IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO.
1, MARCH 2010
Step Construction of Visual Cryptography Schemes
Feng Liu, Chuankun Wu, Senior Member, IEEE, and Xijun Lin
Abstract—Two common drawbacks of the visual cryptography
scheme (VCS) are the large pixel expansion of each share image
and the small contrast of the recovered secret image. In this paper,
we propose a step construction to construct VCSOR and VCSXOR
for general access structure by applying (2,2)-VCS recursively,
where a participant may receive multiple share images. The pro-
posed step construction generates VCSOR and VCSXOR which
have optimal pixel expansion and contrast for each qualified set
in the general access structure in most cases. Our scheme applies
a technique to simplify the access structure, which can reduce the
average pixel expansion (APE) in most cases compared with many
of the results in the literature. Finally, we give some experimental
results and comparisons to show the effectiveness of the proposed
scheme.
Index Terms—Secret sharing, step construction, visual cryptog-
raphy.
I. INTRODUCTION
T HE basic principle of visual cryptography scheme (VCS)
was first introduced by Naor and Shamir. The idea of the
visual cryptography model proposed in [1] is to split a secret
image into two random share images (printed on transparencies)
which separately reveal no information about the original secret
image. The secret image is composed of black and white pixels.
The original secret image can be recovered by superimposing
the two share images together. The underlying operation of such
a scheme is the logical operation OR. Generally, a -VCS
takes a secret image as input, and outputs share images that
satisfy two conditions: First, any out of share images can
recover the secret image; second, any less than share images
cannot get any information about the secret image.
Similar models of visual cryptography with different under-
lying operations have been proposed, such as the XOR operation
introduced in [2]–[6], and the NOT operation introduced in [7],
which uses the reversing function of the copy machines. Denote
as the XOR operation, as the OR operation, as
the AND operation, and as NOT operation; then, we have the
following relation between the operations XOR and OR:
Manuscript received June 03, 2009; accepted October 09, 2009. First pub-
lished December 01, 2009; current version published February 12, 2010. This
work was supported by China national 973 Project 2007CB807902 and Project
2007CB311202, by NSFC Grant 60873260 and Grant 60903210, and by China
National 863 Project 2009AA01Z414. The associate editor coordinating the re-
view of this manuscript and approving it for publication was Prof. Ton Kalker.
F. Liu and C. Wu are with The State Key Laboratory of Information Security,
Institute of Software, Chinese Academy of Sciences, Beijing 100190, China
(e-mail: liufeng@is.iscas.ac.cn; ckwu@is.iscas.ac.cn).
X. Lin is with the Department of Computer Science and Technology, Ocean
University of China, Qingdao 266100, China (e-mail: linxj77@is.iscas.ac.cn).
Digital Object Identifier 10.1109/TIFS.2009.2037660
1556-6013/$26.00 © 2010 IEEE
27
i.e., the XOR operation can also be achieved by the operation OR
and NOT, which is implemented by using a copy machine with
the reversing function.
In the following, we will consider the VCS both under the op-
erations XOR and OR. To simplify the discussion, the notion VCS
means a visual cryptography scheme regardless of the under-
lying operation, and we use the notations VCS and VCS
to denote the visual cryptography scheme with particular under-
lying operations XOR and OR respectively.
Traditionally, visual cryptography schemes are evaluated by
two parameters: the pixel expansion, which is the number of
subpixels that each pixel of the original secret image is encoded
into, and the contrast, which reflects the visual quality of the re-
covered secret image. From the point of view of the participants,
the pixel expansion is expected to be as small as possible, and
the contrast is expected to be as large as possible. Many studies
focused on improving the properties of pixel expansion and con-
trast [8]–[11], [7], [12]. Also studies have tried to trade the pixel
expansion for the contrast [13].
VCS
In this paper, we propose a step construction which generates
and VCS that, in most cases, have optimal pixel
expansion and contrast for each qualified set in the general ac-
cess structure. Because each participant in the proposed scheme
may have multiple share images with different pixel expansions,
so we introduce the notion average pixel expansion (APE, for-
mally defined in Section III). The proposed scheme can also re-
duce APE in many cases compared with the known results in the
literature. With our step construction, the VCS with general ac-
cess structure can be constructed only by applying a (2,2)-VCS
recursively, for both the OR and XOR operations. This result is
important for the reason that the construction of VCS for
the general access structure was once thought as impossible be-
fore. Finally, we give the experimental results and comparisons
to show the effectiveness of our scheme compared to the known
results in [14], [2].
The rest of this paper is organized as follows. In Section II, we
give some definitions about the VCS. In Section III, we propose
the step construction of VCS for the general access structure.
In Section IV, we give some experimental results and compar-
isons to show the effectiveness of our scheme, and the paper is
concluded in Section V.
II. PRELIMINARIES
Suppose all the participants of an access structure form a set
. The specification of all qualified and for-
bidden subsets of participants constitutes an access structure
. Denote as the set of qualified sets (the par-
ticipants in a qualified set can collaboratively recover the secret
image), and as the set of forbidden sets (the participants in
a forbidden set cannot recover the secret image). Obviously, we
have . In this paper, we only consider access
28 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO. 1, MARCH 2010

structures with , where is the power set is denoted by the number 1. We notice that the definitions of
of , i.e., the set of all the possible subsets of . The set VCS under OR and XOR operation are quite similar. We will give
is monotone because of that, if part of the participants in a set some definitions about visual cryptography under the operation
can recover the secret image, then obviously all the “ ”, which can either be the OR operation such as in [1] or the
participants in can recover the secret image as well. We de- XOR operation such as in [2]. In this paper, we use the subscripts
fine and for emphasizing different underlying operations
when necessary.
Because the proposed constructions in this paper are all based
and on the traditional -VCS, we first give the definition of the
traditional -VCS.
For a vector , denote as the Hamming
weight of the vector , i.e., the number of nonzero coordinates
We call the minimal qualified access structure, and a subset in . A -VCS, denoted by , consists of two col-
is called the minimal qualified set. We call the lections of binary matrices and . To share a white
maximal forbidden access structure, and a subset (respectively, black) pixel, a dealer (the one who sets up the
is called the maximal forbidden set. For any , define system) randomly chooses one of the matrices, called a share
. We call the matrix, in (respectively, ) and distributes its rows (rep-
closure of . Since is monotone, then . resenting a pattern of subpixels in the share image) to the
This means that the qualified access structure and the min- participants of the scheme, i.e., giving row to participant
imal qualified access structure are determined by each other. . More precisely, we give a formal definition of
Similarly, and can be determined by each other as -VCS as follows.
well. Furthermore, because , we have that Definition 1: Let and be nonnegative integers satis-
and can be determined by each other. So when we dis- fying . The two collections of binary matrices
cuss a general access structure, we only need to give discussions constitute a visual cryptography scheme -VCS
based on its minimal qualified access structure in the fol- if there exist a value and satisfies:
lowing of this paper. 1) (Contrast) Any participants can recover the secret image
Particularly, we call a qualified set that has the by stacking (the “ ” operation) their share images. More
largest cardinality the maximum qualified set of . Formally, precisely, for any , the stacking (the “ ” operation)
the maximum qualified set satisfies of any out of rows of is a vector that satisfies
. Note that, the maximum qualified set of may not be , whereas for any , we have .
, and there may be several maximum qualified sets in . 2) (Security) Any less than participants have no information
It should be pointed out that, the threshold access structure is a about the secret image. More precisely, for any
special case of the general access structure, because a threshold
in with , the two collections
access structure is a general access structure with the fol-
of matrices , , obtained by restricting
lowing constraints:
each matrix in , to rows , are
indistinguishable in the sense that they contain the same
matrices with the same frequencies.
and
In the above definition, is called the pixel expansion of the
scheme, and each secret pixel is represented by subpixels in
the recovered secret image. We denote and as the
pixel expansions under the operation OR and XOR, respectively.
In a VCS, there is a secret image which is encrypted into The defined above is called the contrast and is related to
some share images. The secret image is called the original secret
the visual quality of the recovered secret image. For different
image for clarity, and the share images are the encrypted images
operations OR and XOR, we use the notations and ,
(and are called the transparencies if they are printed out). When
respectively. In fact, there are several definitions about contrast
a qualified set of share images (transparencies) are stacked to-
in the literature; we use the simple one to simplify the discus-
gether properly, it gives a visual image which is almost the same
as the original secret image; we call this the recovered secret sion, and this definition of contrast has also been used in [1],
image. In the case of black and white images, the original se- [14], etc.
cret image is represented as a pattern of black and white pixels. The implementation of VCS has two phases: the distribution
Each of these pixels is divided into subpixels which themselves phase and the reconstruction phase. In the distribution phase,
are encoded as black and white to produce the share images. The the dealer generates all the share images and distributes them
recovered secret image is also a pattern of black and white sub- to the participants; in the reconstruction phase, the participants
pixels which should visually reveal the original secret image if reconstruct the secret image by stacking a qualified set of share
a qualified set of share images is stacked. images.
In this paper, we will focus on the black and white images, The (2,2)-VCS, for OR and XOR operations, respectively, is as
where a white pixel is denoted by the number 0 and a black pixel follows:
LIU et al.: STEP CONSTRUCTION OF VISUAL CRYPTOGRAPHY SCHEMES 29

Example 1: The -VCS : 2) (Security) Any forbidden set of participants has no infor-
mation about the secret image. More precisely, for any for-
bidden set , there exist a participant , then the
share images of set , after being adjusted, form a
and VCS under the Definition 1, where is a forbidden set of
the VCS under the Definition 1.
In the above definition, because a qualified set of share im-
ages may have different pixel expansion when they are stacked,
The (2,2)-VCS : they should first be adjusted to the same size, i.e., the share im-
ages should be expanded by replicating their sub-
pixels for times, respectively. The ad-
justing stacking makes sense because the share images need to
and be stored, and only need to be expanded when used to recover
the secret image. Apparently a smaller share image is more con-
venient to preserve. Furthermore, the VCS often carries impor-
tant secret information, however, it does not provide authenti-
In Example 1, for the (2,2)-VCS , the pixel expansion and cation ability. Hence, the participants should authenticate other
contrast are and , respectively, i.e., participants by other authentication means. Therefore, it is rea-
the size of the recovered secret image and share images will sonable to assume that the participants have authenticated each
be twice the size of the original secret image. The contrast of other before stacking their share images, i.e., they can know,
the recovered secret image will be half of that of the original in advance, the exact set of participants who are going to stack
secret image. For the (2,2)-VCS , we have that, their shares. According to the step constructions proposed in this
and , i.e., the recovered secret image is identical to paper (Construction 1, Construction 2, and Construction 3), any
the original secret image and the share images have no pixel participant can know, in advance, the size of other participants
expansion. share images. This also implies the reasonableness of the adjust
stacking.
III. STEP CONSTRUCTION OF VCS FOR GENERAL ACCESS According to the security condition of Definition 2, a for-
STRUCTURE bidden set of share images of VCS under Definition 2 is also
a forbidden set of share images under Definition 1, hence the
In this section, we give a formal definition of step construc- security condition of Definition 2 is no weaker than that of Def-
tion VCS. We propose the step construction of general access inition 1.
structure VCS in Construction 3, which is based on two sim- Note that, for the security condition of Definition 2, we only
pler step constructions: Construction 1 and Construction 2 in need to guarantee that any set in cannot recover the secret
Section III-A and Section III-C, respectively. image, because, for any forbidden set , there exists
a set in , denoted by , satisfying . It is clear that
A. Definition of Step Construction and Step Construction of if cannot get any information about the secret image, then
-VCS cannot either.
In this section, we first show the formal definition of step con- In a traditional VCS, each participant takes one share image
struction VCS, and then give a step construction of -VCS and all the share images have the same pixel expansion. How-
in Construction 1. ever, in the proposed construction of this paper, each of the par-
Recall that and are the minimal qualified access ticipants may take multiple share images with different pixel
structure and the maximal forbidden access structure of expansions. So, in the following part, we list the pixel expan-
, respectively. The formal definition of step sions of all the share images for each participant. We compute
construction VCS is as follows. the average pixel expansion (APE) as well, where the APE is
Definition 2: Denote as an access structure on the par- defined as the average value of the total pixel expansions of the
ticipant set . The step construction -VCS share images that each participant holds.
exists if there exist values and satisfying: Particularly, for a set of participants , we define the pixel
1) (Contrast) Any qualified set of participants can recover the expansion of as the largest pixel expansion of the share images
secret image by stacking (the “ ” operation) their share of . If is a qualified set, then define the contrast of as the
images. More precisely, for any share images in a quali- contrast of the recovered secret image after adjusting stacking.
fied set with pixel expansion The participants may have multiple share images, and dif-
, respectively, let , ferent qualified sets of share images may result in different con-
then the adjusting stacking (the “ ” operation) of the share trasts. So, in the following part of this paper, we will list all the
images can recover the secret image. possible contrasts of the proposed VCS.
If the secret pixel is black, the adjusting stacking (the To make things clearer, we give the following example for the
“ ” operation) of is a vector that satisfies step construction of (3,3)-VCS.
, whereas for a white secret pixel, we have Example 2: The step construction of (3,3)-VCS can be real-
. ized by applying traditional (2,2)-VCS twice. Denote the secret
30 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO. 1, MARCH 2010

Fig. 3. The construction tree for the (n; n)-VCS.

Fig. 1. The step construction of the (3,3)-VCS .

and

In Example 2, for the VCS in Fig. 2, the pixel expansion

of the share image is 2, and the pixel expansion of the share
images and is 4. So in the reconstruction phase, the par-
ticipants should first adjust (enlarge) the smaller share image
Fig. 2. The step construction of the (3,3)-VCS .
to which is of the same size as the other share ( or
). We call the share image the primary share image of
image of the (3,3)-VCS as , and denote and as the two . The dealer only needs to distribute the primary share im-
share images of the (2,2)-VCS by encrypting the secret image ages to the participants, because the participants can expand
. Then taking as the secret image of a new (2,2)-VCS, we their share images easily in the reconstruction phase. Hence,
get another two share images and . It is easy to verify for the VCS , the pixel expansions for the share images of
that the share images , , and constitute a (3,3)-VCS. the three participants are 2, 4, and 4, respectively, the average
Fig. 1 depicts the step construction of (3,3)-VCS . pixel expansion is APE , and
According to Fig. 1, the corresponding collections the contrast is . For the VCS , the pixel expan-
of share matrix of the (3,3)-VCS , denoted as sions are 1, 1, and 1, respectively, the average pixel expansion
, are as follows: is APE , and the contrast is .
For step construction of -VCS, we start with a (2,2)-
VCS, and by taking one of its share images as the secret image
of another (2,2)-VCS, we get a (3,3)-VCS; then we take one of
the newly generated share images as the secret image of another
and (2,2)-VCS, and so on, repeat the process times, and then
get an -VCS (Construction 1). The procedure can be de-
scribed by using the binary tree (Fig. 3). We call such a binary
tree the construction tree, and we call this kind of construction
the step construction.
Fig. 2 depicts the step construction of (3,3)-VCS . In a construction tree, once a (2,2)-VCS is applied, we gen-
According to Fig. 2, the corresponding collections erate two new share images out of a “secret image;” we call
of share matrices of the (3,3)-VCS , denoted as such a generation of share images the dividing generation. For
, can be as follows: example, the “secret image” is divided into two new share
images and .
Because the construction tree depicts how to generate the
share images precisely, hence in the proposed Constructions 1,
2, and 3 of this paper, we only provide the construction trees in-
stead of the detailed text descriptions for explicit access struc-
tures.
Formally, we give the following step construction of
-VCS.
LIU et al.: STEP CONSTRUCTION OF VISUAL CRYPTOGRAPHY SCHEMES 31

Construction 1: As the construction tree of Fig. 3 depicts, we in is represented by two black subpixels in , whereas
apply the traditional (2,2)-VCS for times which takes a white pixel in is represented by a black subpixel and a
as the secret images in turn, and distributes white subpixel in . Then adjust the share image to the
the share image images to the par-
ticipants, respectively. size of , and denote it as . Denoting the stacking result
For the step construction of VCS , the share images of the of and as , we have that recovers
-VCS may not have the same pixel expansions. So, in where a black pixel in is represented by four black sub-
the distribution phase, the dealer distributes the primary share pixels in , and a white pixel in is represented by three
images to the participants, and in the reconstruction phase, the
black subpixels and a white subpixel in . When we repeat
participants adjust the smaller share images to the size of the
the process for times, we have that the adjusting stacking of
largest share image before stacking. More precisely, the share
share images recovers the secret image
images should be expanded by
, and the contrast is and the pixel expansions
times, respectively.
of the share images are , which implies
For the step construction of VCS , because all the share
APE .
images have the same pixel expansion, the participants do not
Then we prove the security condition. Consider the share im-
need to adjust their share images.
ages . For any forbidden set ,
It should be pointed out that the construction trees of this
the participants of lack one of these share images. We
paper all satisfy that at most one of the two share images of a
prove that the share images form an
dividing generation is divided by other dividing generation, i.e.,
-VCS under the security condition of Definition 1.
there does not exist the case that both the two share images of a
For the XOR operation, the stacking of
dividing generation are divided by another dividing generation.
recovers the secret image,
The reason that we do not divide both the share images of
i.e., . We have that the
a dividing generation is to avoid the bad visual quality of the
share matrices corresponding to can
recovered secret image. In fact, if both the share images of a di-
be as follows:
viding generation are divided, then the newly generated share
images will not satisfy the contrast condition of Definition 2 (or
equivalently that of Definition 1) any more, and the newly gener-
ated share images will form a probabilistic visual cryptography
scheme (PVCS), which was introduced in [15] and [16]. How-
ever, the PVCS has bad visual quality of the recovered secret .. ..
image, and Yang et al. has pointed out the phenomenon in [15] . .
and given some simulations about the visual quality of PVCS.
We conclude the above discussion as the following theorem. and
Theorem 1: Construction 1 is a step construction of
-VCS which is realized by applying traditional (2,2)-VCS
recursively for times. For VCS , the pixel expansion
for each share image is , and the APE of the
VCS is APE , and the contrast is . .. ..
. .
For VCS , the pixel expansions for the share images are
, and the APE of the VCS is
where a simple example of can be
APE , and the contrast is .
found in Example 2.
Proof: In order to prove that Construction 1 is a step con-
It is easy to verify that satisfy
struction of -VCS, we need to prove that it satisfies the
the security condition of Definition 1, where by deleting one
contrast and security conditions of Definition 2.
row of the share matrices in and ,
First, we prove the contrast condition. According to the con-
struction tree of Fig. 3, for the VCS , the adjusting stacking we will get the same collection of submatrices; i.e., is a
forbidden set of the -VCS under the Definition 1. Hence,
procedure is as follows: The stacking result of the share images
also satisfy the security condition of
and is , and the stacking result of and
is . When we repeat the process for times, we have that Definition 2.
the stacking result of the share images For the OR operation, similarly, we have that the share ma-
recovers the secret image , which means that, a black pixel trices corresponding to can be as fol-
in the secret image is represented by a black pixel and a white lows:
pixel in the secret image is represented by a white pixel. Hence,
we have and the pixel expansions of all the share
images equal to 1, which implies APE .
For the VCS , the adjusting stacking procedure is as fol-
lows: According to the share matrices in Example 1, we have
that the stacking result of the share images and , de-
noted by , recovers the . More precisely, a black pixel
32 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO. 1, MARCH 2010

and Definition 4 [17, Definition 2.2]: Denote as an access

structure on participant set . Let be the
quotient set of on the equivalence relation . We call
the simplified access structure
on , where is the equivalence class of (simply we call the
corresponding participant of , and the set
is called the corresponding set of ). When , we
call the most simplified access structure.
At this point, we can construct VCS for the most simpli-
where a simple example of can be found fied access structure instead of the original access structure. To
in Example 2. demonstrate how to simplify an access structure, we give the
It is easy to verify that satisfy the following example.
security condition of Definition 1 via simple inductive proof, Example 3: For the access structure
where by deleting one row of the share matrices in on , we
have that, , hence, we have 4 and
and , we will get the same collection of submatrices,
3. Then . We can distribute the
i.e., is a forbidden set of the -VCS under the Definition
identical share images to participants 1 and 4 (respectively, 2
1. Hence, also satisfy the security con-
and 3). Hence, we only need to construct a (2,2)-VCS for the
dition of Definition 2.
access structure . Then distribute the first share image to
From Theorem 1, for the -VCS , it is easy to see that,
participants 1 and 4, and the second share image to participants
the largest pixel expansion of the share images is .
2 and 3. Hence, we constructed a VCS for the access structure
The pixel expansion grows exponentially on the number of the
by constructing VCS for its simplified access structure .
participants . However, it is still the optimal value. This is seen
According to Definitions 3 and 4, the following Theorem 4
in [1, Theorem 4.3]. (Another study [11] about the contrast of
becomes obvious.
-VCS confirms this bound).
Theorem 4: Let be an access structure with equivalent
Theorem 2 ([1]): In any -VCS
participants on the participant set , denote as the quotient
and .
set of on the equivalent relation . Let
Note that the study in [1] did not consider the technique of ad-
, we have that by distributing the share images
justing stacking. Theorem 1 confirms Theorem 2 after adjusting
of corresponding participants to the equivalent participants, a
the size of the share images of Construction 1.
construction of VCS for the is also a construction of VCS
For the -VCS , according to Definition 1, it is ob-
for .
vious that, and . Hence, the step
Definition 4 and Theorem 4 provide a technique to simplify
construction for the -VCS also generates the VCS
the access structure .
with optimal pixel expansion and optimal contrast
. C. Step Construction of VCS for Access Structure
The above discussions can be summarized as the following Such that
theorem.
In this section, we give Construction 2 for the particular ac-
Theorem 3: The step construction of Constriction 1 gener-
cess structure such that
ates the -VCS and -VCS with optimal pixel
, and then discuss its contrast and pixel expan-
expansion and contrast.
sion properties.
Construction 2: For the access structure
B. Simplifying the Access Structure by Using Equivalent
, where ,
Participants
let and denote
Now, we introduce the concept of equivalent participants as the maximum value of for all , i.e.,
(equivalent participants can be viewed as the participants who . Two methods (Method 1 and
have the same rights). Participant is equivalent to in a secret Method 2) of step construction for the are depicted by the
sharing scheme means that they can be assigned to identical construction trees of Figs. 4 and 5, respectively.
shares without affecting the access structure of the secret Method 1: In the construction tree of Fig. 4, the dealer
sharing scheme. Formally, we define the equivalent participants distributes the share images to the participants
as follows. . For all , if , distributes to the
Definition 3 [17, Definition 2.1]: Denote as an access participant in , else for every , let , takes as
structure on participant set . If participants the secret image and generates the share images for as Fig. 4
and satisfy that, for hold iff hold, depicts (i.e., the subtree in the dashed box is changeable for the
then participants and are called to be equivalent participants sets in ), and distributes the share images of
on , denoted by . and to the participants in .
It is easy to verify that is an equivalence relation on . Then Method 2: In the construction tree of Fig. 5, for the step con-
we can simplify the access structure based on the equivalent struction based on the OR operation, in the left branch of the
participants as follows: construction tree, the share image is obtained by expanding
LIU et al.: STEP CONSTRUCTION OF VISUAL CRYPTOGRAPHY SCHEMES 33

Fig. 6. The construction tree of Method 1 for 0 .

Fig. 4. The construction tree of Method 1.

Fig. 7. The construction tree of Method 2 for 0 .

According to the two methods of step construction of Figs. 4

and 5, we know that the pixel expansion of each share image is
at most . The difference between the two construction
trees of Method 1 and Method 2 is that, the construction tree
of Method 1 first generates the share images for participants
, whereas the construction tree of the Method 2 first
generates the share images for the participants in .
Generally, in this paper, a construction tree for a qualified
set is a binary tree that contains all the share images that
Fig. 5. The construction tree of Method 2. distributed to the participants in . A construction tree for an
access structure is a binary tree with several changeable subtrees
(see examples in Figs. 4, 5, 6, and 7).
the share image to its double pixel expansion. For the XOR According to the construction tree of Method 2 (Fig. 5), we
operation, the share image is identical to the share image define another way of generating share images, called the trans-
. mitting generation, where the information of a share image is
For all , if , the dealer distributes to duplicated to another share image with or without pixel ex-
the participant in , else for every , let , the dealer pansion. In Fig. 5, the generation of share image out of
takes as the secret image and generates the share images is of this kind. Precisely, if the underlying
for as Fig. 5 depicts (i.e., the subtree in the dashed box is operation is XOR, then the share image is identical to ,
changeable for the sets in ), and distributes the share images and if the underlying operation is OR, then the share image
of and to the participants in . If , then is generated by duplicating each pixel in twice.
distributes share image to the participant , else distributes Together with the dividing generation defined in
the share images and to the Section III-A, we have two ways of generating share images
participants . in the construction trees of this paper. Note that, the dividing
It is clear that, the step construction of -VCS is just a generation of this paper generates at least one share image
special case of Construction 2. that will be distributed to the participants, and the transmitting
Note that, the participants are distributed with only generation does not generate share images that will be
one share image, and the participants that appear in access struc- distributed to the participants.
ture may be distributed with more than one share images. In In light of the above discussions, we have the following the-
the rest of this paper, we will use the indexes of the participants, orem.
directly, in the construction trees. In such a case, it is easy to Theorem 5: Construction 2 is a step construction of VCS for
obtain the number of share images that are distributed to each the access structure such that
participant by counting the number of times that each partici- , which is realized by applying tradi-
pant appears in the construction trees. tional (2,2)-VCS recursively.
34 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO. 1, MARCH 2010

Proof: In order to prove that Construction 2 is a step con- Proof: First, consider the step construction of Method 1.
struction of VCS for access structure such For the VCS , because the pixel expansion and contrast
that , we need to prove that it for each qualified set in are and , this
satisfies the contrast and security conditions of Definition 2. means that they reach their optimal values.
First, we prove the contrast condition. For both Method 1 and For the VCS , according to the construction tree in Fig. 4,
Method 2, according to Figs. 4 and 5, the step construction of the for any , the height of the construction tree is ,
sets are processed independently, i.e., for each , and there exist dividing generations in the construction
let , then the step construction of the set tree. We have that, the pixel expansion of the qualified set is
forms a step construction of -VCS. Then , and the contrast of is .
according to Theorem 1, the contrast property of Definition 2 is According to Theorem 2, they reach their optimal values.
satisfied. Second, consider the step construction of Method 2.
Second, we prove the security condition. For a forbidden set For the VCS , because the pixel expansion and contrast
of participants , there exist a participant , by for each qualified set in are and , this
similar discussion of Theorem 1; i.e., when we list all the share means that they reach their optimal values.
matrices, we have that the share images of form a VCS For the VCS , because the number of dividing generations
under Definition 1, where is a forbidden set of the VCS under in the construction tree of is , we have that the con-
the Definition 1. Hence, the security condition of Definition 2 is trast of is , which reaches its optimal value
satisfied. according to Theorem 2.
We then discuss the pixel expansion and contrast properties Recall that in Construction 2, for any maximum qualified
of the VCS and VCS that constructed by the step con- set , we have , and
struction of Method 1 and Method 2. , i.e., . Because the height of the
For the VCS as Figs. 4 and 5 depict, for any qualified set construction tree in Fig. 5 is , we have that, the pixel
, there is a corresponding construction tree. Note that, expansion of is , which reaches
the share images that are distributed to the participants of are its optimal value according to Theorem 2.
all the leaves of the construction tree. Because both the transmit- From Theorem 6 it is noted that, Method 2 may not al-
ting generation and dividing generation expand the share image ways generate optimal pixel expansion for each qualified set
to twice its original size, denote as the height of the construc- in -VCS . However, Method 2 is still useful, because
tion tree, then the pixel expansion of is . Be- Method 2 can generated VCS with smaller average pixel
cause the dividing generation applies the (2,2)-VCS which re- expansion (APE) in some cases.
duces the contrast of the recovered image to the half of its orig- Recall that the average pixel expansion (APE) of VCS is
inal value, and the transmitting generation does not affect the defined as the average value of the total pixel expansions of
contrast of the recovered image, when we denote the number of the share images each participants holds. Define the multiset
dividing generations in the construction tree of as , we have ; denoting APE and APE as the APE of
that the value of contrast of the recovered secret image by ad- Method 1 and 2 in Figs. 4 and 5 respectively, we have
justing stacking the share images of is . For the
VCS , similar to the above discussion, the pixel expansion
of all the share images is equal to , and the contrast
is .
In light of the above discussion, we get the following theorem. and
Theorem 6: The step construction of Construction 2 gener-
ates VCS with the following pixel expansion and contrast.
For the step construction of Method 1, the values of pixel
expansion and contrast are optimal for each qualified set of
both for the VCS and VCS ; i.e., for any qualified set
, the pixel expansion and contrast of satisfy that
and . The above values of APE and APE can easily be verified since
For the step construction of Method 2, we have the following: they are the sum of the pixel expansion of the leaves in the con-
a) The values of pixel expansion and contrast are optimal struction trees.
for each qualified set in for the VCS , i.e., for any Hence, for different and , the dealer can choose the
qualified set , the pixel expansion and contrast of method with APE APE APE according to dif-
satisfy ; ferent requirements.
b) The value of contrast is optimal for each qualified set in
for the VCS , i.e., for any qualified set , the D. Step Construction of VCS for General Access Structure
contrast of satisfies ; In this section, we give the step construction of VCS for gen-
c) The value of pixel expansion is optimal for the maximum eral access structure based on the assess structure simplifying
qualified set of for the VCS , i.e., let be a max- technique and Construction 2.
imum qualified set of , the pixel expansion of satis- Note that, a general access structure can be divided into
fies . several parts where each part has the form
LIU et al.: STEP CONSTRUCTION OF VISUAL CRYPTOGRAPHY SCHEMES 35

TABLE I
EXPERIMENTAL RESULTS AND COMPARISONS

such that ; i.e., each part Remark: In the above Construction 3, we call the participant
satisfies the condition of Construction 2. Hence, each part can and the share image the virtual participant and virtual share
be constructed by applying Construction 2. However, in order image, respectively.
to construct a step construction of VCS with smaller APE, we To show how Construction 3 works, we give the following
also need to apply the access structure simplifying technique example.
introduced in Section III-B. Example 4: Let . Be-
Construction 3: For a general access structure , the cause is already the most simplified access structure and it
dealer generates the construction trees of the step construction satisfies the condition of Construction 2, we have
of -VCS by executing the following steps: , treat as a virtual participant , then
Step 1) Simplify to according to Theorem 4; can be represented by . Apply Construction 2 for
Step 2) Divide into several parts with each part being in , i.e., apply the (2,2)-VCS, and denote the share image
the form such that distributed to as . Take as the secret image, and construct
; a step construction of VCS for . We divide into two parts
Step 3) For each part, let and . For the first part, because 4,
and . If , we apply a (2,2)-VCS and distribute the first share image to par-
then apply Construction 2 directly on , and the ticipants 3 and 4 and the second share image to the participant
construction is done. Else treat as a participant 2. For the second part, we apply a (2,2)-VCS and distribute the
in , by applying Construction 2, we have two two share images to participant 3 and 4, respectively.
cases: The pixel expansions and contrasts of the above construction
1) If Method 1 of Construction 2 is used, denote the can be found in Table I.
share image that distributed to as , goto Step Because Theorem 4 simplifies the access structure , Step
1 for a new step construction of VCS, which 1 reduces the number of qualified sets in , and hence reduces
takes as the secret image, for the access struc- the number of dividing generations in the construction trees of
ture . Construction 3.
2) If Method 2 of Construction 2 is used, denote In Step 2, since each part of satisfies the condition of Con-
the share image that distributed to as , and struction 2, Construction 3 seems to terminate at Step 2. How-
denote as the cardinality of the maximum ever, in order to obtain a smaller APE, the dealer needs to further
set of , i.e., . divide each , i.e., Construction 3 needs to be recursively ap-
We insert transmitting generations be- plied until all the participants receive their share images for all
tween the secret image and the subtree corre- the qualified sets in .
sponding to the participant set , and We claim that there always exist partitions for a general ac-
goto Step 1 for a new step construction of VCS, cess structure where each part satisfies the condition of Con-
which takes as the secret image, for the access struction 2. In order to show the feasibility of Construction 3,
structure . we give, for example, a simple partition method for a general
Step 4) Repeat Steps 1, 2, and 3 until all the participants access structure . Suppose . Let
receive their share images for all the qualified sets be the collection of all the sets
in . which are chosen from and contain the participant 1, i.e.,
36 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO. 1, MARCH 2010

. Let be the collection of all the c) The value of pixel expansion is optimal for the maximum
sets which are chosen from (i.e., the remaining set qualified set of for the VCS , i.e., let be a max-
of by removing ) and contain the participant 2. Similarly, imum qualified set of , the pixel expansion of satis-
let be the collection of all the sets which are chosen from fies .
and contain the participant . Because there Proof: Recall that is the simplified access structure of
are participants in total, we have , , for any qualified set , let be the corresponding
and each satisfies the condition of Construction 2. set in . We first prove that the optimal values of the pixel
As a summary, we give the following theorem. expansion and contrast for are also optimal for .
Theorem 7: Construction 3 is a step construction of VCS for For the VCS , according to Definition 4 in Section III-B, we
general access structure , which is realized by applying tra- have that, , i.e., each participant in is
ditional (2,2)-VCS recursively. replaced by its corresponding participant in . Hence, we have
Proof: In order to prove that Construction 3 is a step con- . According to Theorem 2 in Section III-A, we have
struction of VCS for general access structure , we need to that the optimal values of pixel expansion and contrast of are
prove that it satisfies the contrast and security conditions of Def- and . Because , we
inition 2. have that the optimal values of the pixel expansion and contrast
First, we prove the contrast condition. Note that in Construc- for are also optimal for .
tion 3, the access structure is divided into several parts. Con- For the VCS , because the optimal values of the pixel ex-
struction 2 is applied recursively to generate the share images pansion and contrast of are and , they
for each part. For any qualified set , it belongs to one are the optimal values of the pixel expansion and contrast of
part. When applying Construction 2, the share images and vir- as well.
tual share images are distributed to the participants of and Given the above, we only need to prove the theorem for the
the virtual participants, respectively. The virtual share images simplified access structure .
are further divided in the next execution of Construction 2 until Construction 3 applies Construction 2 recursively, and each
all the participants of receive their share images. Hence, ac- time when Construction 2 is applied, it generates several share
cording to Theorem 5, the secret image and all the virtual share images and a virtual share image (if it exists). For a qualified set
images can be recovered by adjusting stacking the share images , without loss of generality, assume that Construction 3
that distributed to . Furthermore, according to Theorem 4, for generates all the share images for by applying Construction
any qualified set in , there exists a corresponding set in , 2 for times. Let such that
i.e., the share images of any qualified set in can recover the for , where is the the set of share
secret image. Hence, the contrast condition of Definition 2 is images that generated by the th execution of Construction 2.
satisfied. We have that the construction tree of is formed by connecting
Second, we prove the security condition. For a forbidden set the corresponding trees of , one by one, at the virtual
of participants , there exist a participant ; by share images.
similar discussion of Theorem 1, i.e., list all the share matrices, Particularly, if only Method 1 is used when applying Con-
we have that the share images of form a VCS under struction 2, we have:
Definition 1, where is a forbidden set of the VCS under the For the VCS , because the pixel expansion and contrast
Definition 1. Hence, the security condition of Definition 2 is for each qualified set in are , hence
satisfied. they reach their optimal values.
Then we consider the pixel expansion and contrast properties For the VCS , note that, the construction tree of is gen-
of the -VCS generated by applying Construction 3; we give erated only by dividing generations. Each dividing generation
the following theorem. generates one share image except the last dividing generation
Theorem 8: The step construction of Construction 3 gener- which generates two share images. Hence, there are
ates VCS with pixel expansion and contrast as follows. dividing generations in the construction tree.
If only Method 1 of Construction 2 is used in Construction 3, Hence, the contrast of the is . We have that,
then the values of pixel expansion and contrast are optimal for the height of the construction tree of is , i.e., the pixel ex-
each qualified set of both for the VCS and VCS , i.e., pansion is . According to Theorem 2, both
for any qualified set , the pixel expansion and contrast of and reach their optimal values.
satisfy and Once Method 2 is used when applying Construction 2, we
. have:
Once Method 2 of Construction 2 is used in Construction 3, For the VCS , because the pixel expansion and contrast
then: for each qualified set in are , hence
a) The values of pixel expansion and contrast are optimal they reach their optimal values.
for each qualified set in for the VCS , i.e., for any For the VCS , the number of dividing generations in the
qualified set , the pixel expansion and contrast of construction tree of is , and that of
satisfy . is . Hence, the number of dividing generations in the
b) The value of contrast is optimal for each qualified set in construction tree of is ,
for the VCS , i.e., for any qualified set , the we have that the contrast of is , which is
contrast of satisfies . optimal according to Theorem 2.
LIU et al.: STEP CONSTRUCTION OF VISUAL CRYPTOGRAPHY SCHEMES 37

For the VCS , and for any maximum qualified set , IV. EXPERIMENTAL RESULTS AND COMPARISONS FOR UP TO
assume that is the first set of share images gen- FOUR PARTICIPANTS
erated by using Method 2 of Construction 2, i.e., the share im- Note that, different partition methods of the access structure
ages of are all generated by using Method 1 will result in different values of APE. However, it is quite
of Construction 2. At the point when Method 2 is used, denoting complicated to find a general partition method to obtain the min-
as the access structure when using Method 2 of Construction imal average pixel expansion APE of the step construction of
2, we have . Then the -VCS. Here we only give the APE of the VCS for the
is the maximum set of , the reason is as follows. access structures with up to four participants (Table I) by com-
For any set , we have . puting search. We also compare these results to the well-known
Because is the maximum results in the literature [14], [2].
qualified set of , by deleting the same number of elements In Table I, the total pixel expansion and pixel expansion of
from each set in , then has the largest each share of each participant are listed in sequence. For ex-
cardinality, i.e., is the maximum set of . ample, the pixel expansion for the access structure
According to the second case of Step 3, we have that the height means that the third participant re-
of the construction tree that corresponds to ceives two share images with pixel expansions 2 and 4, respec-
is . Hence, the height of the construction tively, and the total pixel expansion is obtained by .
tree that corresponds to is , i.e., the pixel expansion of For the VCS , the values in brackets in the column APE
is , which reaches its optimal value according to and of Table I are from the paper [14]. It is obvious that,
Theorem 2. our construction improves the properties with regard to the APE,
The following example demonstrates how Construction 3 pixel expansion, and contrast in most cases. For VCS , the
works. values in brackets in the column APE and of Table I
Example 5: Let are from the paper [2]; we only compare the threshold access
. For the step construction of Construc- structure, because there is no known construction of VCS
tion 3 which only uses Method 1, the construction trees are for the general access structure.
shown in Fig. 6. We also provide the partition method of the access structures
For the VCS , the APE by using a semicolon between different parts of the qualified
, note that participants 4 and 5 are distributed with sets, where each part satisfies the condition of Construction 2.
the same share image since they are equivalent participants for
the access structure . The pixel expansion for V. CONCLUSION
the qualified sets is 8, and In this paper, we proposed the step construction of VCS for
the contrast is , which are optimal for a qualified set with general access structure which improves the pixel expansion and
four participants according to Theorem 2. The pixel expansion contrast properties compared with many of the known results in
for qualified set is 4, and the contrast is which are the literature. According to the step construction proposed in
also optimal for a qualified set with three participants according this paper, the VCS with general access structure can be con-
to Theorem 2. structed by only applying (2,2)-VCS recursively, regardless of
For the VCS , the pixel expansion and contrast for each whether the underlying operation is OR or XOR, where a par-
qualified set are 1 and 1, respectively, which are optimal. ticipant may receive multiple share images. This result is most
Once Method 2 is used when applying Construction 2 in the interesting, because the construction of VCS for general
step construction of Construction 3, the construction trees are access structure has never been claimed to be possible before.
shown in Fig. 7. The proposed construction can generate optimal VCS and
For the VCS , we have the APE VCS for each qualified set in , and our schemes can also
, which is smaller than that of reduce the APE in most cases compared with the known results
Method 1; note that participants 4 and 5 are distributed with in the literature. However, how to efficiently partition the access
the same share image since they are equivalent participants structure to reduce the APE to the minimum remains as an open
for the access structure . The contrast of the problem.
set is which is optimal for a qualified set with Note that it is easy to adjust the pixel expansion of the shares
three participants according to Theorem 2. The contrast of the for every participant to the same. However, this will likely to
maximum qualified sets is sacrifice the low APE of the proposed VCS.
, which is optimal for a qualified set with four participants
according to Theorem 2. However, the pixel expansion of ACKNOWLEDGMENT
the qualified set is 8 which is larger than its optimal The authors would like to thank the anonymous reviewers for
value 4. The pixel expansion for the maximum qualified sets their valuable comments.
is 8, which is optimal for a
qualified set with 4 participants according to Theorem 2. REFERENCES
For the VCS , the pixel expansion and the contrast for [1] M. Naor and A. Shamir, “Visual cryptography,” in EUROCRYPT’94,
each qualified set are 1 and 1, respectively, which are optimal. Berlin, 1995, vol. LNCS 950, pp. 1–12, Springer-Verlag.
38 IEEE TRANSACTIONS ON INFORMATION FORENSICS AND SECURITY, VOL. 5, NO. 1, MARCH 2010
[2] P. Tuyls, H. D. L. Hollmann, J. H. van Lint, and L. Tolhuizen,
“Xor-based visual cryptography schemes,” Designs Codes and Cryp-
tography, vol. 37, pp. 169–186, 2005.
[3] E. Biham and A. Itzkovitz, “Visual cryptography with polarization,” in
The Dagstuhl Seminar on Cryptography, Sep. 1997.
[4] E. Biham and A. Itzkovitz, “Visual cryptography with polarization,” in
RUMP Session of CRYPTO’98, 1997.
[5] P. Tuyls, T. Kevenaar, G. J. Schrijen, T. Staring, and M. V. Dijk, “Secu-
rity displays enabling secure communications,” in First Int. Conf. Per-
vasive Computing, Boppard, Germany, 2004, vol. 2802, pp. 271–284,
Berlin Springer LNCS.
[6] S. S. Lee, J. C. Na, S. W. Sohn, C. Park, D. H. Seo, and S. J. Kim, “Vi-
sual cryptography based on an interferometric encryption technique,”
ETRI Journal, vol. 24, no. 5, pp. 373–380, 2002.
[7] D. Q. Viet and K. Kurosawa, “Almost ideal contrast visual cryptog-
raphy with reversing,” Topics in Cryptology—CT-RSA, pp. 353–365,
2004.
[8] S. Droste, “New results on visual cryptography,” in CRYPTO’96, 1996,
vol. 1109, pp. 401–415, Springer-Verlag LNCS.
[9] C. Blundo, A. De Santis, and D. R. Stinson, “On the contrast in vi-
sual cryptography schemes,” J. Cryptology, vol. 12, no. 4, pp. 261–289,
1999.
[10] S. Cimato, R. De Prisco, and A. De Santis, “Optimal colored threshold
visual cryptography schemes,” Designs, Codes and Cryptography, vol.
35, pp. 311–335, 2005.
[11] M. Krause and H. U. Simon, “Determining the optimal contrast for
secret sharing schemes in visual cryptography,” Combinatorics, Prob-
ability Comput., vol. 12, no. 3, pp. 285–299, 2003.
[12] H. Koga, “A general formula of the (t,n)-threshold visual secret
sharing scheme,” in ASIACRYPT’2002, 2002, vol. 2501, pp. 328–345,
Springer-Verlag LNCS.
[13] C. N. Yang and T. S. Chen, “Size-adjustable visual secret sharing
schemes,” IEICE Trans. Fundamentals, vol. E88-A.NO.9, pp.
2471–2474, 2005.
[14] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, “Visual cryp-
tography for general access structures,” Inf. Computation, vol. 129, pp.
86–106, 1996.
[15] C. N. Yang, “New visual secret sharing schemes using probabilistic
method,” Pattern Recognit. Lett., vol. 25, pp. 481–494, 2004.
[16] S. Cimato, R. De Prisco, and A. De Santis, “Probabilistic visual cryp-
tography schemes,” Computer J., vol. 49, no. 1, pp. 97–107, 2006.
[17] X. M. Chen, “On the simplification of the access structure secret
sharing schemes (in chinese),” China Sci. Bulletin, vol. 15, pp.
1599–1603, 1999.
Feng Liu received the bachelor degree in computer
science from Shandong University, in 2003, and the
Ph.D. degree in information security from the Insti-
tute of Software, Chinese Academy of Sciences, in
2009.
He is now an Assistant Professor with the Institute
of Software, Chinese Academy of Sciences. His re-
search interests include visual cryptography and de-
sign and analysis of security protocols.
Chuankun Wu (M’99–SM’00) received the B.Sc.
degree, the M.Sc. degree, and the Ph.D. degree in en-
gineering in 1985, 1988, and 1994, respectively.
Since January 1988, he has been teaching at
Xidian University, China. He was promoted by
Xidian University to Lecturer in 1990, Associate
Professor in 1992, and Full Professor in 1995. In
September 1995, he became a postdoctoral fellow
at Queensland University of Technology, then in
1997 a research fellow at the University of Western
Sydney, and in 2000 a Lecturer in the Department
of Computer Science, Australian National University. In 2003, he joined the
Institute of Software, Chinese Academy of Sciences, as a Research Professor in
the State Key Laboratory of Information Security. His current research interests
include Boolean functions, wireless network security, and group-oriented
cryptography.
As a cofounder, Dr. Wu has served as a program chair for the 2001, 2002,
and 2003 International Workshop on Cryptology and Network Security (CANS)
which has become a regular annual conference since 2005. He has served as
an Associate Editor of IEEE COMMUNICATIONS LETTERS since 2001. He is a
member of the editorial board of the International Journal of Network Security,
and was invited to be a guest editor for a number of special journal issues, in-
cluding the 2008 and 2009 issues of IEICE-Special Section on Information and
Communication System Security.
Xijun Lin received the Masters degree in computer
science from Ocean University of China, in 2004, and
the Ph.D. degree from the Institute of Software, Chi-
nese Academy of Sciences, in 2008.
His research interests include cryptography and in-
formation security.