Impulse-Step Differential Attack

• ISBDA is a differential attack that leverages the impulse-input and step-output behavior in plaintext non-delayed chaotic ciphers to recover key components such as pre-permutation and diffusion layers.
• The attack exploits a single plaintext impulse that results in a deterministic step output, enabling attackers to map internal positions and systematically dismantle the cipher’s structure.
• ISBDA’s effectiveness is demonstrated on a three-stage permutation-diffusion-permutation model, highlighting vulnerabilities even when standard statistical metrics indicate secure diffusion.

Searching arXiv for the cited paper to ground the article and citations. Impulse-step-based differential attack (ISBDA) is a chosen-plaintext differential attack introduced for plaintext non-delayed chaotic ciphers (PNDCCs), a class of sequential chaos-based image ciphers whose diffusion stage depends on the current plaintext symbol and previous ciphertext but contains no plaintext delay term. In the formulation examined in "Cryptanalysis and design for a family of plaintext non-delayed chaotic ciphers" (Wang et al., 14 Sep 2025), ISBDA exploits an impulse-input / step-output condition: a one-position plaintext differential, after the pre-permutation, induces a ciphertext differential that is zero before a certain internal index and nonzero from that index onward. This deterministic time-domain behavior allows recovery of the pre-permutation, after which the diffusion and post-permutation can also be recovered in the worked three-stage permutation-diffusion-permutation example (Wang et al., 14 Sep 2025).

1. Placement within plaintext non-delayed chaotic ciphers

A PNDCC is defined by a diffusion equation of the form

$$C(k) = f_D\big(P(k), C(k-1), K(k)\big), \quad k = 1,\dots, MN,$$

where $P(k)$ is the permuted plaintext pixel at position $k$, $C(k)$ is the ciphertext pixel, $C(k-1)$ is a ciphertext feedback term, and $K(k)$ is key material, typically derived from chaotic maps (Wang et al., 14 Sep 2025). The defining structural property is that the diffusion equation contains no plaintext delay term such as $P(k-1)$ or $P(k-2)$, but does contain ciphertext feedback.

The broad cipher family discussed in the source paper follows a classical permutation-diffusion-permutation architecture. A pre-permutation rearranges plaintext positions, the diffusion stage applies a sequential recurrence with feedback, and a post-permutation shuffles the resulting ciphertext positions. In the worked three-stage example, the diffusion is

$C(k) = \bmod\big(P(k) - C(k-1) - K(k), 256\big).$

Although the permutation and key-generation components are driven by chaotic maps, the operative diffusion structure is regular, modular-additive or XOR-based, and sequential (Wang et al., 14 Sep 2025).

This structural characterization is central to ISBDA. The attack does not rely on statistical deficiencies in ciphertext images. The source paper states that the example cipher passes standard statistical indicators including histogram, correlation, NPCR, UACI, and entropy, yet remains breakable. This suggests that ISBDA targets the recurrence structure of PNDCC diffusion rather than the visual or distributional properties usually emphasized in chaos-based image-encryption literature (Wang et al., 14 Sep 2025).

2. Differential model and the impulse-step condition

ISBDA models the cipher as a system with plaintext sequence as input, ciphertext sequence as output, and feedback through $C(k-1)$. Differences are defined under an operation $P(k)$0, where $P(k)$1 denotes XOR difference and $P(k)$2 denotes modular subtraction difference. For two encryption runs $P(k)$3 and $P(k)$4, the differential is

$P(k)$5

The attack constructs a baseline monochrome plaintext

$P(k)$6

and a perturbed plaintext with a single impulse at position $P(k)$7,

$P(k)$8

The resulting input differential is therefore a discrete unit impulse (Wang et al., 14 Sep 2025).

After the unknown pre-permutation, the impulse is relocated from $P(k)$9 to some internal position $k$0. The decisive property is the corresponding output behavior: $k$1 The source paper designates this as the impulse-input / step-output condition. In its terminology, an impulse is a differential pattern with exactly one nonzero sample, while a step is a differential pattern in which all samples from some index onward are nonzero (Wang et al., 14 Sep 2025).

For a general PNDCC diffusion, the authors write the recurrence in expanded form as

$k$2

with key and initial state fixed during analysis. Under this representation, a change at a single input position cannot influence earlier outputs, but can propagate forward through the feedback chain. ISBDA exploits precisely this onset index and persistence behavior. The trailing post-permutation alters only the positions of the nonzero differential values, not the number of such values, which is what enables permutation recovery in the attack (Wang et al., 14 Sep 2025).

3. Proof mechanism in the three-stage worked example

For the example diffusion

$k$3

the source paper derives the differential recurrence

$k$4

assuming equal initial conditions in the compared runs (Wang et al., 14 Sep 2025).

When the plaintext differential is an impulse at $k$5, the recursion yields three regimes. For $k$6, both $k$7 and the preceding ciphertext difference are zero, so the output difference remains zero. At $k$8, the ciphertext difference becomes $k$9. At $C(k)$0, the recursion gives

$C(k)$1

For all later positions, the difference alternates between $C(k)$2 and $C(k)$3, so it never returns to zero (Wang et al., 14 Sep 2025).

This establishes the step property explicitly: $C(k)$4 The key mathematical point is that the difference dynamics are linear in the modular-difference domain. The support of the output differential is therefore a contiguous suffix $C(k)$5. Because the post-permutation preserves the cardinality of that support, counting nonzero entries in the observed ciphertext difference reveals the onset position $C(k)$6 even though the suffix has been permuted (Wang et al., 14 Sep 2025).

A plausible implication is that ISBDA is best understood as a structural differential method for one-dimensional recurrences rather than as a variant of classical block-cipher trail analysis. The source paper itself contrasts it with conventional differential cryptanalysis, which centers on S-box differentials, mixing layers, and probabilistic trails; ISBDA instead uses deterministic positional propagation in a feedback-driven sequential system (Wang et al., 14 Sep 2025).

4. Attack workflow and recovery of cipher components

The worked ISBDA against the three-stage permutation-diffusion-permutation PNDCC proceeds in three stages. First, the attacker recovers the pre-permutation using chosen plaintexts. One baseline plaintext is formed with all pixels equal to $C(k)$7, and for every position $C(k)$8, an additional plaintext is formed with the same constant value except for a single pixel set to $C(k)$9. After encryption, output differentials relative to the baseline ciphertext are computed (Wang et al., 14 Sep 2025).

Because the internal differential has nonzero support on all positions $C(k-1)$0, the number of nonzero pixels before the final permutation is exactly $C(k-1)$1. The post-permutation changes only location, not count. Hence

$C(k-1)$2

and therefore

$C(k-1)$3

Since each experiment identifies both the original perturbed index $C(k-1)$4 and the corresponding internal index $C(k-1)$5, the mapping $C(k-1)$6 is fully determined. The source paper identifies this mapping as the pre-permutation $C(k-1)$7 (Wang et al., 14 Sep 2025).

Second, with the pre-permutation known, the attacker recovers the diffusion and neutralizes the post-permutation by a chosen-ciphertext strategy. The paper states that one may choose an all-zero ciphertext $C(k-1)$8 to neutralize the post-permutation, yielding $C(k-1)$9. Using the corresponding plaintext returned by a decryption oracle, the attacker obtains known values at the input and output boundaries of the diffusion stage. For the example diffusion, the keystream is then recovered directly from

$K(k)$0

once initial values are fixed (Wang et al., 14 Sep 2025).

Third, once the diffusion is known, internal ciphertexts before the post-permutation can be reconstructed, and the remaining position permutation is deduced by comparing internal and observed external positions. In the paper’s description, all three stages—pre-permutation, diffusion, and post-permutation—are thereby broken (Wang et al., 14 Sep 2025).

The source paper also gives a generic ISBDA flow for more complicated diffusions. The first step is to test whether the diffusion satisfies the impulse-input / step-output condition, empirically if necessary. If the condition holds, the impulse-based chosen-plaintext procedure can be used to recover permutations and then diffusion. If it does not hold, the paper states that ISBDA may not apply (Wang et al., 14 Sep 2025).

5. Complexity, effectiveness, and relation to other attacks

For the three-stage PNDCC studied in the source paper, the data complexity of ISBDA is $K(k)$1 chosen plaintext-ciphertext pairs: one baseline plaintext and $K(k)$2 impulse plaintexts, one per position. The computational work per experiment consists of encryption and counting nonzero differences, with the paper noting that the total cost is dominated by the number of encryptions and is entirely practical for an image cipher. The same $K(k)$3 pairs are stated to suffice for diffusion-key recovery once permutations are known, so the total attack complexity remains $K(k)$4 pairs (Wang et al., 14 Sep 2025).

The paper reports experimental demonstration on a three-stage permutation-diffusion-permutation PNDCC with the diffusion equation above, under 2-round encryption and image size $K(k)$5, with the Cameraman image given as an example. The cipher reportedly shows visually uniform histograms, near-zero ciphertext adjacent-pixel correlation, NPCR/UACI values around $K(k)$6 and $K(k)$7, and ciphertext entropy near 8 bits per pixel. Despite this, ISBDA completely recovers the plaintext, and the reconstructed Cameraman image in Figure 1 is described as indistinguishable from the original (Wang et al., 14 Sep 2025).

Within the paper’s broader cryptanalytic framework, ISBDA is one of four attacks demonstrated against PNDCC:

Attack	Basis	Characterization in the source paper
Homogeneous-operation differential attack	Modular/XOR homogeneity	Effective but relies heavily on specific algebraic forms
S-PTC attack	Plaintext intersection and unidirectional diffusion	Eventually requires a codebook
ISBDA	Dynamic impulse/step behavior	Relatively simple and low complexity when applicable
Chain attack	Positional chains induced by recurrence	More universal for multi-stage PNDCC, but more involved

The paper attributes the S-PTC attack to Zhou and Yu and presents both ISBDA and the chain attack as new attacks in that work (Wang et al., 14 Sep 2025). Its own comparison places ISBDA between specialized homogeneous-operation attacks and the more universal but more complex chain attack.

6. Scope, failure conditions, and design implications

ISBDA is explicitly designed for PNDCC-type diffusions of the form

$K(k)$8

with no plaintext delay, ciphertext feedback, and satisfaction of the impulse-input / step-output condition (Wang et al., 14 Sep 2025). The paper states that this covers a large family of chaotic image ciphers in the literature. It further notes that the mathematics is not chaotic-specific and depends on the recurrence structure. This suggests that analogous sequential systems outside the chaos-based image-cipher domain could, in principle, admit similar analysis if they exhibit the same deterministic impulse-to-step propagation.

The source paper also delineates cases in which ISBDA fails. It does not apply when the impulse-input / step-output condition does not hold, including settings in which a single input difference does not produce a contiguous nonzero suffix at the output. The paper lists several circumstances that can destroy this behavior: plaintext delays, more complex nonlinear mixing, cancellation of differences, interleaving or multi-branch feedback that breaks one-dimensional recursion, and strong nonlinearity in the difference domain (Wang et al., 14 Sep 2025).

These limitations motivate the paper’s proposed secure improvement, the plaintext-delayed chaotic cipher (PDCC). In the PDCC formulation, diffusion includes plaintext delays and ciphertext-history terms: $K(k)$9 with $P(k-1)$0, and $P(k-1)$1 described as heterogeneous composite functions (Wang et al., 14 Sep 2025). The paper states that once plaintext delays are introduced, the neat step property disappears, generalized iteration equations analogous to those for PNDCC cannot be derived, and both ISBDA and the chain attack no longer work.

A central conclusion of the source paper is therefore methodological rather than merely attack-specific: statistical criteria such as histogram uniformity, low correlation, high NPCR/UACI, and near-8-bit entropy are not sufficient indicators of security for PNDCCs. ISBDA demonstrates that even when ciphertexts satisfy these empirical benchmarks, a cipher can remain vulnerable if its diffusion is a simple feed-forward recurrence without plaintext delay (Wang et al., 14 Sep 2025). In that sense, ISBDA functions both as a concrete chosen-plaintext attack and as a diagnostic framework for analyzing whether a sequential chaotic diffusion exhibits a deterministic impulse response that leaks positional structure.