Quantum-Proof Encryption Scheme Hides Data in Encrypted Images Without Ever Decrypting Them

Every medical scan, satellite photograph and legal archive image stored in the cloud today faces a quiet deadline. If its confidentiality must survive for decades — and statutory retention periods for radiology archives commonly run twenty to thirty years — then the classical encryption protecting it may not outlive the arrival of a cryptographically relevant quantum computer. The threat has a name: harvest-now-decrypt-later. An adversary who intercepts or archives encrypted images today can simply store them and decrypt everything once quantum machines mature. A new study published in Multimedia Tools and Applications confronts this problem head-on, and in doing so delivers something the field of image steganography has never had before: a mathematically formalized, provably secure, quantum-resistant method for hiding data inside encrypted images without ever decrypting them.

The technique at the heart of the research is known as Reversible Data Hiding in Encrypted Images, or RDHEI. The concept is deceptively simple in its ambition. A hospital encrypts a scan before uploading it to a cloud provider. The provider, who never sees the plaintext, must still attach patient identifiers, study metadata and audit trails to the encrypted volume for storage management, content annotation or access control. RDHEI allows exactly that: auxiliary information is embedded directly into the ciphertext, and later, the original pixel data can be recovered bit-for-bit with perfect fidelity. This reversibility is what makes the method ideal for medical imaging, military reconnaissance and legal document archiving, where both the embedded annotations and the original media must be preserved exactly.

Yet despite two decades of development since the idea was first proposed by Puech and colleagues in 2008 and refined by Zhang in 2011, RDHEI has never been treated as a proper cryptographic primitive. Existing schemes rely on heuristic security arguments — statistical tests of histograms, entropy and correlation — rather than rigorous adversarial models or reduction-based proofs. Without formal syntax and game-based security definitions, claims about confidentiality, integrity and reversibility cannot be verified using standard cryptographic analysis. Meaningful comparisons between schemes become impossible, and the security of constructions cannot be tied to well-studied computational assumptions. Navid Abapour of the Surrey Centre for Cyber Security at the University of Surrey set out to close this gap, and the result is the first formalization of RDHEI as a cryptographic primitive with well-defined syntax, correctness properties and security notions.

The formalization is meticulous. Abapour defines RDHEI as a tuple of five polynomial-time algorithms — KeyGen, Enc, Embed, Extract and Dec — each with exact input-output specifications. Correctness is expressed probabilistically: embedding correctness guarantees that extraction recovers both the original ciphertext and the payload with probability 1 minus a negligible function of the security parameter, while decryption correctness guarantees the image itself is recovered. On the security side, five game-based notions are formulated with explicit advantage functions: semantic security, which ensures an adversary seeing a ciphertext cannot distinguish which of two equal-length images was encrypted; payload privacy, which protects the embedded auxiliary data independently of image confidentiality; separability, which formalizes extraction-first and decryption-first operational modes; compactness, which bounds how much the marked ciphertext can grow; and robustness, which ensures adversarially modified marked ciphertexts cannot be misattributed to honest embeddings.

Building on this foundation, the study introduces PQ-RDHEI, a post-quantum construction secure against quantum adversaries under the Module Learning With Errors assumption in the quantum random oracle model. The design assembles several standardized building blocks. A Module Lattice Key Encapsulation Mechanism — the NIST-standardized ML-KEM of FIPS 203 — establishes shared encryption keys, relying on MLWE hardness with the content owner holding the public and secret keys for decryption. SHAKE256 serves as a pseudorandom function generating block masks and payload masking streams, with keys derived from the encapsulated secret. SHA3-256 provides post-quantum collision-resistant hashing for key derivation, commitments and authentication tags. Hash-based verifiable secret sharing enables payload integrity verification, allowing any threshold number of parties to reconstruct and verify. A Fisher-Yates permutation seeded by the pseudorandom function randomizes block positions, recoverable with the encryption key, while adaptive Huffman coding compresses most-significant-bit predictions to maximize embedding capacity.

The encryption itself follows a hybrid KEM-DEM paradigm. The image is partitioned into non-overlapping blocks, and each block receives a common 8-bit mask generated by the pseudorandom function from the derived encryption key, XORed with every pixel in that block. Crucially, this design preserves intra-block most-significant-bit correlation structure — the statistical fingerprint that the embedding phase later exploits to identify embeddable regions. During embedding, the procedure analyzes the β most significant bits of each pixel in every encrypted block and counts distinct values. Blocks whose distinct MSB patterns fall at or below a threshold are deemed embeddable and recorded in a location map. An adaptive Huffman codebook, ordered by occurrence frequency, then encodes the MSB values, and the freed prefix-zero positions are filled with payload bits, a delimiter, and the reversed codeword. The complete embedding stream — length-prefixed masked payload, auxiliary metadata and a verifiable secret sharing proof — is distributed across embeddable blocks, culminating in a commitment tag binding the hiding key to the embedded content.

Extraction reverses the process through pattern detection, scanning for the characteristic prefix-zero-delimiter structure in MSB positions, decomposing each pixel’s upper bits into embedding prefix length and encoded codeword, and applying reverse Huffman decoding to recover original MSB values. After stream reassembly and verifiable secret sharing verification, the original encrypted blocks are reconstructed by reinstating decoded MSB values into their canonical positions. Decryption then proceeds conventionally: KEM decapsulation recovers the shared secret, the inverse Fisher-Yates permutation restores block ordering, XOR with regenerated masks yields plaintext blocks, and the original image is reassembled from its constituent blocks. For images whose dimensions are not divisible by the block size, boundary blocks are zero-padded with original dimensions stored in auxiliary data for exact recovery, and the extraction algorithm returns a failure symbol upon tag verification failure, secret sharing verification failure or malformed stream parsing, without leaking failure-mode information.

The quantitative results are striking. On standard grayscale test images, PQ-RDHEI achieves embedding rates of 0.61 to 2.27 bits per pixel, compared with 0.04 to 0.18 bits per pixel for the most efficient existing scheme — a 13.4-fold improvement in mean rate. The entropy of the encrypted shares rises from 7.48 to between 7.9902 and 7.9992 bits per pixel, approaching the theoretical maximum of 8. Abapour is careful to stress that entropy is used strictly as a statistical indicator and carries no cryptographic meaning on its own; high entropy does not establish semantic security or resistance to any specific cryptanalysis. The cryptographic guarantees come exclusively from reduction-based theorems proving correctness, compactness, semantic security, robustness, payload privacy and separability against quantum polynomial-time adversaries in the quantum random oracle model. The study also evaluates the scheme on medical images spanning computed tomography, magnetic resonance, ultrasound and projection radiography, where the capacity advantage improves further: net embedding rates range from 1.16 to 1.99 bits per pixel, with a mean of 1.57, and every image is recovered bit-exactly with infinite PSNR and SSIM of 1.0.

Runtime measurements on an Apple M2 system-on-chip show the complete pipeline takes 91.66 milliseconds on a 512 by 512 image, with extraction dominating at 50.24 milliseconds. The post-quantum components — ML-KEM encapsulation and decapsulation together with verifiable secret sharing — account for 7.49 milliseconds, or 8.2 percent of the pipeline, quantifying the price of quantum resistance and payload integrity. The scheme scales linearly: a 4096 by 4096 image completes in 7.4 seconds and 1.6 gigabytes in an interpreted Python implementation, with throughput essentially flat at 0.345 to 0.453 microseconds per pixel across a 256-fold range in resolution. Peak memory is likewise linear at a constant 96 megabytes per megapixel. The practical consequence is that the scheme is not limited by scale in the resolutions typical of medical and archival imaging.

The single deliberate limitation is that the message space is fixed to grayscale images. Cryptographically, this costs nothing: the encryption layer operates over arbitrary byte strings, and applying PQ-RDHEI independently to the red, green and blue planes of a colour image under domain-separated keys yields a scheme for which every security and correctness theorem carries over verbatim by a standard hybrid argument. But such a plane-wise treatment ignores the strong inter-channel correlation of natural colour images — correlation coefficients between planes typically exceed 0.9 — so it leaves capacity on the table relative to a scheme that predicts one plane from another. Designing a capacity function and embeddability criterion that operate jointly on the three planes, and proving that cross-channel prediction does not leak plaintext structure into the marked ciphertext, is a genuinely open problem and, in Abapour’s view, the natural next step for this line of work. The grayscale restriction is least binding in exactly the domains that motivate the construction, since computed-tomography, magnetic-resonance, ultrasound and radiographic images are single-channel by acquisition. For the archives whose confidentiality must outlive the quantum era, the message is clear: post-quantum protection for encrypted image annotation is no longer a theoretical concern but a practical one, and the tools to deliver it now exist with provable guarantees.

Subject of Research: Cryptography and Information Security

Article Title: Formalized threshold reversible hiding in encrypted images in Post-Quantum settings

Article References: Abapour, N. (2026). Formalized threshold reversible hiding in encrypted images in Post-Quantum settings. Multimedia Tools and Applications, 85(11), Article 814. https://doi.org/10.1007/s11042-026-21965-5

Image Credits: AI Generated

DOI: 10.1007/s11042-026-21965-5

Keywords: post-quantum cryptography, reversible data hiding, encrypted images, image steganography, lattice cryptography, ML-KEM, provable security, quantum random oracle model, medical imaging security, harvest-now-decrypt-later, Formalized, threshold