1. New Attacks on Sari Image Authentication System Proceeding of SPIE 2004 Jinhai Wu 1, Bin B. Zhu 2, Shipeng Li, Fuzong Lin 1 State key Lab of Intelligent Technology and Systems, Beijing 2 Microsoft Research Asia, Beijing Reporter: YH Chung

2. Outline Introduction Sari System Histogram attack Oracle attack Conclusions

3. Introduction Image processing tools and widely available powerful computers have made image manipulations an easy task. Checking an image’s authenticity becomes more and more important.

4. Sari System Sari system means Self-Authentication and Recovery Image system, and it’s a widely studied image authentication schemes. The SARI system exploits the fact that the same quantization table is applied to all the Discrete Cosine Transform blocks of an image in the JPEG.

5. Sari System Check authenticity Parameters: For the block pair p and q at the DCT frequency bin V. Count Measure the tolerance bound t

6. Sari System A vulnerability of the SARI system, as the follow scheme:

7. Histogram attack When a histogram of DCT coefficients is stretched or shrunken, the relationship between any two DCT coefficients does not change. Histogram attack steps: Collect all the DCT coefficient at a selected frequency bin v. Calculate the histogram of these DCT coefficients. For a JPEG compressed image, the histogram can b e the JPEG quantized integers of the DCT coefficients since any change will be quantized by the same JPEG quantization step.

8. Histogram attack The result of histogram attack It causes the trust problem.

9. Histogram attack A fix to histogram attack To add the maximum and minimum DCT coefficients of each selected frequency bin to the digital signature for an image. It’s much more difficult to modify the histogram without changing any relationship of DCT coefficients and with the mean values of DCT values close enough to the mean values recorded in the digital signature.

10. Oracle attack It is designed to find out the secret mapping function W. In the SARI system, if two DCT coefficients from two blocks in the same pair at a selected frequency bin are modified by the same amount,the corresponding feature bit does not change. Two stage of oracle attack: Find the first pair of blocks Find the remaining pairs Use the pair that previously found to ensure the sum of DCT values.

11. Oracle attack Solution to fight oracle attack Making each pair has exactly one block in common with one more pair. Shortcoming is increase the signature size. Use two independent mapping functions W 1 and W 2 to generate two sets of the feature codes of the same size.

12. Conclusions This paper proposed two new attacks to the SARI system. The first is the histogram attack which modifies DCT coefficients. The second is the oracle attack which uses and oracle to find the secret pairs used by SARI in generating the digital signature for an image.