A Hybrid ECC-LFT and AES-256-GCM Framework for Secure and Authenticated Image Encryption

Abstract

The proliferation of image-centric applications in healthcare, defense communication, cloud storage, and social platforms has intensified the demand for encryption schemes that combine strong confusion–diffusion properties with verifiable ciphertext integrity. Existing elliptic curve cryptography–linear fractional transformation (ECC–LFT) image ciphers achieve favorable statistical security but generally omit a standardized authentication mechanism, leaving ciphertexts exposed to undetected tampering. This paper proposes a four-stage hybrid pipeline that closes this gap. Dynamic 8×8 substitution boxes are first constructed over GF(2⁸) using parameters derived from an elliptic-curve pseudo-random generator and a linear fractional transformation, yielding a nonlinearity score of 112. An elliptic-curve-driven pseudo-random index sequence then permutes the substituted pixels, a ChaCha20 keystream whitens the permuted stream, and AES-256 in Galois/Counter Mode encrypts the whitened stream and appends a 128-bit authentication tag, providing NIST-aligned authenticated encryption. Evaluated on standard test images, the framework achieves information entropy of 7.9990–7.9992, NPCR of 99.60%–99.63%, UACI of approximately 33.41%–33.43%, and adjacent-pixel correlation below 0.06 in all directions, with the constructed S-boxes attaining optimal nonlinearity, balanced output, and zero linear structure. Comparative evaluation against six state-of-the-art schemes indicates competitive or superior statistical security while uniquely providing cryptographic tamper detection through the embedded authentication tag