The insufficiency of statistical analysis as security proof in image encryption: A comparative analysis with the IND-CPA security model

Abstract

The majority of studies in the field of image encryption attempt to prove the security of proposed encryption methods through statistical tests such as entropy, NPCR (Number of Pixels Change Rate), UACI (Unified Average Changing Intensity), correlation coefficient, and histogram analysis. In this study, it is experimentally demonstrated that these statistical tests alone are insufficient to prove cryptographic security. For this purpose, a logistic map-based XOR encryption algorithm is implemented in two different configurations: System-A (deterministic, without IND-CPA security) and System-B (using a random initialization vector, designed to satisfy the structural precondition for IND-CPA security). Experiments conducted on five standard test images (baboon, pepper, plane, splash, ship) from the USC SIPI dataset reveal that both systems pass statistical tests with nearly identical values. However, IND-CPA security game analysis, evaluated over 1000 trials using three independent discrimination strategies (pixel-based L2 distance, structural similarity (SSIM), and a machine learning-based discriminator), proves that System-A can be completely broken by a chosen-plaintext attack (adversary advantage = 1.000), while System-B consistently yields low adversary advantage (ranging from 0.004 to 0.076 across test images and discriminators), statistically indistinguishable from random guessing and consistent with the operational conditions of IND-CPA security. The results clearly demonstrate that while statistical analyses are useful for evaluating the visual quality of encryption, cryptographic security can only be established through cryptanalysis methods.