372 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO.

2, APRIL 2012
A Weak Security Notion for Visual
Secret Sharing Schemes
Mitsugu Iwamoto, Member, IEEE
AbstractWe propose a weak security notion for visual secret
sharing (VSS) schemes. Under such a weak security notion, VSS
schemes are designed to be secure against attackers eyesight,
but are not unconditionally secure, in general. In this paper, we
theoretically discuss the relation between unconditionally secure
(US) and weakly secure (WS) VSS schemes and present two
constructions of WS-VSS schemes for color images. We show that
WS-VSS schemes can achieve clearer color reproduced images
with a smaller pixel expansion compared to those using US-VSS
schemes, while we clarify that the basis matrices in both types of
VSS schemes for blackwhite binary images are the same. These
results suggest that the proposed VSS schemes can be regarded as
ramp (or nonperfect) VSS schemes for color secret images.
Index TermsRamp schemes, secret sharing schemes, visual
cryptography, visual secret sharing schemes, weak security.
I. INTRODUCTION
A
visual secret sharing (VSS) scheme [1] is one realization
of secret sharing schemes (see, for example, [2] and [3]).
In a typical VSS scheme, called a -threshold VSS scheme,
a dealer encodes a secret image into shares, each of which
reveals no information regarding the secret image. The secret
image can be reproduced by stacking arbitrary out of shares
in an arbitrary order. Hence, no computation is required in de-
cryption for VSS schemes, which distinguishes VSS schemes
from ordinary cryptography. In addition, unconditional security
is guaranteed in VSS schemes, which means that every color on
the secret image seems to be equiprobable (and hence, no infor-
mation is obtained) from or fewer shares no matter they
are investigated.
On the other hand, a drawback exists in VSS schemes. That
is, we must expand the original pixels on the secret images
in encryption, which makes lower level of contrast of the re-
produced images. Hence, many efforts have been devoted to
minimizing the pixel expansion and to maximize the contrast
of reproduced images, e.g., [1], [4], and [5]. As a result, tight
lower bounds for pixel expansion were derived for several VSS
schemes. However, we note that such attempts of minimization
Manuscript received June 28, 2011; revised September 25, 2011; accepted
September 26, 2011. Date of publication October 10, 2011; date of current ver-
sion March 08, 2012. This paper was presented in part at the International Sym-
posium on Information Theory and Its Applications (ISITA), 2008. This work
was supported in part by the MEXT Grant-in-Aid for Young Scientists (B) under
Grant 20760236 and Grant 23760330. The associate editor coordinating the re-
view of this manuscript and approving it for publication was Dr. Carlo Blundo.
The author is with the Center for Frontier Science and Engineering, the Uni-
versity of Electro-Communications, Chofu-shi, 182-8585 Tokyo, Japan (e-mail:
mitsugu@inf.uec.ac.jp).
Color versions of one or more of the gures in this paper are available online
at http://ieeexplore.ieee.org.
Digital Object Identier 10.1109/TIFS.2011.2170975
were discussed under the unconditional security notion. Hence,
a question arises naturally regarding whether or not the pixel
expansion can be made smaller if leaking some of the informa-
tion of the secret image is allowed. In ordinary secret sharing
schemes, ramp (or nonperfect) schemes were proposed in [6]
and [7]. In ramp schemes, shares can be shortened instead of al-
lowing some information of the secret to leak out.
Ramp schemes in VSS schemes were studied in [8], in which
a secret image is partially reproduced when the number of shares
is below the threshold. Unfortunately, however, this may some-
times make it easy to guess whole secret images from a partial
image since the secret is an image in VSS schemes. This fact
suggests that it is difcult to apply the original concept of ramp
schemes in secret sharing schemes directly to VSS schemes.
Hence, it is necessary to introduce another approach to extend
VSS schemes into ramp schemes.
The proposed idea comes from the fact that VSS schemes
need no computation in decryption. That is, it is possible to as-
sume in VSS schemes that we do not have (or it is a bother to
use) computers in decryption. In such a scenario, it may be dif-
cult to analyze every share exhaustively without computers, for
instance, we would not investigate combinations and/or statis-
tical data of pixels in shares. Based on this observation, we can
relax the unconditional security notion of -threshold VSS
schemes to a weaker notion in such a way that it is secure if the
image obtained by stacking or fewer shares seems to be
a random dot image. We say that such VSS schemes are weakly
secure VSS schemes, or simply WS-VSS schemes hereafter. On
the other hand, we abbreviate the unconditionally secure VSS
scheme as US-VSS schemes in this paper. We note here that,
in several previous studies on VSS schemes for blackwhite
binary secret images, e.g., [8] and [9], the weak security no-
tion discussed above was implicitly used in their constructions
of US-VSS schemes without sufcient security analyses. Hence,
it is important to discuss the security of WS-VSS schemes not
only in terms of minimizing the pixel expansion but also to eval-
uate the security of these previous studies in VSS schemes.
Motivated by the above background, we formally dene
a WS-VSS scheme and give its security analyses. We also
present two constructions of WS-VSS schemes. We clarify the
following two facts.
1) Basis matrices of WS-VSS schemes for blackwhite bi-
nary secret images are essentially the same as those for
US-VSS schemes. This fact implies that, in the case of
blackwhite binary secret images, security does not degen-
erate if we impose weak security on VSS schemes.
2) In the case of color secret images, a gap exists between
two security notions. That is, we can show an example of a
WS-VSS scheme for color images that reproduces clearer
1556-6013/$26.00 2011 IEEE
IWAMOTO: WEAK SECURITY NOTION FOR VISUAL SECRET SHARING SCHEMES 373
images with a smaller pixel expansion compared to that for
US-VSS scheme.
Fact 1) is theoretically interesting but is slightly pessimistic
since the proposed security notion does not improve the pixel
expansion of VSS schemes for blackwhite binary images.
However, it guarantees that previous studies, e.g., [8] and [9],
are proved to be unconditionally secure although the security
analyses were insufcient in these reports. Fact 2) is validated
by showing that WS-VSS schemes can attain a smaller pixel
expansion than the minimum pixel expansion for US-VSS
schemes. In addition, we can see in the Appendix that clearer
images are reproduced by WS-VSS schemes compared to
US-VSS schemes. In this paper, we show how to obtain the
minimum pixel expansion for US- and WS-VSS schemes
by solving integer programming (IP). Furthermore, since the
construction using IP is an NP-hard problem and troublesome,
we propose a construction for WS-VSS schemes based on an
algebraic method [10].
The rest of this paper is organized as follows. In Section II,
denitions of US-VSS schemes are reviewed and notations
are introduced. Then, the concept and formulation of WS-VSS
schemes are described, and the relation between US- and
WS-VSS schemes is discussed in Section III. To clarify the
gap between two security notions, we show in Section IV
constructions of US- and WS-VSS schemes based on IP, and
a comparison of both VSS schemes are discussed. Further-
more, an algebraic method [10] to construct the WS-VSS
schemes is explained in Section V. Finally, a variation of
WS-VSS schemes and several open problems are discussed
in Section VI. Examples of shares and recovered images are
provided in the Appendix.
II. PRELIMINARIES: DEFINITION OF UNCONDITIONALLY
SECURE VSS SCHEMES
In this section, we dene unconditionally secure
-threshold VSS schemes (hereafter referred to as
-US-VSS schemes). It is easy to extend the denition
of -US-VSS schemes to US-VSS schemes for general
access structures.
1
Let be a set of shares. The color
of each pixel is represented by a letter of sans-serif font. For
example, we use , , and to represent cyan, yellow, and green,
respectively. In particular, black and white are represented by
and , respectively, since the subtract mixture, denoted by ,
of black and white can be regarded as OR operations of
and . That is, mixtures of black and white are equivalent to the
relations such that and .
In addition, we can write , which means that the
mixture of cyan and yellow is green. Let and be sets of
colors on a secret image and shares, respectively. For example,
in VSS schemes for blackwhite binary images, we use
. Throughout the paper, we assume that and are
given.
1
General access structure consists of qualied (authorized) sets and for-
bidden (unauthorized) sets. A secret can be reproduced from a qualied set,
while no information can be obtained from each of the forbidden sets. See [10]
and [11] for details.
We rst overview how to encrypt secret images. To encrypt a
pixel with color into shares, we use pixels called sub-
pixels for each share. Parameter is called pixel expansion, and
it should be as small as possible from the viewpoint of the res-
olution of reproduced images. Formally, for a pixel with color
, we select matrix according to
the uniform distribution on set , where , ,
and denote the color of the th subpixel on the th
share. Normally, is generated by matrix , called a basis
matrix, by permuting all columns of .
Next, we introduce several notations corresponding to
stacking shares. Let us dene the operation of stacking two
pixels that consist of subpixels. For -dimensional vectors
2
, and where
, we dene operation as
(1)
which represents the subtract mixtures of two pixels with
subpixels. Then, for matrix ,
and arbitrary set , is dened
as , which implies the restriction
of pixels to pixels corresponding to share set . The colors
obtained by stacking the shares corresponding to share set can
be represented by the following map where
represents a cardinality of a set:
(2)
If consists of colors and , we recognize that
represents color .
To formulate security conditions, we introduce equivalence
relation into matrices in for convenience. For two ma-
trices , means that can be obtained by
the column permutation of . In other words, it holds that for
any permutation
(3)
where are -dimensional vectors in . It is easy to check
that this relation satises the three conditions of the equiva-
lence relation. Hence, the quotient set can be introduced with
respect to , which consists of equivalence classes, and each
equivalence class is represented as by a representative
in the class. For a concatenation of matrices denoted by , i.e.,
for and
, we can naturally dene .
Formally, when we encrypt color , set is generated
by basis matrix by letting , and we select a matrix
from according to the uniform distribution on .
Now, let be a share set satisfying , and suppose
that , i.e., is satised for
each . In this case, we cannot obtain any information
regarding the colors from share set , no matter how we inves-
tigate or fewer shares. Suppose that we observe matrix
which belongs to some . Then, the prob-
ability that belongs to is the same for every ,
and hence, no information of color can be obtained from .
2
In this paper, vectors are assumed to be row vectors and column vectors are
represented as where means the transpose of vectors or matrices.
374 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 2, APRIL 2012
To summarize, we can dene the unconditionally secure VSS
schemes given hereafter.
Denition 1 [10]: Let and be sets of colors for a secret
image and shares, respectively. We call a basis ma-
trix for of an unconditionally secure out of threshold
visual secret sharing scheme for and if satises the fol-
lowing conditions.
1) For any satisfying , it holds that
(4)
2) For any satisfying , are equiv-
alent for all , i.e., there exists an matrix
such that
for all (5)
In the following, we abbreviate an unconditionally se-
cure out of threshold visual secret sharing scheme as a
-US-VSS scheme.
Recall that (4) means that color on a secret image is repro-
duced by a set of subpixels that consists of and . That is, the
reproduced pixel is darker than the original pixel with color .
Hence, in condition 1) of Denition 1, we dene contrast of a
VSS scheme as
(6)
where denotes the number of in the right hand side
of (4). It is clear that large contrast is desirable to achieve good
quality in the reproduced images.
Example 2: Let and .
Then, the basis matrices of a -US-VSS scheme for
and are given by
(7)
It is easy to check that (7) satises conditions 1) and 2) of Def-
inition 1. In this example, pixel expansion , and contrast
. For the secret image presented in Fig. 1(a), examples
of shares and the reproduced image are provided in Figs. 2 and
5(a), respectively.
Remark 3: For blackwhite binary secret images, i.e.,
, it is sufcient to require the following condition
instead of condition 1) of Denition 1 [1].
) For any satisfying , it holds that
(8)
Fig. 1. Secret images: (a) Secret image 1 and (b) Secret image 2.
where denotes the Hamming weight of vector
.
The contrast in this case can be dened as
(9)
III. PROPOSAL OF WEAKLY SECURE VSS SCHEMES
In this section, we discuss how to relax security condition 2)
of Denition 1 in order to make clearer reproduced images with
smaller pixel expansion. Let us recall that condition 2) of De-
nition 1 claims that we cannot obtain any information regarding
the colors of the secret image, no matter how we investigate
or fewer shares. However, such a requirement is some-
times too strong since we may not use computers to investigate
shares of VSS schemes. Instead, it is sufcient to require that
the secret image cannot be recognized by human eyesight. In
other words, we assume that it is secure if the image obtained by
stacking or fewer shares seems to be a random dot image.
To formulate the above requirement, it is sufcient to replace
and in (5) with and vector , re-
spectively. Hence, we have a denition for weakly secure VSS
schemes as indicated in the following.
Denition 4: Let and be sets of colors of a secret image
and shares, respectively. We call a basis matrix
for of a weakly secure out of threshold visual secret
sharing scheme for and if satises condition below
in addition to the condition 1) in Denition 1.
) For any satisfying , are
equivalent for all . Formally, there exists an -dimen-
sional vector such that
(10)
IWAMOTO: WEAK SECURITY NOTION FOR VISUAL SECRET SHARING SCHEMES 375
Fig. 2. Three shares of (3,3)-US-VSS schemes: (a) Share 1, (b) Share 2, and
(c) Share 3.
In the following, we abbreviate a weakly secure out of
threshold visual secret sharing scheme as a -WS-VSS
scheme.
For share set satisfying , suppose that we ob-
serve matrix which belongs to some .
If (10) holds, it is easy to see that no information regarding
color can be obtained from stacked pixel since (10)
implies that are recognized as the same color. However,
we note that this condition does not guarantee unconditional se-
curity since, as is shown in the following example, we can de-
termine to which belongs with probability 1 under
weak security condition. Hence, condition can be insecure
for attackers who have sufcient computing power to analyze
combinations of subpixels exhaustively.
Example 5: The following matrices are the basis matrices for
the -WS-VSS scheme for and :
Fig. 3. Three shares of (3,3)-WS-VSS schemes: (a) Share 1, (b) Share 2, and
(c) Share 3.
(11)
For share set , it is easy to check that
, and are equiv-
alent to . Hence, if attackers observe vector
obtained by stacking the rst and second shares, it holds
that , and the probabilities that belongs to
and are always
. Therefore, as long as attackers only look at stacked
shares, they cannot tell color from which is
generated.
On the other hand, we consider the case where attackers
analyze the share set with sufcient computing power.
Let 2 5 matrix be observed pair of pixels corresponding
to the rst and second shares. Then, must belong to one
376 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 2, APRIL 2012
Fig. 4. Stacking two out of three shares of (3,3)-WS-VSS schemes: (a) Shares
1 and 2, (b) Shares 2 and 3, (c) Shares 3 and 1.
of , , and since ,
, and are not equivalent to each other.
Therefore, the attackers can tell with probability 1 which color
is reproduced from without the third share. In this way, they
can recover the secret image from arbitrary two shares. On the
contrary, it is impossible for them to tell colors on the secret
image from arbitrary one share.
In Fig. 3, we provide examples of three shares of
-WS-VSS schemes generated by (11). Note that, from
Fig. 4, we cannot recognize the secret image from two out of
three shares when they are stacked. Furthermore, comparing
(a) and (b) in Fig. 5,
3
the WS-VSS scheme using (11) achieves
clearer reproduced images of the US-VSS scheme based on
(7). Actually, in this example, the pixel expansion is 5, and
contrast is , which is better than the basis matrices for the
-US-VSS scheme given by (7).
3
Note that the share sizes of US- and WS-VSS schemes are not actually the
same since the pixel expansions of both schemes are different. However, in com-
paring the reproduced images, we adjust the shares of the WS-VSS schemes to
be the same share size as those for the US-VSS schemes.
Fig. 5. Reproduced images of (3,3)-US/WS-VSS schemes: (a) US-VSS
scheme and (b) WS-VSS scheme.
It is clear that a set of basis matrices for US-VSS scheme
can be used as basis matrices for WS-VSS schemes. How-
ever, the converse does not hold generally. For instance,
recall that the basis matrices of the -WS-VSS scheme
given by (11) do not satisfy condition 2) of Denition 1 since
, and are not equivalent to each
other. In this example, we can determine every color of a
secret image from with probability 1 if we investigate
each combination of pixels, while stacked shares seem to be
the same random dots. Instead, WS-VSS schemes are more
efcient than US-VSS schemes from the viewpoint of pixel
expansion and contrast. Actually, pixel expansion of WS-VSS
schemes can be smaller than the minimum pixel expansion
of US-VSS schemes. This fact has been validated since the
basis matrices given by (7) and (11) are obtained by solving
IP problems which are designed to minimize pixel expansions.
The construction of US- and WS-VSS schemes by using IP
will be explained in Section IV.
From the above discussion, it has been shown that a smaller
pixel expansion and/or larger contrast can be achieved by
WS-VSS schemes for color images compared to US-VSS
schemes at the sacrice of security. In this sense, the proposed
WS-VSS schemes can be considered as ramp (or nonperfect)
VSS schemes [6], [7]. However, the following theorem tells us
that there is no gap between the two security notions for VSS
schemes in the case of blackwhite binary secret images.
Theorem 6: In the case of blackwhite binary secret images,
basis matrices for -WS-VSS schemes are also the basis
matrices for -US-VSS schemes. In other words, De-
nition 1 is satised by the basis matrices of -WS-VSS
schemes.
IWAMOTO: WEAK SECURITY NOTION FOR VISUAL SECRET SHARING SCHEMES 377
Remark 7: Theorem 6 also states that condition ) can
be used instead of condition 2) in order to construct US-VSS
schemes for blackwhite binary secret images. Actually, in sev-
eral previous studies on VSS schemes for blackwhite binary
secret images, e.g., [8] and [9], basis matrices are designed to
satisfy the weak security notion although they required uncon-
ditional security. Theorem 6 claries that such constructions
could fortunately guarantee the unconditional security.
Proof of Theorem 6
4
: We prove that the basis matrices sat-
isfying ) in Denition 4 also satisfy condition 2) in Deni-
tion 1 in the case of . To prove the theorem, it
is sufcient to show the implication, a) b), in the following
propositions, a) and b). For and set
with :
a) for any ;
b) for any .
Let denote a submatrix of that consists of all column
vectors in with Hamming weight . Then, matrix ,
can be written as
(12)
In order to show that a) b), we will prove in the following
that
for all (13)
by induction on .
In the case of , (13) clearly holds from
due to proposition a).
For integer , suppose that (13) is satised
for all . We eliminate all common columns
from and and denote them by and , respectively.
Then, due to the induction hypothesis, it is clear that and
consist of column vectors with Hamming weights greater
than or equal to . Therefore, for arbitrary share set
, the number of in
coincides with the number of columns in which consist of
in the th, th th elements; otherwise, . Since
holds from proposition a) for
arbitrary , this fact implies that . Hence,
we complete the proof of Theorem 6.
IV. CONSTRUCTION OF VSS SCHEMES USING
INTEGER PROGRAMMING
In the previous sections, we introduced US- and WS-VSS
schemes. In order to show that reproduced images of WS-VSS
schemes are superior to those of US-VSS schemes, we compare
the best parameters of both schemes. Hence, we show a method
to obtain the basis matrices of -US/WS-VSS schemes for
given and that minimizes pixel expansion with the aid
of IP. Actually, the basis matrices given by (7) and (11) are
derived based on this method, which shows that the minimum
4
It is easy to see from this proof that Theorem 6 also holds for general access
structures.
pixel expansion of the WS-VSS scheme is smaller than that of
the US-VSS scheme.
Parameter should be as small as possible since shares and
reproduced images are times larger than the original secret
image. If is large, the resolution of reproduced images is de-
teriorated, and the size of random numbers necessary to select a
matrix from an equivalence set becomes large since it is given
by bits. Furthermore, small often results in larger
contrast, which is validated by examples of reproduced images
of US- and WS-VSS schemes provided in the Appendix.
A. Construction
For and , let be the number of column
vector in the basis matrix . Then, pixel expansion of
is represented as
(14)
We dene characteristic function for , and
such that
if
otherwise
(15)
i.e., means that reduces to if it is restricted
to . Then, it is easy to see that
(16)
represents the number of in matrix . Then, we dene a
similar characteristic function , to be
if
otherwise
(17)
for , and . Then
(18)
can be considered as the number of color in vector
. Note that (16) and(18) have the form of the
inner product of vectors. Hence, letting ,
and be the -dimensional vectors that consist of
, and , respectively, we rewrite
(16) and (18) as
(19)
(20)
respectively, where we assume that the elements of ,
, and are suitably ordered with respect to
378 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 2, APRIL 2012
TABLE I
IP PROBLEM FOR US-VSS SCHEMES (IP-US)
so that the inner products in (19) and (20) are well dened. In
addition, (14) can be rewritten using as
(21)
where is a vector with all entries .
In the following, we explain how to determine the vectors ,
that satisfy Denition 1. Let us recall that condition 1)
of Denition 1 requires that consists of and , and
in (20) is the number of color in vector
. Hence, condition 1) of Denition 1 is equivalent to
the following conditions
5
for all with cardinality :
(22)
for all (23)
Note that (22) implies that there exists at least one in
, while no color appears in except for
and from (23). As a result, consists of and .
Similarly, recalling that given by (19) is
the number of in matrix , observe that (5) in
condition 2) of Denition 1 is equivalent to
for and (24)
where is a share set with cardinality .
Summarizing (21)(24), the problem minimizing pixel ex-
pansion of the -US-VSS scheme for and can be for-
mulated as shown in Table I (IP-US).
IP-US can be regarded as an IP problem although it is slightly
different from its canonical form. By solving IP-US, we can ob-
tain a set of basis matrices for a US-VSS scheme that
attains the minimum pixel expansion. It is obvious that this ap-
proach is easily extended to US-VSS schemes with general ac-
cess structures.
The basis matrices given by (7) are obtained by solving the
corresponding IP problem although the details are omitted since
it uses -dimensional binary vectors. However, fortu-
nately, it takes about few seconds to solve the IP problem since
the feasible for the IP problem is very sparse.
6
In a similar way to formulate IP-US, we can also obtain the IP
problem for WS-VSS schemes. Actually, since -WS-VSS
5
In the case of blackwhite binary secret images, i.e., , it is
sufcient to require , instead of (22) and (23).
However, we omit the case of binary secret images in what follows since it is
essentially the same with the case for color images.
6
Note that (23) causes the sparsity.
TABLE II
IP PROBLEM FOR WS-VSS SCHEMES (IP-WS)
TABLE III
COMPARISON OF US- AND WS-VSS SCHEMES
schemes also require condition 1) of Denition 1, we can also
use the conditions given by (22) and (23) for WS-VSS schemes.
On the other hand, there are two differences with respect to
the security conditions. First, we should note that in
(10) may contain several colors not belonging to since all
colors obtained by subtract mixtures of colors in can appear
in . Second, (10) must be satised for every share set
with the cardinality less than or equal to .
Hence, letting be the set of colors obtained by every sub-
tract mixture of colors in , condition can be formulated as
(25)
for all , and for every satisfying .
Hence, by using (25) instead of (24), the IP to minimize the
pixel expansion of -WS-VSS schemes can be obtained as
shown in Table II (IP-WS).
The basis matrices of the -WS-VSS scheme for and
given by (11) are obtained by solving IP-WS for this case
although the details of its derivation are omitted for the same
reason as the US-VSS scheme in Example 2.
B. Comparison of US- and WS-VSS Schemes
According to the proposed construction, we obtain basis ma-
trices of US- and WS-VSS schemes for and with sev-
eral thresholds that achieve the minimum pixel expansions. The
results are summarized in Table III. For instance, the minimum
pixel expansions of -US- and -WS-VSS schemes are
given by 17 and 13, respectively. FromTable III, we can see that
WS-VSS schemes achieve smaller pixel expansion that cannot
be obtained by US-VSS schemes, and bits of random numbers
necessary to construct WS-VSS schemes is considerably re-
duced compared to US-VSS schemes. Furthermore, it is shown
that larger contrast are achieved by WS-VSS schemes. The basis
matrices, examples of shares and reproduced images for the
-US/WS-VSS schemes are provided in the Appendix.
V. ALGEBRAIC CONSTRUCTION OF WS-VSS SCHEMES
As shown in the previous section, constructions of basis ma-
trices for US/WS-VSS schemes are proposed with the aid of IP.
IWAMOTO: WEAK SECURITY NOTION FOR VISUAL SECRET SHARING SCHEMES 379
However, it is known that solving IP is an NP-hard problem,
and hence, it is impractical to construct the VSS schemes using
IP when , , etc., are large.
7
Hence, we show another method
to construct WS-VSS schemes called algebraic construction,
based on the work by Koga et al. [10].
A. Review of Algebraic Construction of US-VSS Schemes
In this section, we briey review the algebraic construction
of -US-VSS schemes according to [10]. For an -dimen-
sional vector , let be an matrix which con-
sists of all permutations of . We call a column per-
mutation (CP) matrix. For example, in the case of ,
we have
(26)
which is equivalent to
(27)
Next, let be the matrix obtained by eliminating an ar-
bitrary row of . For the above example of given by
(26), satises
(28)
which can be rewritten as
(29)
It is easy to see that this relation generally holds. For
, matrix , which is obtained by elim-
inating arbitrarily one row from , satises
(30)
where is the -dimensional vector obtained by
eliminating from .
Interestingly, the above CP matrices can be identied with
polynomials by introducing the following relations. Let us iden-
tify colors in san-serif font with variables in italic
font. In particular, and are identied with and , respec-
tively. For vector , we also identify
and with monomial and , respectively,
which are referred to as a polynomial representation of CP ma-
trices. For instance, in (27) and in (29) can
be identied with and , respectively. Then,
we observe that relation holds where
. In other words, the polynomial
representation of can be obtained by applying to the
7
However, we also note that pixel expansion becomes too large to imple-
ment VSS schemes if is large. In this sense, the construction of VSS schemes
using IP problems is not so impractical if is small enough to achieve the VSS
schemes.
polynomial representation of . Generalizing this fact,
the relation given by (30) can be written as
(31)
where we dene .
Let us consider the case where basis matrices of
-US-VSS schemes are obtained by concatenating CP
matrices. Then, each basis matrix can be translated into
a homogeneous polynomial of degree called a basis
polynomial. Furthermore, for every share set with
, the polynomial representation of the equivalence
class is given by . Hence, if color is
obtained by subtract mixture of colors , it is
sufcient for to satisfy
(32)
so that the corresponding satises (4) in condition 1) of Def-
inition 1. In addition, since also satises the security condi-
tion, i.e., (5) in condition 2) of Denition 1, must satisfy
(33)
for every , where is a homogeneous polynomial of
degree not depending on . Summarizing, we have the
following theorem.
Theorem 8 [10]: Let , be basis polynomials of a
-US-VSS scheme for and . Then, it is sufcient for
to satisfy the simultaneous partial differential equations given
by (32) and (33).
Example 9: Let us consider the -US-VSS scheme for
and . From (32), suppose that basis polynomials
and satisfy
(34)
Then, from (33), and satisfy the relation
(35)
where
(36)
By solving the partial differential equations given by (34) and
(35), we obtain
(37)
(38)
(39)
which achieve contrast and pixel expansion 60.
B. Construction of WS-VSS Schemes
To construct the WS-VSS schemes using the algebraic
method, we introduce equivalence relation into a set of
380 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 2, APRIL 2012
homogeneous polynomials. For , , , , we dene
if
(40)
In addition, we dene if and .
For example, it holds that .
Now, let be a basis polynomial corresponding to basis
matrix of a -WS-VSS scheme. Then, similar to the
-US-VSS schemes, we assume that satises (32) in
order to guarantee condition 1) in Denition 1. In addition, (10)
in condition is guaranteed if satises
(41)
for every and , where is a homoge-
neous polynomial of degree which does not depend on .
Summarizing, we obtain the following theorem for basis
polynomials of -WS-VSS schemes.
Theorem 10: For colors , let be basis polynomials
of a -WS-VSS scheme. Then, it is sufcient for to sat-
isfy (41) in addition to (32).
Note that (32) and (41) are no longer simultaneous partial
differential equations. However, as shown in the following ex-
ample, it is easy to obtain basis polynomials for -WS-VSS
schemes algebraically in a similar way to algebraic construction
of -US-VSS schemes.
Example 11: We construct a (3,3)-WS-VSS scheme for
and based on the algebraic construction. Let , and
be the basis polynomials corresponding to , and ,
respectively. Since these polynomials must satisfy (34) in Ex-
ample 9, we assume that
(42)
(43)
(44)
where for , are homogeneous polynomials
of degree which consist of the variables and . Then, ap-
plying partial differential operator given by (36) to (42)(44),
we have
(45)
(46)
(47)
According to (41), must be satised.
Hence, by letting , be
(48)
(49)
(50)
where , , and are integers satisfying
, , and , respectively, we
can check that
holds.
We apply again to (45)(47) after substituting(48)(50) into
them. Then, we obtain
(51)
(52)
(53)
where for . Furthermore, let
, where , are nonnegative
integers.
Finally, we note that is satised since
is a homogeneous polynomial of degree 1 and
must hold from (41). Hence, we substitute
and into (51)(53) and compare the coefcients of , ,
and . Then, the coefcients of , , and must satisfy
(54)
(55)
(56)
(57)
respectively.
In order to achieve a small pixel expansion, it is sufcient to
set , and for all ,
, which results in
(58)
(59)
(60)
It is easy to check that (58)(60) satisfy conditions (32) and (41).
In this case, contrast and pixel expansion 30 are achieved.
We observe that the basis polynomials of the (3,3)-WS-VSS
scheme in Example 11 achieve a smaller pixel expansion
and larger contrast compared to the (3,3)-US-VSS scheme
in Example 9. Note that it is impossible to reduce the pixel
expansion to smaller than that of the (3,3)-US-VSS scheme
obtained in Example 2, because it is proved in [10, Th. 4]
that the basis polynomials derived from the partial differential
equations given by (32) and (33) are uniquely determined
if they contain no common term. Hence, it is also shown in
the case of algebraic construction that WS-VSS schemes are
more efcient than US-VSS schemes from the viewpoints of
pixel expansion and contrast in the case of color images at the
sacrice of security.
VI. CONCLUDING REMARKS
We introduced a weakly secure WS-VSS scheme. In
-WS-VSS schemes, the classical unconditional security
notion of -threshold visual secret sharing (US-VSS)
schemes is relaxed in such a way that it is secure if the image
obtained by stacking or fewer shares seems to be a
random-dot picture. Hence, for instance, this weak security
notion is effective when attackers cannot use computers since
it may take much time to analyze combinations of subpixels
exhaustively in such a scenario.
IWAMOTO: WEAK SECURITY NOTION FOR VISUAL SECRET SHARING SCHEMES 381
We discussed the relations between US- and WS-VSS
schemes. As a result, it was shown that WS-VSS schemes
can attain a smaller pixel expansion and larger contrast (and
hence, clearer reproduced color images) compared to that for
US-VSS schemes. On the other hand, in the case of blackwhite
binary secret images, it was shown that the basis matrices for
US/WS-VSS schemes coincide. This is a slightly pessimistic
result, but it can justify the unconditional security of several
previous VSS schemes that were discussed without sufcient
security proofs. In Theorem 6, it is essential that we can only
use black and white subpixels in order to reproduce blackwhite
binary secret images. Hence, the recent work on VSS schemes
[12] in which blackwhite binary secret images are reproduced
by mixtures of blue, red, and green, has the potential to reduce
pixel expansion if it is discussed under our weak security
notion.
Finally, two constructions were presented for -WS-VSS
schemes using integer programming and algebraic construction
of VSS schemes, which suggests that WS-VSS schemes can
attain a smaller pixel expansion and larger contrasts that cannot
be achieved by US-VSS schemes at the sacrice of security. In
this sense, WS-VSS schemes can be viewed as achieving ramp
schemes for VSS schemes.
As a variation of the WS-VSS schemes, we can consider a
VSS scheme with hybrid security conditions. For instance, con-
sider the following basis matrices for the (3,3)-VSS scheme with
and :
(61)
It is easy to check that the basis matrices in (61) guarantee
the unconditional security for share set in addition
to each share, while they satisfy weak security for share sets
and . In this case, contrast and pixel ex-
pansion 6, i.e., larger contrast and smaller pixel expansion than
the (3,3)-US-VSS scheme in Example 2, are attained.
It is easy to expect that pixel expansion and contrast of such
hybrid schemes lie between those of US- and WS-VSS schemes
although the theoretical proof of this conjecture remains open.
In addition, nding simple constructions of such hybrid VSS
schemes, e.g., algebraic constructions, are also interesting future
topics. Note that the basis matrices given by (61) are derived
using an integer programming problems similarly formulated
as IP-WS and IP-US.
APPENDIX
EXAMPLES OF SHARES
Here, we show examples of the -US/WS-VSS and the
-US/WS-VSS schemes in order to show that WS-VSS
schemes are secure for attackers eyesight, and WS-VSS
Fig. 6. Security of -WS-VSS schemes: (a) Shares 1, (b) Shares 1 and 2,
and (c) Shares 1, 2, and 3.
schemes recover clearer secret images compared to US-VSS
schemes. We use Fig. 1(a) and (b) as secret images.
-US/WS-VSS Schemes: We use Fig. 1(a) as a secret
image. Figs. 2 and 3 are examples of shares for the -US-
and the -WS-VSS schemes for and
, respectively. The basis matrices for the US- and the
WS-VSS schemes are given by (7) in Example 2 and by (11) in
Example 5, respectively.
The reproduced images of US- and WS-VSS schemes are pre-
sented in Fig. 5(a) and (b), respectively, from which we can see
that the WS-VSS scheme can recover a clearer image compared
to the US-VSS scheme.
-US/WS-VSS Schemes: Based on the construction
given by Section IV-A, the basis matrices for -US-
and -WS-VSS schemes for and
are given by
(62)
382 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 7, NO. 2, APRIL 2012
Fig. 7. Reproduced images of -US/WS-VSS schemes: (a) US-VSS
scheme and (b) WS-VSS scheme.
(63)
(64)
and
(65)
(66)
(67)
which achieve the minimum pixel expansions 14 and 9,
respectively.
We use Fig. 1(b) as a secret image. Since we have many com-
binations of four shares, we only show the rst share and sev-
eral images of stacked shares in Fig. 6(a)(c), but they might
be sufcient to justify that the -WS-VSS scheme is secure
against attackers eyesight. The reproduced images of US- and
WS-VSS schemes are provided in Fig. 7(a) and (b), respectively,
from which we can see that the WS-VSS scheme can recover a
clearer image compared to the US-VSS scheme.
ACKNOWLEDGMENT
The author would like to thank Prof. H. Yamamoto of the Uni-
versity of Tokyo, and anonymous reviewers, for their helpful
comments.
REFERENCES
[1] M. Naor and A. Shamir, Visual cryptography, in Proc. Advances
Cryptology-EUROCRYPT94, LNCS 950, 1994, pp. 112.
[2] G. R. Blakley, Safeguarding cryptographic keys, in Proc. AFIPS
1979 National Computer Conf., 1979, vol. 48, pp. 313317.
[3] A. Shamir, How to share a secret, Commun. ACM, vol. 22, no. 11,
pp. 612613, 1979.
[4] C. Blundo, P. DArco, A. D. Santis, and D. R. Stinson, On the con-
trast in visual cryptography schemes, J. Cryptol., vol. 12, no. 4, pp.
261289, 1999.
[5] C. Blundo, P. Darco, A. D. Santis, and D. R. Stinson, Contrast op-
timal threshold visual cryptography, SIAM J. Discrete Math., vol. 16,
no. 2, pp. 224261, 2003.
[6] G. R. Blakley and C. Meadows, Security of ramp schemes, in Ad-
vances Cryptology-CRYPTO84, LNCS 196, 1985, pp. 242269.
[7] H. Yamamoto, On secret sharing systems using threshold
scheme, IECE Trans., vol. J68A, no. 9, pp. 945952, 1985, in
Japanese.
[8] T. Kato and H. Imai, An extended construction method of visual secret
sharing scheme, IEICE Trans. Fundamentals, vol. J79A, no. 8, pp.
13441351, 1996, (in Japanese).
[9] C. S. Hsu, S. F. Tu, and Y. C. Hou, An optimization model for visual
cryptography schemes with unexpanded shares, in Proc. Foundations
of Intelligent Systems 16th Int. Symp. LNCS 4203, 2006, pp. 5867,
Springer-Verlag.
[10] H. Koga, M. Iwamoto, and H. Yamamoto, An analytic construction
of the visual secret sharing scheme for color images, IEICE Trans.
Fundamentals, vol. E84-A, no. 1, pp. 262272, 2001.
[11] G. Ateniese, C. Blundo, A. D. Santis, and D. R. Stinson, Visual cryp-
tography for general access structures, Inform. Computation, vol. 129,
no. 2, pp. 86106, 1996.
[12] R. De Prisco and A. De Santis, Using colors to improve visual cryp-
tography for black and white images, in Proc. ICITS2011, LNCS 6673,
2011, pp. 182201.
Mitsugu Iwamoto (M06) was born in Fukuoka,
Japan, in 1976. He received the B.E., M.E., and
Ph.D. degrees from the University of Tokyo, Japan,
in 1999, 2001, and 2004, respectively.
Currently, he is an Assistant Professor in the
Center for Frontier Science and Engineering, the
University of Electro-Communications, Tokyo,
Japan. His research interests include information
security and cryptography.