Contrast Optimal Threshold Visual Cryptography ... - Semantic Scholar

Contrast Optimal Threshold Visual Cryptography Schemes Carlo Blundo,  Paolo D'Arco , Alfredo De Santis,  and Douglas R. Stinson 1;

1

1;

2; y

Dipartimento di Informatica ed Applicazioni Universita di Salerno, 84081 Baronissi (SA), Italy E-mail: fcarblu,[email protected] URL: http://www.unisa.it/fcarblu/, ads/g 1

Department of Computer Science and Engineering University of Nebraska-Lincoln, Lincoln NE 68588, USA E-mail: [email protected] URL: http://bibd.unl.edu/stinson 2

April 24, 1998 Abstract

A ( )-threshold visual cryptography scheme (( )-threshold VCS, for short) is a method to encode a secret image into shadow images called shares such that any or more shares enable the \visual" recovery of the secret image, but by inspecting less that share one cannot gain any information on the secret image. The \visual" recovery consists of xeroxing the shares onto transparencies, and then stacking them. Any shares will reveal the secret image without any cryptographic computation. In this paper we analyze the contrast of the reconstructed image for ( )threshold VCS. We de ne a canonical form for ( )-threshold VCS and we also provide a characterizazion of ( )-threshold VCS. We completely characterize contrast optimal ( ? 1 )-threshold VCS in canonical form. Moreover, for  4, we provide, a contrast optimal (3 )-threshold VCS in canonical form. We rst describe a family of (3 )-threshold VCS achieving various values of k; n

k; n

SI

n

k

k

k

k; n

k; n

k; n

n

;n

n

;n

;n

 Research partially supported by the Italian Ministry of University and Research (M.U.R.S.T.) and by the National Council for Research (C.N.R.).

y Research partially supported by NSF grant CCR-9610138.

1

contrast and pixel expansion. Then, we prove an upper bound on the contrast of any (3 )-threshold VCS and show that a scheme in the described family has optimal contrast. Finally, for = 4 5 we present two schemes with contrast asymptotically equal to 1 64 and 1 256, respectively. ;n

k

=

;

=

1 Introduction

A (k; n)-threshold visual cryptography scheme for a set P of n participants is a method to encode a secret image SI into n shadow images called shares, where each participant in P receives one share. Any (quali ed) set of k or more participants can \visually" recover the secret image, but (forbidden) sets of participants of cardinality less that k have no information (in an information-theoretic sense) on SI . A \visual" recovery for a set X  P consists of xeroxing the shares given to the participants in X onto transparencies, and then stacking them. The participants in a quali ed set X will be able to see the secret image without any knowledge of cryptography and without performing any cryptographic computation. Visual cryptography schemes are characterized by two parameters: The pixel expansion, which is the number of subpixels each pixel of the original image is encoded into, and the contrast which measures the \dierence" between a black and a white pixel in the reconstructed image. This cryptographic paradigm was introduced by Naor and Shamir [11]. Further results on (k; n)-threshold visual cryptography schemes ((k; n)-threshold VCS, for short) can be found in [1, 3, 5, 6, 8, 15]. The model by Naor and Shamir has been extended in [1, 3] to general access structures (an access structure is a speci cation of all quali ed and forbidden subsets of participants), where general techniques to construct visual cryptography schemes for any access structure have been proposed. Droste [6] gave an algorithm to construct (k; n)-threshold visual cryptography schemes. In [3] the authors provide the rst construction for (2; n)-threshold VCS having the best possible contrast, for any n  2. In [5], for any n, it is provided a complete characterization of (2; n)-threshold VCS having optimal contrast and minimum pixel expansion in terms of certain balanced incomplete block designs. In [8] the authors showed that by solving a suitable linear program one can compute the best contrast achievable in any (k; n)-threshold VCS. In [8], for the cases k = 2 with n even and k = 3 with n divisible by 4, it is described a (k; n)-threshold VCS achieving the best possible contrast. For a simple and non-technical introduction to visual cryptography see [14]. In implementing visual cryptography schemes it would be useful to conceal the existence of the secret message, namely, the shares given to participants in the scheme should not look as a random bunch of pixels, but they should be innocent looking images (an house, a dog, a tree, ...). Naor and Shamir [11] rst considered the problem of concealing the existence of the secret message for the case of 2 out of 2 threshold VCS. In [2] the authors gave a general technique to implement visual cryptography schemes with such an extended capability. Droste [6] also considered the problem of concealing the existence of the secret message and presented a technique to implement 2

such schemes. Alternative reconstruction methods for visual cryptography schemes based on \opaque" shares [12] and on polarized lters [4] have been recently proposed. Both models make assumptions dierent from ours on the way the shares combine. Visual cryptography schemes to encrypt coloured images are given in [9, 13, 15]. Recently, authentication and identi cation methods for human users based on visual cryptography have been considered [10]. In this paper we analyze the contrast for (k; n)-threshold visual cryptography schemes. We de ne a canonical form for (k; n)-threshold VCS. We characterize (k; n)threshold VCS (see Lemmas 3.8 and 3.9). We completely characterize contrast optimal (n ? 1; n)-threshold VCS in canonical form. Moreover, for n  4, we present a contrast optimal (3; n)-threshold VCS in canonical form. We rst describe a family of (3; n)-threshold VCS achieving various values of contrast and pixel expansion. Then, we prove an upper bound on the contrast of any (3; n)-threshold VCS and show that a scheme in the described family has optimal contrast. Finally, for k = 4 and 5 we present two schemes with contrast asymptotically equal to 1=64 and 1=256, respectively.

2 The Model We assume that the secret image consists of a collection of black and white pixels. Each pixel appears in n versions called shares, one for each transparency. Each share is a collection of m black and white subpixels. The resulting structure can be described by an n  m Boolean matrix S = [sij ] where sij = 1 i the j -th subpixel in the i-th transparency is black. Therefore the grey level of the combined share, obtained by stacking the transparencies i ; : : : ; is, is proportional to the Hamming weight w(V ) of the m-vector V = OR(ri ; : : : ; ri ) where ri ; : : : ; ri are the rows of S associated with the transparencies we stack. This grey level is interpreted by the visual system of the participants as black or as white according to some rule of contrast. 1

1

1

s

s

De nition 2.1 Let k and n be two integers such that k  n and let P be a set of n participants. Two collections (multisets) of n  m boolean matrices C0 and C1 constitute a (k; n)-threshold visual cryptography scheme with pixel expansion m if there exist the value (m) and the set f(X; tX )gX P :jX j=k satisfying: 1. Any (quali ed) set X = fi1 ; i2; : : : ; ik g  P can recover the shared image by stacking their transparencies. Formally, for any M 2 C0 , the \or" V of rows i1 ; i2 ; : : : ; ik satis es w(V )  tX ? (m)
m; whereas, for any M 2 C1 it results that w(V )  tX . 2. Any (forbidden) set X = fi1 ; i2 ; : : : ; ipg  P , with p < k, has no information on the shared image. Formally, the two collections of p  m matrices Dt , with t 2 f0; 1g, obtained by restricting each n  m matrix in Ct to rows i1 ; i2 ; : : : ; ip , are indistinguishable in the sense that they contain the same matrices with the same frequencies. 3

Each pixel of the original image will be encoded into n pixels, each of which consists of m subpixels. To share a white (black, resp.) pixel, the dealer randomly chooses one of the matrices in C (C , resp.), and distributes row i to participant i. Thus, the chosen matrix de nes the m subpixels in each of the n transparencies. Notice that in the previous de nition C is a multiset of n  m boolean matrices. Therefore we allow a matrix to appear more than once in C (C ). Finally, observe that the size of the collections C and C does not need to be the same. The rst property is related to the contrast of the image. It states that when any k participants stack their transparencies they can correctly recover the image shared by the dealer. The value (m) is called contrast of the image and the set f(X; tX )gX P jX j k is called the set of thresholds. (We use a slightly dierent terminology from [11] where the contrast is called relative dierence and the quantity (m)
m is referred to as the contrast of the scheme.) We want the product of the contrast times the pixels expansion to be as large as possible and at least one, that is, (m)  1=m. The second property is called security, since it implies that, even by inspecting all their shares, any set of less than k participants cannot gain any information in deciding whether the shared pixel was white or black. Notice that if a set of participants X is a superset of a quali ed set X 0, then they can recover the shared image by considering only the shares of the set X 0. This does not in itself rule out the possibility that stacking all the transparencies of the participants in X does not reveal any information about the shared image. A strong (k; n)-threshold VCS is a (k; n)-threshold VCS in which Property 1 of De nition 2.1 is satis ed for any set X of cardinality at least k, that is, the image is visible if and only if k or more participants stack their transparencies. There are few dierences between the model of visual cryptography we propose and the one presented by Naor and Shamir [11]. Our model is a generalization of the one proposed in [11], since with each set X of size k we associate a (possibly) dierent threshold tX . Nevertheless, all the (k; n)-threshold VCS given in this paper have the property that for any X; X 0  P with jX j = jX 0j  k, it results that tX = tX 0 . 0

1

0

0

0

:

1

1

=

2.1 Basis Matrices

In this paper we consider only (k; n)-threshold VCS in which the collections C and C have the same size, i.e., jC j = jC j = r. Actually, this is not a restriction at all. Indeed, in Section 2.1 of [1] is has been shown how to obtain, from an arbitrary (k; n)threshold VCS, a VCS having the same parameters m, (m), and f(X; tX )gX P jX j k, with equally sized C and C . All of the constructions in this paper are realized using two n  m matrices, S and S , called basis matrices satisfying the following de nition. 0

1

0

1

:

0

1

=

0

1

De nition 2.2 Let k and n be two integers such that k  n and let P be a set

of n participants. A (k; n)-threshold VCS with contrast (m) and set of thresholds f(X; tX )gX P :jX j=k is realized using the two n  m basis matrices S 0 and S 1 if the following two conditions hold.

4

1. If X = fi1 ; i2 ; : : : ; ik g  P , (i.e., if X is a quali ed set), then the \or" V of rows i1 ; i2 ; : : : ; ik of S 0 satis es w(V )  tX ? (m)
m; whereas, for S 1 it results that w(V )  tX . 2. If X = fi1; i2 ; : : : ; ipg  P and p < k (i.e., if X is a forbidden set), then the two p  m matrices obtained by restricting S 0 and S 1 to rows i1 ; i2 ; : : : ; ip are equal up to a column permutation.

The collections C and C are obtained by permuting the columns of the corresponding basis matrix (S for C , and S for C ) in all possible ways. Note that, in this case, the size of the collections C and C is the same (it is equal to m!) and it is denoted by r. This technique has been introduced in [11]. The algorithm for the VCS based on the previous construction of the collections C and C has small memory requirements (it keeps only the basis matrices S and S ) and it is ecient (to choose a matrix in C (C , resp.) it only generates a permutation of the columns of S (S , resp.)). 0

0

1

1

0

0

1

1

0

0

1

0

1

0

1

3 Canonical (

1

-threshold VCS

k; n)

Most of the constructions found in literature for (k; n)-threshold VCS are realized by using basis matrices. Among these constructions there are a few having the property that all the columns of a given weight appear with the same multiplicity in the basis matrices (see, for instance, [11, 3, 1, 6, 5, 8, 15]). Because of the relevance of this property we review some of the constructions for (k; n)-threshold VCS having such a property.

 Naor and Shamir [11] proposed a (k; k)-threshold VCS which is obtained by

means of the construction of the basis matrices S and S de ned as follows: S is the matrix whose columns are all the boolean k-vectors having an even number of `1's, and S is the matrix whose columns are all the boolean k-vectors having an odd number of `1's. In [11] the basis matrices of (2; n)-threshold VCS are realized as follows: S contains n ? 1 columns of weight 0 and one column of weight n; whereas, S contains all the columns of weight 1. Naor and Shamir [11] also proposed a (3; n)-threshold VCS whose basis matrices are realized as follows: S contains n ? 2 columns of weight zero and all the columns of weight n ? 1; whereas, S contains all the columns of weight 1 and n ? 2 columns of weight n.  In [3] the authors showed how to construct a (2; n)-threshold VCS which is optimal with respect to the contrast. The basis matrix S of such scheme is realized by considering  n?all the columns of weight bn=2c; whereas,  the basis n ? matrix S contains bn= c columns of weight zero and bn= c? columns of weight n.  Droste [6] gave an algorithm to construct basis matrices of any (k; n)-threshold VCS. The basis matrices realized by such an algorithm are constructed by adding/deleting all the columns of particular weights to the basis matrices. 0

1

0

1

0

1

0

1

1

0

1 2

1

2

5

1

 Other (k; n)-threshold VCS in which all the columns of a given weight appear in the basis matrices can be found in [5]. For instance, when kjn, setting ` = n!= ((n=k)!)k , we have that, for j = 0; : : : bk=2c, the basis matrix S is 1

realized by considering all the columns of weight (2j + 1)n=k each appearing with multiplicity ` and the basis matrix S contains all the columns of weight 2jn=k each appearing with multiplicity `.  In [8] basis matrices containing all the columns of a given weight each occuring with the same frequency have been referred to as totally symmetric matrices. The authors analyzed (k; n)-threshold VCS having as basis matrices totally symmetric ones. They gave explicit constructions for k = 2; 3; n.  In [15] the authors proposed two constructions for (k; n)-threshold VCS whose parameters are connected to notions in nite geometry and coding theory. The basis matrices derived from such constructions contain all the columns of a given weight. 0

In this section we consider basis matrices containing all the columns of a given weight each occuring with the same frequency with few additional properties (see De nition 3.1). We refer to such matrices as canonical. Since we are interested in optimizing the contrast this is without lost of generality. Before we state our results we need to set up our notation. Let M be an n  m matrix and let X  f1; : : : ; ng and Z  f1; : : : ; mg. Let M [X ][Z ] denote the jX jjZ j matrix obtained from M by considering its restriction to rows and columns indexed by X and Z , respectively. Let M be a matrix in the collection C [ C of a (k; n)threshold VCS on a set of participants P . For X  P , let MX denote the mvector obtained by considering the or of the rows corresponding to participants in X ; whereas M [X ] = M [X ][f1; : : : ; mg] denotes the jX j  m matrix obtained from M by considering only the rows corresponding to participants in X . Let M be a matrix and let D be a sub-matrix of M having the same number of rows, with M nD we denote the matrix obtained from M by removing all the columns of the matrix D. For sets X and Y and for elements x and y, to avoid overburdening the notation, we will often write x for fxg, xy for fx; yg, xY for fxg[ Y , and XY for X [ Y . Let c be a boolean vector, with c we denote the vector obtained from c by complementing all its entries; whereas, given a boolean matrix M with M we denote the matrix obtained from M by complementing all its entries. For i = 0; 1, with fc;i we denote the multiplicity of the column c in S i, that is, fc;i is the number of times the column c appears in S i. By abusing of notation, we write c 2 M to denote the fact that c is a column of the matrix M . 0

1

De nition 3.1 Let (S ; S ) be the basis matrices of a (k; n)-threshold VCS. They 0

1

are in canonical form if, for i = 0; 1, the following two properties are satis ed.

1. For any columns c and c0 such that w(c) = w(c0), it results that fc;i = fc0;i .

6

2. For any column c it results that

(

fc;i = ffc;i ifif kk isis even odd. c; ?i 1

A (k; n)-threshold VCS whose basis matrices are in canonical form is referred to as a canonical (k; n)-threshold VCS. To prove some of our results we need the following theorem.

Theorem 3.2 ([5]) Let S and S be two n  m boolean matrices. The matrices 0

1

S and S are basis matrices of a (k; n)-threshold VCS with pixel expansion m and contrast (m) if and only if for all subsets X consisting of k rows there exist a boolean matrix DX and an integer z  (m)
m such that DX is a sub-matrix of both S [X ] and S [X ], all the even columns appear in S [X ]nDX with multiplicity z , and all the odd columns appear in S [X ]nDX with multiplicity z . 0

1

0

X

1

0

X

1

X

We will use the next lemma to prove that if there exists a (k; n)-threshold VCS with contrast , then there exists a canonical (k; n)-threshold VCS having the same contrast . A weaker version of the result stated by the next lemma was independently proved in [15, Theorem 5.7].

Lemma 3.3 Let (S ; S ) be the basis matrices of a (k; n)-threshold VCS with pixel 0

1

expansion m and contrast . The matrices (B 0 ; B 1), de ned as

8 < (S ; S ) if k is odd (B ; B ) = : (S ; S ) if k is even, are the basis matrices of a (k; n)-threshold VCS with pixel expansion m and contrast . 0

1

0

0

1

1

Proof. Assume that k is odd and let B = S and B = S . Since (S ; S ) are 0

1

1

0

0

1

basis matrices of a (k; n)-threshold VCS, then, from Theorem 3.2, it results that for all subsets X consisting of k rows there exist a boolean matrix DX and an integer z  
m such that DX is a sub-matrix of both S [X ] and S [X ], all the even columns appear in S [X ]nDX with multiplicity z , and all the odd columns appear in S [X ]nDX with multiplicity z . Hence, for all subsets X consisting of k rows there exist a boolean matrix GX = DX and an integer z such that GX is a sub-matrix of both B [X ] and B [X ], all the even columns appear in B [X ]nGX with multiplicity z , and all the odd columns appear in B [X ]nGX with multiplicity z . Therefore, from Theorem 3.2, we get that (B ; B ) are basis matrices of a (k; n)-threshold VCS. It is immediate to see that the contrast of the (k; n)-threshold VCS having basis matrices (B ; B ) is the same as the contrast of the scheme we started with. The proof for the case k even is analogous to the one for k odd. 0

X

1

0

X

1

X

0

X

1

0

1

X

0

0

X

1

1

7

In [5] it was shown that if there exists a (k; n)-threshold VCS , realized using collections of n  m boolean matrices C and C , having contrast , then there exists a (k; n)-threshold VCS realized by using basis matrices having the same contrast as . We state this result as a lemma. 0

1

Lemma 3.4 Let C and C be the collections of matrices of a (k; n)-threshold VCS 0

1

with contrast . Then, there exists a (k; n)-threshold VCS realized by using basis matrices having contrast .

Proof. Without loss of generality we can assume that r = jC j = jC j (see Section 2.1 of [1]). Suppose that C = fM ; ; : : : ; M ;r g and C = fM ; ; : : : ; M ;r g, where  denotes the concatenation of two matrices. It is immediate to check that S = M ; 


 M ;r and S = M ; 


 M ;r constitute the basis matrices of a (k; n)01

0

01

0

1

11

0

0 11

1

1

1

0

1

threshold VCS having the same contrast as . The next lemma holds.

Lemma 3.5 Let C and C be the collections of matrices of a (k; n)-threshold VCS 0

1

with contrast . Then, there exists a canonical (k; n)-threshold VCS realized by basis matrices (S 0; S 1 ) having contrast .

Proof. Assume k odd. Let  be a (k; n)- threshold VCS with pixel expansion m and contrast . Suppose that  is realized using collections of n  m boolean matrices C and C . By Lemma 3.4 there exists a (k; n)-threshold VCS realized by using basis matrices (S ; S ) having the same contrast  as . For i = 0; 1, let Di 0

1

0

1

be the collection of boolean matrices obtained from S i by permuting its rows. Now, construct a new pair of matrices D and D by concatenating all the matrices in D and D , respectively. It is immediate to see that D and D constitute basis matrices of a (k; n)-threshold VCS having the same contrast as . At this point, it results that if a column of weight w appeared in S (S ), then all the columns of weights w appears in D (D ). Finally, let B = D and B = D . By Lemma 3.3, the pair (B ; B ) represents the basis matrices of a (k; n)-threshold VCS having contrast . It is straightforward to check that A = B  D and A = B  D are the basis matrices of a canonical (k; n)-threshold VCS having contrast . The proof for the case k even is analogous to the one for k odd. Notice that in [8] the authors considered totally symmetric matrices which satisfy only Property 1: of De nition 3.1 and they proved the analogous of Lemma 3.5. In any canonical (k; n)-threshold VCS, by Property 1 of De nition 3.1, all the columns of a given weight appear with the same multiplicity. Therefore, we de ne the multiplicity of a column of weight j in S i as hj;i, i.e., hj;i = fc;i if w(c) = j . Hence, any canonical (k; n)-threshold VCS can be simply described by the pair of vectors (h ; ; : : : ; hn; ) and (h ; ; : : : ; hn; ). Clearly, the pixel expansion m of a canonical (k; n)-threshold VCS is equal to ! ! X n n X n n m = hj; j = hj; j : j j 0

1

0

1

0

0

0

0

1

0

1

1

1

0

1

0

00

1

0

01

0

0

1

1

1

0

=0

=0

8

1

1

Moreover, it is easy to see that in a canonical (k; n)-threshold VCS, for any X; X 0  P , with jX j = jX 0j = k, we have that tX = tX 0 as in the original de nition by Naor and Shamir [11]. This means also that the optimal contrast is the same in our de nition as in the Naor Shamir's de nition (however, the minimal pixel expansion need not be the same). The next corollary is an consequence of Lemma 3.5.

Corollary 3.6 Let  be a (k; n)-threshold VCS in canonical form. If k is odd, then

for j = 0; : : : ; n, it results that hj;0 = hn?j;1 ; whereas, if k is even, for j = 0; : : : ; n, it results that hj;0 = hn?j;0 and hj;1 = hn?j;1.

There is another equality relating the hi;j 's which is based on the security of the (k; n)-threshold VCS. From Condition 2 of De nition 2.2 in [1], for j = 0; : : : ; n, it has to be that w(S [j ]) = w(S [j ]). From which one gets that 0

1

n X i=1

hi;

0

! ! n n ? 1 n?1 =X i ? 1 i hi; i ? 1 : 1

=1

Hence, in any canonical (k; n)-threshold VCS all the rows of the basis matrices have the same weight. The next corollary is an immediate consequence of previous observation and of Lemma 3.5.

Corollary 3.7 The pixel expansion of any canonical (k; n)-threshold VCS is twice the weight of any row of a basis matrix.

Proof. Suppose n is odd (n even) and let (S ; S ) be the basis matrices of a canonical 0

1

(k; n)-threshold VCS. From Corollary 3.6 it results that S ?i = S i (S i = S i), for i = 0; 1. Hence, as in any canonical (k; n)-threshold VCS all the rows of the basis matrices have the same weight, we have that the weight of any row of a basis matrix is half of the pixel expansion of the scheme. Notice that if (A ; A ) and (B ; B ) are (k; n)-threshold VCS having contrast , then (A  B ; A  B ), where  denotes the operator \concatenation" of two matrices, is a (k; n)-threshold VCS having contrast . Hence, if (h ; ; : : : ; hn; ) and (h ; ; : : : ; hn; ) are a pair of vectors describing a canonical (k; n)-threshold VCS having contrast , then, for any positive integer `, the vectors (`
h ; ; : : : ; `
hn; ) and (`
h ; ; : : : ; `
hn; ) again describe a canonical (k; n)-threshold VCS having contrast . Therefore, if we want to minimize the pixel expansion m for a given value of the contrast , we consider values h ; ; : : : ; hn; ; h ; ; : : : ; hn; such that gcd(h ; ; : : : ; hn; ) = gcd(h ; ; : : : ; hn; ) = 1. Suppose that n  2 is an integer, and 2  k  n. For i = 0; 1, let hi = (h ;i; : : : ; hn;i) be an (n + 1)-tuple of non-negative integers. For i = 0; 1, de ne S (hi) to be the matrix in which every binary n-tuple of weight j occurs exactly hj;i times as a column (0  j  n). In the following we provide a necessary and sucient condition for the existence of (k; n)-threshold VCS realized by such matrices S (h ) and S (h ). The following lemma holds. 1

0

0

0

1

1

0

1

1

00

01

0

1

00

01

0

1

00

01

0

01

1

00

0

1

0

0

1

9

Lemma 3.8 S (h ) and S (h ) are basis matrices of a (k; n)-threshold VCS with pixel 0

1

expansion m and contrast  if and only if the following properties are satis ed: P  P  1. nj=0 nj hj;0 = nj=0 nj hj;1 = m:

Pn?` `0  n?` h = Pn?` `0  n?` h , for 1  `  k ? 1 and 0  `0  `, j `0 j `0 j ?`0 j; j ?`0 j;   3. Pjn?k n?j k (hj; ? hj; ) = m: 2.

=

+

0

0

=0

=

+

1

1

Proof. Suppose that S (h ) and S (h ) are basis matrices for a VCS with the stated 0

1

parameters. The number of columns in S (hi) (i = 0; 1) is n n! X j hj;i: j =0

Therefore property 1 holds. Next, let c be a binary column `-tuple, where 0  `  k ? 1. Suppose that the weight of c is `0 (note that `0  `). Fix ` rows of S (h ) and S (h ), say the rst ` rows. The number of occurrences of c as a column of S (hi)[f1; : : : ; `g] is 0

nX ?` j =0

1

! n?` h ; j ? `0 j;i

for i = 0; 1. Therefore property 2. holds. Finally, we look at the weight of the OR of k rows of S (h ) and S (h ), say the rst k rows. If we let X = f1; : : : ; kg, then 0

1

w(S (h )X ) ? w(S (h )X )  m: 1

0

Let i denote the number of occurrences of (0; : : : ; 0)T as a column of S (hi)[X ], for i = 0; 1. It is easy to see that

w(S (hi)X ) = m ? i; for i = 0; 1. Hence,

w(S (hi)X ) = m ?

nX ?k j =0

! n?k h ; j;i j

for i = 0; 1. Therefore property 3. holds. Conversely, if properties 1.{3. hold, it is easy to see that S (h ) and S (h ) are basis matrices for a VCS with the stated parameters. We can in fact simplify the statement of the above lemma, by observing that many of the conditions are redundant. By repeated application of Pascal's identity for binomial coecients, we obtain the following equivalent formulation. 0

1

Lemma 3.9 S (h ) and S (h ) are basis matrices of a (k; n)-threshold VCS with pixel 0

1

expansion m and contrast  if and only if the following properties are satis ed:

10

Pn nh = Pn nh = m: j j j j; j j; P   P   2. For 1  `  k ? 1, jn?` n?j ` hj; = jn?` n?j ` hj; .   3. Pjn?k n?j k (hj; ? hj; ) = m:

1.

=0

0

1

=0

0

=0

=0

0

1

=0

1

Example 3.10 Suppose k = 2 and n = 4. The following example is from [5]. Let

h = (3; 0; 0; 0; 3) and let h = (0; 0; 1; 0; 0). This de nes a (2; 4) threshold VCS with m = 6 and contrast  = 1=3: ! ! X 4! 4 4 j hj; = 0 3 + 4 3 = 6 j ! X 4! 4 j hj; = 2 1 = 6 j ! X 3! 3 j hj; = 0 3 = 3 j ! X 3! 3 j hj; = 2 1 = 3 j ! ! X 2! 2 2 j (hj; ? hj; ) = 0 3 ? 2 1 = 2: j Example 3.11 Suppose k = 3 and n = 7. The following example is an application of a construction we give in Section 4.2. Let h = (9; 0; 0; 0; 0; 1; 0; 0) and let h = (0; 0; 1; 0; 0; 0; 0; 9). This de nes a (3; 7) threshold VCS with m = 30 and contrast  = 1=10: ! ! X 7! 7 7 j hj; = 0 9 + 5 1 = 30 j ! ! X 7! 7 7 j hj; = 2 1 + 7 9 = 30 j ! ! X 6! 6 6 j hj; = 0 9 + 5 1 = 15 j ! X 6! 6 j hj; = 2 1 = 15 j ! ! X 5! 5 5 j hj; = 0 9 + 5 1 = 10 j ! X 5! 5 j hj; = 2 1 = 10 j ! ! X 4! 4 4 j (hj; ? hj; ) = 0 9 ? 2 1 = 3: j 0

1

4

0

=0 4

1

=0 3

0

=0 3

1

=0

2

0

1

=0

0

7

0

=0 7

1

=0 6

0

=0 6

1

=0 5

0

=0 5

1

=0

4

0

1

=0

11

1

The characterization of (k; n)-threshold VCS provided by Lemma 3.9, because of Lemma 3.5, gives rise to a natural and simple formulation for computing their optimal contrast for any xed n and k in terms of linear programming. We set m = 1 without loss of generality since  is unchanged if all the hj;i's are multiplied by a constant factor. The resulting LP has only 2n + 2 variables. Maximize:

= Subject to:

nX ?k j =0

! n ? k (h ? h ) j; j; j 0

1

n n! X j !hj; = 1 j n n X j hj; = 1 j nX ?` n ? `! j (hj; ? hj; ) = 0 for ` = 1; : : : ; k ? 1 j hj;  0 for j = 0; : : : ; n hj;  0 for j = 0; : : : ; n 0

=0

1

=0

0

1

=0

0 1

It is worthwhile to notice that our linear program is equivalent to, but simpler than, the one given in [8]. We can further simplify the previous LP formulation taking into account Corollary 3.6. For odd values of k the LP formulation can be written as follows. Maximize:

= Subject to:

nX ?k j =0

! n ? k (h ? h ) j; n?j; j 0

0

n n! X j hj; = 1 j nX ?` n ? `! j (hj; ? hn?j; ) = 0 for ` = 1; : : : ; k ? 1 j hj;  0 for j = 0; : : : ; n 0

=0

0

0

=0

0

For even values of k the LP formulation can be obtained similarly. This new LP formulation is clearly simpler than the previous one as it uses only half of the variables and it reduces the number of constraints. 12

In view of Lemma 3.5, if we are interested in getting schemes with a given contrast or bound on the contrast itself, then we can restrict our attention to canonical (k; n)threshold VCS. Therefore, henceforth, unless otherwise speci ed, all (k; n)-threshold VCS we consider/analyze are canonical (k; n)-threshold VCS.

4 Contrast Optimal (

-threshold VCS

k; n)

The same column cannot appear in both basis matrices of a contrast optimal (k; n)threshold VCS. This property is easy to verify. Indeed, if the same column appears in both basis matrices, then by removing it we obtain a new schemes having a better contrast than the one we started with. This property implies the following fact.

Fact 4.1 In any contrast optimal (k; n)-threshold VCS whose basis matrices are in canonical form, for j = 0; : : : ; n and i = 0; 1, it holds that, 1. If hj;1?i > 0, then hj;i = 0. 2. If k is even, then hj;i = hn?j;i. 3. If k is odd, then hj;i = hn?j;1?i .

As a consequence of above fact and because of Corollary 3.6, we have that if n is even and k is odd then hn= ; = hn= ; = 0. 20

21

4.1 Contrast Optimal ( ? 1 )-threshold VCS n

;n

In this section we characterize contrast optimal (n ? 1; n)-threshold VCS whose basis matrices are in canonical form. The next lemma holds.

Lemma 4.2 Let n  3. In any contrast optimal (n ? 1; n)-threshold VCS whose basis matrices are in canonical form, the hj;i's satisfy:

1. hj;0 > 0 if and only if either j < n=2 and j is even or j > n=2 and j is odd. 2. hj;1 > 0 if and only if either j < n=2 and j is odd or j > n=2 and j is even.

Proof. Let (S ; S ) be the basis matrices of a canonical (n ? 1; n)-threshold VCS 0

1

which is contrast optimal. It holds that:

If j is odd and hj; = 0; then hj ; > 0; whereas, if j is even and hj; = 0; then hj ; > 0: 1

(1)

+1 1

0

+1 0

Would it be otherwise we have hj; = hj ; = 0 which is impossible as, by Theorem 3.2, all the columns of weight j have to appear among the columns of S [X ], where X is a subset of f1; : : : ; ng of cardinality n ? 1. Similarly, we can prove that if 1

+1 1

13

1

j is even and hj; = 0, then it holds that hj ; > 0. We will prove that for any integer j < n=2 it holds that: 0

+1 0

If j is even, then hj;0 > 0; whereas, if j is odd, then hj;1 > 0.

(2)

Therefore, applying Corollary 3.6, the lemma holds. Now assume that n is even and j < n=2. Suppose by contradiction that hj; = 0. From (1) and by Fact 4.1 we have hj ; > 0 and hj ; = 0. Applying again (1) and Fact 4.1 we get hj ; > 0 and hj ; = 0. Iterating the previous argument we get that either hn= ; > 0 or hn= ; > 0 depending on whether n=2 is even or odd which is a contradiction (recall that hn= ; = hn= ; = 0). If j is odd, then we repeat the proof for the case j even, mutatis mutandis. If n is odd, then by Corollary 3.6 we have that h n? = ;i = h n = ;i , where i = 0; 1. At this point we repeat the proof for the case n even, mutatis mutandis. We get that either h n? = ; = 0 and h n = ; > 0 or h n? = ; = 0 and h n = ; > 0 which is a contradiction. Thus, the lemma holds. The next lemma states the exact value of the hj;i of any contrast optimal (n ? 1; n)threshold VCS whose basis matrices are in canonical form. 0

+1 0

+2 1

+1 1

+2 0

20

21

20

21

(

(

1) 2 0

( +1) 2 0

(

1) 2

( +1) 2

1) 2 1

( +1) 2 1

Lemma 4.3 Let n  3. In any contrast optimal (n ? 1; n)-threshold VCS whose basis matrices are in canonical form, the hj;i's satisfy:

 If n is even, then for j = 0; : : : ; b(n ? 2)=4c, we have h j; = hn? j; = n ? 2j ; whereas, for j = 0; : : : ; b(n ? 4)=4c, we have h j ; = hn? j ; = n ? (2j +1).  If n is odd, then for j = 0; : : : ; bn=4c, we have h j; = hn? j; = n ? 4j ; whereas, for j = 0; : : : ; d(n ? 5)=4e, we have h j ; = hn? j ; = n ? (4j + 2). Proof. Let  be a contrast optimal (n ? 1; n)-threshold VCS. Let (S ; S ) be the n  m basis matrices of  and let  be its contrast. Let X be a subset of f1; : : : ; ng of cardinality n ? 1 and let c be a column of weight j , where n=2  j < n. Suppose j is even. According to Theorem 3.2, the column c has to appear at least 
m times 2 0

2 +1 1

(2 +1) 0

2 0

2 +1 1

2 1

2

2

2 0

(2 +1) 1

0

1

more in S [X ] than in S [X ]. Therefore, since  is contrast optimal, by Lemma 4.2 we have that hj ; ? hj; = 
m. A similar argument applies when j is odd. In this case we obtain hj ; ? hj; = 
m. For n even, recalling Lemma 4.2 and setting, w.l.o.g., 
m = 1, we get the following n=2 linear equations in n unknowns 0

1

+1 0

1

+1 1

0

hn? j; ? hn? j hn? j ; ? hn? 2 1

(2 +1) 0

;

(2 +1) 0

j

;

(2 +2) 1

= 1 for j = 0; : : : ; b(n ? 2)=4c = 1 for j = 0; : : : ; b(n ? 4)=4c

(3)

Summing up equations (3) and recalling that hn= ; = hn= ; = 0, we get that hn = n=2 from which we can compute the value of the other unknowns. Therefore, we obtain that if n is even, then for j = 0; : : : ; b(n ? 2)=4c, we have h j; = hn? j; = n ? 2j ; whereas, for j = 0; : : : ; b(n ? 4)=4c, we have h j ; = hn? j ; = n ? (2j + 1). If n is odd, then we set 
m = 2 and we repeat the proof for the case n even, mutatis mutandis. 20

21

2 0

2 +1 1

14

(2 +1) 0

2 1

2

2

The results of the above lemma can be summarized as follows: If n is even, then, for j = 0; : : : ; n, 8 n ? j if j is even and j < n=2 > > < hj; = hn?j; = j ? n if j is odd and j > n=2 > :0 otherwise. If n is odd, then, for j = 0; : : : ; bn=2c, 8 < n ? 2j if j is even and j < n=2 hj; = hn?j; = : 0 otherwise. and 8 < n ? 2j if j is odd and j < n=2 hj; = hn?j; = : 0 otherwise. The next lemma holds. Lemma 4.4 For any n  3 and for any contrast optimal canonical (n?1; n)-threshold VCS the pixel expansion m is given by 8 n n  > < if n is even m = > n=n?  : n n? = if n is odd. 2

0

1

0

0

1

1

2

4

2

(

1 1) 2

Proof. Assume n is even. We have that,

! n hj; j m = j  n ! b nX  n ! ? = c n b n?X= c  n = 2 ? 2j 2j + j 2 ? (2j + 1) 2j + 1 j  n! n=X?  n = 2 ?j j j Since for any even integer r and any integer m it holds that, see [7, pag. 166],  r! g + 1 r ! g r X 2 ?j j = 2 g+1 : j then, ! n n m = 4 n=2 : n X

0

=0

(

(

2) 4

=0

=0

2

4) 4

1

=0

=0

On the other hand, if n is odd, then

m=

n X j =0

hj;

0

! ! n= c n n = 2 bX (n ? 4j ) 2j : j j 4

=0

15

We begin by simplifying the sum as follows: b c X n

4

(n ? 4j ) 2nj

!

j =0

!! n = (n ? 2j ) n ? 2j ? 2j 2j j !! ! b c X n ? 1 n ? 1 = n n ? 2j ? 1 ? n 2j ? 1 j 0b c ! X !1 b c X n ? 1 n ? 1 A = n@ 2j ? j 2j ? 1 : j b c X

!

n

n

4

=0 n

4

=0

n

n

=0

=1

4

Recall that

4

! ! n ? 1 = bXc n ? 1 = 2n? 2j 2j ? 1 j j for any positive integer n. Suppose n  1 mod 4. Then we have the following: ? c ! ! ! ! ? bX b c n?1 = X n ? 1 + bXc n ? 1 ? n ? 1 n? 2j 2j j j j b c 2j ! ! ! X b c bXc n ? 1 n ? 1 n ? 1   = 2j + i 2 b n c + i ? n? j ! bXc ! ! bXc n ? 1 n ? 1 n ? 1 = 2j + j n ? 1 ? 2j ? n? j ! ! bXc n ? 1 n ? 1 = 2 2j ? n? ?1 c bX 2 n

n

2

=0

n

2

1

2

=1

n

n

4

=0

2

1

1

n

=0

= 4

n

n

4

2

4

=0

1

=0

n

n

=0

=0

4

4

2

4

1

2

n

4

1

j =0

2

Suppose n  3 mod 4. Then we have the following: ?1 c bX 2 n

j =0

n?1 2j

!

? ! ! n ? 1 + bXc n ? 1 2j 2j j j b c ! ! bXc n ? 1 + bXc  n ? 1  2j 2 bnc + 1 + i j i ! ! bXc n ? 1 + bXc n ? 1 2j n ? 2j j j ! b c X n ? 1 2 2j j

bX c 4

n

n

= =

1

=0

+1 = n 4

n

n

4

4

=0

=0

4

n

n

=

2

4

4

=0

=0

n

=

4

=0

Therefore, for n odd we have

  ! 8  b c X n ? 1 = < 2n? + n?? if n  1 mod 4 : n ? 2j (2 ) if n  3 mod 4. j n

4

=0

1 2

2

n

1 2

16

1

2

1

2

Similarly,

c bX 4 n

j =1

! 8 (2n?) if n  1 mod 4 n?1 =<   if n  3 mod 4. 2j ? 1 : 2n? ? n?? 1 2

1 2

2

Hence, for n odd,

bX c 4 n

2

(n ? 4j ) n 2j

n

!

1

2

1

! n ? 1 n : = 2 n? 1

j =0

2

Thus, the theorem holds.

Theorem 4.5 For any n  3 and for any canonical (n ? 1; n)-threshold VCS the maximum contrast  is given by

8 h n  n i? > <  = > h n=n? i? : n 1

4

2

1

1

2

n?1)=2

(

if n is even if n is odd.

Proof. In the proof of Lemma 4.3, to compute the value of the hj;i's of any contrast optimal (n ? 1; n)-threshold VCS, for n even, we set 
m = 1; whereas for n odd, we set 
m = 2. Therefore, applying Lemma 4.4 the theorem holds.

It is worthwhile to notice that according to the previous lemma one has that in any contrast optimal (n ? 1; n)-threshold VCS  = (2?nn? = ). This is a lower contrast than an (n; n)-threshold VCS. 1 2

4.2 Contrast Optimal (3 )-threshold VCS ;n

In this section we provide, for n  4, a contrast optimal (3; n)-threshold VCS which is also strong and has its basis matrices in canonical form. We rst describe a family of (3; n)-threshold VCS achieving various values of contrast and pixel expansion. Then, for any xed n  4, we determine the scheme in this family having the best contrast. Finally, we prove that the scheme has optimal contrast among all (3; n)-threshold VCS by proving an upper bound on the contrast of any (3; n)-threshold VCS. For any n  4 and any integer 1  g < n=2, consider the visual cryptography scheme whose basis matrices are in canonical form, denoted by S (3; n; g), described by the following hj;i's.

! ! n ? 1 n ? 1 (4) h ; = hn; = g ? g ? 1 and hn?g; = hg; = 1 whereas all the remaining hj;i's are equal to zero. This is a strong (3; n)-threshold VCS as shown by the following theorem. 00

0

1

17

1

Theorem 4.6 For any n  4 and any integer 1  g < n=2, the scheme S (3; n; g) described by (4) is a strong (3; n)-threshold VCS having pixel expansion and contrast equal to ! g(n ? 2g) ; n ? 1 and  = m=2 g 2(n ? 1)(n ? 2) respectively.

Proof. Let hi = (h ;i ; : : : ; hn;i), for i = 0; 1, where the hj;i's are given by (4) and let 0

Sg (h ) and Sg (h ) be binary matrices in which, for i = 0; 1, every binary n-tuple of weight j occurs exactly hj;i times as a column of Sg (hi). Then, Sg (h ) and Sg (h ) satisfy the conditions of Lemma 3.9, where n?  n?  ! n ? 1 g ( n ? 2 g ) g? ? g? = (5) and m = 2 = 2(n ? 1)(n ? 2) g : 2 n?g Indeed, it is immediate to verify that ! ! ! ! n n! X n ? 1 n n ? 1 n ? 1 j hj; = g ? g ? 1 + n ? g = 2 g j and ! ! ! ! n n! X n ? 1 n ? 1 n ? 1 n j hj; = g + g ? g ? 1 = 2 g : 0

1

0

3 1

1

3 2

1

0

=0

1

j =0

Hence, Condition 1 of Lemma 3.9 is satis ed. Condition 2 is also satis ed because of ! nX ! ! ! ? n ? 1! nX ? n ? 1! n ? 1 n ? 1 n ? 1 n ? 1 j hj; ; j hj; = g ? g ? 1 + n ? g = g = j j and ! ! ! ! ! nX ? n ? 2! n ? 2 n ? 1 n ? 2 n ? 1 n ? 1 g ? g?1 j hj; = g ? g ? 1 + n ? g = j ! nX ? n ? 2! n ? 2 = j hj; : g =j Now, we prove that Condition 3 of Lemma 3.9 is satis ed, where  and m are as given by (5). We have that ! ! ! ! nX ? n ? 3! n ? 3 n ? 3 n ? 1 n ? 1 g ? g?1 ? g + n?g j (hj; ? hj; ) = j ! ! ! ! ! n ? 3 n ? 3 n ? 1 n ? 2 n ? 2 = g + g?1 ? g?1 ? g + g?3 ! ! ! n ? 3 n ? 2 n ? 3 = g?1 ? g?2 + g?3 ! ! n ? 3 n ? 3 = g ? 1 ? g ? 2 = m: 1

1

1

0

=0

=0

2

0

=0

2

1

=0

3

0

1

=0

18

This proves that Condition 3 of Lemma 3.9 holds. Finally, we prove that the scheme S (3; n; g) is strong. For any 3  `  n and for any Y  f1; : : : ; ng such that jY j = `, the number of zero columns in Sg (h )[Y ] (Sg (h )[Y ]) does not depend on the particular set Y , but only on its size ` since the basis matrices are in canonical form. Hence, we refer to such a quantity as ` (` ). We have that ! ! ! ! n ? ` n ? ` n ? 1 n ? 1 ` = g ? g ? 1 + n ? g and ` = g : 0

1

0

1

1

0

 

 

Notice that when ` > g, then nn??g` = 0; whereas, n?g ` = 0 when g > n ? `. We 4 de ne the function (`), for 3  `  n, as (`) = ` ? ` , that is, 0

1

! ! ! ! n ? ` n ? ` n ? 1 n ? 1 (`) = g ? g ? 1 + n ? g ? g : To prove that the scheme is strong it is enough to show that (`)  m, for 3  `  n. We next show that the function (`) is non decreasing, by proving that (` + 1) ? (`)  0. Indeed, this dierence can be written as ! ! ! ! n ? ` ? 1 n ? ` n ? ` n ? ` ? 1 (` + 1) ? (`) = g n?g ? n?g + g ? ! ! n ? ` ? 1 n ? ` ? 1 = g?1 ? n?g?1 ! ! n ? ` ? 1 n ? ` ? 1 = g?1 ? g?` :   Notice that if ` >g, then n?g?`?` = 0 and (` + 1) ? (`)  0. Assume ` = g. Then (` + 1) ? (`) = n?g?`? ? 1. Since g < n=2 and ` = g, then g ? 1  n ? ` ? 1. Thus, (` + 1) ? (`)  0. Finally, assume ` < g. Then (n ? ` ? 1)! n ? ` ? 1)! ? (` + 1) ? (`) = (g ? (1)!
(n ? ` ? g)! (g ? `)!
(n ? g ? 1)! `j? (n ? g ? j ) ? `j? (g ? j ) (n ? ` ? 1)! =
: (g ? `)!
(n ? ` ? g)! `j? (n ? g ? j )
(g ? j ) The above quantity is non-negative, as n ? g ? j  g ? j for g  n=2. Therefore, the function (`) is a non decreasing function. Hence, since (3)  m0, the scheme S (3; n; g) is strong. From the arguments used in the proof of the above theorem one can see that by stacking together more than three transparencies from the scheme S (3; n; g), the image we recover becomes more visible (i.e., the dierence between a white and a black pixel is larger when we stack together more than three transparencies). When 1

1

1

1 =1

1 =1

1 =1

19

n?  n?  we stack n ? g < `  n transparencies we have that ( ` ) = g ? g? . Since n?  m = 2 g , we get that the \contrast" in this case is equal to 1

1 1

1

n?  n?  (`) = g ? g? = n ? 2g : m 2(n ? g) 2 n?g 1

1 1

1

Notice that, for xed n, the contrast of the scheme given by Theorem 4.6 depends only on the parameter g. Hence, the scheme achieving the best contrast among the schemes S (3; n; g) is obtained by choosing the integer g in the interval [1; n=2[, in such a way that the quantity (n ? 2g)g is maximized. For real g the function (n ? 2g)g is convex \ and reaches its maximum at g = n=4. Since g has to be an integer, a simple algebra shows that the quantity (n ? 2g)g reaches its maximum at g = b(n + 1)=4c. Thus, for any n  4, the following hj;i's describe a strong (3; n)-threshold VCS achieving the best contrast among the family of schemes S (3; n; g).

! ! n ? 1 n ? 1 h ; = hn; = j n k ? j n k ? 1 00

1

hn?b c; = hb c; = 1; (6)

and

+1 4

+1 4

n+1

4

n+1

0

4

1

whereas all the remaining hj;i's are equal to zero. The contrast of the scheme described by the above hj;i's is equal to

  n ? 2b n c b n c 2(n ? 1)(n ? 2) : +1 4

+1 4

(7)

We now show that the schemes described by (6) is indeed a contrast optimal (3; n)threshold VCS.

Theorem 4.7 Let n  4. In any (3; n)-threshold visual cryptography scheme it holds that   n ? 2b n c b n c   2(n ? 1)(n ? 2) : +1 4

+1 4

Proof. Let S and S be the n  m basis matrices in canonical form of a (3; n)0

1

threshold VCS with contrast . Since our aim is to prove an upper bound on the contrast we do not loose of generality in considering basis matrices in such a form (see Lemma 3.5). Let T = f2; : : : ; ng and Zi = fj : S i[1][j ] = 0g, that is, Zi denotes the set of indices of columns of S i having a zero as rst entry. Finally, let A = S [T ][Z ] and A = S [T ][Z ]. In other words, the pair of matrices A = (A ; A ) is constituted by the sub-matrices of S and S obtained by removing all the columns having a one as rst entry and removing the rst row. Hence, up to a column permutation, the basis matrices S and S are of the following form: 0

1

1

0

1

0

0

1

1

"




1 S = 0
A

0 1 B 0

1

0

#

"

#




1 ; S = 0
A

0 1 B 1

0

20

1

1

0

0

where B and B are boolean matrices. It is known (see Theorem 6.1 and Corollary 6.2 of [5]) that A and A are basis matrices of a (2; n ? 1)-threshold VCS. Now, denote by (A) the contrast of the (2; n ? 1)-threshold VCS with basis matrices (A ; A ). Since by Corollary 3.7 m = 2w(S [1]), then it is easy to see that the contrast  of the scheme represented by (S ; S ) is equal to 0

1

0

1

0

1

0

0

1

 = (2A) ;

(8)

while the pixel expansion is equal to m = 2m0, where m0 is the pixel!expansion of the X scheme having basis matrices (A ; A ), that is, m0 = hj; n ?j 1 , where J is the 0

1

1

j 2J

set of indices j for which hj; > 0 and j < n in A . Let X be a set of two rows, we have that (A)  w(AX ) m?0 w(AX ) ; 1

1

1

0

Since w(A [i]) = w(A [i]),hfor ii = 1; : : : ; n ? 1, we have that w(AX ) ? wh (AiX ) is equal to the number of columns in A [X ] minus the number of columns in A [X ]. Therefore, we get that 1

0

1

1 0

0

1 0

1

0

!# X " n ? 3! n ? 3 w(AX ) ? w(AX ) = hj; j ? 1 ? hn?j; n ? j ? 1 j 2J X " n ? 3! n ? 3!# = hj; j ? 1 ? j ? 2 : j 2J 1

0

0

1

1

Hence,

!# ! n ? 3 n ? 3 hj; j ? 1 ? j ? 2 j 2J ! : (9) (A)  X n ? 1 hj; j j 2J Notice that for any function g(x), for any positive function f (x), and for any non empty set D which is a subset of both functions' domain, it holds that X g(x) g(x) : xX 2D  max f (x) x2D f (x) X

"

1

1

x2D

Therefore, since J  f0; : : : ; n ? 1g, we have that

!# ! n ? 3 n ? 3 n?  n?  hj; j ? 1 ? j ? 2 (n ? 2j )j : j 2J j ?  ? j ? !  max = max n ? X j 2J j 2J (n ? 1)(n ? 2) j hj; n ?j 1 j 2J X

"

1

3 1

3 2

1

1

21

We have already seen earlier in this section that the function (n ? 2j )j reaches its maximum over the integers j 2 f0; : : : ; n ? 1g at j = b(n + 1)=4c. Therefore,



 n c bn c n ? 2 b (A`)  (n ? 1)(n ? 2) : The theorem then follows by (8). Let  (n) be the expression (7). It is easy to see that nlim !1  (n) = 1=16. Therefore, the construction for (3; n)-threshold VCS given at the end of Section 5 in [5] has nearly optimal contrast asymptotically, as well as a small pixel expansion. +1 4

+1 4

3

3

5 A Canonical (4 )-threshold VCS ;n

In this section we provide, for n  4, a class of strong (4; n)-threshold VCS whose basis matrices are in canonical form. We rst describe a family of (4; n)-threshold VCS achieving various values of contrast and pixel expansion. Then, for any xed n  4, we determine the scheme in this family having the best contrast. For any even n  4 and any integer 1  g < n=2, consider the visual cryptography scheme whose basis matrices are in canonical form, denoted by S (4; n; g), described by the following hj;i's

  h ; = hn; = n=n?? t nng? n?ng? g ; ? (10) hn= ; = t ; and hg; = hn?g; = (( ??))
t ? n?  nn?   n? o where t = g? / gcd g? ; n= ? and all the remaining hj;i's are equal to zero. This is a strong (4; n)-threshold VCS as shown by the following theorem. Theorem 5.1 For any even integer n  4 and any integer 1  g < n=2, the scheme S (4; n; g) is a strong (4; n)-threshold VCS having pixel expansion and contrast equal to ! 2nt (n ? 1) n ? 3 n ? 2g) ; m = g(n ? g) n=2 ? 1 and  = 4n(gn(n??1)(gn)(? 2)(n ? 3) 00

20

n;g

2 1

0

2

1

n;g

2 1

3 1

2

n;g

(

2 )2

1)(

(

)

1

n n=2 n g

3

2 1

1

n;g

3 1

2

n;g

respectively.

Proof. Let hi = (h ;i; : : : ; hn;i), for i = 0; 1, where the hj;i's are given by (10) and 0

let Sg (h ) and Sg (h ) be binary matrices in which, for i = 0; 1, every binary n-tuple of weight j occurs exactly hj;i times as a column of Sg (hi). Then, Sg (h ) and Sg (h ) satisfy the conditions of Lemma 3.9. Indeed, it is immediate to verify that ! " !# n n! X ( n ? 1)( n ? 2 g ) n ? 3 n j hj; = 2 n=2 ? 1 ng(n ? g) + n=2 t j 0

1

0

1

2

0

n;g

=0

=

# !" n ? 3 2(n ? 1)(n ? 2g) + 8n(n ? 1)(n ? 2) t ng(n ? g) n (n ? 2) n=2 ? 1 2

2

22

n;g

!

2nt (n ? 1) n ? 3 = g(n ? g) n=2 ? 1 n;g

and

 n?   n?  ! ! ! n n! X 2 nt ( n ? 1) n ? 3 n n n= ? n= ?     j hj; = ng?? g t + ng?? n ? g t = g(n ? g) n=2 ? 1 : j 2

1

3 1

2

n;g

2 1

=0

3 1

n;g

n;g

2 1

Hence, Condition 1 of Lemma 3.9 is satis ed. To prove that Condition 2 of Lemma 3.9 is satis ed we have to show that, for ` = 1; 2; 3, the following identity holds nX ?` n ? `! nX ?` n ? `! (11) j hj; : j hj; = j j Notice that, for ` = 1, we have ! ! nX ?` n ? `! ( n ? 1)( n ? 2 g ) n ? 3 n ? 1 j hj; = t n=2 ? 1 ng(n ? g) + t n=2 j !" # ( n ? 1)( n ? 2 g ) n ? 3 4( n ? 1) = t n=2 ? 1! ng(n ? g) + n ? 1) = t n=n2??31 ng((nn ? g) and   nX ?` n ? `! t n=n?? " n ? 1! n ? 1!# n?  + g?1 j hj; = g j g?n? n t n= ? g n?  = 1

0

=0

=0

2

0

n;g

n;g

=0

2

n;g

n;g

n;g

1

2

3 1

2 1

=0

n;g

2

3 1 2

g?1

! ? 1) : n ? 3 = t n=2 ? 1 ng((nn ? g) Therefore, for ` = 1, we have that the identity (11) holds. (The cases ` = 2 and ` = 3 are considered in Appendix A.) Now, we prove that Condition 3 of Lemma 3.9, where  and m are as given by (5), that is, ! nX ? n ? 4! t (n ? 2g) n ? 3 (12) j (hj; ? hj; ) = 2(n ? 2)(n ? 3) n=2 ? 1 j is satis ed. We have that nX ? n ? 4! j (hj; ? hj; ) = j n?  n?  n?  3 !2 + n ? 3 ( n ? 1)( n ? 2 g ) t n=2 ? 1 4 ng(n ? g) +  nn=?  ? g n? n?g 5 n= ? g? n;g

4

2

0

n;g

1

=0

4

0

1

=0

4 2

2

n;g

2

23

3 1

4

4

2 1

!" (n ? 1)(n ? 2) + (n ? 4)(n ? 6) n ? 3 = t ng(n ? g) 2n(n ? 3) n=2 ? 1 # ( n ? g ? 1)( n ? g ? 2)( n ? g ? 3) ( g ? 1)( g ? 2)( g ? 3) ? ? (n ? g)(n ? 2)(n ? 3) g(n ? 2)(n !? 3) t (n ? 2g) = 2(n ? 2)(n ? 3) n=n2??31 : 2

n;g

2

n;g

This proves that Condition 3 of Lemma 3.9 holds. Finally, we prove that the scheme S (4; n; g) is strong. For any 4  `  n and for any Y  f1; : : : ; ng such that jY j = `, the number of zero columns in Sg (h )[Y ] (Sg (h )[Y ]) does not depend on the particular set Y , but only on its size ` since the basis matrices are in canonical form. Hence, we refer to such a quantity as ` (` ). We have that ! ! t (n ? 1)(n ? 2g) n ? 3 n ? ` ` = n=2 ? 1 + t n=2 ng(n ? g) 0

1

0

1

2

0

n;g

n;g

and

 n?  " !# ! n ? ` n ? ` n= ? ` = t n?  + n?g : g g? n?`   Notice that when ` > g, then n?g = 0; whereas, n?g ` = 0 when g > n ? `. We 4 de ne the function (`), for 4  `  n, as (`) = ` ? ` , that is, !  n?  " ! !# ! t (n ? 1)(n ? 2g) n ? 3 n ? ` n ? ` n ? ` n= ?   (`)= n=2 ? 1 +t n=2 ?t ng?? ng(n ? g) g + n?g : 2

1

n;g

3 1

2 1

0

1

2

2

n;g

n;g

n;g

3 1

2 1

To prove that the scheme is strong it is enough to show that (`)  m, for 4  `  n. Next we show that the function (`) is non decreasing, by proving that (` + 1) ? (`)  0. Indeed, this dierence can be written as

!#  n?  ! n ? ` ? 1 n ? ` ? 1 n ? ` ? 1 n= ? (` + 1) ? (`)= g ? 1 + n ? g ? 1 n?  t ? n ? 1 t : g? "

!

2

3 1

2 1

n;g

n;g

2

Assume `  g. Then, after some algebra, to prove (` + 1) ? (`)  0 is equivalent to prove that  `Y ? n `Y ? `Y ? (n ? g ? j ) + (g ? j ) ? 2 ? j 2 j j j  0:  `Y ? n 2 2 ?j 1

1

1

=1

=1

=1

1

j =1

Since j < `  g < n=2, we have that the denominator is positive. Therefore, we have to show that the numerator is non negative. To this aim we need some de nitions and properties of combinatorial quantities (see [7, pag. 47{48]). For any integer s  0 24

and real x, the rising factorial power xs is de ned as xs = x(x + 1)


(x + s ? 1). The rising factorial power is strictly related to the Stirling numbers of rst kind. For any integers n and" k #such that n  k  0 and n > 0, the Stirling numbers of rst kind, denoted by count the number of ways to arrange n objects into k cycles and they are de ned as " # " # " # " # " # n = (n ? 1) n ? 1 + n ? 1 0 n with k k k?1 0 = 1 and 0 = 0: The Stirling numbers of rst kind and the rising factorial powers are related by n "n # X n xk : x = k k Using the rising factorial powers and the above identity, we have that  `Y ? n `Y ? `Y ? (n ? g ? j ) + (g ? j ) ? 2 2 ?j j j j n k

;

=0

1

1

1

=1

=1

=1

`?  + (g ? ` + 1)`? = (n ? g ? ` + 1)`? ? 2 n2 ? ` + 1 p `X ? " ` ? 1 # n `X ? " `?1 # p ( n ? g ? ` + 1) ? 2 ? ` + 1 = + p p 2 1

1

1

1

1

p=1

`? " X

p=1

# ` ? 1 (g ? ` + 1)p p p " #  p  `X ? `?1  p ? 2 n ? ` + 1 + (g ? ` + 1)p ( n ? g ? ` + 1) = p 2 p By induction on p, it is immediate to see that (n ? g ? ` + 1)p ? 2(n=2 ? ` + 1)p + (g ? ` + 1)p  0. Indeed, setting a = n=2 ? ` + 1 and d = n=2 ? g, we have to prove that (a + d)p ? 2ap + (a ? d)p  0. (Notice that a > d > 0.) For p = 1 , the basis of the induction is true. By inductive hypothesis, assume that (a + d)p ? 2ap + (a ? d)p  0, for some p  1. We have that (a + d)p + (a ? d)p = a[(a + d)p + (a ? d)p] + d[(a + d)p ? (a ? d)p]  a[(a + d)p + (a ? d)p]  2ap : (by the inductive hypothesis) Hence, for `  g, we have that (` + 1) ? (`)  0. Assume now g < `  n=2. Then, to prove that (` + 1) ? (`)  0 is equivalent to prove that  `Y ? n `Y ? (n ? g ? j ) ? 2 2 ?j j j  0:  `Y ? n 2 2 ?j j 1

=1

1

=1

+1

+1

+1

1

1

=1

=1

1

=1

25

Since j < `  n=2, we have that the denominator of the above expression is a positive quantity; while, the numerator can be written as (n ? g ? ` + 1)`? ? 2(n=2 ? ` + 1)`? 1

1

p `X ? " ` ? 1 # n `? " ` ? 1 # X p = p p (n ? g ? ` + 1) ? 2 p 2 ?`+1 p  p `? " ` ? 1 #  X p?2 n ?`+1 ( n ? g ? ` + 1) : = p 2 p 1

1

=1

=1

1

=1

By induction on p, one can see that (n ? g ? ` + 1)p ? 2(n=2 ? ` + 1)p  0. Therefore, for g < `  n=2 we have that (` + 1) ? (`)  0. Finally, assume that ` > n=2. Then,

(` + 1) ? (`) =

t
n;g

n?`?  n?  g?  n= ?  0: n? 1

1

2

3 1

2

g?1

Therefore, the function (`) is non decreasing. Hence, since (4)  m, the scheme S (4; n; g) is strong. Notice that, for xed n, the contrast of the scheme given by Theorem 5.1 depends only on the parameter g. Hence, for xed n, the scheme achieving the best contrast among the schemes S (4; n; g) is obtained by choosing the integer g in the interval [1; n=2[, in such a way that the quantity

 (g; n) = 4n(gn(n??1)(gn)(n??2)(2ng)? 3) 2

4

is maximized. For real g and for xed n, a simple algebra shows that the function p g(n? g)(n?2g) , with g 2 [1; n=2[, is convex \ and reaches its maximum at g = (2p? 2)n=4. Since g has topbe an integer, we have that g can be neither equal p to b(2 ? p2)n=4c oro equal to d(2? 2)n=4e. For any xed n  4, let gn 2 b(2 ? 2)n=4c; d(2 ? 2)n=4e be the integer which maximizes  (g; n). One can easily see that nlim !1  (gn; n) = 1=64. 2

4

4

Remark 5.2 Theorem 5.1 holds only when n is even. If n is odd, then, by applying

the technique given in Theorem 5.1, we construct a (4; n +1)-threshold VCS, and then we consider only the rst n rows of the basis matrices of such scheme. Therefore, for any odd n  4 and any integer 1  g < n=2, there exists a strong (4; n)-threshold VCS having pixel expansion and contrast equal to ! 2nt (n + 1) n + 1 ? 3 n + 1 ? 2g) ; m = g(n + 1 ? g) (n + 1)=2 ? 1 and  = g4(nn(+n +1 ?1)(gn)(? 1)(n ? 2) 2

n;g

respectively. 26

6 A Canonical (5 )-threshold VCS ;n

In this section we provide, for n  5, a class of (5; n)-threshold VCS whose basis matrices are in canonical form. Similarly to the previous cases, we rst describe a family of (5; n)-threshold VCS achieving various values of contrast and pixel expansion. Then, for any xed n  5 we determine the scheme in this family having the best contrast. For any two integers ` and g such that 1  ` < g < n=2, the (5; n)-threshold VCS whose basis matrices are in canonical form, denoted by S (5; n; `; g), is described by the following hj;i's: hg; = hn?g; = t ; hn?`; = h`; = s ; and h ; = hn; = r ; (13) where 0

1

0

(n;`;g )

1

00

(n;`;g )

1

(n;`;g )

n?  n?  hn?  n? i ? ? t = nn?  `?n?  `?n?  n? o ; s = t hng??  ng?? i ; gcd `? ? `? ; g? ? g? `? ? `? !# ! " !# ! " n ? 4 n ? 4 n ? 4 n ? 4 r =s g ? g?4 ; ` ? `?4 ?t and all the remaining hj;i's are equal to zero. Theorem 6.1 For any two integers ` and g such that 1  ` < g < n=2, the scheme S (5; n; `; g) is a canonical (5; n)-threshold VCS having pixel expansion and contrast 4 1

(n;`;g )

4 3

4 1

(n;`;g )

equal to

m=s

(n;`;g )

4 3

4 1

(n;`;g )

4 3

4 3

4 1

4 3

(n;`;g )

(n;`;g )

!# ! " ! n + n?4 ? n?4 +t `?4 ` `

(n;`;g )

and

(n;`;g )

4 1

!# ! " ! n + n?4 ? n?4 g g?4 g

)(n ? 2g)(n ? 2`)  = 2(n + `2(`g??2`g)()(nn??g1)( n ? 2)(n ? 3)(n ? 4) ;

respectively.

Proof. It is easy to see that Condition 1 of Lemma 3.9 is satis ed as the basis matrices of the scheme S (5; n; `; g) are one the complement of the other. To prove that Condition 2 of Lemma 3.9 is satis ed we have to show that, for 1  q  4, the following equality holds

nX ?q j =0

We have that

nX ?q j =0

n

? j

q

! j;

h 1

=

! ?q n ? q ! n ? q h = nX j; j hj; : j j

(14)

0

1

=0

t (n;`;g )

n

!?
?
? ?ng??
? ?ng??
+ n? ? n? q

4 1 4 1

`?

`

27

4 3 4 3

`?

t (n;`;g )

n n

? ?

q g

!

and

nX ?q

n

?

j =0

q

!

=

j;

h 0

j

t (n;`;g )

t (n;`;g )

?n?
? ?n?
" ! ? 4 ? g ? g ? ?n?
? ?n?
"`? !`? !# ?4 ? ?4 + ?4 4 1 4 1

4 3 4 3

n

n

`

n

g

g

n `

! !# ?4 + ? ? ?4 ? ! ?

t (n;`;g )

n

q

n

q

n

`

:

g

Therefore, equality (14) is satis ed if and only if the quantity

n?  n?  " !# ! !# " ! n ? 4 n ? 4 n ? 4 4  g?  ?  g?  n ? 4 (15) ? `?4 ? g ? g?4 A(n; `; g) = n? n? ` ? `? `? 4 1

4 3

4 1

4 3

is equal to

n?  n?  " !# ! !# " ! n ? q n ? q n ? q 4  g?  ?  g?  n ? q B (n; `; g; q) = n? n? g ? n ? g : (16) ` ? n?` ? `? ? `? 4 1

4 3

4 1

4 3

If we substitute q for 4 in (16) we get expression (15). Therefore, (14) is satis ed for q = 4. We will prove that equality (14) holds when q = 1 and 4  ` < g. (The remaining cases are analyzed in Appendix A.) Note that A(n; `; g) can be written as

n?  h n?g? gn??  h n?g`?? 4 3

(

4

(

`?3

n?g?2) ? 1i ( 1)(g ?2) i 1)(n?`?2) ? 1 (`?1)(`?2)

!" # n ? 4 (n ? ` ? 1)(n ? ` ? 2)(n ? ` ? 3) ? ` ? 3 `?3 `(` ? 1)(` ? 2) n?` !" # ( n ? g ? 1)( n ? g ? 2)( n ? g ? 3) n ? 4 g ? 3 ? g?3 ? n?g g(g ? 1)(g ? 2)

1)(

which is equal to

h n?g? !8 < n?4 g? : g?3 (

(

n?g?2) ? 1i h (n?`?1)(n?`?2)(n?`?3) g?2) h `(`?1)(`?i 2) (n?`?1)(n?`?2) ?1 (`?1)(`?2)

1)( 1)(

? n`??` 3

i )

n ? g ? 2)(n ? g ? 3) + g ? 3 : ? (n ? g ? 1)( g(g ? 1)(g ? 2) n?g

After some algebra, we get that the above expression is reduced to

! n ? 4 (n ? 1)(n ? 2)(n ? 3)(n ? 2g)(g ? `)(n ? ` ? g) : g?3 g`(g ? 1)(g ? 2)(n ? `)(n ? g) We can rewrite B (n; `; g; 1) as: 28

(17)

n?  h n?g? gn??  h n?g`?? 4 3

(

4

(

`?3

n?g?2) ? 1i ( g?2) i 1)(n?`?2) ? 1 (`?1)(`?2)

!" # n ? 4 (n ? 1)(n ? 2)(n ? 3) ? (n ? 1)(n ? 2)(n ? 3) `?3 `(` ? 1)(` ? 2) (` ? 1)(` ? 2)(n ? `) !" # ( n ? 1)( n ? 2)( n ? 3) n ? 4 ( n ? 1)( n ? 2)( n ? 3) ? g?3 g(g ? 1)(g ? 2) ? (g ? 1)(g ? 2)(n ? g)

1)( 1)(

which is equal to

! 8h n ? 4 < n?gg?? g?3 : (

n?g?2) 1)(g ?2) 1)(

(

"

n? n? ? (n?1)(n?2)(n?3) i ` `? `? i (`?1)(`?2)(n?`) (n?`?1)(n?`?2) ?1 (`?1)(`?2)

?h1

i h n? (

1)( 2)( 3) ( 1)( 2)

n ? 2)(n ? 3) ? (n ? 1)(n ? 2)(n ? 3) ? (n ?g(1)( g ? 1)(g ? 2) (g ? 1)(g ? 2)(n ? g)

#)

:

A simple algebra shows that the above expression reduces to (17). Therefore, when q = 1 and 4  ` < g equality (14) is satis ed. To prove that Condition 3 of Lemma 3.9 is satis ed we have to show that nX ?5 j =0

! n ? 5 (h ? h ) = m: j; j; j 0

(18)

1

We show that (18) holds for 4  ` < g. (The cases 1  ` < g  3 and 1  `  3 with g  4 are considered in Appendix A.) It is immediate to see that equation (18) is satis ed if and only if:

! n ? 5 (h ? h ) j; j; j `(g ? `)(n ? g)(n ? 2g)(n ? 2`) j = : m 2(n + 2` ? 2g)(n ? 1)(n ? 2)(n ? 3)(n ? 4) We have that ! nX ? ?5 ( ? ) j; j; nX ?5

0

1

(19)

=0

5

n

j =0

= =

h 0

j

h 1

m n;`;g)

s(

h?n?
?n?
?n?
?n?
i h?n?
?n?
?n?
?n?
i ? + ? ? ? + ? n;`;g ` nh?` h?n
g ?n?n?
g ?n?
gi n?g ?n
+ ?nn??`
? ?n?`
i + n;`;g ` n;`;g g + g? ? g ` `? h?n?
?n?
i h?n?
?n?
i ? ? n;`;g g? ? g? hn;`;g h?n
?n?
?n?
i (20) ?n
+ ?n`??
? ?n`??
i + n;`;g g + g? ? g ` ` `? 4

s(

s(

n;`;g)

s(

)

4

)

5

5

4

t(

)

4 4

t(

)

5 1

5 1

5 4

t(

)

4

4 4

t(

)

Let 29

4

4

4 4

5 4

4 4

4

:

5

4

5

a =4 s

(n;`;g )

hn?  n? i 5 1

`?

?

b =4 t

5 4

`?

hn?  n? i 5

(n;`;g )

g?1

?

5

g?4

hn n?  n? i hn n?  n? i 4 c =4 s + ? d = t ` ` `? g + g? ? g . It is easy to check that the following three equalities hold. 4

4 4

(n;`;g )

4 4

(n;`;g )

4

a = `(n ? 2`)(n ? n` ? 6n + ` + 11) : c 2(n ? 3)(n ? 4)(n ? n` ? 3n + 2` + 2) b = (n ? ng ? 6n + g + 11) : a (n ? n` ? 6n + ` + 11) d = `(n ? 2`)(2n ? 3ng ? 3n + 2g + 2) : c (n ? 2g)(n ? g)(n ? n` ? 3n + 2` + 2) 2

2

2

2

2

2

2

2

2

2

2

2

b=a we have that Since (a ? b)=(c + d) = ac ?d=c (1 (1+

h   i h   i s n;`;g n`?? ? n`?? ? t n;`;g ng?? ? ng?? hn n?  n? i hn n?  n? i + ? + t n;`;g g + g? ? g ` ` `? (

s n;`;g (

)

) )

)

5 1

5 4

(

)

4

4 4

(

)

5 1

5 4

4 4

4

can be rewritten as

2 `(n ? 2`)(n ? n` ? 6n + ` + 11)
4 1 ? nn ??ngn`?? nn `g ?n g 2(n ? 3)(n ? 4)(n ? n` ? 3n + 2` + 2) 1 + n`?n?g `n?gn ?n ng ?n`? n ` 2

( 2 ( 2

2

2

(

2

(

6 + 2 +11) 6 + 2 +11)

2 )(2 2

2 )(

3 +2 2 +2)

3 )( 2

3 5:

3 +2 2 +2)

It is simple, but tedious to check, to see that the previous expression reduces to `(g ? `)(n ? g)(n ? 2g)(n ? 2`) 2(n + 2` ? 2g)(n ? 1)(n ? 2)(n ? 3)(n ? 4) : Therefore, Equation (18) is satis ed and the theorem holds. Notice that, for xed n, the contrast of the scheme given in the above theorem depends only on the parameters ` and g. Therefore, if we want to get from the construction given by Theorem 6.1 the scheme achieving the best contrast we have to choose, for a xed n, the integers ` and g, where 1  ` < g < n=2, in such a way that the quantity )(n ? 2g)(n ? 2`) (`; g; n) = 2(n + `2(`g??2`g)()(nn??g1)( n ? 2)(n ? 3)(n ? 4) is maximized. Choosing ` and g proportional to n, setting ` =
n and g = 
n, where and  are constant to be determined later such that 0 < <  < 1, we have that ? )(1 ? )(1 ? 2)(1 ? 2 )n (
n; 
n; n) = 2(1 + 2(  ? 2)n(n ? 1)(n ? 2)(n ? 3)(n ? 4) : 5

30

One can easily see that

( ? )(1 ? )(1 ? 2)(1 ? 2 ) : 2(1 + 2 ? 2) For real and , with 0 < <  < 1, by using the system MathematicaTM , we have seen that, for xed n, the function ( ? )(1 ? )(1 ? 2)(1 ? 2 )=2(1 + 2 ? 2) reaches it maximum at ( ; ) = (0:0954913; 0:345492) and the above limit is equal to 1 :


n; 
n; n ) = lim  ( n!1 256 Therefore, there are (5; n)-threshold VCS that, for large n, have contrast almost 1=256. nlim !1 (
n; 
n; n) =

7 Conclusion In this paper we have analyzed the contrast of the reconstructed image for (k; n)threshold VCS. We have de ned a canonical form for such VCS and we have also provided a characterizazion of (k; n)-threshold VCS. Several open problems arise. For instance, we conjecture that the (k; n)-threshold VCS, for k = 4 and 5, have an optimal contrast. Moreover, further research could be done in nding a closed formula for the optimal contrast for general (k; n)-threshold VCS.

References [1] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, Visual Cryptography for General Access Structures, in Information and Computation, Vol. 129, No. 2, pp. 86{106, 1996. [2] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, Extended Schemes for Visual Cryptography, submitted for publication, 1996. Available as http://www.unisa.it/VISUAL/papers/evcs.ps. [3] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, Constructions and Bounds for Visual Cryptography, in \23rd International Colloquium on Automata, Languages and Programming" (ICALP '96), F. M. auf der Heide and B. Monien Eds., Vol. 1099 of \Lecture Notes in Computer Science", Springer{Verlag, Berlin, pp. 416{428, 1996. [4] E. Biham and A. Itzkovitz, Visual Cryptography with Polarization, talk given by Biham at the \Weizmann Workshop on Cryptography", Weizmann Institute, Rehovot, Israel, June 8{9, 1997. [5] C. Blundo, A. De Santis, and D. R. Stinson, On the Contrast in Visual Cryptography Schemes, to appear in Journal of Cryptology. Also available at Theory of Cryptography Library as ftp://theory.lcs.mit.edu/pub/tcryptol/96-13.ps.

31

[6] S. Droste, New Results on Visual Cryptography, in \Advances in Cryptology CRYPTO '96", N. Koblitz Ed., Vol. 1109 of \Lecture Notes in Computer Science", Springer{Verlag, Berlin, pp. 401{415, 1996. [7] R. L. Graham, D. E. Knuth, and O. Patashnik, Concrete Mathematics. A foundation for Computer Science. Addison Wesley, 1988. [8] T. Hofmeister, M. Krause, and H. U. Simon, Contrast-Optimal out of Secret Sharing Schemes in Visual Cryptography, in \COCOON '97", T. Jiang and D. T. Lee, Eds., Vol. 1276 of \Lecture Notes in Computer Science", Springer{Verlag, Berlin, pp. 176{185, 1997. k

n

[9] D. Naccache, Colorful Cryptography { a purely physical secret-sharing scheme based on chromatic lters, Coding and Information Integrity, French-Israeli workshop, December 1994. [10] M. Naor and B. Pinkas, Visual Authentication and Identi cation, in \Advances in Cryptology - CRYPTO '97", B. S. Kaliski Jr. Ed., Vol. 1294 of \Lecture Notes in Computer Science", Springer{Verlag, Berlin, pp. 322{336, 1997. Available at Theory of Cryptography Library as ftp://theory.lcs.mit.edu/pub/tcryptol/97-13.ps. [11] M. Naor and A. Shamir, Visual Cryptography, in \Advances in Cryptology { Eurocrypt '94", A. De Santis Ed., Vol. 950 of Lecture Notes in Computer Science, Springer-Verlag, Berlin, pp. 1{12, 1995. [12] M. Naor and A. Shamir, Visual Cryptography II: Improving the Contrast via the Cover Base. Available at Theory of Cryptography Library as ftp://theory.lcs.mit.edu/pub/tcryptol/96-07.ps. A preliminary version appears in \Security Protocols", M. Lomas Ed., Vol. 1189 of Lecture Notes in Computer Science, Springer-Verlag, Berlin, pp. 197{202, 1997. [13] V. Rijmen and B. Preneel, Ecient Colour Visual Encryption or \Shared Colors of Benetton", presented at EUROCRYPT '96 Rump Session. Available as http://www.iacr.org/conferences/ec96/rump/preneel.ps. [14] D. R. Stinson, An Introduction to Visual Cryptography, presented at Public Key Solutions '97, Toronto, April 28-30, 1997. Available as http://bibd.unl.edu/ stinson/VKS-PKS.ps. [15] E. R. Verheul and H. C. A. van Tilborg, Constructions and Properties of out of visual secret sharing schemes, Designs, Codes, and Cryptography, Vol. 11, No. 2, pp. 179{196, 1997. k

32

n

A Appendix A In the following we show the computation omitted from the proof of Theorem 5.1.

 Proof that the equality (11) in Theorem 5.1 is satis ed for the case ` = 2. We have that nX ?` j =0

!# ! " ! n ? 3 (n ? 1)(n ? 2g) + n ? 2 n?` h = t j; ng(n ? g) n=2 n=2 ? 1 j !" # ( n ? 1)( n ? 2 g ) n ? 3 2( n ? 2) = t n=2 ? 1 + n ng ( n ? g ) ! ? n + 2g n ? 3 = t n=2 ? 1 n ? 2gng (n ? g) 2

0

n;g

2

n;g

2

2

n;g

and nX ?` j =0

! n?` h = t j; j 1

!    n ? 3 n?g  + nn??g n? n=2 ? 1 ! " g? # n ? 3 (n ? g ? 1) + g ? 1 : n=2 ? 1! g n?g n ? 3 n ? 2ng ? n + 2g : g(n ? g) n=2 ? 1 2

n;g

= t

n;g

2

2 1

2

= t

n;g

2

Therefore, for ` = 2, we have that the identity (11 in Theorem 5.1 holds.  Proof that the equality (11) in Theorem 5.1 is satis ed for the case ` = 3. We have that ! " !# nX ?` n ? `! ( n ? 1)( n ? 2 g ) n ? 3 n ? 3 n=2 ? 1 j hj; = t ng(n ? g) + n=2 j # !" n ? 4 ( n ? 1)( n ? 2 g ) n ? 3 = t ng(n ? g) + n n=2 ? 1 and nX ?` n ? `! j hj; = j 2

0

n;g

=0

2

n;g

1

=0

!  ! ! !  n ? 3 (n ? 1)(n ? 2g) + n ? 3 = n ? 3 n=n?? + n ? 3 n=n?? n? g ng(n ? g) n=2 n=2 ? 1 n ? g ng?? g? 2

2

3 1

2

2 1

that is,

2 1

    (n ? 1)(n ? 2g) + n=2 ? 2 = n?g  + nn??g n? ng(n ? g) n=2 g? 3

2

3

2 1

i

3 1

which turns out to be equivalent to (n ? 1)(n ? 2g) + n ? 4 = (n ? g ? 1)(n ? g ? 2) + (g ? 1)(g ? 2) : ng(n ? g) n g(n ? 2) (n ? g)(n ? 2) A simple algebra shows that the above equality holds. 2

In the following we show the computations omitted from the proof of Theorem 6.1. Recall that equality (14) holds if and only if the expression (15) is equal to the expression (16). Now, we show that equality (14) is always satis ed.  For q = 2 and 4  ` < g, we must show that A(n; `; g) = B (n; `; g; 2) In Theorem 6.1 we proved that A(n; `; g) is equal to (17). Notice that B (n; `; g; 2) can be written as n?g?2) ? 1i ( g?2) i 1)(n?`?2) ? 1 (`?1)(`?2)

n?  h n?g? gn??  h n?g`?? 4 3

(

4

(

`?3

!" # n ? 4 (n ? ` ? 1)(n ? 2)(n ? 3) ? (n ? 2)(n ? 3) `?3 `(` ? 1)(` ? 2) (` ? 2)(n ? `) !" # ( n ? g ? 1)( n ? 2)( n ? 3) n ? 4 ( n ? 2)( n ? 3) ? g?3 ? (g ? 2)(n ? g) g(g ? 1)(g ? 2)

1)( 1)(

which is equal to

h n?g? !8 < n?4 g? : g?3 (

n?g?2) 1)(g ?2) 1)(

(

"

i h n?`?

n? n?3) ` ` ? h (n?`?1)(n?`?2) `? i ?1 (`?1)(`?2)

?1

(

1)( 2)( ( 1)( 2)

?

n?2)(n?3) i `?2)(n?`)

( (

n ? 2)(n ? 3) ? (n ? 2)(n ? 3) ? (n ? gg(?g ?1)(1)( g ? 2) (g ? 2)(n ? g)

#)

:

A simple algebra shows that the above expression can be reduced to (17). Therefore, equality (14) is satis ed when q = 2 and 4  ` < g.  For q = 3 and 4  ` < g, we must show that A(n; `; g) = B (n; `; g; 3) In Theorem 6.1 we proved that A(n; `; g) is equal to (17). Note that B (n; `; g; 3) can be rewritten as

n?  h n?g? gn??  h n?g`?? 4 3

(

4

(

`?3

n?g?2) ? 1i ( g?2) i 1)(n?`?2) ? 1 (`?1)(`?2) 1)( 1)(

# !" n ? 4 (n ? ` ? 1)(n ? ` ? 2)(n ? 3) ? (n ? 3) `(` ? 1)(` ? 2) (n ? `) `?3 # !" ( n ? 3) ( n ? g ? 1)( n ? g ? 2)( n ? 3) n ? 4 ? (n ? g) ? g?3 g(g ? 1)(g ? 2) ii

which is equal to

h n?g? !8 < n?4 g? : g?3 (

(













n?g?2) ? 1i h (n?`?1)(n?`?2)(n?3) g?2) h `(`?1)(`?i2) (n?`?1)(n?`?2) ?1 (`?1)(`?2)

1)( 1)(

"

?

n?3) i n?`)

( (

#)

n ? g ? 2)(n ? 3) ? (n ? 3) : ? (n ? g ?g(1)( g ? 1)(g ? 2) (n ? g) A simple algebra shows that the above expression can be reduced to (17). Therefore, equality (14) holds for q = 3 when 4  ` < g. For q = 1, ` = 1 and g = 2, we have that A(n; 1; 2) = (n ? 3)(2 n ? 4) and B (n; 1; 2; 1) = (n ? 3)(2 n ? 4) : Therefore, A(n; 1; 2) = B (n; 1; 2; 1) and equality (14) in Theorem 6.1 is satis ed. For q = 1, ` = 1 and g = 3, we have that A(n; 1; 3) = (n ? 2)(n ?3 4)(n ? 6) and B (n; 1; 3; 1) = (n ? 2)(n ?3 4)(n ? 6) : Therefore, A(n; 1; 3) = B (n; 1; 3; 1) and equality (14) in Theorem 6.1 is satis ed. For q = 1, ` = 2 and g = 3, we have that ? 5)(n ? 6) and B (n; 2; 3; 1) = (n ? 1)(n ? 5)(n ? 6) : A(n; 2; 3) = (n ? 1)(n 12 12 Therefore, A(n; 2; 3) = B (n; 2; 3; 1) and equality (14) in Theorem 6.1 is satis ed. For q = 2, ` = 1 and g = 2, we have that A(n; 1; 2) = (n ? 3)(2 n ? 4) and B (n; 1; 2; 2) = (n ? 3)(2 n ? 4) : Therefore, A(n; 1; 2) = B (n; 1; 2; 2) and equality (14) in Theorem 6.1 is satis ed. For q = 2, ` = 1 and g = 3, we have that A(n; 1; 3) = (n ? 2)(n ?3 4)(n ? 6) and B (n; 1; 3; 2) = (n ? 2)(n ?3 4)(n ? 6) : Therefore, A(n; 1; 3) = B (n; 1; 3; 2) and equality (14) in Theorem 6.1 is satis ed. For q = 2, ` = 2 and g = 3, we have that ? 5)(n ? 6) and B (n; 2; 3; 2) = (n ? 1)(n ? 5)(n ? 6) : A(n; 2; 3) = (n ? 1)(n 12 12 Therefore, A(n; 2; 3) = B (n; 2; 3; 2) and equality (14) in Theorem 6.1 is satis ed. iii

 For q = 3, ` = 1 and g = 2, we have that A(n; 1; 2) = (n ? 3)(2 n ? 4) and B (n; 1; 2; 3) = (n ? 3)(2 n ? 4) Therefore, A(n; 1; 2) = B (n; 1; 2; 3) and equality (14) in Theorem 6.1 is satis ed.  For q = 3, ` = 1 and g = 3, we have that A(n; 1; 3) = (n ? 2)(n ?3 4)(n ? 6) and B (n; 1; 3; 3) = (n ? 2)(n ?3 4)(n ? 6) : Therefore, A(n; 1; 3) = B (n; 1; 3; 3) and equality (14) in Theorem 6.1 is satis ed.  For q = 3, ` = 2 and g = 3, we have that ? 5)(n ? 6) and B (n; 2; 3; 3) = (n ? 1)(n ? 5)(n ? 6) : A(n; 2; 3) = (n ? 1)(n 12 12 Therefore, A(n; 2; 3) = B (n; 2; 3; 3) and equality (14) in Theorem 6.1 is satis ed.  For q = 1, ` = 1 and g  4, we must show that A(n; 1; g) = B (n; 1; g; 1). Notice that

A(n; 1; g) =

n?4 g?3

#

! ("

(n ? g ? 1)(n ? g ? 2) ? 1 (n ? 4) #) " (g ? 1)(g ? 2) ( g ? 3) ( n ? g ? 1)( n ? g ? 2)( n ? g ? 3) ? (n ? g) ? g(g ? 1)(g ? 2)

and

B (n; 1; g; 1) =

! (" # n ? 4 (n ? g ? 1)(n ? g ? 2) ? 1 (n ? 2) g?3 " (g ? 1)(g ? 2) #) ( n ? 1)( n ? 2)( n ? 3) ( n ? 1)( n ? 2)( n ? 3) ? g(g ? 1)(g ? 2) ? (g ? 1)(g ? 2)(n ? g) :

After some algebra A(n; 1; g) and B (n; 1; g; 1) can be reduced to

! n ? 4 (n ? 2)(n ? 3)(n ? 2g)(n ? g ? 1) : g?3 g(g ? 2)(n ? g)

Therefore, equality (14) in Theorem 6.1 is satis ed when q = 1, ` = 1 and g  4.

iv

 For q = 1, ` = 2 and g  4, we must show that A(n; 2; g) = B (n; 2; g; 1). Notice that

A(n; 2; g) =

and

i ! 8h n ? 4 < n?gg?? gn??g? ? 1 (n ? 4)(n ? 5) (n ? 4) 2 g?3 : " #) ( n ? g ? 1)( n ? g ? 2)( n ? g ? 3) ( g ? 3) ? ? (n ? g) g(g ? 1)(g ? 2) (

1)( 1)(

(

2)

2)

ih i h !8 < n?gg?? ng??g? ? 1 n? n? ? (n ? 1) n ? 4 B (n; 2; g; 1) = g ? 3 : (n ? 4) " #) (n ? 1)(n ? 2)(n ? 3) ? (n ? 1)(n ? 2)(n ? 3) : g(g ? 1)(g ? 2) (g ? 1)(g ? 2)(n ? g) After some algebra A(n; 2; g) and B (n; 2; g; 1) can be reduced to ! n ? 4 (n ? 1)(n ? 3)(n ? 2g)(n ? g ? 2) g?3 2g(g ? 1)(n ? g) Therefore, equality (14) in Theorem 6.1 is satis ed when q = 1, ` = 2 and g  4.  For q = 1, ` = 3 and g  4, we must show that A(n; 3; g) = B (n; 3; g; 1). Notice that (

1)(

(

A(n; 3; g) =

1)(

(

2)

2)

1)(

2)

2

i n? n? n? h n?g? n?g? !8 < ? 1 n?4 g? g? n? n? ? 1 : g?3 ) ( g ? 3) ( n ? g ? 1)( n ? g ? 2)( n ? g ? 3) + (n ? g) ? g(g ? 1)(g ? 2) (

(

1)( 1)(

(

2)

4)(

2)

(

5)(

6)

6

4)( 2

5)

and

h i ih !8 < n?gg?? gn??g? ? 1 n? n? n? ? n? n? n ? 4 B (n; 3; g; 1) = g ? 3 : n? n? ? 1 ) ( n ? 1)( n ? 2)( n ? 3) ( n ? 1)( n ? 2)( n ? 3) ? g(g ? 1)(g ? 2) + (g ? 1)(g ? 2)(n ? g) : After some algebra A(n; 3; g) and B (n; 3; g; 1) can be reduced to ! n ? 4 (n ? 1)(n ? 2)(g ? 3)(n ? 2g)(n ? g ? 3) : 3g(g ? 1)(g ? 2)(n ? g) g?3 Therefore, equality (14) in Theorem 6.1 is satis ed for q = 1, ` = 3 and g  4. (

(

1)( 1)(

2)

(

2)(

6

(

v

1)(

2)

4)( 2

5)

3)

(

1)( 2

2)

 For q = 2, ` = 1 and g  4, we must show that A(n; 1; g) = B (n; 1; g; 2). Notice that

B (n; 1; g; 2) =

n?4 g?3

#

! ("

(n ? g ? 1)(n ? g ? 2) ? 1 (n ? 2) " (g ? 1)(g ? 2) #) ( n ? g ? 1)( n ? 2)( n ? 3) ( n ? 2)( n ? 3) ? ? (g ? 2)(n ? g) : g(g ? 1)(g ? 2)

After some algebra B (n; 1; g; 2) can be reduced to ! n ? 4 (n ? 2)(n ? 3)(n ? 2g)(n ? g ? 1) : g(g ? 2)(n ? g) g?3 Therefore, equality (14) in Theorem 6.1 is satis ed when q = 2, ` = 1 and g  4.  For q = 2, ` = 2 and g  4, we must show that A(n; 2; g) = B (n; 2; g; 2). Notice that

h ih i !8 < n?gg?? gn??g? ? 1 n? n? ? 1 n ? 4 B (n; 2; g; 2) = g ? 3 : (n ? 4) " #) ( n ? g ? 1)( n ? 2)( n ? 3) ( n ? 2)( n ? 3) ? ? (g ? 2)(n ? g) : g(g ? 1)(g ? 2) After some algebra B (n; 2; g; 2) can be reduced to ! n ? 4 (n ? 1)(n ? 3)(n ? 2g)(n ? g ? 2) : 2g(g ? 1)(n ? g) g?3 Therefore, equality (14) in Theorem 6.1 is satis ed when q = 2, ` = 2 and g  4.  For q = 2, ` = 3 and g  4, we must show that A(n; 3; g) = B (n; 3; g; 2). Notice that (

1)(

(

1)(

2)

(

2)

2)( 2

3)

h ih i !8 < n?gg?? gn??g? ? 1 n? n? n? ? (n ? 2) n ? 4 B (n; 3; g; 2) = g ? 3 : n? n? ? 1 " #) ( n ? g ? 1)( n ? 2)( n ? 3) ( n ? 2)( n ? 3) ? ? (g ? 2)(n ? g) : g(g ? 1)(g ? 2) After some algebra B (n; 3; g; 2) can be reduced to ! n ? 4 (n ? 1)(n ? 2)(g ? 3)(n ? 2g)(n ? g ? 3) : 3g(g ? 1)(g ? 2)(n ? g) g?3 Therefore, equality (14) in Theorem 6.1 is satis ed for q = 2, ` = 3 and g  4. (

1)(

(

1)(

2)

(

3)(

6

(

vi

2)(

2)

4)( 2

5)

4)

 For q = 3, ` = 1 and g  4, we must show that A(n; 1; g) = B (n; 1; g; 3). Notice that

#

! ("

(n ? g ? 1)(n ? g ? 2) ? 1 (n ? 3) B (n; 1; g; 3) = " (g ? 1)(g ? 2) #) ( n ? g ? 1)( n ? g ? 2)( n ? 3) ( n ? 3) ? ? (n ? g) : g(g ? 1)(g ? 2) After some algebra B (n; 1; g; 3) can be reduced to ! n ? 4 (n ? 2)(n ? 3)(n ? 2g)(n ? g ? 1) : g?3 g(g ? 2)(n ? g) Therefore, equality (14) in Theorem 6.1 is satis ed when q = 3, ` = 1 and g  4.  For q = 3, ` = 2 and g  4, we must show that A(n; 2; g) = B (n; 3; g; 3). Notice that

n?4 g?3

i h n? n? i h n?g? n?g? !8 < ? 1 ?4 g? g? B (n; 2; g; 3) = ng ? : (n ? 4) 3 " #) ( n ? g ? 1)( n ? g ? 2)( n ? 3) ( n ? 3) ? ? (n ? g) : g(g ? 1)(g ? 2) After some algebra B (n; 2; g; 3) can be reduced to ! n ? 4 (n ? 1)(n ? 3)(n ? 2g)(n ? g ? 2) : g?3 2g(g ? 1)(n ? g) Therefore, equality (14) in Theorem 6.1 is satis ed when q = 3, ` = 2 and g  4.  For q = 3, ` = 3 and g  4, we must show that A(n; 3; g) = B (n; 3; g; 3). Notice (

1)(

(

1)(

(

2)

2)

3)(

4)

2

that

ih i h !8 < n?gg?? gn??g? ? 1 n? n? n? ? 1 n ? 4 B (n; 3; g; 3) = g ? 3 : n? n? ? 1 " #) ( n ? g ? 1)( n ? g ? 2)( n ? 3) ( n ? 3) ? ? (n ? g) : g(g ? 1)(g ? 2) After some algebra B (n; 3; g; 3) can be reduced to ! n ? 4 (n ? 1)(n ? 2)(g ? 3)(n ? 2g)(n ? g ? 3) : 3g(g ? 1)(g ? 2)(n ? g) g?3 Therefore, equality (14) in Theorem 6.1 is satis ed for q = 3, ` = 3 and g  4. (

1)(

(

1)(

3)(

4)(

6

(

vii

(

2)

2)

4)( 2

5)

5)

In the following we prove that equality (18) in the proof of Theorem 6.1 holds for the cases 1  `  3 with g  4 and 1  ` < g  3. In order to prove (18), we must show that

hn?  n? i hn?  n? i s ? ? t ? n;`;g n;`;g hn n`??  n`?? i hng? n?g? n? i F (n; `; g) =4 s n;`;g ` + ` ? `? + t n;`;g g + g? ? g (

(

)

)

5 1

5 4

(

)

4

4 4

(

)

5 1

5 4

4 4

4

is equal to )(n ? 2g)(n ? 2`) D(n; `; g) =4 2(n + `2(`g??2`g)()(nn??g1)( n ? 2)(n ? 3)(n ? 4) : Recall that in the proof of Theorem 6.1 we have de ned

a =4 s

(n;`;g )

c =4 s

(n;`;g )

hn?  n? i 5 1

`?

?

b =4 t

5 4

`?

`

+

`

4

5

(n;`;g )

hn n?  n? i

?

d =4 t

4 4

`?

hn?  n? i

(n;`;g )

g?1

?

5

g?4

hn n?  n? i g

+ g? ? 4 4

g

4

.

 If ` = 1 and g  4 it holds that: b = (n ? ng ? 6n + 11 + g ) ; a (n ? 3)(n ? 4)

a= 1 ; c 2(n ? 2) and

and

2

d = (2n ? 3gn ? 3n + 2g + 2) : c (n ? g)(n ? 2g)(n ? 2) 2

Since we have that

2

2

(a ? b) = a(1 ? ab ) (c + d) c(1 + dc )

(21)

g)(n ? 2g)(g ? 1) F (n; 1; g) = 2(n ? (2ng ? + 2)(n ? 1)(n ? 3)(n ? 4) g)(n ? 2g)(g ? 1) D(n; 1; g) = 2(n ? (2ng ? + 2)(n ? 1)(n ? 3)(n ? 4) :

Therefore, equality (18) is satis ed.  If ` = 2 and g  4 it holds that: b = (n ? ng ? 6n + 11 + g ) a = (n ? 5) ; c (n ? 5n + 10) a (n ? 3)(n ? 5) and d = 2(2n ? 3gn ? 3n + 2g + 2)(n ? 4) : c (n ? g)(n ? 2g)(n ? 5n + 10) 2

2

2

2

2

viii

2

From (21), we have that

g)(n ? 2g)(g ? 2) F (n; 2; g) = (n ? 2(gn+?4)( n ? 1)(n ? 2)(n ? 3) and

g)(n ? 2g)(g ? 2) D(n; 2; g) = (n ? 2(gn+?4)( n ? 1)(n ? 2)(n ? 3) :

Therefore, equality (18) is satis ed.  If ` = 3 and g  4 we have

3(n ? 5)(n ? 6) b = (n ? ng ? 6n + 11 + g ) a= ; c (n(n ? 1)(n ? 2) + (n ? 4)(n ? 5)(n ? 6)) a (n ? 4)(n ? 5) and d = 3(n ? 6)(2n ? 3gn ? 3n + 2g + 2) : c (n ? g)(n ? 2g)(n ? 6n + 20) 2

2

2

2

From (21), we have that

g)(n ? 2g)(g ? 3)(n ? 6) F (n; 3; g) = 2(n ?3(2gn+?6)( n ? 1)(n ? 2)(n ? 3)(n ? 4) and

g)(n ? 2g)(g ? 3)(n ? 6) D(n; 3; g) = 2(n ?3(2gn+?6)( n ? 1)(n ? 2)(n ? 3)(n ? 4) :

Therefore, equality (18) is satis ed.  If ` = 1 and g = 2 it is easy to see that

1 F (n; 1; 2) = D(n; 1; 2) = 2(n ? 1)( n ? 3) :

 If ` = 1 and g = 3 it is easy to see that ? 6) : F (n; 1; 3) = D(n; 1; 3) = 2(n ?(n1)( n ? 4)  If ` = 2 and g = 3 it is easy to see that ? 6) : F (n; 2; 3) = D(n; 2; 3) = 2(n ?(n1)( n ? 2) Therefore, equality (18) is satis ed.

ix

2