Cryptanalysis of a New Chaotic Image Encryption Technique Based on Multiple Discrete Dynamical Maps.

Recently, a new chaotic image encryption technique was proposed based on multiple discrete dynamic maps. The authors claim that the scheme can provide excellent privacy for traditional digital images. However, in order to minimize the computational cost, the encryption scheme adopts one-round encryption and a traditional permutation-diffusion structure. Through cryptanalysis, there is no strong correlation between the key and the plain image, which leads to the collapse of cryptosystem. Based on this, two methods of chosen-plaintext attacks are proposed in this paper. The two methods require 3 pairs and 258 pairs of plain and cipher images, respectively, to break the original encryption system. The simulation results show the effectiveness of the two schemes.

1. Introduction

In this era of big data, information security has always been a sensitive topic [1]. Image files as one of the most typical multimedia information will inevitably pass through unstable and unsafe channels, and probably resulting in information leakage. Criminals intercept important information by certain technical means to change and transmit it at will, causing a series of information security problems [2]. Over the years, a large number of researchers have proposed a variety of image encryption ideas and strived to solve the security of image transmission. Among them, chaos-based methods are more suitable for image encryption than DES [3] and AES [4] because of the characteristics of pseudo-randomness and sensitivity. Therefore, chaos-based image encryption schemes have sprung up owing to the researchers who are investing a lot of time and effort in this field [5,6,7,8,9,10,11,12].

So far, many chaos-based image encryption schemes have been based on the permutation–diffusion structure proposed by Fridrich [13]. However, some encryption schemes [14,15,16,17,18] are insecure, which have been cracked by some researchers with known/chosen-ciphertext attacks or known/chosen-plaintext attacks [19,20,21,22,23]. Hu et al. in [17] found security vulnerabilities in the scheme [24] and carried out cryptanalysis and improvement. In the improved scheme, different secret keys were proposed to eliminate vulnerabilities in two rounds of diffusion. However, this scheme was still cracked by Li et al. in [25], who found a linear relationship of diffusion and used chosen-plaintext attacks. These broken encryption schemes are problematic because the key is fixed—it cannot be adapted to different plain images. At this point, the plain/cipher images can be constructed. The generated plain/cipher is then used to infer the key. To overcome this shortcoming, Hsiao et al. in [26] proposed a color image encryption scheme that uses the sum of plain image pixels to enhance the secret key space. The sum of its pixels (Mod 256) is set as the basic parameter of chaotic sequence. Since the sum of its pixels (Mod 256) has 256 possibilities, it can be exhaustively listed and calculated for correlation analysis. Having found the most relevant image among 256 plain/cipher images, this scheme was cracked by Fan et al. in [27] with a chosen-plaintext attack. However, the broken encryption scheme exposed some features of the plain image due to the low-level key space and square image limitations. The attacker uses the number of key matrices and the range of pixel values in encryption to successfully crack the cryptosystem through correlation analysis. In [28], an image encryption algorithm based on improved Henon mapping is proposed to encrypt images through shift transformation and diffusion. This scheme was effectively cracked by Zhou et al. in [29] using 257 plaintext images, and if boundary pixels were not taken into account, two plaintext images were required to achieve effectively attack. Mondal et al. in [30] proposed a new 2D chaotic mapping. The encryption scheme first scrambles the pixel position and then changes the pixel position by diffusion. Li et al. in [31] found three security vulnerabilities in this scheme, and successfully cracked them by using a chosen-plaintext attack. Although these schemes involve multiple rounds of encryption with a high level of time complexity, they are all based on the permutation–diffusion structure, and the key is independent of the plain image. Therefore, the attacker can first eliminate the diffusion effect of the cipher image and observe the different characteristics leaked in the encryption stage, and then verify possible solutions to break the stages of multiple rounds of permutation and diffusion.

Recently, Majid in [32] proposed a new chaotic image encryption technique based on multiple discrete dynamical maps. It uses three chaotic maps to generate random sequences, and in order to save time, it only uses one round of encryption to achieve confusion and diffusion. The scheme can be divided into two parts: pixel permutation and pixel diffusion. This scheme involves one round of encryption based on a permutation–diffusion structure, which has been analyzed and studied by many researchers [33,34]. We conducted cryptanalysis on the encryption scheme and then proposed related attack methods to crack it. In this paper, we have used two methods of chosen-plaintext attack, both of which can destroy diffusion and permutation transformation, and successfully attacked the original encryption scheme. The rest of the paper is organized as follows: Section 2 summarizes Majid’s scheme [30]; Section 3 proposes two kinds of chosen-plaintext attacks and carries out simulation experiments; the final section simply summarizes the whole paper.

2. Overview of Majid’s Encryption Scheme

Majid et al. designed an original image encryption scheme, which used one-round encryption to provide better confidentiality. This encryption scheme is divided into five main steps: image sub-blocking, permutation within blocks, permutation between blocks, the first diffusion, and the second diffusion.

2.1. Chaotic Maps of the Original Cipher Scheme

A two-dimensional Henon chaotic map has good chaotic behavior, and its mathematical expression is presented as follows: where x0 and y0 are the initial parameters of the chaotic map, and x0 = 1.61001, y0 = 2.9996, a = 1.7085, b = 0.32032.

A circle chaotic map has good chaotic behavior, and its mathematical expression is as follows: where θ0 = 0.4, Ω = 0.4, K is a constant.

A Duffing chaotic map also has good chaotic behavior. Its mathematical expression is as follows: where x0 = −1.5, y0 = 1.5, a = 2.738, b = 0.1534.

2.2. Majid’s Encryption Scheme

The specific steps are as follows:

Input a 256 × 256 × 3 plain image, divide it into three channels, and then separate the single-channel image into 32 × 32 blocks.

Generate a chaotic sequence using a two-dimensional Henon chaotic map and perform pixel permutation within blocks of each channel in order.

Perform random permutation between blocks of each channel orderly.

Use a circle chaotic map to execute the first diffusion for each channel.

Use a Duffing chaotic map to execute the second diffusion for each channel.

3. Cryptanalysis

This section mainly introduces the preparation work and two schemes to eliminate the diffusion effect and obtain equivalent displacement mapping. The feasibility of the two schemes is verified by simulation experiments.

For the encryption scheme of the permutation–diffusion structure, using the all-zero image can break the diffusion transform to obtain the equivalent diffusion matrix.

Assuming that the plain image of 256 × 256 × 3 is P, the permutation transformation expression is defined as: where F(.) is the permutation transform of the image, S is the permutation-only image of plain image P. During the permutation transformation, the pixel value P(i, j) in the plain image only corresponds to the pixel value S(i, j) in the permutation-only image of row i and column j.

The expression of image diffusion transformation is as follows: where ⊕ is the XOR operation, D is the diffusion matrix, and D is the image after diffusion transformation. Finally, the cipher image C corresponding to the plain image P is obtained as shown in Equation (8).

The permutation phase will not change the original pixel value of the image but simply changes the pixel position of the previous image. A plain image of all zero pixels is still with all zero pixels after permutation. Then, one will obtain the cipher image C0 from the all-zero image P0 after the diffusion step.

It can be seen that after a round of permutation and diffusion of all-zero image P0, the cipher image C0 obtained at this time is exactly equal to diffusion matrix D. Then, the permutation-only image S can be obtained by XOR operation in Equation (10). □

Two diffusions on a permutation-only image S can be linearly transformed into one diffusion.

where D1 is the first diffusion matrix and D2 is the second diffusion matrix.

At this time, according to the reversible operation of XOR, the XOR result of the next two matrices is calculated firstly as follows:

Finally, the pixel value of D(i, j) is obtained and XOR operation is performed with the pixel value of S(i, j).

Then, □

Suppose a plain image is denoted by P

The encryption process for plain image P1 is as follows: where F1 is the first intra-block pixel displacement and F2 is the second inter-block displacement. Image S1 represents the permutation-only image after two permutations, K1 is the diffusion XOR matrix for the first time, and K2 is the diffusion XOR matrix for the second time. Position (i′, j′) is the transposition of Position (i, j).

The encryption process for plain image P2 is as follows:

According to proposition 2, image S1 and S2 after two diffusions can be considered equivalent to those being processed by one linearly transformed diffusion. where K (i′, j′) is the XOR result of K1 (i′, j′) and K2 (i′, j′).

Since the permutation rules for P1 and P2 are the same, the permutation positions for P1 and P2 are the same. Now, assuming that the number of different pixel values n = 1, there is only one different pixel value at (i″, j″) between P1 and P2. Therefore, in XOR, all pixels at the same positions will have the same values, except the one at (i″, j″).

Then,

Change the pixel values of P1(1,1) and P1(1,2) to obtain image P′.

Change the pixel values of P1(1,1) and P1(1,3) to obtain image P″.

The image P′ is encrypted to obtain the cipher image C51, and the image P″ is encrypted to obtain the cipher image C52. There are two different pixels between C1 and C51.

In this case, C56 has two non-zero values, the positions of the two non-zero values are represented by (X11, Y11) and (X12, Y12), where X represents the row and Y represents the column. These two non-zero values are the encrypted positions of P′ (1,1) and P′ (1,2).

There are two different pixels between C1 and C52.

In this case, C57 has two non-zero values, the positions of the two non-zero values are represented by (X13, Y13) and (X14, Y14). These two non-zero values are the encrypted positions of P″ (1,1) and P″ (1,3).

So, (X11, Y11) is the same position as (X13, Y13), and (X12, Y12) is different from (X14, Y14). The comparison between C51 and C52 shows that there is only one pixel difference. □

3.2. Elimination of Diffusion Effect

3.2.1. Method 1

In the original encryption scheme, a 256 × 256 × 3 plain image P was used, which was divided into three channel images: , and . Three channels are encrypted to obtain , and . The color cipher image C is obtained by merging the three channels. The original encryption scheme is expressed as follows: where F1 is the first intra-block pixel permutation and F2 is the second inter-block permutation. In the original encryption scheme, the same permutation matrices F1 and F2 were used for the three channels. Matrix K1 is the same matrix used for the first diffusion of the three channels, while K2, K3, and K4 are the same for the second diffusion of the three channels.

Since the original scheme used different diffusion matrices for PR, PG and PB, it is necessary to consider the matrices used in the two diffusions. According to proposition 2, two diffusion matrices are transformed into one diffusion matrix for XOR operation. where K12 is the XOR matrix of K1 and K2, K13 is the XOR matrix of K1 and K3, and K14 is the XOR matrix of K1 and K4.

As shown in Figure 1, the position of the plain image is still one-to-one mapped to a certain position of the second permutation-only image. So, the two permutation matrices F1 and F2 can be linearly transformed into a permutation matrix F, as shown in the following formula:

Figure 1

An example of second permutation for a 1D plain image.

Then, we can construct an all-zero image P0 of size 256 × 256 × 3 and use the all-zero matrix to obtain the diffusion matrix. The constructed all-zero image P0 is shown as follows:

We divide the image P0 into three channels , = and = . After encryption, the cipher images of three channel are , and . The three channel images , and are merged into the color cipher image C0.

An all-zero matrix is still an all-zero zero matrix after permutation. As follows, Equation (29) can be transformed into Equation (30).

According to proposition 1, three diffusion matrices K12, K13 and K14 can be obtained.

The process of obtaining three diffusion matrices is shown in Figure 2. The all-zero image P0 is encrypted to obtain the merged cipher image C0. The three channel images , and of cipher image C0 can be transformed into three diffusion matrices K12, K13 and K14.

Figure 2

The process of obtaining three diffusion matrices.

In method 1, the obtained diffusion matrix is used to eliminate the diffusion effect, and the main steps are described as follows:

Construct an all-zero image P0 with 256 × 256 × 3, and the influence of two permutations is eliminated by the all-zero matrix.

Three equivalent diffusion matrices, K12, K13, and K14, are obtained.

Then, permutation-only images can be obtained through Equation (32). In the cipher image C, the red channel image CR XOR diffusion matrix K12 is permutation-only image SR, the green channel image CG XOR diffusion matrix K13 is permutation-only image SG, and the red channel image CB XOR diffusion matrix K14 is permutation-only image SB. Three channel images, SR, SG, and SB, are merged to obtain color permutation-only image S.

Figure 3 shows the experiments of method 1. Figure 3(a1) is a plain image and Figure 3(a2) is the cipher image of Figure 3(a1). Figure 3(a3) is a permutation-only image of Figure 3(a2). Figure 3(b1–b3) are permutation-only images from the three channels of Figure 3(a2).

Figure 3

Experiments of method 1: (a1) a plain image; (a2) the cipher image of (a1); (a3) permutation-only image of (a2); (b1–b3) permutation-only images from the three channels of (a2).

3.2.2. Method 2

In method 2, We can construct 256 plain image . The plain images are encrypted to obtain the cipher images . The three channel images of the cipher image are , and . The plain image is constructed as shown in Equation (33). where x = 0, 1, 2, …, 255. The x value in the plain image changes from 0 to 255.

Thus, 256 different plain images are encrypted to obtain 256 different cipher images . If all the (i, j)th pixels of plain images are used to form a vector X = , each of the elements of X are different. According to proposition 3, the encrypted cipher image of the plain image always has a unique corresponding position, and each element is mapped one-to-one. So, a given pixel in the target cipher image needs to be decrypted, then the pixel value of the cipher image can be compared with the pixel value at the same position in 256 different cipher images . For a given cipher image C, the three channel images are CR, CG, and CB. Through Equations (34) and (35), the permutation-only images , and of three channels are retrieved.

Figure 4 shows the process of eliminating the diffusion effect, where the color permutation-only image S of color cipher image C is successfully obtained. Here, S is the combined image of three channel images SR, SG, and SB. Figure 5 shows the experiment of method 2, where Figure 5(a1) is a plain image, Figure 5(a2) is the cipher image of Figure 5(a1), Figure 5(a3) is the permutation-only image of Figure 5(a2), and Figure 5(b1–b3) are permutation-only images from the three channels of Figure 5(a2).

Figure 4

Process of eliminating diffusion effect in method 2.

Figure 5

Experiments of method 1: (a1) a plain image; (a2) the cipher image of (a1); (a3) permutation-only image of (a2); (b1–b3) are permutation-only images from the three channels of (a2).

3.3. Obtain Equivalent Permutation Mapping

In the previous section, the effects of diffusion can be eliminated by means of methods 1 and 2. In this way, we can obtain a permutation-only image of all the cipher images.

In this section, the substitution matrices F1 and F2 used in PR, PG and PB in the original encryption scheme are the same. Two permutation matrices, F1 and F2, can be linearly transformed into one permutation matrix, F, so the permutation matrix F of each of the three channels is universal.

Cryptanalysis is used in [34] to obtain equivalent permutation matrices on the basis of a permutation-only image. Therefore, we can construct the chosen-plaintext image to obtain the corresponding equivalent permutation mapping F′, so that we can eliminate the influence of two permutations and the plain image P can be restored.

Based on Lemma 1 in [35], equivalent permutation mapping can be revealed by n pairs of plain/cipher images. where g is the gray level of the image and M and N are the rows and columns of the plain image. In the original encryption scheme, 256 × 256 × 3 plain image is used, which is divided into three 256 × 256 channels for permutation transformation.

The size of each channel is 256 × 256, which is a total of 65,536 pixel values. Therefore, g = 256, M = 256, N = 256, n pairs of plain/cipher images can be obtained from Equation (37).

By calculating n = 2, the corresponding equivalent permutation map F′ can be solved by using two pairs of plain/cipher images.

The three channel images PR, PG, and PB are stretched into column vectors, which can be expanded to a two-digit representation in base 256. where the element (a1) (a2) corresponds to 256 × a1 + a2 of A. The chosen-plaintext image A is divided into two bitplane images, A1 and A2. Then, A1 and A2 are used to construct 2 pairs of plain/cipher images.

Two cipher images CA1 and CA2 are obtained by encrypting two plain images, A1 and A2. Plain image A1 is divided into three channel images: , and . Plain image A2 is divided into three channel images: , and . The cipher image CA1 is divided into three channel images: , and . The cipher image CA2 is divided into three channel images: , and . After the Equation (41) transformation, the red channel images A1 and A2 are transformed into matrices . Transforming the green channels A1 and A2 into matrices , the blue channel images A1 and A2 are transformed into a matrix .

By method 1 or 2, the permutation-only images , and of C1, C1 and C1 are obtained, and permutation-only images , and of C2, C2 and C2 are obtained.

Then, it can be observed that all elements in image S are the permutation order of image P1, all elements in image S are the permutation order of image P1, and all elements in image S are the permutation order of image P1. We know that the permutation matrices of the three channels are the same, and any of the three channels are stretched row by row to form a vector . Therefore, F′ is an equivalent permutation mapping.

Figure 6 shows the flow to obtain this equivalent permutation mapping F′. The main steps of equivalent permutation mapping are described as follows:

Figure 6

The flow chart to obtain this equivalent permutation mapping.

Two plain images A1 and A2 were encrypted to obtain two cipher images: CA1 and CA2. The cipher image CA1 is divided into three channel images: C1, C1, and C1. The cipher image CA2 is divided into three channel images: C2, C2, and C2.

By using method 1 or 2, the permutation-only images S1, S1, and S1 of C1, C1, and C1 are obtained first, and after that, the permutation-only images S2, S2, and S2 of C2, C2, and C2 are obtained.

Method 1

(i) Three equivalent diffusion matrices, K12, K13, and K14, are known. The red channel image C1 is XORed with the diffusion matrix K12 of the cipher image CA1 to obtain the permutation-only image S1. The green channel image C1 is XORed with the diffusion matrix K13 to obtain the permutation-only image S1, and the blue channel image C1 is XORed with the diffusion matrix K14 to obtain the permutation-only image S1.

(ii) The red channel image C2 is XORed with the diffusion matrix K12 of the cipher image CA2 to obtain the permutation-only image S2. The green channel image C2 is XORed with the diffusion matrix K13 to obtain the permutation-only image S2, and the blue channel image C2 is XORed with the diffusion matrix K14 to obtain the permutation-only image S2.

Method 2

(i) The cipher image CA1 is divided into three channel images: C1, C1, and C1. The permutation-only images S1, S1, and S1 of the three channel images are retrieved by Equations (45) and (46).

(ii) The cipher image CA2 is divided into three channel images: C2, C2 and C2. The permutation-only images S2, S2, and S2 of the three channel images are retrieved by Equations (47) and (48).

Image S, S and S are obtained from Equation (42). Any of the three channel images are stretched row by row to form . Therefore, F′ is an equivalent permutation mapping.

Figure 7 shows the permutation-only images of the constructed plain images A1 and A2, where the first column is the plain images A1 and A2, the second column is the encrypted images of the first column, and the third, fourth, and fifth columns are permutation-only images of the three channels retrieved from the second column. Since the permutation maps of the three channels in the original encryption scheme are the same, the permutation-only images of the three channels are the same.

Figure 7

Obtain the permutation-only images of the chosen plain image: the first column (a1,b1) is the constructed plain images A1 and A2; the second column (a2,b2) is the corresponding cipher images; the third column (a3,b3), the fourth column (a4,b4), and the fifth column (a5,b5) retrieve the second column for three channels of permutation-only images.

3.4. Summary of the Attack Strategy

In this section, we provide a detailed overview of the attack process in methods 1 and 2.

Based on propositions 1 and 2, the three equivalent diffusion matrices K12, K13 and K14 are obtained from the all-zero image (shown in Figure 2) as described in Section 3.2.1. The diffusion effect is eliminated through the known matrices K12, K13 and K14. Then the permutation-only images of the three channel images CR, CG and CB are obtained through the three matrices as shown in the sub-steps (shown in Figure 3).

The red channel image CR XORing equivalent diffusion matrix K12 is the permutation-only image SR, the green channel image CG XORing diffusion matrix K13 is the permutation-only image SG, and the red channel image CB XORing diffusion matrix K14 is the permutation-only image SB.

The equivalent permutation mapping F′ can be obtained from 2 pairs of plain/cipher images (shown in Figure 6) in Section 3.3. The detailed sub-steps are as follows:

Two plain images A1 and A2 were encrypted to obtain two cipher images CA1 and CA2. The cipher image CA1 is divided into three channel images C1, C1 and C1. The cipher image CA2 is divided into three channel images C2, C2 and C2.

Based on Section 3.2.1, the permutation-only images S1, S1 and S1 of C1, C1 and C1 were obtained, and the permutation-only images S2, S2 and S2 of C2, C2 and C2 were obtained (shown in Figure 7).

S, S and S are obtained from Equation (42). All the three channels are stretched row by row to form an equivalent permutation mapping F′.

Invoke Algorithm 1 to obtain deciphered images PR, PG and PB. Merge the three channel images for obtaining image P.

Based on proposition 3, one can construct 256 different plain images and encrypt them to obtain 256 different cipher images (shown in Figure 4) in Section 3.2.2. For the three channel images CR, CG and CB of the given cipher image C. Equations (34) and (35) are used to eliminate the diffusion effect. The permutation-only images SR, SG and SB of the three channels are retrieved (shown in Figure 5).

The equivalent permutation mapping F′ can be obtained from 2 pairs of plain/cipher images (shown in Figure 6) as described in Section 3.3. The detailed sub-steps are the same as the three sub-steps of step 2 in Section 3.4.1.

Invoke Algorithm 1 to obtain deciphered images PR, PG and PB. Then, image P is obtained by merging the three channel images.

3.5. Simulation Experiment

3.5.1. Computational Complexity Analysis

In our cryptanalysis, method 1 used three chosen plain images to attack the original encryption scheme, one all-zero image to obtain the diffusion matrix and two chosen plain images to obtain the equivalent permutation mapping. For a cipher image with a size of 256 × 256 × 3, the data complexity is O (3 × 256 × 256 × 3), which is close to O (223). Method 2 used 258 chosen plain images to attack the original encryption scheme. A total of 256 chosen plain images were used to eliminate the diffusion effect, and 2 chosen plain images were used to obtain the equivalent permutation mapping. Similarly, for a cipher image with a size of 256 × 256 × 3, the data complexity is O (258 × 256 × 256 × 3), which is close to O (226). More remarkably, method 1 is faster, but method 2 can break the diffusion phase of Majid’s encryption scheme more subtly.

3.5.2. Experimental Results

The simulation experiment was performed on a personal computer (Intel Core i5-10210U 2.11 GHz CPU, 16 GB). All experiments were carried out using MATLAB R2020a. In the simulation experiments, we used the same initial values as the Majid’s scheme. The two attack methods are identical in the steps of obtaining equivalent permutation mapping F′ but different in the steps of eliminating diffusion effect. We implemented these two attack methods using some different experimental images for accuracy. It can be found from Table 1 that the two methods will cause time differences due to different computational complexity, and different images will also cause time differences in different attack processes. However, the two solutions we proposed are sufficient in terms of real-time requirements.

Table 1

Execution time (seconds).

Image	Image Size	Encryption	Deciphering
			Method 1	Method 2
Lena	256 × 256 × 3	1.191755	9.057486	235.661488
Pepper	256 × 256 × 3	1.083255	8.445166	233.262743
Sailboat	256 × 256 × 3	1.058173	8.273460	233.330141

The simulation results of the two attack methods in this paper are shown in Figure 8. Figure 8(a1,b1,c1) are the images of “Lena”, “Sailboat”, and “Pepper”. They are encrypted by the original cryptosystem as plain images, and the encrypted images are shown in Figure 8(a2,b2,c2). Then, we can execute two attack methods, respectively. The encrypted image can be restored to permutation-only images first, and then the decrypted image, as shown in column 3, column 4, and column 5 in Figure 8. Figure 8(a6,b6,c6) show the combined images of the three channels, that is, the recovered decrypted images. After comparison, we find that the decrypted image is consistent with the plain image, which confirms the feasibility of our attack methods.

Figure 8

Experimental results of method 1 and method 2: (a1,b1,c1) are plain images; (a2,b2,c2) are the cipher images of (a1,b1,c1); three channel images (a3–a5) are recovered from (a2); three channel images (b3–b5) are recovered from (b2); three channel images (c3–c5) are recovered from (c2); (a6,b6,c6) final deciphered image.

4. Conclusions

In this paper, we cryptanalyzed a new chaotic image encryption technique based on multiple discrete dynamic maps, which adopts one-round encryption and permutation–diffusion structure. (1) The permutation–diffusion structure of one-round execution is found to be insecure because the cipher image generated by the all-zero image is the same as the diffusion matrix of the XOR phase. (2) The original encryption scheme’s secret key is irrelevant to the plain image, leading to the successful attack of the two proposed methods. The simulation results show that both of our methods are feasible.

In view of the original encryption scheme, we put forward some reasonable suggestions. (1) There should be strong correlation between the key and the plain image. (2) Multiple rounds of encryption should be adopted since it is difficult to avoid security problems with only one round of encryption. (3) Add nonlinear substitution phase to the encryption scheme as appropriate. (4) For the diffusion stage, some pixels in the plain image should be fused to complicate the diffusion, so as to avoid obtaining the diffusion matrix directly.