ABSTRACT

The image security problem is an important area in information security, and image encryption plays a vital role in this day. To protect the image encryption from the attack of quantum algorithm appeared recently, an image encryption method based on quantum Fourier transformation is proposed here. First, the image encryption and Fourier transformation are discussed here, then a encryption function is proposed. Second, a quantum Fourier transformation is introduced to quantum encryption, and the full step of quantum encryption is given as well. Third, the security of the proposed quantum encryption if analyzed, and some propositions are also presented. Lastly, some conclusions are indicated and some possible directions are also listed.

Keywords:

Image Encryption, Quantum Encryption, Quantum Fourier Transformation, Quantum Image

1. Introduction

1.1. Related Work

Image encryption technology won great attention recently because of its complexity. [1] adopted a novel chaotic block image encryption algorithm based on dynamic random growth technique. [2] extended a 2D Sine Logistic modulation map for image encryption. [3] gave a new image encryption algorithm based on non-adjacent coupled map lattices. [4] considered a novel chaotic image encryption scheme using DNA sequence operations. [5] concerned an image encryption scheme based on elliptic curve pseudo random and Advanced Encryption System.

Image encryption method often includes space encryption and condenses encryption. [6] built a color image encryption based on chaotic systems and elliptic curve ElGamal scheme. [7] studied an optical double-image encryption and authentication by sparse representation. [8] offered a N-phase logistic chaotic sequence and its application for image encryption. [9] implied an impulsive synchronization of reaction-diffusion neural networks with mixed delays and its application to image encryption.

However, the appearance of quantum computing brought a great challenge to classic encryption methods. At the same time, quantum encryption also gives us an absolutely secure encryption method. For example, [10] painted a quantum image encryption based on iterative framework of Frequency-Spatial Domain transforms. [11] displayed a quantum color image encryption algorithm based on a hyper-chaotic system and quantum Fourier transform. [12] discussed the research on an E-mail encryption protocol based on quantum teleportation. [13] featured a quantum image encryption algorithm based on quantum image XOR operations. [14] stated that encryption faces quantum foe. [15] put forward a quantum image encryption based on generalized Arnold transform and double random-phase encoding.

In quantum image encryption, the efficiency of transformation plays an important role, especially the Fourier transformation [11] . [16] discussed the change from fractional Fourier transformation to quantum mechanical fractional squeezing transformation. This paper tried to introduce an efficient quantum Fourier transformation in image encryption to improve the encryption security and efficiency.

1.2. Organization of the Article

Section 2 defines the general notion of privacy for quantum key distribution. Section 3 contains preliminaries, basic rules and the general model used to analyze the protocol. In Section 4, the protocol is described. Section 5 contains the analysis of privacy protection.

2. Image Security and Image Encryption

2.1. Fourier Transformation in Image Encryption

Through bringing the ideal into this work from $P{D}_{\gamma }$ a brilliant estimation of this Fourier transform of $P{D}_{\gamma }$ is required, which denoted by η_1/r. It might be illustrated that since $1/r\ll {\tau }_1\left(D^{\ast }\right)$ one has the estimation

${\eta }_{1/r}\left(x\right)\approx \exp \left(-\text{π}{\left(r\cdot \text{dist}\left(D^{*},x\right)\right)}^2\right)$ (1)

Therefore, ${\eta }_{1/r}\left(x\right)\approx 1$ for any $\chi \in D^{\ast }$ (as a matter of fact a par holds) as well as one avoids $D^{\ast }$ , its value drop off. For the dot not far from distance, for example, 1/r from this fretwork, its significance is still a little positive constant (approximately $\exp \left(-\text{π}\right)$ ). As the length from $D^{\ast }$ increases, the significance of the purpose quickly changes into triffling. Because the length between any two matrixes in $D^{\ast }$ is at any rate ${\tau }_1\left(D^{\ast }\right)\gg 1/r$ , the normal distribution around each point of $D^{\ast }$ are well fell apart.

Let us begin to try to comprehend what the distinguishing difference $P_{D/p,r/p}$ looks like. Point out that this image matrix D/p compound of $p^{\in }$ translates of the primal image matrix D that’s to say, as for each $a\in O_p^{\in }$ , consider the set

$D+Da/p=\left\{Db/p|b\in O^{\in },b\mathrm{mod}p=a\right\}$ (2)

Then, $\left\{D+Da/p|a\in O_P^{\in }O\right\}$ establishes a division of D/p. what’s more, it could be depicted that since r/p is bigger than the system parameter $\eta \in \left(D\right)$ , the possibility distributed to each $D+D_{a/p}$ under $P_{D/p,r/p}$ is fundamentally alike, that is, $p^{-\in }$ . Intuitively, in addition to system parameter, the normal measure not any more “sees” the discerning construction of D, so distinguished from others, it is not influenced by translations.

It guided us to think about the next dispersion, name it P. A example from P is a pair $\left(a,y\right)$ from which y is sampled $P_{D/p,r/p}$ , and $a\in O_p^{\in }$ is such that $y\in D+D_{a/p}$ .

Now the Fourier transform of $P_D+D_{a/p,r/p}$ is presently analyzed. When “a” is zero, the Fourier transform is known as $f_{p/r}$ . For universal a, a stock calculation illustrated that the Fourier transform of $P_D+D_{a/p,r/p}$ is granted by

$\exp \left(2\text{π}i\langle a,T\left(x\right)\rangle /p\right)\cdot {\eta }_{p/r}\left(x\right)$ (3)

where $T\left(x\right)\in O_p$ is outlined as

$T\left(x\right)={\left(D^{\ast }\right)}^{-1}k{D}^{\ast }\left(\chi \right)\mathrm{mod}p$ ,

and $k{p}^{\ast }\left(\chi \right)$ gives the only hide vector in $D^{\ast }$ to $\chi$ . Put differently, $T\left(x\right)$ is the vector of constant number of the vector in $D^{\ast }$ hide to x when laid out in the foundation of $D^{\ast }$ , shrink possibility p. therefore seeing that the Fourier transform $P_D+D_{a/p,r/p}$ is basically $f_{p/r}$ , besides that each “hill” has its unique phase as a support for the vector of constant number of the image matrix dot in its center. The visual aspect of those phases is as a termination of a famous dimension of the Fourier transform, given that translation is transmuted with phase to multiplication.

For two real numbers x and $y>0$ , generally, x mod y can be defined as $\chi /y|y$ for $\chi \in R$ , $\lfloor \chi \rfloor$ is defined as the integer closest to x or, in case of existing two such integers, the small one of the two. For any integer $p\ge 2$ , $O_p$ is written for the cyclic group $\left\{0,1,p^{-1}\right\}$ with addition possibility p.

As two possibility density functions λ₁，λ₂ on $R^{\in }$ , the statistical length between them is defined as

$\Delta \left({\lambda }_1,{\lambda }_2\right)={\displaystyle {\int }_{R^{\in }}\left|{\lambda }_1\left(x\right)-{\lambda }_2\left(x\right)\right|\text{d}x}$ (4)

(as this definition observing, the statistical length ranges in $\left[0,2\right]$ . A allied definition can be showed for sensible random variables. The statistical length satisfies the triangle inequality, it’s to say, for any, ${\lambda }_1,{\lambda }_2,{\lambda }_3$

$\Delta \left({\lambda }_1,{\lambda }_3\right)\le \Delta \left({\lambda }_1,{\lambda }_2\right)+\Delta \left({\lambda }_2,{\lambda }_3\right)$ (5)

Another significant fact is that the statistical length cannot increase by using a possibility function f, that’s to say,

$\Delta \left(\eta \left(X\right),\eta \left(Y\right)\right)\le \Delta \left(X,Y\right)$ (6)

Retrieve that the normal distribution with variance a² and mean 0 is the distribution on R illustrated by the density function $\frac{1}{\sqrt{2}\text{π}\sigma }\exp \left(-1/2{\left(\frac{x}{\sigma }\right)}^2\right)$

where exp(y) denotes e^y. Also see from that the summary of two mean = 0 independent variables with variances ${\sigma }_1^2$ and ${\sigma }_2^2$ is also a normal variable. A vector x and any $\omega >0$ , let

$Q_w\left(x\right):=\exp \left(-\text{π}{\Vert x/w\Vert }^2\right)$ (7)

be a normal function measured by a component of s. if denoted M1 by p. Note that ${\displaystyle {\int }_{R^{\in }}{Q}_{\omega }\left(x\right)\text{d}x}={\omega }^{\in }$ Therefore,

$s_{\omega }:=Q_{\omega }/{\omega }^{\in }$ (8)

is an n-dimensional chance density function and like what have mentioned above, if apply s to denote s₁. Functions are expended to sets in the normal way; that’s to say, $Q_s\left(A\right)={\displaystyle {\sum }_{x\in A}{Q}_{\omega }\left(x\right)}$ for any countable matrix A. For any vector $c\in R^{\in }$ , if defined $Q_{\omega }$ ， $c\left(\chi \right)=Q_{\omega }\left(\chi -C\right)$ to be a shifted version of $Q_{\omega }$ . The next example bounds the sum by which $Q_{\delta }\left(\chi \right)$ can deduce by a little change in $\chi$ .

For all $\omega ,t,l>0$ and $\chi ,y\in R^{\in }$ with $\Vert \chi \Vert \le t$ and $\Vert \chi -y\Vert \le 1$ ,

$Q_w\left(y\right)\ge \left(1-\text{π}\left(2lt+l^2\right)/w^2\right)Q_{\omega }(x)$

Using the inequality ${\text{e}}^{-z}\ge 1-z$ ,

$Q_w\left(y\right)={\text{e}}^{-\text{π}{\Vert \frac{y}{w}\Vert }^2}\ge {\text{e}}^{-\text{π}{\left(\frac{\Vert x\Vert }{w}+\frac{1}{w}\right)}^2}={\text{e}}^{-\text{π}\left(2l\frac{\Vert x\Vert }{w^2}+{\left(\frac{1}{w}\right)}^2\right)Q_w\left(x\right)}\ge \left(1-\text{π}\left(2lt+l^2\right)/w^2\right)Q_{\omega }\left(x\right)$ (9)

2.2. The Encryption Function

As the option of basis is obvious, if write $M\left(D\right)$ instead of $M\left(s_1,\cdots ,s_{\in }\right)$ . For a point $\chi \in R^{\in }$ , $\chi \mathrm{mod}M\left(D\right)$ is defined as the only point $y\in M\left(D\right)$ such that $y-x\in D$ . if denote by $\det \left(D\right)$ the volume of the primal parallelepiped of D or equivalently, the determinant’ absolute value of the matrix with the basis image matrixes of matrix ( $\det \left(D\right)$ is an image matrix invariant, to be exactly, it is free from the option of basis). The double of a image matrix D in $R^{\in }$ , denoted $D^{\ast }$ , is the image matrix illustrated by the set of all matrixes $y\in R^{\in }$ such that $\langle x,y\rangle \in 0$ for all matrixes $x\in D$ . In the same way, given a basis $\left(s_1,\cdots ,s_{\in }\right)$ of an image matrix, define the double basis as the vector set $\left(s_1^{\ast },\cdots ,s_{\in }^{\ast }\right)$ such that $\langle s_i{s}_j^{\ast }\rangle ={\delta }_{ij}$ for all $ij\in [\in ]$ where ${\omega }_{ij}$ denotes the weight delta, in another word, 1 if $i=j$ and 0 other than. With a little abuse of notation, people often use D for the ϵ x ϵ matrix whose columns are $s_1,\cdots ,s_{\in }$ With this notation, find that $D^{*}={\left(D^{\text{T}}\right)}^{-1}$ . Because of that, it shows that $\det \left(D^{\ast }\right)=1/\det \left(D\right)$ . At another case, for a point $s\in D$ , $D^{-1}s$ is written to illuminate the integer coefficient vector of s.

Because of the iterative step, the algorithm can be expressed as follows. Allow $r_i$ denote $r\cdot {\left(\alpha p/\sqrt{\in }\right)}^i$ The algorithm begin with producing ${\in }^c$ samples from $P_{D\gamma 3\in }$ On account of $r3\in$ is indeed large, this samples can be computed expeditiously by a unproblematic procedure. The next comes the most essential part of the algorithm: for $i=3\in ,3\in -1,\cdots$ 1 the algorithm applies $ts{\in }^c$ samples from $P_{D,{r^{\prime }}_i}$ to produce ${\in }^c$ samples from $P_{D,r_{i-1}}$ by naming the iterative step ${\in }^c$ times. Finally, it ends up with ${\in }^c$ samples from $P_{D,r_0}=P_{D,r}$ as well as people finish the algorithm by uncomplicated outputting the initial of them. Note the next essential answer: applying ${\in }^c$ samples from $P_{D,r_i}$ , there will have the ability to bring forth the same number of samples ${\in }^c$ from $P_{D,r_{i-1}}$ (actually, people could even give forth more than ${\in }^c$ examples). The algorithm would not operate if only generate, in another word, ${\in }^c/2$ samples.

Now eventually get to depict the iterative step by us. Retrieve that as input the $\in$ samples from $P_{D,r}$ and there will be supposed to give forth a sample from $P_{D,r}$ , where $r^1=r\sqrt{\in }/\left(ap\right)$ . What’s more, r is knowable and assured to be at least $\sqrt{2}P{f}_q\left(D\right)$ , which can be illustrated to illuminate that $p/r<{\tau }_1\left(D^{\ast }\right)/2$ . From what have illustrated in the former passage, the exact lower related to r does not count much for this summary; it’s adequate to remember that r is adequately larger than (D), and that 1/r is adequately smaller than ${\tau }_1(D\ast )$

The algorithm composed of two primary parts. In that passage, there will be described as a classical algorithm that applying W and the samples from $P_{D,r}$ ,

solve ${\text{CVP}}_{D^{*},\alpha p/\left(\sqrt{2}r\right)}$ . There, what illustrate a encryption algorithm is that, showed an oracle that solves ${\text{CVP}}_{D^{*},\alpha p/\left(\sqrt{2}r\right)}$ , outputs a example from $P_{D,r\sqrt{\in }/\left(\alpha p\right)}$ .

This is the unique encryption element in this essay. People find that the condition is content since $(\sqrt{2}r)\le 1/f_q\left(D\right)\le {\tau }_1\left(D^{\ast }\right)/2$

3. Quantum Fourier Transformation for Encryption

3.1. A Fast Quantum Fourier Transformation

In a fast quantum Fourier transformation, the first aim is to produce a quantum announcement in relate to ${\eta }_{1/r}$ . with formality, it could be described as

${\displaystyle {\sum }_{x\in R^{\in }}{\eta }_{1/r}|x\rangle }$ (10)

Taking account of some possibility distribution P on some image matrix D and its Fourier transform $f:R^{\in }\to C$ , defined as

$\eta \left(x\right)={\displaystyle {\sum }_{y\in D}P\left(y\right)}\exp \left(2\text{π}i\langle x,y\rangle \right)=\underset{y~P}{{\displaystyle Exp}}\left[\exp \left(2\text{π}i\langle x,y\rangle \right)\right]$ (11)

where in the second equality. the sum is simply be rewrote as an expectation. By definition, η is $D^{\ast }$ -periodic, that’s to say, $\eta \left(x\right)=\eta \left(x+y\right)$ for any $\chi \in R^{\in }$ and $y\in D^{\ast }$ It can compute an estimation of η to within $\pm 1/\text{poly}(\in )$ . If $y_1,\cdots ,y_N$ are $N=\text{poly}(\in )$ independent samples from P, and then

$f\left(x\right)\approx \frac{1}{N}{\displaystyle {\sum }_{j=1}^N\exp \left(2\text{π}i\langle x,y_j\rangle \right)}$ (12)

where the estimation is to within $\pm 1/\text{poly}\left(n\right)$ and poses with possibility exponentially just about 1, presuming that N is a large adequate multinomial.

Let $q=q(\in )$ be a negligible function, $p=p(\in )\ge 2$ be an integer, and $a=a(\in )\in \left(0,1\right)$ be a real number. presume that way to an oracle W that solves quantum oracle, given a multinomial number of examples. As for an ϵ-dimensional image matrix D, some $0<d<{\tau }_1\left(D\right)/2$ , and an integer $p\ge 2$ , there is an algorithm solves ${\text{CVP}}_{D,d}^{\left(p\right)}$ if, depicted any point $x\in R^{\in }$ within distance d of D, it outputs $D^{-\text{l}}{k}_1\left(x\right)\mathrm{mod}p\in O_P$ mod $p\in O_P$ , the coefficient matrix to x deduced possibility p. Here shows a reduction from ${\text{CVP}}_{D,d}$ to ${\text{CVP}}_{D,d}^{\left(p\right)}$ .

There is an effective algorithm for given a image matrix D, a number $d<{\tau }_1\left(D\right)/2$ and an integer $p\ge 2$ , solves ${\text{CVP}}_{D,d}$ given way to an oracle for ${\text{CVP}}_{D,d}^{\left(p\right)}$ .

The input is a point x in distance d of D. A sequence of points is defined as ${\chi }_1,{\chi }_2,{\chi }_3,\cdots$ as follows. Let $a_i=D^{-1}{K}_D\left({\chi }_i\right)\in O^{\in }$ be the coefficient image matrix point to x_i. Define. Find that the closest image matrix point to ${\chi }_{i+1}=\left(x_i-D\left(a_i\mathrm{mod}p\right)\right)/p\in D$ therefore $a_{i+1}=\left(a_i-a\left(a_i\mathrm{mod}p\right)\right)/p$ what’s more, the length of x_i+1 from D is at most d/pⁱ. as well as depicted that this sequence can be computed by applying the oracle.

After $\in$ steps, there is a point $x_{ϵ+1}$ whose length to the image matrix is at most ${d/p}^{\in }$ . An algorithm is applied for solving the closest matrix. This outputs a image matrix point Da within distance $2^{ϵ}\cdot d/p^{ϵ}\le d<{\tau }_1\left(D\right)/2$ of ${\chi }_{\in +1}$ . Therefore, Da is the image matrix point closest to ${\chi }_{\in +1}$ and one tried to retrieve $a_{\in +1}=a$ realizing and $a_{\in }$ mod p (by applying the oracle), one can recover $a_{\in }=p{a}_{\in +1}+\left(a_{\in }\mathrm{mod}p\right)$ . proceeding this process, one could recover $a_{\in -1},a_{\in -2},\cdots ,a_1$ . This finishes the algorithm for Da₁ is the closest point to $x_1=x$

As the option of r, ( $\alpha p\left(\sqrt{2}r\right)<{\tau }_1\left(D^{\ast }\right)/2$ it’s adequate to depict an efficient algorithm for ${\text{CVP}}_{{}_{D^{*},\alpha p/\left(\sqrt{2}r\right)}}^{\left(p\right)}$ . By combining the discussion above this could be done. Initially, it depicts an algorithm W’ that, showed samples from $A_{s,{\psi }_{\beta }}$ . The next, it is described how to use W’ and the shown samples from $P_{D\gamma }$ in order to solve ${\text{CVP}}_{{}_{D^{*},\alpha p/\left(\sqrt{2}r\right)}}^{(p)}$

3.2. Quantum Encryption Step

Repeating the process illustrated above $\in$ times, the system state is described as an $\in$ -fold tensor product of the state in Equation (12), which might be understood as

${\displaystyle {\sum }_{x\in {\left\{-\sqrt{\in }r,\cdots ,\sqrt{\in }r\right\}}^{\in }}{Q}_{\sqrt{2}r}\left(x\right)|x\rangle }$ (13)

For $O^{\in }\cap \sqrt{\in }r{\eta }_{\in },{\left\{-\sqrt{\in }r,\cdots ,\sqrt{\in }r\right\}}^{\in }$ it indicates that the state is within l₂ distance $2^{-\Omega (\in )}$ of

${\displaystyle {\sum }_{x\in Z^{\in }}\in Q_{\sqrt{\text{2}}r}\left(x\right)|x\rangle }$ (14)

Therefore, for the goal it can be presumed that it is generated the state in Equation (14).

The next step, applying the LLL foundation reduction algorithm, a base can be acquired for D of length at most $2^{\in }{\tau }_{\in }\left(D\right)$ and let $M\left(D\right)$ be brought forth by a new register $M\left(D\right)$ Let $y\in M\left(D\right)$ denote the state that $\Vert y\Vert \le diam\left(M\left(D\right)\right)<\in 2^{\in }{\tau }_{\in }\left(D\right)$ . The state acquired by us after the measurement is

${\displaystyle {\sum }_{x\in L+y}{Q}_{\sqrt{2}r}\left(x\right)|x\rangle }$ (15)

In the end, subtract y from the register, and get

${\displaystyle {\sum }_{x\in L}{Q}_{\sqrt{2}r}\left(x+y\right)|x\rangle }$ (16)

Therefore assume any $x\in D$ with $\Vert X\Vert \le \sqrt{\in }r$ . The amplitude squared offered to it in Equation (13) is $Q_r\left(X\right)/M_r\left(D\right)$ By The denominator is $Q_r\left(D\right)=\det \left(D^{\ast }\right)\cdot r^{\in }{Q}_{1/r}\left(D^{\ast }\right)\ge \det \left(D^{\ast }\right)\cdot r^{\in }$ and therefore the amplitude is at most $Q_r\left(x\right)/\left(\det \left(D^{\ast }\right)\cdot r^{\in }\right)=\det \left(D\right)s_y(x)$

In another word, the amplitude squared provided to x by the process is $Q_r\left(X+y\right)/Q_y\left(D+y\right)$ . Then the denominator is

$Q_r\left(D+y\right)=\det \left(D^{*}\right)\cdot r^{\in }{\displaystyle {\sum }_{z\in D^{*}}{\text{e}}^{2\text{π}i\langle z,y\rangle }}{Q}_{\frac{1}{r}}\left(z\right)\le \left(1+2^{-\Omega (\in )}\right)\det \left(D^{*}\right)\cdot r^{\in }$ (17)

To get this inequality, initially observe that by the simple part, ${\tau }_1\left(D\right)\ge 1/{\tau }_{\in }\left(D\right)>\sqrt{\in }/r$ , and then apply quantum Fourier transformation. what’s more, the numerator is in $\left(1-2^{-\Omega (\in )}\right)Q_y\left(x\right)$ . Therefore, the amplitude squared provided to x is in $\left(1-2^{-\Omega (\in )}\right)Q_y\left(x\right)\det \left(D\right)s_r(x)$

The l₂ distance between different states r to

$|s_1\rangle ={\displaystyle {\sum }_{x\in \frac{D}{R},\left|\right|x\left|\right|<\sqrt{\in }}Q\left(x\right)|x\mathrm{mod}M\left(D\right)\rangle }$ , and

$|s_2\rangle ={\displaystyle {\sum }_{x\in \frac{D}{R}}Q\left(x\right)|x\mathrm{mod}M\left(D\right)\rangle }={\displaystyle {\sum }_{x\in \frac{D}{R}\cap M\left(D\right)}{\displaystyle {\sum }_{y\in D}Q\left(x-y\right)|x\mathrm{mod}M\left(D\right)\rangle }}$

is $2^{-\Omega (\in )}$ .

here, consider $|s_1\rangle$ and $|s_2\rangle$ as matrixes in $R^{\in }$ -dimensional space. Make Z be the l₂ norm of $|s_1\rangle$ . In the next it can be shown that the l₂ length between $|s_1\rangle$ and $|s_2\rangle$ is at most $2^{\text{-}\Omega (\in )}$ Z. it is adequate to build that the l₂ distance between different states referring to $|s_1\rangle$ and $|s_2\rangle$ is exponentially tiny.

Initially, get a good approximation of Z. As far as ${\tau }_1\left(D\right)>2\sqrt{\in }$ , each key in the definition of
$|s_1\rangle$ , and so

$Z={\displaystyle {\sum }_{x\in \frac{D}{R},\Vert X\Vert <\sqrt{\in }}Q{\left(x\right)}^2}=q\left(\sqrt{2}D/R\cap \sqrt{2\in }{\eta }_{\in }\right)$ (18)

By applying the image matrix s₂"D/R, get that

$\left(1-2^{-2\in }\right)Q\left(\frac{\sqrt{2}D}{R}\right)\le Z\le Q\left(\sqrt{2}D/R\right)$ (19)

It is verified with an upper relate to the l₂ distance between the two matrixes. Applying the normal monotonicity of s,

$\begin{array}{l}{\left||s_{\text{1}}\rangle -|s_{\text{2}}\rangle \right|}_2\le {\left||s_{\text{1}}\rangle -|s_{\text{2}}\rangle \right|}_1\\ ={\displaystyle {\sum }_{x\in \frac{D}{R},\Vert x\Vert \ge \sqrt{\in }}Q}\left(x\right)\\ \le 2^{-2\in }Q\left(D/R\right)\\ \le 2^{-2\in }{2}^{\in /2}Q\left(\sqrt{2}D/R\right)\\ \le 2^{-\in }Q\left(\sqrt{2}D/R\right)\end{array}$ (20)

There will be an effective quantum algorithm that, offered any n-dimensional image matrix D, a number $d<{\tau }_1\left(D^{\ast }\right)/2$ , and an oracle that handles ${\text{CVP}}_{D^{\ast }d}$ , outputs a sample from $P_{D\text{,}\in /\sqrt{\text{2}}d}$ .

By scaling, presume without decline in amount of generality that $d=\sqrt{\in }$ . Let $R\ge 2^{\Im \in }{\tau }_{\in }\left(D^{\ast }\right)$ be a big adequate integer, presume that log R is multinomial in the image matrix D. The initial task is to build a state exponentially near to

${\displaystyle {\sum }_{x\in \frac{D^{*}}{R}\cap M\left(D\right)}{\displaystyle {\sum }_{y\in D}Q\left(x-y\right)}|x\rangle }$ (21)

As a state on $\in$ log R qubits, that is a multinomial number in the input scale. In order to do in this way, initially, it is used with $r=1/\sqrt{2}$ and the image matrix $D^{\ast }/R$ to make the state

${\displaystyle {\sum }_{x\in \frac{D^{\text{*}}}{R}}Q\left(x\right)|x)}$ (22)

Then, this is exponentially relate to

${\displaystyle {\sum }_{x\in \frac{D^{*}}{R},\Vert x\Vert <\sqrt{\in }}Q\left(x\right)|x)}$ (23)

An then, calculate x mod M(D^*) in a new register and get

${\displaystyle {\sum }_{x\in \frac{D^{*}}{R},\Vert x\Vert <\sqrt{\in }}Q\left(x\right)|x,x\mathrm{mod}M\left(D^{*}\right))}$ (24)

applying the CVP oracle, recover x from x mod M(D*). This admits us to uncompute the primal register and get

${\displaystyle {\sum }_{x\in \frac{D^{*}}{R},\Vert x\Vert <\sqrt{\in }}Q\left(x\right)|x\mathrm{mod}M\left(D^{*}\right))}$ (25)

Then, this state is exponentially close to the recommended state (25).

In the next step, apply the quantum Fourier transform. To begin with, applying the mapping between $D^{\ast }/RR\cap M\left(D^{\ast }\right)$ and $O_p^{\in }$ , rewrite (25) as

${\displaystyle {\sum }_{\omega \in O_R^{\in }}{\displaystyle {\sum }_{r\in O^{\in }}Q\left(\frac{D^{*}\omega }{R}-D^{*}r\right)|\omega \rangle }}$ (26)

Then apply the quantum Fourier transform on $O_p^{\in }$ . get a state where the amplitude of t for te, ZR is proportional to

$\begin{array}{l}{\displaystyle \sum _{\omega \in O_R^{\in }}{\displaystyle \sum _{r\in O^{\in }}Q}}\left(\frac{D^{*}S}{R}-D^{*}r\right)\exp \left(2\text{π}i\langle \omega ,t\rangle /R\right)={\displaystyle {\sum }_{\omega \in O_R^{\in }}Q}\frac{D^{*}\omega }{R}\text{exp}\left(2\text{π}i\langle \omega ,t\rangle /R\right)\\ ={\displaystyle {\sum }_{\omega \in D^{*}/R}Q}\left(x\right)\text{exp}\left(\text{2π}i{\left(D^{\text{*}}\right)}^{-1}x,t\right)\\ ={\displaystyle {\sum }_{x\in D^{*}/R}Q}\text{(}x\text{)exp}\left(\text{2π}i\langle x,Dt\rangle \right)\\ =\det \left(RD\right){\displaystyle {\sum }_{Y\in RD}Q\left(y-Dt\right)}\end{array}$ (27)

where the last equality follows from Equation (26). Therefore, the crucial state can be fairly written as

${\displaystyle {\sum }_{x\in M\left(D\right)\cap D}{\displaystyle {\sum }_{y\in RD}Q\left(y-x\right)}|x\rangle }$ (28)

Look at that ${\tau }_1\left(RD\right)=R{\tau }_1\left(D^{\ast }\right)\ge 2^{\Im \in }$ Therefore, according to the image matrix RD, and get that this state is exponentially close to

${\displaystyle {\sum }_{x\in D,\Vert x\Vert <\sqrt{\in }}Q\left(x\right)|x\mathrm{mod}M\left(RD\right)\rangle }$ (29)

Quantify this state and get x mod $M\left(RD\right)$ for some vector x with $\Vert X\Vert <\sqrt{\in }$ . Since x mod $M\left(RD\right)$ is within $\sqrt{\in }$ of the image matrix RD, and ${\tau }_1\left(RD\right)\ge 2^{\Im \in }$ , recuperate x by using. The answer of the algorithm is x.

Presume without deprivation of generalization that the vector $\left(1,0,\cdots ,0\right)$ is or thogonal to H. There is,

$\begin{array}{l}\underset{X~P_{D,r}}{Exp}\left[\exp \left(-\text{π}{\left(x_1/r\right)}^2\right)\right]\\ =\frac{1}{Q_r\left(D\right)}{\displaystyle {\sum }_{x\in L}\exp \left(-\text{π}{\left(\sqrt{2}{x}_1/r\right)}^2\right)\exp \left(-\text{π}{\left(\sqrt{2}{x}_2/r\right)}^2\right)\cdots \exp \left(-\text{π}{\left(\sqrt{2}{x}_{\in }/r\right)}^2\right)}\\ =\frac{\det \left(D^{*}\right)r^{\in }}{Q_r\left(D\right)}{\displaystyle {\sum }_{y\in L^{*}}\exp \left(-\text{π}{\left(r{y}_1/r\right)}^2\right)\exp \left(-\text{π}{\left(r{y}_2/r\right)}^2\right)\cdots \exp \left(-\text{π}{\left(r{y}_{\in }/r\right)}^2\right)}\\ =\frac{\det \left(D^{*}\right)r^{\in }}{\sqrt{2}{Q}_r\left(D\right)}{Q}_{\sqrt{2}/r}\left(D^{*}\right)=\frac{\det \left(D^{*}\right)r^{\in }}{\sqrt{2}{Q}_r\left(D\right)}\left(1+q\right)\end{array}$ (30)

Let be ${\in }^2$ matrixes chosen by $P_{D,r}$ For $i=1,\cdots ,\in$ , let $B_i$ be the event that

$\dim \text{span}\left(x_1,\cdots ,x_{\left(i-1\right)\in }\right)=\dim \text{span}\left(x_1,\cdots ,x_{i\in }\right)<\in$ .

Obviously, if none of the $B^{\prime }\omega$ takes place, then $\dim \text{span}\left(x_1,\cdots ,x_{{\in }_2}\right)=\in$ . Therefore, it is necessary to depict that for all i, $M_r\left[B_i\right]<2^{-\Omega (\in )}$ . Indeed, fix some i on condition of $x_1,\cdots ,x_{\left(i-1\right)\in }$ such that $\dim \text{span}\left(x_1,\cdots ,x_{\left(i-1\right)\in }\right)<\in$ . Then the possibility that

$x_{\left(i-1\right)\in +1},\cdots ,x_{i\in }$ ^{$\dim \text{span}\left(x_1,\cdots ,x_{\left(i-1\right)\in }\right)$}

is at most ${\left(9/10\right)}^{\in }=2^{-\Omega (\in )}$ . This indicated that $M_r\left[B_i\right]<2^{-\Omega (\in )}$ , as commanded.

4. Security Analysis and Proposition of Quantum Encryption

Let ϵ be the security parameter of encryption system. The encryption system is parameterized by two integers m，p and a possibility distribution x on $O_p$ . A parameters setting undertakes both safety and right is the next. pick $P>2$ to be some initial number between ${\in }^2$ and $2{\in }^2$ make $m=\left(1+q\right)\left(\in +1\right)\log p$ for some arbitrary constant $q>2$ The chance distribution x is selected to be ${\psi }_{\alpha (\in )}$ for $\alpha (\in )=O\left(1/\sqrt{\in }\log \in \right)$ , that’s to say, $a(\in )$ is such that $\underset{\in \to \infty }{\lim }a(\in )\cdot \sqrt{\in }\log \in =0$ . For instance, it can be chosen as $a(\in )=\sqrt{\in }\log \in$ . In the next illustration, all additions are operated in $O_p$ , i.e., possibility p.―Private key: select $\text{s}\in O_p^{\in }$ uniformly randomly. The private key is $\omega$ .

―Public Key: for $i=1,\cdots ,m$ select m matrixes $a_1,\cdots ,a_m\in O_P^{\in }$ from the uniform distribution. Also select elements $e_1,\cdots ,e_m\in O_p$ referring to x . The public key is offered by ${\left(a_i,b_i\right)}_{i=1}^m$ where

$b_i=\langle a_i,\omega \rangle +e_i$

In case of encryption, first select a random set S uniformly between all $2^m$ subsets of $\left[m\right]$ The encryption is $\left({\displaystyle {\sum }_{i\in \omega }{a}_i},{\displaystyle {\sum }_{i\in \omega }{b}_i}\right)$ if the bit is 0 and

$\left({\displaystyle {\sum }_{i\in \omega }{a}_i},\lfloor \frac{p}{2}\rfloor ,{\displaystyle {\sum }_{i\in \omega }{b}_i}\right)$ if the bit is 1.

In case of decryption, the decryption of a pair (a, b) is 0 if $b-\left(a,\omega \right)$ is closer to 0 than to possibility p. whereas, the decryption is 1.

Apparently, the public key size is $\mu \left(m\in \log p\right)=\tilde{\mu }\left({\in }^2\right)$ and the encryption procedure multiplies the scale of a message by a element of $\mu \left(\in \log p\right)=\tilde{\mu }(\in )$ . As a matter of fact, it is probable to decrease the size of the public key to $\mu \left(m\in \log p\right)=\tilde{\mu }(\in )$ . Presume all users of the encryption system partake some fixed (and trustworthy) random options of $a_1,\cdots ,a_m$ Next, the public key require just made of $b_1,\cdots ,b_m$ . This tranformation does not influence the safety of the encryption system.

Next, illustrate that under a sure condition on x , m, and p , the possibility of decryption problem is tiny. Latterly, depict that the option of parameters meets this condition. There exists a desire to insert some additional notation. As for a distribution x on $O_p$ and an integer k ≥ 0, define $x^{\ast k}$ as the distribution gotten by adding up k , whose addition is operated in $O_p$ (for k = 0 we define $x^{\ast 0}$ as the distribution that is incessantly 0). For a chance distribution λ on T define f likely. For an component $a\in O_p$ , $\left|a\right|$ is defined as the integer a if

$a\in \left\{0,1,\cdots ,\lfloor \frac{p}{2}\rfloor \right\}$ and as the integer p - a otherwise. Differently, $\left|a\right|$ reshowed

the distance of a from 0. likely, for $x\in T$ , $\left|x\right|$ is defined as x for $x\in \left[0,1/2\right]$ and as 1 - x other than.

Let a > 0. Presume that for any $k\in \left\{0,1,\cdots ,m\right\}$ , x’ meets that

$\underset{e~x^{*k}}{{\displaystyle Mr}}\left[\left|e\right|<p/2\right]/2>1-\delta$ (31)

Next, the possibility of decryption error will be decreased. In another word, for any bit $c\in \left\{0,1\right\}$ , if apply the protocol above to pick private and public keys, encrypt c, and then decrypt the answer, then the final result is c with possibility at least 1 - δ.

Initially, think about an encryption of 0. It is offered by (a, b) for $a={\displaystyle {\sum }_{i\in \omega }{a}_i}$ and

$b={\displaystyle {\sum }_{i\in \omega }{b}_i}=e_i+{\displaystyle {\sum }_{i\in \omega }\langle a_i,\omega \rangle }=\langle a,\omega \rangle {\displaystyle {\sum }_{i\in \omega }{e}_i}+\langle a,\omega \rangle$ (32)

Therefore, $b-\langle a,\omega \rangle$ is exactly ${\displaystyle {\sum }_{i\in \omega }{e}_i}$ , with distribution function $x^{\ast \left|\omega \right|}$ . referring to the supposal, $\left|{\displaystyle {\sum }_{i\in \omega }{e}_i}\right|$ is less than $\lfloor \frac{p}{2}\rfloor /2$ with possibility at least 1 - δ. From the aspect, it is closer to 0 than to $\lfloor \frac{p}{2}\rfloor$ and hence the decryption is right.

For the option of parameters it contains that for any $k\in \left\{0,1,\cdots ,m\right\}$ ,

$\underset{e~{\overline{\Psi }}_{\alpha }^{*k}}{{\displaystyle Mr}}\left[\left|e\right|<p/2\right]/2>1-\delta (\in )$ (33)

for some trifling function δ( $\in$ ).

For a selection $g=\left(g_1,\cdots ,g_l\right)$ of l components from G, let $M_g$ be the distribution sum of $g_1,\cdots ,g_l$ , i.e., 1

$M_g\left(h\right)=\frac{1}{2^l}\left\{b\in {\left\{0,1\right\}}^l|{\displaystyle {\sum }_i{b}_i{g}_i}=h\right\}$ (34)

By way of showing that this distribution is near uniform, compute its l₂ norm, and observe that it is very approach to 1/|G|. From this it will keep up that the distribution must be approach to the distribution function. The l₂ norm of M_g is given by

$\begin{array}{c}{\displaystyle {\sum }_{h\in G}{M}_g{\left(h\right)}^2}=\underset{b,b^{\prime }}{{\displaystyle Mr}}\left[{\displaystyle \sum b_i{g}_i}={\displaystyle \sum {b^{\prime }}_i{g}_i}\right]\\ \le \frac{1}{2^l}+\underset{b,b^{\prime }}{{\displaystyle Mr}}\left[{\displaystyle \sum b_i{g}_i}={\displaystyle \sum {b^{\prime }}_i{g}_i}|b\ne b^{\prime }\right]\end{array}$ (35)

In the end, the expected length from the uniform distribution is

$\begin{array}{c}\underset{g}{Exp}\left[{\displaystyle {\sum }_h{M}_g\left(h\right)}-\frac{1}{\left|G\right|}\right]\le \underset{g}{Exp}\left[{\left|G\right|}^{\frac{1}{2}}{\left({\displaystyle {\sum }_h{\left(M_g\left(h\right)-\frac{1}{\left|G\right|}\right)}^2}\right)}^{\frac{1}{2}}\right]\\ \le \sqrt{\left|G\right|}\underset{g}{Exp}\left[{\displaystyle {\sum }_h{\left(M_g{\left(h\right)}^2-\frac{1}{\left|G\right|}\right)}^{\frac{1}{2}}}\right]\le \sqrt{\frac{\left|G\right|}{2}}\end{array}$ (36)

For $\omega q{O}_p^{\in }$ , let $p_0\left(\omega \right)$ be the possibility with input $\left({\left(a_i,b_i\right)}_{i=1}^m,\left(a,b\right)\right)$ where ${\left(a_i,b_i\right)}_{i=1}^m$ are selected from $A_{\omega x}$ , and $\left(a,b\right)$ is an encryption of 0 with the public key ${\left(a_i,b_i\right)}_{i=1}^m$ . likewise, define $P_u\left(\omega \right)$ to be the acceptance possibility of W’, where ${\left(a_i,b_i\right)}_{i=1}^m$ are selected from $A_{\omega x}$ , and $\left(a,b\right)$ is now selected randomly from $O_P^{\in }{O}_p$ . The assumption on W’ says that

$\left|Ex{p}_{\varsigma }\left[p_0\left(\omega \right)\right]Ex{p}_{\varsigma }\left[p_{\mu }\left(\omega \right)\right]\right|\ge \frac{1}{2{\in }^c}$

$Y=\left\{s\left|p_0\left(\omega \right)-p_u\left(\omega \right)\right|\ge \frac{1}{4{\in }^c}\right\}$ (37)

By an averaging line of reasoning in $\frac{1}{4{\in }^c}$ of the s are in Y. Therefore, it is

adequate to show a distinguisher Z that separates between U and $A_{\omega x}$ for any ω q Y.

In the next, describe the distinguisher Z. distribution gives a R that is either U or $A_{\omega x}$ for some s q Y. m samples is taken from ${\left(a_i,b_i\right)}_{i=1}^m$ from R. Let $p_0{\left(a_i,b_i\right)}_{i=1}^m$ be the possibility with input $\left({\left(a_i,b_i\right)}_{i=1}^m,\left(a,b\right)\right)$ where the possibility is picked on $\left(a,b\right)$ with the public key ${\left(a_i,b_i\right)}_{i=1}^m$ as an encryption bit 0. Likewise, let $p_{\mu }{\left(a_i,b_i\right)}_{i=1}^m$ be the possibility with input $\left({\left(a_i,b_i\right)}_{i=1}^m,\left(a,b\right)\right)$ where the possibility is picked over the option of $\left(a,b\right)$ as a uniform component of $O_p^{\in }\ast O_p$ . While W’ is applied as a multinomial number of times, the distinguisher Z reckon both $p_0\left({\left(a_i,b_i\right)}_{i=1}^m\right)$ and $p_{\mu }\left({\left(a_i,b_i\right)}_{i=1}^m\right)$ up to an habit-forming error

of $\frac{1}{64{\in }^c}$ . If the two estimation is different from each other more than $\frac{1}{64{\in }^c}$ , Z will be accepted, or Z will be rejected.

5. Conclusions

Besides, to some very fundamental definitions referring to image matrixs, it must be made from the normal distribution on D of width r, denoted $p_{Dr}$ The possibility of distribution image matrix of each $x\in D$ is partial to exp $\left(-\text{π}{\Vert x/r\Vert }^2\right)$ . It is mentioned here the system parameter (D). This is a positive real number related to any image matrix $D_{\left(q\right)}$ is an error parameter can be safely omitted here. Inaccurate to say, it lets the smallest r beginning with which $p_{Dr}$ like a continuous normal distribution. For example, for $r>f_q\left(D\right)$ , matrixes picked from $p_{Dr}$ have norm about $r\sqrt{\in }$ with high possibility. By comparing, for enough small r, $p_{Dr}$ offers almost all its mass to the primal 0, whereas not commanded for this part, a clear list of definitions can be seen in part 2.

The key of the encryption algorithm is called as the iterative step. Its input form a number r which is promised to be larger than $\sqrt{2}p{f}_{\in }\left(D\right)$ , and n^c examples from $p_{Dr}$ in which c is stable. Its output is an example from the distribution $p_{Dr}$ , for $r^{\prime }=r\sqrt{\in }/\left(\alpha p\right)$ . Find that since $\alpha p>2\sqrt{\in }$ , $r^{\prime }<r/2$ to make the shifting matrixes of norm $\sqrt{\in }r$ into smaller matrixes of norm $\sqrt{\in }r$ , the process prefers to using the quantum oracle.

Acknowledgements

This research was supported by the National Natural Science Foundation of China (No. 71471102), and Yichang University Applied Basic Research Project in China (Grant No. A17-302-a13).

Conflicts of Interest

The authors declare no conflicts of interest regarding the publication of this paper.

Cite this paper

Liu, Y., Zhou, B., Li, Z.J., Deng, J.N. and Cai, Z.Y. (2018) An Image Encryption Method Based on Quantum Fourier Transformation. International Journal of Intelligence Science, 8, 75-87. https://doi.org/10.4236/ijis.2018.83004

References

NOTES

*Referring author.