{"id":"2ef3e1ce-d976-49c4-8e60-92e3392656c7","arxiv_id":"1908.02553","paper_version":3,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":6.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"A chosen-plaintext attack recovers the equivalent secret key of the MPPS medical image cipher using ceil(log_256(3MN))+4 chosen images, invalidating its security claims.","lead":"This paper breaks a published medical image encryption scheme that combines chaotic maps with DNA coding. It shows that a chosen-plaintext attack using only a few crafted images recovers the full equivalent secret key and that the scheme's other security claims do not hold up.","discovery_kind":"new_method","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Attack validity hinges on the unverified claim that the condensed description (footnote 2, Eqs. 10-12) preserves the original MPPS; if the original complements all channels, the S3 recovery step fails.","rationale":"The reader identified the same weakest assumption: the attack depends on the condensed description being security-equivalent to the original MPPS, and that equivalence is asserted in footnote 2 rather than proven. I agree this is the most load-bearing concern because every later step, especially S3 recovery in Eq. (25) and the exhaustive key-search in Algorithm 1, is stated in terms of the condensed scheme. If the original differs in the complement or diffusion structure, the algebraic properties in Sec. III-A may still be correct for the described variant, but they would not establish a chosen-plaintext break of [33]. Internal soundness of the described variant appears reasonable: the difference-propagation argument in Property 1 is algebraically correct for Eq. (13), Property 2 correctly encodes the behavior of the two-bit XOR under the 4-cycle map g, and the worked 2x2 example is consistent. However, no machine-checked proof or code is provided, and the final key-selection step is demonstrated on only one tiny image. The provided condition, confirming the condensed description against [33], would settle whether the attack applies to the actual published scheme. Since this is the same condition the reader imposed, the verdict remains conditional rather than accept or reject.","tokens_in":26148,"tokens_out":14659,"duration_ms":163760,"concrete_test":"Obtain [33] and implement the original MPPS directly from its published specification, then run the proposed attack on that implementation. Specifically verify whether Step (c) of Sec. II matches [33, Sec. III] exactly: is the DNA complement applied only to the red channel (Eq. (10)) and are the diffusion relations exactly as in Eq. (12)? If any step differs, re-derive the attack for the true scheme and test it on a nontrivial image size (e.g. 256x256) with several random keys; if the S3 recovery or candidate-key consistency fails, the central claim is not established for the published cipher.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The central claim is that MPPS is breakable by the proposed chosen-plaintext attack, but the attack is built on the condensed description in Sec. II, not on the original algorithm in [33]. Footnote 2 asserts that details and symbols were modified 'under the precondition its security performance is kept unchanged,' yet this equivalence is not demonstrated. The first and most load-bearing step of the attack, recovery of S3 via Eq. (25), relies specifically on Property 2 applied to the red channel and on the exact forms of the DNA complement (Eq. (10)) and DNA diffusion (Eq. (12)): the complement is applied only to R, and the diffusion is R**=R*, G**=G⊞R*, B**=B⊞G. If the published MPPS applies the complement to all three color channels, or if the diffusion uses G** instead of G in the blue channel, then Eq. (25) no longer determines S3 and Algorithm 1 does not apply to the real scheme. The paper provides no side-by-side mapping from [33] to its Sec. II and no code, so the faithfulness of the target description is the least secure link in the argument. The cross-channel pruning is also validated only on a 2x2 image, but that is secondary; if the described scheme is not the published one, the whole attack targets a variant rather than MPPS.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper presents a chosen-plaintext attack on MPPS, a medical privacy protection scheme based on chaos and DNA coding proposed by Ravichandran et al. in IEEE Transactions on Nanobioscience (2017). The authors first give a concise description of the scheme (Sec. II), then prove several properties of DNA coding maps (Sec. III-A), and use them to devise a divide-and-conquer attack that recovers an equivalent key (S1, S2/DNA rules, S3, S4, S5, S6) using at most ceil(log_256(3MN))+4 chosen plain-images and corresponding cipher-images (Sec. III-B). The attack is illustrated on a 2x2 RGB image (Sec. III-C), and the paper further criticizes the original scheme's claimed security properties such as key space, statistical resistance, differential attack resistance, and cropping robustness (Sec. III-D). The central claim is that MPPS is insecure under chosen-plaintext attack despite the designers' claims to the contrary.","tokens_in":26333,"tokens_out":7567,"duration_ms":80988,"significance":"If the attack is valid for the actually published MPPS, this is a significant cryptanalytic result: it would refute the designers' security claim and provide a concrete, low-complexity attack on a published medical image encryption scheme. The attack's internal mathematics is largely self-contained and checkable: no fitted parameters appear, secret quantities are cancelled via ciphertext differences, DNA rule candidates are enumerated, and the data-complexity bound follows from counting. The worked 2x2 example supports the attack end-to-end for the described variant, and the paper gives explicit algorithms (e.g., Algorithm 1) and properties (Properties 1-5). The main weaknesses are the unverified fidelity of the Sec. II description to the original MPPS and the lack of a proof that the final cross-channel pruning yields a unique or functionally equivalent key for general image sizes.","major_comments":[{"comment":"The paper's final claim that the whole equivalent key is recovered with ceil(log_256(3MN))+4 chosen plain-images is not fully supported by the presented analysis. After the cross-channel consistency check, the 2x2 example leaves 8x8x16 = 1024 candidate tuples (Sec. III-C, Table VI), and the manuscript does not prove that all remaining candidates are functionally equivalent nor does it give a deterministic procedure, within the stated chosen-image budget, to select the tuple that decrypts correctly. The example simply picks one tuple 'such as' without explaining why it is identifiable. If additional verification images are required or if some candidates are not functionally equivalent, the claimed data complexity is not established. The authors should either prove that any surviving candidate yields the same plaintext for all images, or add an explicit verification step (and count it in the complexity).","section":"Sec. II, footnote 2; Eqs. (10)-(12); Property 2 and Eq. (25)"}],"minor_comments":[{"comment":"In Table VII, the displayed S3 sequence contains a typographical double comma: '{0, 0, 1, 1, 1, 1,, 0, ...}'. Please fix.","section":"Sec. III-C, Table VII"},{"comment":"The word 'Hoverer' appears in the paragraph discussing Table VI; it should be 'However'.","section":"Sec. III-C, text after Eq. (28)"},{"comment":"The paper uses several visually similar superscript symbols for intermediate images (I*, I⋆, I⋆⋆, I**), and the 2D/1D indexing is sometimes implicit. A brief notation table or a more careful distinction between I⋆ (permuted) and I⋆⋆ (after DNA diffusion) would improve readability, especially in Sec. III-C where I∗∗ is introduced without a formal definition.","section":"Sec. II and III (notation)"},{"comment":"The ordering of 2-bit chunks in the worked example appears inconsistent with the LSB-first indexing implied by Eq. (9) and by l = 4i-4+n+1. The recovered S3 matches the true S3, so the attack is internally consistent, but the presentation should clarify the bit-ordering convention used when applying Eq. (25) to byte-wise differences.","section":"Sec. III-B1, Eq. (25) and Sec. III-C"}],"recommendation":"major_revision","confidential_remarks":"The paper is a competent cryptanalysis of the described variant, and the core attack idea is plausible. The key question for the editor is whether the authors can substantiate that the Sec. II description is faithful to the published MPPS; if they cannot, the paper should be re-scoped or rejected. The final-key-selection gap is also important but likely fixable by additional analysis. I recommend major revision rather than rejection because both issues are addressable within the manuscript's scope."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"Short version: the attack is correct for the scheme as described in Sec. II, and the paper is a solid contribution to image-cipher cryptanalysis. The DNA-rule equivalence properties are new, the exhaustive search steps are small and clearly explained, and the 2x2 example reproduces the claimed data complexity. If the description in Sec. II is faithful to the original MPPS, the attack retires that published scheme.\n\nThe main caveat is exactly the one in the stress-test note. Footnote 2 says the original description was modified to be more concise, with security unchanged, but no side-by-side mapping is given. The S3 recovery in Eq. (25) and the cross-channel equations in Sec. III-B2 depend on the complement being applied only to the red channel and on the exact diffusion wiring. If the original applies complement to all channels or uses a different diffusion, those equations may not hold. The authors need to show the original pseudocode, or explicitly state which parts were changed and why those changes preserve the attack-relevant structure.\n\nThe second, smaller gap is that the cross-channel intersection which selects the correct equivalent key is demonstrated on a 2x2 image and backed by an unspecified 'large number of experiments.' No code or data are provided. That uniqueness step is not proven for general image sizes. It is probably true, but the evidence is thin.\n\nThe rest of the paper—questioning the original scheme's key space, statistical tests, and so on—is standard and mostly sensible, though not deep.\n\nThis paper is for cryptanalysts working on chaos-DNA image ciphers and for anyone relying on the original MPPS. It deserves a serious referee. The referee should press on the fidelity to [33] and ask for more empirical support for the pruning step.","headline":"Competent chosen-plaintext break of a published DNA-chaos image cipher, but the attack's anchoring to the paper's simplified MPPS description is not proven.","tokens_in":26894,"tokens_out":11534,"would_cite":false,"duration_ms":103846,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":[],"pacs":[],"model":"deepseek-v4-flash","headline":"A chosen-plaintext attack recovers the full equivalent key of the MPPS medical image cipher using only ceil(log_256(3MN))+4 chosen plain-images.","keywords":["cryptanalysis","chosen-plaintext attack","DNA coding","chaotic cryptography","image encryption","equivalent key","medical privacy","DICOM"],"falsifier":"Implement the original MPPS algorithm exactly as published in reference [33] and run the proposed chosen-plaintext attack on images larger than 2 by 2 pixels; if the recovered equivalent keys fail to decrypt a fresh test image, or if the number of chosen images needed grows faster than the claimed bound, the central claim is refuted. A quick check is to compare Eq. (10) of this paper with the original source code to see whether the DNA complement acts on the red channel alone.","tokens_in":25889,"feed_emoji":"🔓","tokens_out":4247,"duration_ms":41913,"temperature":0.7,"pith_summary":"This paper establishes that MPPS, a chaos-and-DNA-coding image encryption scheme proposed for medical DICOM images, is insecure against chosen-plaintext attacks. The authors prove that an attacker who can choose a small number of plain images, specifically ceil(log_256(3MN))+4 of them, can recover the entire equivalent secret key. They achieve this by exploiting structural properties of DNA coding operations and by reducing the scheme to a permutation-only cipher once the diffusion layers are stripped away. The result directly contradicts the original designers' explicit claim that MPPS resists chosen-plaintext attacks.","feed_headline":"DNA-chaos medical image cipher broken by chosen plain-images","feed_subtitle":"Recovering the full key needs only ceil(log_256(3MN))+4 selected images, contradicting the original security claim.","key_machinery":"The key object is the pair of composite maps F_{s,t}(x) = $f_t^{{-1}}$(f_s(x)) and G_{s,t}(x) = $f_t^{{-1}}$(g(f_s(x))), where f_s and f_t are DNA encoding and decoding rules from Table I and g is the DNA-complement 4-cycle. Over the four 2-bit values these maps have only 8 and 16 distinct forms respectively, and Property 2 says that for x0 xor x1 = 3, F_{s,t}(x0) xor F_{s,t}(x1) = 3 but G_{s,t}(x0) xor G_{s,t}(x1) is in {1,2}. This direct differential signature turns the hidden binary sequence S3, which chooses between F and G for each 2-bit position, into a quantity readable from ciphertext XOR differences, after Property 1 removes the effects of the keystreams S4 through S6.","core_discovery":"The central discovery is that the combined effect of DNA encoding, DNA complement, and DNA decoding can be represented as a small family of maps, eight maps F_{s,t} and sixteen maps G_{s,t}, on the four 2-bit values, and that these maps satisfy a differential signature: when two input nibbles differ by (11)_2, applying F preserves the difference (11)_2 while applying G turns it into (10)_2 or (01)_2. This signature lets the attacker read off the binary sequence S3 directly from XOR differences between selected cipher-images, without knowing the DNA rules or the keystreams. Once S3 is known, exhaustive search over the few DNA rule combinations and consistency checks across four chosen plain-images recover the DNA coding rules and the keystreams; the remaining permutation index is then recovered by standard permutation-only cipher cryptanalysis. The whole equivalent key is recovered with only ceil(log_256(3MN))+4 chosen plain-images.","pith_inferences":["The same differential-signature technique could serve as a general litmus test for whether a DNA-coding layer in any chaos-based cipher actually changes the diffusion behavior; if the layer collapses to the F/G dichotomy on Z_4, the cipher is likely breakable in this way.","The count ceil(log_256(3MN))+4 is dominated by the permutation-recovery stage, so schemes that omit the permutation step or use grayscale images would require even fewer chosen plain-images.","The attack assumes the same key is reused across the chosen plain-images, a common situation in practice; if a hospital reuses a long-lived key, the attack becomes a realistic threat to intercepted DICOM transmissions."],"forward_implications":["The designers' claim that MPPS resists chosen-plaintext attacks is disproven, and the scheme cannot be considered secure for protecting medical images.","Any DNA-based image cipher with the same channel layout, complement applied only on the red channel and cross-channel diffusion, inherits the same break.","The effective key space of MPPS is far smaller than claimed because many distinct secret keys map to identical encryption behavior, as shown by the candidate equivalent sub-key classes.","The attack shows that DNA coding in this scheme contributes no meaningful security; it is equivalent to a handful of fixed S-boxes on 2-bit values, easily enumerated by an attacker."],"supporting_citations":[{"why":"Describes the original MPPS scheme that is the target of the cryptanalysis; all properties and attack steps are built against this scheme.","marker":"[33]"},{"why":"Supplies the method for recovering the permutation index S1 of a permutation-only cipher, used in the final stage of the attack.","marker":"[34]"},{"why":"Provides additional cryptanalytic techniques for image-scrambling algorithms that the authors rely on when solving the permutation part.","marker":"[35]"},{"why":"Underpins the paper's critique of using statistical tests as security evidence, questioning the designers' evaluation methodology.","marker":"[32]"},{"why":"Offers a counterexample to histogram-based security claims, which the authors use to dismiss the differential and statistical arguments in the original scheme.","marker":"[36]"}],"fun_headline_variants":["Chosen plaintext breaks chaos-DNA medical image cipher","Efficient key recovery in medical image chaos-DNA scheme","Medical DICOM encryption falls to chosen-plaintext attack","DNA-chaos cipher for DICOM images cracked with few pairs","Full key of chaos-DNA medical cipher recovered via chosen text"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The attack is derived from the paper's condensed description of MPPS, in which the DNA complement step is applied only to the red channel; if the original implementation applies complement to all three color channels or uses a different complement map, the differential signature in Property 2 would not hold and the recovery of S3 would fail.","fun_headline_variants_meta":{"raw":{"variants":["Chosen plaintext breaks chaos-DNA medical image cipher","Efficient key recovery in medical image chaos-DNA scheme","Medical DICOM encryption falls to chosen-plaintext attack","DNA-chaos cipher for DICOM images cracked with few pairs","Full key of chaos-DNA medical cipher recovered via chosen text"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.000242,"raw_usage":{"total_tokens":1536,"prompt_tokens":965,"completion_tokens":571,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":581,"completion_tokens_details":{"reasoning_tokens":488}},"tokens_in":581,"tokens_out":571,"duration_ms":6996,"temperature":1.0,"reasoning_tokens":488,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T14:42:09.191964+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Implement the original MPPS algorithm exactly as published in reference [33] and run the proposed chosen-plaintext attack on images larger than 2 by 2 pixels; if the recovered equivalent keys fail to decrypt a fresh test image, or if the number of chosen images needed grows faster than the claimed bound, the central claim is refuted. A quick check is to compare Eq. (10) of this paper with the original source code to see whether the DNA complement acts on the red channel alone.","supporting_citations":[{"cited_title":"DNA chaos blend to secure medical privacy,","cited_arxiv_id":null,"evidence_quote":"Describes the original MPPS scheme that is the target of the cryptanalysis; all properties and attack steps are built against this scheme."},{"cited_title":"Optimal quantitative cryptanalysis of permutation- only multimedia ciphers against plaintext attacks,","cited_arxiv_id":null,"evidence_quote":"Supplies the method for recovering the permutation index S1 of a permutation-only cipher, used in the final stage of the attack."},{"cited_title":"Cryptanalyzing an image-scrambling encryp- tion algorithm of pixel bits,","cited_arxiv_id":null,"evidence_quote":"Provides additional cryptanalytic techniques for image-scrambling algorithms that the authors rely on when solving the permutation part."},{"cited_title":"Cryptanalysis of a chaotic image encryption algorithm based on information entropy,","cited_arxiv_id":null,"evidence_quote":"Offers a counterexample to histogram-based security claims, which the authors use to dismiss the differential and statistical arguments in the original scheme."}],"review_version":1}