.4. Discussion

The analysis of Table 1 confirms that the proposed basis matrices satisfy the enhanced XOR-based visual cryptography definition. Authorized subsets ($\left|X\right|=3$) exhibit a strictly positive contrast gap, whereas unauthorized subsets ($\left|X\right|=1,2,4$) exhibit zero contrast. Consequently, visual clarity emerges exclusively for three-share combinations, establishing the desired non-monotonic reconstruction property. This behavior makes the construction particularly suitable for authentication, as successful verification occurs only for precisely defined share combinations.

4. Mutual Authentication Protocol

This section describes the proposed mutual authentication protocol built upon the enhanced XOR-based visual cryptography scheme introduced in Section 3. The protocol enables two parties to verify each other’s identity using visual reconstruction, while requiring only lightweight XOR operations and human visual perception. The scheme assumes a trusted authority for the initial generation and distribution of visual shares, and avoids the use of heavy cryptographic primitives such as public-key encryption or digital signatures during the authentication phase.

4.1. System Setup Phase

A trusted authority (TA) is responsible for initializing the system. The TA generates a secret binary image and constructs four visual shares $(S_1,S_2,S_3,S_4)$ using the basis matrices defined in Section 3.

In addition to the visual shares, the TA generates a secret seed K and securely distributes it to the communicating parties during the registration phase. User A receives $(S_1,S_2,K)$, while User B receives $(S_3,S_4,K)$.

The seed K is used to derive a synchronized sequence of session-dependent pseudorandom permutations. For each authentication session t, both participants independently generate the same permutation sequence from K and the session identifier t using a cryptographically secure pseudorandom generator, instantiated concretely in Section 5 (paragraph “Instantiating the Permutation Generator”). These permutations are subsequently applied to the basis matrices during the share reconstruction process, ensuring that each authentication session employs a distinct visual encoding while preserving the contrast properties of the underlying enhanced visual cryptography scheme.

After this initialization phase, the TA is no longer involved in the authentication process.

4.2. Authentication Phase

The mutual authentication between User A and User B is performed through a challenge–response mechanism based on XOR operations and session-dependent visual encoding.

For authentication session t, both participants derive the same pseudorandom permutation sequence from the shared secret seed K. Specifically, they compute a session seed $R_t=\mathrm{SHA}256\left(K\right|\left|t\right)$, where $\left|\right|$ denotes the concatenation operation and t is the session identifier. Thus, the session seed is obtained by applying the SHA-256 hash function to the concatenation of the secret seed K and the current session identifier t.

The value $R_t$ is then used to generate a deterministic sequence of column permutations ${\pi }_t^{\left(1\right)},{\pi }_t^{\left(2\right)},\dots ,{\pi }_t^{\left(N\right)}$, where N is the number of pixels in the secret image and ${\pi }_t^{\left(i\right)}$ is applied to the basis matrices used to encode the i-th pixel. The permutations are generated through a Fisher–Yates procedure initialized with $R_t$ (concretely, via an unbiased, rejection-sampled Fisher–Yates shuffle driven by a ChaCha20/AES-CTR keystream keyed with $R_t$, as detailed in Section 5). Since both participants possess the same secret seed K and use the same session identifier t, they obtain identical permutation sequences without additional communication.

Using these session-dependent permutations, both participants generate the corresponding shares $(S_1^{\left(t\right)},S_2^{\left(t\right)},S_3^{\left(t\right)},S_4^{\left(t\right)})$ and perform the following authentication procedure:

• User A computes $X_A^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}$ and sends $X_A^{\left(t\right)}$ to User B.
• Upon receiving $X_A^{\left(t\right)}$, User B computes $V_A^{\left(t\right)}=X_A^{\left(t\right)}\oplus S_3^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}\oplus S_3^{\left(t\right)}$ and visually inspects the reconstructed image.
• If the reconstructed image is visually clear and recognizable, User B accepts the identity of User A; otherwise, the authentication fails.
• User B computes $X_B^{\left(t\right)}=S_3^{\left(t\right)}\oplus S_4^{\left(t\right)}$ and sends $X_B^{\left(t\right)}$ to User A.
• User A computes $V_B^{\left(t\right)}=X_B^{\left(t\right)}\oplus S_1^{\left(t\right)}=S_3^{\left(t\right)}\oplus S_4^{\left(t\right)}\oplus S_1^{\left(t\right)}$ and performs visual verification.
• If the reconstructed image is visually clear and recognizable, User A accepts the identity of User B; otherwise, the authentication is rejected.

Because a distinct permutation sequence is used in each authentication session, the generated shares and transmitted authentication values are session-dependent. Consequently, messages captured during a previous session cannot be successfully reused in subsequent sessions, providing intrinsic replay-attack resistance while preserving the lightweight nature of the protocol.

This bidirectional verification ensures mutual authentication, as both parties independently confirm the legitimacy of the other.

4.3. Verification Procedure

The correctness of the protocol relies on both the non-monotonic reconstruction property of the proposed enhanced visual cryptography scheme and the session-dependent permutation mechanism. By construction, the XOR of exactly three valid shares generated using the current session permutation sequence produces a visually clear and recognizable image, whereas any combination involving fewer than three shares, more than three shares, or an incorrect permutation sequence results in a blurred and unintelligible reconstruction.

Consequently, successful authentication occurs only when the verifier combines a received value with its own share using the same session-dependent permutation sequence. In this case, the XOR operation produces the reconstruction associated with exactly three valid shares, allowing reliable visual verification.

If an adversary replays a message captured during a previous session, the message corresponds to a different permutation sequence and therefore fails to generate a valid reconstruction under the current session parameters. The resulting image remains visually unintelligible and the authentication attempt is rejected.

This verification process provides both human-verifiable identity confirmation and intrinsic protection against replay attacks while preserving the lightweight nature of the proposed protocol.

4.4. Formal Description

The complete mutual authentication procedure is summarized in Algorithm 1. In addition to XOR operations and visual verification, the protocol employs a session-dependent permutation mechanism derived from a shared secret seed. This ensures that each authentication session uses a distinct visual encoding while preserving the lightweight nature of the proposed scheme.

Algorithm 1 Mutual Authentication Protocol

1: Input: User A holds $S_1,S_2,K$; User B holds $S_3,S_4,K$   2: Input: Session identifier t   3: Output: Mutual authentication decision   4: Both users compute the session seed $R_t=\mathrm{SHA}256\left(K\right|\left|t\right)$   5: Both users generate the permutation sequence ${\pi }_t^{\left(1\right)},{\pi }_t^{\left(2\right)},\dots ,{\pi }_t^{\left(N\right)}$   6: Both users generate the session-dependent shares $S_1^{\left(t\right)},S_2^{\left(t\right)},S_3^{\left(t\right)},S_4^{\left(t\right)}$   7: User A computes $X_A^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}$ and sends $X_A^{\left(t\right)}$ to User B   8: User B computes $V_A^{\left(t\right)}=X_A^{\left(t\right)}\oplus S_3^{\left(t\right)}$   9: if $V_A^{\left(t\right)}$ is visually clear then 10:       User A is authenticated 11: else 12:       Abort protocol 13: end if 14: User B computes $X_B^{\left(t\right)}=S_3^{\left(t\right)}\oplus S_4^{\left(t\right)}$ and sends $X_B^{\left(t\right)}$ to User A 15: User A computes $V_B^{\left(t\right)}=X_B^{\left(t\right)}\oplus S_1^{\left(t\right)}$ 16: if $V_B^{\left(t\right)}$ is visually clear then 17:       User B is authenticated 18: else 19:       Abort protocol 20: end if 21: return Mutual authentication success

The execution flow of Algorithm 1 is further illustrated in Figure 1, which provides a high-level overview of the authentication process.

Figure 1. Flowchart illustrating the execution of the proposed mutual authentication protocol described in Algorithm 1.

4.5. Practical Deployment Considerations

In practical deployments, the visual shares $S_1,S_2,S_3,S_4$ and the secret seed K used to derive session-dependent permutation sequences must be securely generated, distributed, and stored by the participating entities. This process is performed during an initial enrollment phase handled by a trusted authority (TA) prior to the execution of the authentication protocol.

During the enrollment phase, the TA generates the visual shares from the secret image using the basis matrices described in Section 3. The TA also generates a secret seed K, which is securely distributed together with the corresponding shares. For instance, User A receives $(S_1,S_2,K)$, while User B receives $(S_3,S_4,K)$. Distribution is performed through an authenticated and protected initialization channel. In IoT, UAV, or cyber-physical environments, this process may occur during device manufacturing, secure provisioning, firmware installation, or a protected onboarding procedure.

Each participant locally stores its assigned shares and the secret seed within a protected storage environment. Standard protection mechanisms, such as secure storage modules, trusted execution environments, secure elements, firmware integrity verification, or hardware-assisted key protection, may be employed to prevent unauthorized extraction of stored information.

During authentication, the secret seed K is used to derive session-dependent pseudorandom permutation sequences. Consequently, authentication messages become session-specific and previously recorded messages cannot be reused successfully in subsequent sessions. This mechanism provides freshness guarantees without requiring timestamps, sequence numbers, public-key cryptography, or additional encrypted message exchanges.

In dynamic environments, periodic renewal of visual shares and the associated secret seed can be performed to limit long-term exposure. This renewal process consists of generating a new secret image, new visual shares, and a new secret seed, followed by secure distribution through an update phase managed by the trusted authority.

These considerations demonstrate that the proposed enhanced visual cryptography-based authentication mechanism can be integrated into existing provisioning and secure onboarding procedures while preserving its lightweight nature and providing resistance against replay attacks.

5. Security Analysis

5.1. Threat Model

We specify the adversarial model considered in the security analysis of the proposed mutual authentication protocol. The objective of the adversary is to impersonate a legitimate participant, replay previously observed authentication messages, or extract visually meaningful information about the protected secret.

We consider an active network adversary with full control over the communication channel. In particular, the adversary can observe, record, analyze, modify, inject, replay, delay, or block protocol messages. The adversary may also monitor multiple authentication sessions and attempt to correlate exchanged values across different executions in order to recover secret information or impersonate a legitimate participant.

The protocol assumes that the visual shares $\{S_1,S_2,S_3,S_4\}$ and the shared secret seed K remain confidential and are not accessible to the adversary. Legitimate participants are assumed to store these long-term secrets using secure storage mechanisms such as Secure Elements (SE), Trusted Platform Modules (TPM), Trusted Execution Environments (TEE), or equivalent hardware- or software-based protected storage.

Accordingly, physical device capture, insider compromise leading to the disclosure of stored secrets, and side-channel attacks capable of extracting protected information are considered implementation-level threats rather than protocol-level attacks. Such attacks are therefore outside the scope of the present work and are left for future investigation. Similarly, legitimate participants are assumed not to maliciously disclose their assigned visual shares or the shared secret seed during normal protocol execution.

The trusted authority responsible for generating and distributing the visual shares and the secret seed is assumed to be fully trusted during the enrollment and renewal phases. Consequently, the security of the proposed protocol relies on the confidentiality of the distributed shares and the secret seed, together with the unpredictability of the pseudorandom permutation sequences derived from K.

5.2. Security Assumptions

The security analysis relies on the following assumptions.

A1.

The visual shares $\{S_1,S_2,S_3,S_4\}$ remain confidential and are securely stored by legitimate participants throughout the protocol execution.

A2.

The shared secret seed K is known only to legitimate participants and is protected using the same secure storage mechanisms as the visual shares.

A3.

The pseudorandom permutation generator derived from K is computationally indistinguishable from a truly random permutation generator. A concrete instantiation of this generator and the corresponding cryptographic justification are given below.

A4.

The trusted authority securely generates and distributes the visual shares and the secret seed during the enrollment phase.

5.2.1. Instantiating the Permutation Generator

Assumption A3 is stated in terms of an abstract pseudorandom permutation generator so as not to tie the security argument to a single primitive; we now give a concrete instantiation and justify the assumption in terms of it. The session seed $R_t=\mathrm{SHA}256(K\parallel t)$ (Section 4) is used to key a stream-cipher-based deterministic random bit generator (DRBG): specifically, we instantiate the generator as ChaCha20 [26], keyed with the 256-bit value $R_t$ and a nonce derived from a public counter, equivalently AES-128 in CTR mode as standardized in NIST SP 800-90A [27]. For each pixel index $i\in \{1,\dots ,N\}$, successive keystream blocks drive a Fisher–Yates shuffle of the m basis-matrix columns, using rejection sampling (discarding out-of-range keystream values) so that the resulting permutation ${\pi }_t^{\left(i\right)}$ is exactly uniform over the symmetric group on m elements, free of modulo bias, conditioned on the keystream being uniform.

The computational-indistinguishability Assumption A3 therefore reduces to the standard cryptographic assumption that ChaCha20 (respectively, AES-CTR) is a secure pseudorandom generator, i.e., that no probabilistic polynomial-time distinguisher can distinguish its output keystream from a truly random bit string with non-negligible advantage. This is not an ad hoc assumption specific to the present protocol: it is the same assumption underlying the confidentiality of TLS 1.3 and countless other deployed systems, and both primitives have withstood over two decades of public cryptanalysis without a practical distinguishing attack. Under this assumption, and because a uniform keystream yields an exactly uniform Fisher–Yates output by construction, the session-dependent permutation sequence $\left\{{\pi }_t^{\left(i\right)}\right\}$ is computationally indistinguishable from a uniformly random permutation sequence, which is precisely Assumption A3. This grounds the abstract term ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ in Equation (10) in the concrete PRG-distinguishing advantage of an adversary against ChaCha20 or AES-CTR, rather than leaving it as an uninstantiated primitive.

5.2.2. Mitigating Trusted-Authority Compromise

The assumption that the TA is fully trusted and uncompromised (A4) is standard for enrollment-based authentication protocols and mirrors the role of the KDC in Kerberos or the CA in TLS. Nonetheless, a single trusted entity is a central point of failure, and we outline three concrete, complementary mitigations that can be layered onto the enrollment procedure of Section 4 without modifying the authentication phase itself.

Threshold enrollment. Rather than a single TA generating and holding the complete secret material $(S_1,S_2,S_3,S_4,K)$, generation can be distributed among n independent custodians using a $(\tau ,n)$-threshold secret-sharing scheme (e.g., Shamir’s 1979 secret-sharing scheme [28]) applied to K and to the random bit-strings used to instantiate the basis-matrix column assignments, so that reconstruction of the full secret material requires cooperation of at least $\tau$ custodians. No single custodian ever observes the complete secret, so this weakens Assumption A4 from “the TA is trusted” to the strictly weaker “fewer than $\tau$ of n custodians are compromised,” a standard threshold-cryptography guarantee.

Ephemeral, offline enrollment. The TA’s role is required only once, at enrollment (and, optionally, at periodic share renewal); it is never invoked during authentication (Section 4.2). It can therefore be instantiated as an air-gapped device that is powered on only for enrollment/renewal ceremonies, with all key material securely erased immediately afterward, sharply reducing the exposure window relative to an always-online authority.

Auditable enrollment. Enrollment events can be bound to a signed, timestamped, append-only enrollment log recording which shares and seeds were issued to which participants (without revealing their values). This does not prevent TA compromise, but it enables retrospective detection of unauthorized enrollment activity and limits its undetected impact.

These measures are defense-in-depth mechanisms external to the authentication protocol itself, which remains unchanged once enrollment has completed; they directly address, rather than merely restate, the single-point-of-trust concern associated with Assumption A4, and we reference them in the Limitations discussion (Section 8) accordingly.

Under these assumptions, the proposed protocol provides mutual authentication, confidentiality of the protected visual secret, and resistance against eavesdropping, impersonation, replay, man-in-the-middle, and brute-force attacks. Since each authentication session employs a distinct permutation sequence derived from the shared secret seed, previously recorded messages cannot be reused successfully, and intercepted authentication values reveal neither the secret image nor future session-dependent authentication information.

The considered adversarial model is consistent with the classical Dolev–Yao model, which assumes full control over the communication channel while long-term secrets remain securely stored. Accordingly, correct XOR-based visual reconstruction is possible only for entities that possess the required visual shares and the corresponding session-dependent permutation sequence.

Before presenting the detailed analysis of each attack scenario, Figure 2 provides an overview of the principal attacks considered in this work and summarizes the corresponding protection mechanisms implemented by the proposed protocol.

Figure 2. Overview of the attack-based security analysis, where dashed arrows denote potential attack vectors targeting the protocol, and solid arrows indicate the progression of protective steps and defense outcomes. The diagram summarizes the principal attack scenarios considered in the proposed mutual authentication protocol and the corresponding protection mechanisms discussed in this section.

5.3. Attack-Based Security Analysis

In this subsection, we analyze the security of the proposed mutual authentication protocol by evaluating its resistance to common attack scenarios under the threat model defined in Section 5.1. The analysis focuses on well-known attack classes, including eavesdropping, impersonation, replay, and man-in-the-middle attacks.

5.3.1. Eavesdropping Attack

We consider a passive adversary that can observe all messages exchanged during the execution of the mutual authentication protocol. In authentication session t, the transmitted values are $X_A^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}$ and $X_B^{\left(t\right)}=S_3^{\left(t\right)}\oplus S_4^{\left(t\right)}$, where the session-dependent shares are generated using permutation sequences derived from the shared secret seed K.

By construction of the proposed enhanced visual cryptography scheme, the XOR of any two shares produces a visually blurred pattern with no distinguishable structure. Consequently, the transmitted values $X_A^{\left(t\right)}$ and $X_B^{\left(t\right)}$ reveal no perceptually meaningful information about the protected secret image.

An adversary may also combine the intercepted authentication messages from the same session by computing $X_A^{\left(t\right)}\oplus X_B^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}\oplus S_3^{\left(t\right)}\oplus S_4^{\left(t\right)}$. However, owing to the non-monotonic reconstruction property of the proposed scheme, the XOR of all four shares also yields a visually blurred pattern and therefore does not reveal the secret image.

Observing multiple authentication sessions does not provide additional information. Since each session employs a distinct pseudorandom permutation sequence derived from the secret seed K, the exchanged authentication values are session-dependent and cannot be correlated to recover either the protected image or future authentication messages. Moreover, without knowledge of K, the adversary cannot derive the session-specific permutation sequences. This claim is stated here qualitatively for readability; Section 5.5 below gives a formal, hybrid-argument proof that a passive adversary observing any polynomial number of sessions gains only a negligible distinguishing advantage over observing independent uniform noise.

Therefore, intercepted authentication messages never provide the authorized three-share reconstruction required to reveal the secret image. Passive eavesdropping thus does not compromise the confidentiality of the proposed authentication protocol under the defined threat model.

5.3.2. Replay Attack

Consider an adversary that records a valid authentication message $X_A^{\left(t\right)}$ during session t and replays it during a subsequent session $t^{\prime }\ne t$. In session t, the transmitted authentication value is $X_A^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}$, where the shares are generated using the permutation sequence ${\mathsf{\Pi }}_t=\{{\pi }_t^{\left(1\right)},{\pi }_t^{\left(2\right)},\dots ,{\pi }_t^{\left(N\right)}\}$. During session $t^{\prime }$, the verifier computes $V_A^{\left(t^{\prime }\right)}=X_A^{\left(t\right)}\oplus S_3^{\left(t^{\prime }\right)}$.

Substituting $X_A^{\left(t\right)}$ yields Equation (3):

$$V_A^{\left(t^{\prime }\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}\oplus S_3^{\left(t^{\prime }\right)}.$$

(3)

For a valid authentication session, all participating shares are generated using the same permutation sequence. In contrast, the replayed reconstruction combines shares generated under two different permutation sequences, namely ${\mathsf{\Pi }}_t$ and ${\mathsf{\Pi }}_{t^{\prime }}$.

Let $A_0=001100$, $A_1=110000$, denote the XOR of the first two rows of the basis matrices $S_0$ and $S_1$, respectively. Let $r_0=101100$, $r_1=001011$ denote the corresponding third rows. The replayed reconstruction can be characterized by the contrast function defined in Equation (4):

$$\Delta \left(\tau \right)=w(A_1\oplus \tau \left(r_1\right))-w(A_0\oplus \tau \left(r_0\right)),$$

(4)

where $w(·)$ denotes the Hamming weight and $\tau ={\left({\pi }_t^{\left(i\right)}\right)}^{-1}{\pi }_{t^{\prime }}^{\left(i\right)}$ is the relative permutation between the two sessions. When $\tau =I$, corresponding to a legitimate authentication session, the construction of the basis matrices yields $\Delta \left(I\right)=4$, which is the positive contrast required for visual reconstruction.

For a replay attack, $\tau \ne I$. Since the session permutations are derived pseudorandomly from the secret seed K, the relative permutation $\tau$ can be regarded as uniformly distributed over the set of all column permutations. For every permutation producing a contrast value $+v$, there exists a corresponding permutation producing the contrast value $-v$. Consequently, the contrast distribution is symmetric around zero and satisfies $E[\Delta (\tau \left)\right]=0$.

To verify this property, all $6!=720$ possible relative permutations were exhaustively enumerated using MATLAB R2023b. The resulting contrast distribution is shown in Figure 3. The experiment yields $\mathrm{mean}(\Delta )=0$, ${\Delta }_{min}=-4$, ${\Delta }_{max}=4$. The histogram exhibits perfect symmetry around zero, confirming that positive and negative contrast contributions cancel each other when shares generated under different permutation sequences are combined.

Figure 3. Distribution of the replay contrast obtained by exhaustive enumeration of all $6!=720$ relative permutations. The distribution is symmetric around zero, with a mean contrast equal to zero, demonstrating that replayed reconstructions do not preserve the positive contrast required for successful visual authentication.

Therefore, replayed reconstructions do not preserve the positive contrast required for visual recognition and become visually indistinguishable from unauthorized subsets. Consequently, previously recorded authentication messages cannot be successfully reused in a different session.

The same reasoning applies to replayed values of $X_B^{\left(t\right)}$. Therefore, the proposed session-dependent permutation mechanism provides intrinsic replay-attack resistance without requiring timestamps, nonces, encrypted counters, or additional cryptographic exchanges.

5.3.3. Man-in-the-Middle Attack

We consider an active adversary that intercepts, modifies, substitutes, or injects protocol messages in an attempt to impersonate a legitimate participant.

During authentication session t, User A transmits $X_A^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}$, and the verifier reconstructs

$$V_A^{\left(t\right)}=X_A^{\left(t\right)}\oplus S_3^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}\oplus S_3^{\left(t\right)}.$$

(5)

Successful authentication is achieved only when the received message matches the unique session-dependent authentication value expected by the verifier.

Assume that the adversary modifies the transmitted message and forwards

$${\tilde{X}}_A^{\left(t\right)}=X_A^{\left(t\right)}\oplus \Delta ,$$

(6)

where $\Delta \ne 0$ is an arbitrary binary vector. The verifier then obtains

$${\tilde{V}}_A^{\left(t\right)}={\tilde{X}}_A^{\left(t\right)}\oplus S_3^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)}\oplus S_3^{\left(t\right)}\oplus \Delta .$$

Since $\Delta \ne 0$, the reconstructed value differs from the valid session-dependent authentication value. Consequently, a modified, substituted, or injected message is accepted only if it accidentally matches the unique authentication value expected by the verifier.

Let N denote the authentication message length. Since only one valid binary vector exists among the $2^N$ possible candidates, an adversary can succeed only by correctly guessing the unique authentication value expected for the current session.

Moreover, because the authentication value depends on the session-dependent permutation sequence derived from the shared secret seed K, an adversary without knowledge of K cannot predict the valid authentication value for the current session. Therefore, for any probabilistic polynomial-time adversary $\mathcal{A}$,

$$Pr\left[\mathcal{A}\mathrm{successfully}\mathrm{modifies},\mathrm{substitutes},\mathrm{or}\mathrm{injects}\mathrm{an}\mathrm{authentication}\mathrm{message}\right]\le 2^{-N}.$$

(7)

Hence, the proposed protocol provides resistance against man-in-the-middle attacks.

5.3.4. Brute-Force and Guessing Attacks

In a brute-force or guessing attack, an adversary attempts to generate a valid authentication message without possessing the required visual shares or the shared secret seed K.

Let N denote the authentication message length. Without knowledge of the legitimate shares or the session-dependent permutation sequence, a forged authentication message is simply a random binary vector $R=(r_1,r_2,\dots ,r_N)\in {\{0,1\}}^N.$

A successful forgery occurs only if R exactly matches the unique session-dependent authentication value expected by the verifier. Since only one valid binary vector exists among the $2^N$ possible candidates, the probability that a probabilistic polynomial-time adversary $\mathcal{A}$ successfully forges a valid authentication message satisfies

$$Pr\left[\mathcal{A}\mathrm{successfully}\mathrm{forges}\mathrm{a}\mathrm{valid}\mathrm{authentication}\mathrm{message}\right]\le 2^{-N}.$$

(8)

Since N is large for practical authentication messages, $2^{-N}$ is negligible, rendering exhaustive search computationally infeasible. Moreover, even after observing multiple authentication sessions, an adversary cannot predict future authentication values without deriving the session-dependent permutation sequence from the shared secret seed K.

Therefore, the proposed protocol provides resistance against brute-force and guessing attacks.

5.3.5. Summary

The preceding analysis demonstrates that the proposed protocol provides resistance against the adversarial behaviors considered in the defined threat model, including eavesdropping, replay, man-in-the-middle, and brute-force attacks. Its security is based on two complementary mechanisms: the non-monotonic reconstruction property of the enhanced XOR-based visual cryptography framework and the session-dependent permutation mechanism derived from the shared secret seed.

Together, these mechanisms ensure that authentication succeeds only when the authorized three-share reconstruction is performed using the correct session-dependent permutation sequence. Consequently, intercepted, modified, or replayed authentication messages do not enable successful authentication or reveal the protected visual secret.

Under the stated security assumptions, the proposed protocol provides a lightweight and efficient mutual authentication mechanism while preserving the computational simplicity of XOR-based visual cryptography.

5.4. Game-Based Authentication Security

To strengthen the formal security analysis, we model the mutual authentication property using a standard game-based experiment between a challenger $\mathcal{C}$ and a probabilistic polynomial-time adversary $\mathcal{A}$.

5.4.1. Authentication Experiment ${\mathrm{Exp}}_{\mathcal{A}}^{auth}$

1.

The challenger generates four valid visual shares $S_1,S_2,S_3,S_4$ according to the enhanced XOR-based visual cryptography scheme and generates a secret seed K used to derive session-dependent permutation sequences. User A receives $S_1,S_2,K$ and User B receives $S_3,S_4,K$.

2.

The adversary $\mathcal{A}$ is granted full control over the communication channel in accordance with the Dolev–Yao model and may observe, modify, inject, delay, block, and replay protocol messages.

3.

$\mathcal{A}$ may interact adaptively with honest participants and may observe polynomially many authentication sessions. For each session t, the honest parties derive a session-dependent permutation sequence from the secret seed K and execute the authentication protocol.

4.

The adversary is not given access to the visual shares $S_1,S_2,S_3,S_4$ or to the secret seed K.

5.

$\mathcal{A}$ wins the experiment if it causes an honest verifier to accept authentication in a session for which $\mathcal{A}$ does not possess the information required to generate a valid session-dependent three-share reconstruction.

5.4.2. Adversarial Advantage

The authentication advantage of the adversary $\mathcal{A}$ is defined by Equation (9):

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{auth}}=Pr\left[{\mathrm{Exp}}_{\mathcal{A}}^{\mathrm{auth}}=1\right].$$

(9)

that is, the probability that the adversary successfully causes an honest verifier to accept an authentication attempt without possessing the information required by the protocol.

Proposition 1.

Consider the authentication experiment ${\mathrm{Exp}}_{\mathcal{A}}^{\mathrm{auth}}$ defined above. Under Assumptions A1–A4, every probabilistic polynomial-time adversary $\mathcal{A}$ satisfies

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{auth}}\le 2^{-N}+{\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}},$$

(10)

where N denotes the authentication message length and ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ denotes the adversary’s advantage in predicting or distinguishing the session-dependent permutation generator from an ideal random permutation generator.

Consequently, if the session-dependent permutation generator is computationally secure and the authentication message length is sufficiently large, then the authentication advantage of any probabilistic polynomial-time adversary is negligible.

Proof. 

Assume that the adversary $\mathcal{A}$ wins the authentication experiment ${\mathrm{Exp}}_{\mathcal{A}}^{\mathrm{auth}}$. By definition of the experiment, an honest verifier accepts an authentication attempt generated by $\mathcal{A}$ without possessing the information required by the protocol.

Successful authentication requires the verifier to reconstruct the valid session-dependent authentication value

$$V^{\left(t\right)}=S_i^{\left(t\right)}\oplus S_j^{\left(t\right)}\oplus S_k^{\left(t\right)},$$

(11)

where $S_i^{\left(t\right)}$, $S_j^{\left(t\right)}$, and $S_k^{\left(t\right)}$ are three legitimate shares generated using the same session-dependent permutation sequence.

Under Assumptions A1 and A2, the adversary does not possess either the required visual shares or the secret seed K. Therefore, a successful authentication forgery can occur only if one of the following events occurs:

$E_1$:

the adversary correctly guesses the valid session-dependent authentication message;

$E_2$:

the adversary predicts the session-dependent permutation sequence derived from the secret seed K.

Long-term secret compromise is excluded by Assumptions A1–A4 and is therefore outside the security experiment.

The probability of event $E_1$ is bounded by

$$Pr\left[E_1\right]\le 2^{-N},$$

(12)

where N denotes the authentication message length.

By Assumption A3, the probability of event $E_2$ satisfies

$$Pr\left[E_2\right]\le {\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}},$$

(13)

where ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ denotes the adversary’s advantage in predicting the session-dependent permutation generator.

Since the adversary succeeds only if either $E_1$ or $E_2$ occurs, the union bound gives

$$Pr[E_1\cup E_2]\le Pr\left[E_1\right]+Pr\left[E_2\right].$$

(14)

Therefore,

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{auth}}\le 2^{-N}+{\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}},$$

(15)

which proves Equation (10).

Finally, if the session-dependent permutation generator is computationally secure, then ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ is negligible. Consequently, for sufficiently large authentication message lengths, the term $2^{-N}$ is also negligible. Therefore, the authentication advantage of any probabilistic polynomial-time adversary is negligible, thereby completing the proof.    □

5.4.3. Share Compromise Analysis

The security of the proposed protocol relies on the confidentiality of both the visual shares and the secret seed K, which are assumed to be stored using protected storage mechanisms such as Secure Elements (SE), Trusted Execution Environments (TEE), Trusted Platform Modules (TPM), or equivalent secure storage technologies.

If an adversary compromises fewer than three valid visual shares and does not obtain the secret seed K, successful authentication remains infeasible. Indeed, unauthorized share combinations satisfy the zero-contrast property of the enhanced visual cryptography scheme and therefore do not produce a recognizable reconstruction. Moreover, without knowledge of K, the adversary cannot derive the session-dependent permutation sequences required to generate valid authentication messages.

Similarly, if the adversary compromises the secret seed K but does not obtain a sufficient number of valid visual shares, authentication also remains infeasible since the visual reconstruction process still requires the appropriate share combination.

Conversely, if an adversary compromises three valid visual shares together with the secret seed K, authentication can be forged because the adversary possesses all information required to reconstruct the valid session-dependent authentication values expected by the verifier. This scenario corresponds to a complete compromise of the long-term secret material.

Insider attacks in which a legitimate participant intentionally discloses its assigned visual shares or the shared secret seed are equivalent to long-term secret compromise and are therefore outside the security guarantees provided by the protocol. Likewise, physical device capture or side-channel attacks capable of extracting protected shares or the secret seed are implementation-level attacks that target the underlying secure storage mechanisms rather than the authentication protocol itself.

Consequently, the proposed protocol assumes that appropriate secure storage mechanisms effectively protect the visual shares and the shared secret seed during normal operation. Under this assumption, the protocol remains secure against network-based adversaries considered in the defined threat model.

5.5. Multi-Session Indistinguishability

Section 5.3 argues qualitatively that observing multiple authentication sessions gives a passive eavesdropper no additional advantage. We now formalize this claim via a standard hybrid argument, showing that the transcript of any polynomial number of sessions is computationally indistinguishable from independent uniform noise, up to the same permutation-distinguishing advantage that already appears in Equation (10).

Multi-Session Indistinguishability Experiment

Let $q=q\left(\lambda \right)$ be an arbitrary polynomial in the security parameter $\lambda$ that governs the length of K, and let m denote the number of subpixels per encoded pixel (Section 3). Define two experiments between a challenger $\mathcal{C}$ and an adversary $\mathcal{A}$:

${\mathrm{Real}}_q$:

$\mathcal{C}$ runs enrollment once with a uniformly random seed K, honestly executes q authentication sessions with distinct identifiers $t_1,\dots ,t_q$, and returns the transcript $\mathcal{T}={\left\{(X_A^{\left(t_i\right)},X_B^{\left(t_i\right)})\right\}}_{i=1}^q$ to $\mathcal{A}$.

${\mathrm{Ideal}}_q$:

$\mathcal{C}$ returns q independently and uniformly sampled pairs $({\widehat{X}}_A^{\left(i\right)},{\widehat{X}}_B^{\left(i\right)})\in {\{0,1\}}^{Nm}\times {\{0,1\}}^{Nm}$, generated without reference to any secret image, share, or seed.

The adversary’s multi-session distinguishing advantage is

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{ms}}\left(q\right)=\left|Pr[\mathcal{A}\left({\mathrm{Real}}_q\right)=1]-Pr[\mathcal{A}\left({\mathrm{Ideal}}_q\right)=1]\right|.$$

Proposition 2.

Under Assumption A3, for every probabilistic polynomial-time adversary $\mathcal{A}$ and every polynomial q,

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{ms}}\left(q\right)\le q·{\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}},$$

(16)

where ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ is the single-session permutation-distinguishing advantage of Equation (10). In particular, since q is polynomial in λ and ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ is negligible in λ under Assumption A3 (instantiated concretely as in the paragraph “Instantiating the Permutation Generator”), ${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{ms}}\left(q\right)$ is negligible in λ.

Proof. 

We use a standard hybrid argument over the q sessions. For $0\le j\le q$, define hybrid experiment $H_j$ as returning the true, honestly generated transcript for sessions $t_1,\dots ,t_j$ and independently uniform pairs for sessions $t_{j+1},\dots ,t_q$. By construction, $H_0={\mathrm{Ideal}}_q$ and $H_q={\mathrm{Real}}_q$, so

$${\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{ms}}\left(q\right)=\left|Pr[\mathcal{A}\left(H_q\right)=1]-Pr[\mathcal{A}\left(H_0\right)=1]\right|\le {\displaystyle \sum _{j=1}^q}\left|Pr[\mathcal{A}\left(H_j\right)=1]-Pr[\mathcal{A}\left(H_{j-1}\right)=1]\right|.$$

(17)

Consider consecutive hybrids $H_{j-1}$ and $H_j$, which differ only in whether session $t_j$’s pair $(X_A^{\left(t_j\right)},X_B^{\left(t_j\right)})=(S_1^{\left(t_j\right)}\oplus S_2^{\left(t_j\right)},S_3^{\left(t_j\right)}\oplus S_4^{\left(t_j\right)})$ is generated using the true session permutation ${\pi }_{t_j}$ derived from K, or replaced by an independent uniform pair. Suppose the permutation sequence ${\left\{{\pi }_{t_j}^{\left(i\right)}\right\}}_{i=1}^N$ used in session $t_j$ were a truly uniformly random permutation sequence, independent of the permutations used in all other sessions (this holds unconditionally if ${\left\{R_t\right\}}_t$ are modeled as independent uniform strings, as is standard when SHA-256 is modeled as a random oracle applied to distinct inputs $K\parallel t_j$). Then, by the zero-contrast property of Equation (1) applied to the two-share subsets $\{1,2\}$ and $\{3,4\}$ (each of which is an unauthorized subset under the enhanced XOR-based visual cryptography definition of Section 3), $X_A^{\left(t_j\right)}$ and $X_B^{\left(t_j\right)}$ are each exactly uniformly distributed over ${\{0,1\}}^{Nm}$, independent of the secret image and of all other sessions. Under this idealized substitution, $H_{j-1}$ and $H_j$ are therefore identically distributed.

Any residual, non-zero distinguishing advantage between $H_{j-1}$ and $H_j$ can consequently arise only from $\mathcal{A}$’s ability to distinguish the actual session-$t_j$ permutation sequence, derived pseudorandomly from K, from a truly uniform permutation sequence. This is precisely the event bounded by Assumption A3: any distinguisher between $H_{j-1}$ and $H_j$ can be converted, by a straightforward black-box reduction, into a distinguisher for the permutation generator of Assumption A3 with the same advantage, by using the challenge permutation sequence to generate session $t_j$’s shares and forwarding $\mathcal{A}$’s output. Hence $\left|Pr[\mathcal{A}\left(H_j\right)=1]-Pr[\mathcal{A}\left(H_{j-1}\right)=1]\right|\le {\mathrm{Adv}}_{\mathcal{A}}^{\mathrm{perm}}$ for every j. Substituting into Equation (17) yields Equation (16), completing the proof.    □

Proposition 2 formalizes the intuition given in Section 5.3: because each session’s transmitted values are computationally indistinguishable from independent uniform strings, correlating transcripts across any polynomial number q of sessions cannot help the adversary recover the secret image or predict future session values, beyond the (negligible, by A3) q-fold permutation-distinguishing advantage. The same argument covers the combined value $X_A^{\left(t\right)}\oplus X_B^{\left(t\right)}$ considered in the Eavesdropping Attack paragraph above, since it is a deterministic function of the (indistinguishable-from-random) session transcript and therefore inherits the same bound.

5.6. Storage and Communication Overhead

The proposed authentication protocol requires each legitimate participant to locally store two visual shares together with the shared secret seed K. No public-key certificates, encrypted counters, timestamps, or additional authentication tokens are maintained during normal protocol execution.

During an authentication session, User A transmits the authentication message $X_A^{\left(t\right)}=S_1^{\left(t\right)}\oplus S_2^{\left(t\right)},$ while User B similarly transmits $X_B^{\left(t\right)}=S_3^{\left(t\right)}\oplus S_4^{\left(t\right)}.$ Therefore, the communication cost consists of transmitting one share-sized binary image in each direction, resulting in a total communication overhead of two share-sized messages per authentication session.

Although visual shares are larger than conventional cryptographic credentials, the protocol compensates for this increased message size by avoiding computationally expensive cryptographic operations during the authentication phase. In particular, no public-key encryption, digital signature, certificate verification, timestamp validation, or encrypted counter synchronization is required. Authentication is performed using only XOR operations and visual reconstruction, leading to very low computational complexity.

The practical communication cost has already been experimentally evaluated in our previous implementation of the proposed framework [25]. Using a Raspberry Pi and a Samsung Galaxy A12 connected via Bluetooth, the average transmission time of one visual share was approximately $0.4$ s, while the average end-to-end authentication time, including Bluetooth connection establishment and image display, was approximately $0.9$ s. These experimental results demonstrate that the communication overhead introduced by transmitting visual shares remains practical for IoT authentication scenarios.

6. Experimental Evaluation

This section experimentally validates the proposed enhanced XOR-based visual cryptography scheme through qualitative and quantitative analyses of its non-monotonic reconstruction behavior.

6.1. Qualitative Visual Evaluation

We first present qualitative reconstruction results illustrating the non-monotonic behavior of the proposed scheme.

Figure 4 shows a representative binary secret image used in the experiments. In addition to this example, we conducted experiments on multiple binary images with varying structural complexity, including geometric patterns, alphanumeric symbols, and dense shapes. Across all tested images, the reconstruction behavior remained consistent.

Figure 4. Representative binary secret image used for evaluation.

Figure 5 illustrates the visual reconstructions obtained from different XOR combinations of shares. Combinations involving one, two, or all four shares produce blurred and visually ambiguous outputs that do not reveal meaningful information. In contrast, combining exactly three shares clearly exposes the structure of the secret image, making it easily recognizable by a human observer.

Figure 5. Visual reconstruction results using the proposed scheme. From left to right and top to bottom: individual share, XOR of two shares, XOR of exactly three shares, and XOR of all four shares. Only the three-share combination yields a visually clear reconstruction, illustrating the non-monotonic behavior of the scheme.

Across all tested images, visually meaningful information emerges exclusively when exactly three shares are combined, while all other combinations remain ambiguous. This confirms that the non-monotonic reconstruction property is independent of image complexity.

6.2. Quantitative Perceptual Evaluation

To complement the qualitative observations, we employ quantitative image quality metrics to assess the perceptual difference between valid and invalid reconstructions.

Implementation Details

All experiments were conducted using MATLAB R2023b simulations on binary images of size $256\times 256$. Each pixel was encoded using the $3\times 3$ basis matrices described in Section 3, resulting in a fixed pixel expansion of $3\times 3$ (i.e., 9 subpixels per pixel). Shares were generated deterministically according to the corresponding basis matrices, and XOR operations were implemented using bitwise computations.

Reconstructed images $\widehat{I}$ were obtained by XORing one, two, three, and four shares, respectively. Prior to computing the quantitative metrics, the reconstructed images were downsampled to the original resolution using a block-wise reduction over each $3\times 3$ group of subpixels. Each block was mapped to a single pixel using a Hamming-weight-based decision rule, ensuring consistency with the decoding mechanism of the proposed visual cryptography scheme.

To evaluate perceptual similarity, we compute the Peak Signal-to-Noise Ratio (PSNR), the Structural Similarity Index Measure (SSIM), and the Shannon entropy, summarized for each reconstruction type in Table 2. The PSNR is defined by Equation (18):

$$\mathrm{PSNR}(I,\widehat{I})=10{log}_{10}\left({\displaystyle \frac{MA{X}_I^2}{\mathrm{MSE}(I,\widehat{I})}}\right).$$

(18)

where $MA{X}_I$ denotes the maximum pixel value and $\mathrm{MSE}(I,\widehat{I})$ is the mean squared error. An infinite PSNR value indicates perfect reconstruction, i.e., zero error between the reconstructed and original images.

Table 2. Quantitative perceptual metrics for reconstructed images.

Reconstruction	PSNR (dB)	SSIM	Entropy
1 share	2.6874	0.4071	0.0000
2 shares	2.6874	0.4071	0.0000
3 shares (valid)	∞	1.0000	0.9957
4 shares	2.6874	0.4071	0.0000

All reported values are obtained from MATLAB-based simulations using the actual reconstructed images. The results demonstrate a clear quantitative distinction between valid and invalid reconstructions. In particular, three-share combinations achieve perfect reconstruction, as reflected by an infinite PSNR and an SSIM value of 1, along with high entropy, indicating a balanced and information-rich structure.

In contrast, unauthorized combinations (one, two, or four shares) collapse to uniform images with zero entropy, indicating a complete loss of informational content. The similarity of the metric values across these cases reflects the enforced annihilation property of the proposed scheme, whereby invalid XOR combinations produce structurally identical constant outputs.

6.3. Robustness to Noise Perturbation

To evaluate the robustness of the proposed authentication scheme under imperfect transmission and display conditions, and to support the practical-deployment claim with more than a single operating point, we performed a progressive bit-flip noise-injection experiment. Random noise affecting a fraction p of the pixels of one transmitted visual share ($S_1$) was introduced before the reconstruction process, at $p=1\%,5\%,10\%,20\%,30\%,$ and $50\%$. Reconstruction was performed by XORing the noisy share with the two remaining valid shares and applying the Hamming-weight threshold $\theta =3$ (Section 6.2) with the basis matrices $S_0,S_1$ of Section 3.3, on the same evaluation image used throughout Section 6 (Figure 4). At each level we report the false-reject rate (FRR, the fraction of foreground pixels incorrectly decoded as background), the false-accept rate (FAR, the fraction of background pixels incorrectly decoded as foreground), the overall pixel error rate, PSNR, and SSIM (Table 3).

Table 3. FRR, FAR, overall pixel error rate, PSNR, and SSIM as a function of bit-flip noise level p.

p	FRR	FAR	Pixel Error Rate	PSNR (dB)	SSIM
1%	0.00%	0.27%	0.12%	29.06	0.949
5%	0.09%	5.41%	2.54%	15.95	0.623
10%	0.58%	17.24%	8.24%	10.84	0.460
20%	2.66%	43.69%	21.52%	6.67	0.194
30%	5.25%	65.50%	32.94%	4.82	0.083
50%	8.95%	90.91%	46.62%	3.31	0.010

The two error types grow at markedly different rates. FRR stays low throughout the tested range—under $1\%$ for $p\le 10\%$ and only $8.95\%$ even at the extreme $p=50\%$ level—because a foreground pixel is decoded correctly as long as the XOR of the three valid shares still reaches the weight-3 threshold, which tolerates a moderate number of flipped bits in a single share. FAR grows far faster: from $0.27\%$ at $p=1\%$ to $17.24\%$ at $p=10\%$, $43.69\%$ at $p=20\%$, and $90.91\%$ at $p=50\%$. This asymmetry has a direct practical reading: under increasing acquisition noise (camera/display capture, print-scan, compression), the scheme degrades primarily by admitting spurious background detail as foreground, well before it starts rejecting genuine foreground content. Overall pixel error rate and the PSNR/SSIM fidelity measures track the same trend, falling from PSNR $29.06$ dB/SSIM $0.949$ at $p=1\%$ to PSNR $3.31$ dB/SSIM $0.010$ at $p=50\%$. Representative noisy shares and their XOR reconstructions at each tested noise level are shown in Figure 6.

Figure 6. Noisy share $S_1$ (top row) and XOR reconstruction (bottom row) at $p=1,5,10,20,30,50\%$. At every noise level, the individual noisy share remains visually meaningless and does not reveal any information about the protected secret. The reconstructed image remains clearly recognizable through $p=10$–$20\%$, is visibly degraded but still discernible at $p=30\%$, and collapses to noise at $p=50\%$.

The corresponding FAR/FRR trends, PSNR/SSIM fidelity measures, and overall pixel error rate are plotted in Figure 7.

Figure 7. (a) FAR and FRR, (b) PSNR and SSIM as a function of bit-flip noise level p, and (c) overall pixel error rate

For deployment, this indicates a graceful-degradation profile rather than an abrupt failure: at low-to-moderate noise ($p\le 10\%$, representative of typical display/camera capture conditions), both error rates remain small (FRR $\le 0.58\%$, FAR $\le 17.24\%$) and the reconstruction stays visually reliable (SSIM $\ge 0.46$). Beyond $p\approx 20$–$30\%$, FAR rises sharply enough that the scheme should not be relied upon without additional error-correction or a stricter acceptance threshold; at $p=50\%$ the reconstruction is effectively unusable. At the same time, unauthorized share combinations continue to produce visually meaningless outputs at every tested noise level, thereby preserving the security properties of the proposed non-monotonic reconstruction scheme.

6.4. Computational Complexity

Let the image size be $m\times n$. Each XOR operation is performed pixel-wise, resulting in a time complexity of $O\left(mn\right)$. The authentication protocol requires only a constant number of XOR operations per session. Therefore, the overall computational complexity remains linear in the image size. The proposed scheme is thus well suited for lightweight and resource-constrained environments, as it relies exclusively on simple bitwise operations without requiring complex cryptographic primitives.

7. Benchmark and Comparative Analysis

This section presents a benchmark and comparative analysis of the proposed XOR-based visual cryptography authentication scheme against representative state-of-the-art approaches. The comparison focuses on computational complexity, reliance on cryptographic mechanisms, infrastructure requirements, and suitability for resource-constrained and human-centric environments.

7.1. Benchmarking Criteria

The evaluation is conducted using criteria commonly adopted in the mutual authentication literature, including the underlying authentication mechanism, dependence on cryptographic primitives, key management requirements, infrastructure or hardware dependencies, and overall suitability for lightweight environments [1,2,3,6].

7.2. Cryptography-Based Mutual Authentication Schemes

Most existing mutual authentication protocols rely on conventional cryptographic primitives such as symmetric encryption, hash functions, and elliptic curve cryptography (ECC). For example, Ma et al. proposed a smart home authentication scheme based on signature updates and gateway-assisted verification [1], while Jan et al. introduced a hybrid AIoMT authentication framework combining AES and message authentication codes (MAC) [2].

ECC-based schemes are widely used in smart grid and healthcare systems to achieve mutual authentication and key agreement [13,14]. Although these approaches provide security guarantees, they incur non-negligible computational and communication overhead, which may limit their applicability in constrained environments.

Lightweight cryptographic solutions have been proposed to reduce these costs, such as hash-and-XOR-based protocols for medical IoT systems [6,21]. However, these schemes still rely on secret credentials, password management, and cryptographic verification procedures.

In contrast, the proposed approach relies only on lightweight bitwise operations (XOR) combined with visual reconstruction, avoiding the need for encryption, digital signatures, or complex key exchange mechanisms.

7.3. Blockchain- and Hardware-Assisted Authentication

Blockchain-based authentication mechanisms have been introduced to enhance decentralization and trust management in IoT and UAV systems [17,18,19]. While these approaches improve traceability and security, they introduce additional overhead in terms of communication, latency, and storage.

Hardware-assisted authentication schemes, particularly those based on physically unclonable functions (PUFs) or cryptographic coprocessors, provide resistance against physical attacks [5,10]. However, they require specialized hardware components, increasing deployment cost and limiting scalability.

The proposed scheme avoids both blockchain infrastructure and specialized hardware requirements, relying instead on lightweight visual share storage and simple XOR operations, while assuming a trusted provisioning phase for share distribution.

7.4. Visual Cryptography and Emerging Authentication Paradigms

Visual cryptography, introduced by Naor and Shamir [15], enables secret reconstruction through human visual perception rather than computational decryption. Recent works have applied this concept to authentication and key distribution in IoT and cloud environments [7,8]. However, these approaches typically follow a monotonic reconstruction behavior, where image quality improves as more shares are combined.

The proposed scheme differs fundamentally by enforcing a non-monotonic XOR-based reconstruction property, in which visual clarity emerges only when an exact subset of shares is combined. This property prevents partial information leakage and enables precise control over the authentication condition.

More importantly, this design allows authentication to be interpreted as the successful reconstruction of a constrained XOR-based visual structure, rather than as a purely cryptographic verification process.

Emerging authentication paradigms based on zero-knowledge proofs and quantum cryptography provide theoretical guarantees [11,23]. However, these approaches require complex infrastructure and are not well suited for lightweight or human-centric applications.

7.5. Summary of Comparison

Table 4 and Table 5 summarize the main characteristics of the proposed authentication framework and compare it with representative authentication schemes. Unlike conventional protocols, which rely on symmetric-key cryptography, public-key cryptography, or hash-based verification, the proposed method performs authentication through XOR-based visual cryptographic reconstruction.

Table 4. Comparison with representative authentication protocols.

Feature	Kerberos	TLS	Proposed
Trusted Authority	KDC	CA	TA
Mutual Authentication	Yes	Yes	Yes
Freshness	Timestamp	Nonce	Permutations
Replay Protection	Yes	Yes	Yes
Primitive	Symmetric	Public-key	XOR-VC
Public-key Ops	No	Yes	No
Certificates	No	Yes	No
Human Verification	No	No	Yes
Computation	Enc.+MAC	ECC+Hash	XOR
Environment	Enterprise	Internet	IoT

Table 5. Comparison of representative authentication schemes in terms of computation, communication, and storage requirements.

Scheme	Dominant Computation	Communication	Stored Secrets
Cryptography-based IoT authentication [1,2]	AES + MAC + Hash	Encrypted messages	Symmetric keys
ECC-based authentication [13,14]	ECC scalar multiplication + Hash	Certificates	Private/Public keys
Lightweight hash-based authentication [6,21]	Hash evaluations	Hash values	Credentials
Blockchain-assisted authentication [17,18,19]	Digital signatures + Hash	Blockchain transactions	Wallet keys
Hardware-based authentication (PUF) [5,10]	PUF evaluation + Hash	Challenge–response	PUF challenge–response pairs
Visual cryptography authentication [7,8]	$O\left(mn\right)$ visual stacking	Image shares	Visual shares
Proposed XOR-VC authentication	$O\left(mn\right)$ XOR	2 share messages	2 visual shares + seed K

The comparison shows that the proposed protocol requires only pixel-wise XOR operations while preserving mutual authentication and replay resistance through session-dependent permutations. In addition, it incorporates human visual verification, a feature that is generally not provided by conventional authentication protocols.

The proposed scheme is not intended to replace established protocols such as Kerberos or TLS, which additionally provide secure key establishment and broader communication security services. Instead, it offers an alternative authentication mechanism for scenarios where lightweight computation and human-verifiable authentication are desired.

7.6. Computational, Communication, and Storage Cost Analysis

Table 5 compares the proposed protocol with representative authentication schemes in terms of computational, communication, and storage requirements.

The proposed scheme performs authentication using pixel-wise XOR operations, resulting in computational complexity of $O\left(mn\right)$ for an image of size $m\times n$. During each authentication session, only two image-share messages are exchanged, namely $X_A=S_1\oplus S_2$ and $X_B=S_3\oplus S_4$. Each participant stores two visual shares together with the secret seed K used to generate the session-dependent permutation sequences.

Compared with authentication schemes based on public-key cryptography, digital signatures, or blockchain operations, the proposed approach eliminates computationally intensive cryptographic primitives and requires only XOR operations. This reduction in computational complexity is achieved at the expense of storing visual shares, representing a different design trade-off that is appropriate for applications where lightweight computation and visual authentication are preferred.

7.7. Scalability and Applicability

The proposed authentication protocol is primarily intended for controlled environments in which a trusted authority can securely distribute visual shares during enrollment. Typical application domains include smart buildings, IoT access control, healthcare facilities, laboratories, and industrial environments.

From a computational perspective, the protocol scales efficiently since authentication requires only pixel-wise XOR operations with complexity $O\left(mn\right)$ for an image of size $m\times n$. The communication cost remains constant for each authentication session, consisting of two transmitted image-share messages. As the number of users increases, the primary scalability challenge lies in enrollment and secure share management rather than in the authentication process itself.

Accordingly, the proposed protocol is intended to complement existing authentication mechanisms in scenarios where lightweight computation and human visual verification are advantageous, rather than to replace general-purpose cryptographic authentication protocols.

8. Conclusions

This paper presented a novel mutual authentication approach based on an enhanced XOR-based visual cryptography scheme exhibiting a non-monotonic reconstruction behavior. By carefully designing the visual basis matrices, the proposed scheme ensures that individual shares remain fully unintelligible, while the XOR of two or four shares produces blurred outputs, and a clear reconstruction is obtained exclusively when exactly three shares are combined. This distinctive property enables precise and human-verifiable authentication under controlled conditions.

Building on this visual structure, we designed a lightweight challenge–response mutual authentication protocol that relies on simple XOR operations and human visual perception, while assuming a trusted provisioning phase for secure share distribution. The proposed approach avoids the use of computationally intensive cryptographic primitives such as encryption, signatures, or key exchange mechanisms, resulting in low computational overhead.

Security analysis under the defined adversarial model demonstrated that the protocol is resilient to eavesdropping, impersonation, and man-in-the-middle attacks, while replay attacks are addressed through the proposed session-dependent permutation mechanism. Experimental evaluation, including qualitative visual inspection and quantitative perceptual metrics, confirmed that only valid three-share combinations yield meaningful reconstructions, whereas all other combinations remain visually ambiguous.

• When Is This Trade-off Preferable to a Lightweight Hash-Based Scheme?

A natural question, given the storage and human-interaction costs of the proposed scheme, is under what conditions this trade-off is preferable to a comparably lightweight hash-based mutual authentication protocol (e.g., a hash-and-XOR or HMAC-based scheme such as [6,21]), which typically requires only tens of bytes of stored credential per party and no human involvement at all. We argue the proposed approach is the preferable choice specifically when (i) an autonomous, unattended verifier cannot, by policy or by design, be given sole authority to accept or reject an authentication attempt, and a human decision-maker is required or desired in the loop for accountability or oversight—e.g., physical access control to a restricted area, safety-critical actuation, or high-value transaction approval; (ii) the deployment specifically seeks to avoid any dependence on a general-purpose cryptographic hash or cipher implementation on the constrained endpoint, relying only on bitwise XOR and display hardware (a screen or printed badge) already present for other purposes; or (iii) reduced exposure to implementation-level side-channel leakage on the endpoint is desired, since long-term secret material (the visual shares) is combined only via XOR during authentication and never processed through a hash or cipher implementation on the device itself, narrowing the timing/power side-channel surface relative to hash-evaluation-based schemes. Conversely, when storage is constrained well below the size of an image share, when no human verifier is available or willing to participate, or when high-frequency, sub-second, fully unattended machine-to-machine authentication is required, a lightweight hash-based scheme remains the preferable choice. This clarifies the intended deployment niche of the proposed protocol relative to conventional lightweight alternatives, consistent with the applicability discussion of Section 7.7.

Limitations of the Study

Although the proposed protocol demonstrates the feasibility of mutual authentication using enhanced XOR-based visual cryptography, several limitations should be acknowledged. First, the protocol assumes the existence of a trusted authority responsible for securely generating and distributing the visual shares and the shared secret seed during enrollment; Section 5.2.2 discusses three concrete, complementary mitigations (threshold enrollment, ephemeral/offline operation, and auditable enrollment logging) that reduce, though do not eliminate, the impact of this assumption, and this remains an open avenue for future strengthening. Second, the security analysis assumes that long-term secrets are protected using appropriate secure-storage mechanisms, while implementation-level threats such as physical device capture, insider compromise, and side-channel attacks remain outside the scope of this work. Finally, in its default configuration, authentication relies on human visual perception to recognize the reconstructed image. As discussed in Section 6.2, the perceptual task presented to the verifier is deliberately made easy by construction—valid reconstructions are perceptually perfect and invalid ones are perceptually featureless (Table 2), rather than differing by degree—which is what makes this reliance defensible under normal viewing conditions. The residual dependency this creates is on the verifier’s own visual ability: users with significant visual impairment, or verification performed under extreme display or lighting conditions, could in principle still affect the accept/reject decision. This is not a limitation specific to the proposed scheme but one inherent to any authentication mechanism relying on human sensory judgment, including classical visual cryptography [15] and biometric authentication methods more broadly (e.g., fingerprint, iris, or face recognition), which similarly exhibit non-zero failure-to-enroll and failure-to-verify rates for certain user populations. The proposed protocol is therefore primarily intended for controlled deployment environments, such as IoT systems, smart buildings, healthcare infrastructures, and industrial facilities.

The proposed scheme demonstrates that authentication can be formulated as the reconstruction of a constrained XOR-based visual structure rather than solely as a cryptographic verification process. This formulation provides a lightweight and human-centric authentication mechanism that is particularly suitable for resource-constrained and visually interactive environments.

Future work will explore extensions to multi-party authentication, adaptive share assignment strategies, support for grayscale and color images, decentralized enrollment mechanisms, and practical deployment in real-world IoT and edge-computing systems.