Visual Cryptographyfor General Access Structures1Giuseppe Ateniese1, Carlo Blundo2, Alfredo De Santis2, and Douglas R. Stinson31 Dipartimento di Informatica e Scienze dell'Informazione,Universit�a di Genova, via Dodecaneso 35, 16146 Genova, ItalyE-mail: ateniese@disi.unige.itURL: http://www.disi.unige.it/phd/ateniese/ateniese.html2 Dipartimento di Informatica ed Applicazioni,Universit�a di Salerno, 84081 Baronissi (SA), ItalyE-mail: fcarblu,adsg@dia.unisa.itURL: http://www.unisa.it/fcarblu.dir/, ads.dir/g3 Department of Computer Science and Engineeringand Center for Communication and Information ScienceUniversity of Nebraska-Lincoln, Lincoln NE 68588, USAE-mail: stinson@bibd.unl.eduURL: http://bibd.unl.edu/�stinsonMay 2, 19961A very preliminary version of this work has been presented at ICALP '96 [1]. Research of C.Blundo and A. De Santis is partially supported by the Italian Ministry of University and Research(M.U.R.S.T.) and by the Italian National Council for Research (C.N.R.). Research of D. R. Stinsonis supported by NSF grant CCR-9402141.

AbstractA visual cryptography scheme for a set P of n participants is a method to encode a secretimage SI into n shadow images called shares, where each participant in P receives oneshare. Certain quali�ed subsets of participants can \visually" recover the secret image,but other, forbidden, sets of participants have no information (in an information-theoreticsense) on SI . A \visual" recovery for a set X � P consists of xeroxing the shares given tothe participants in X onto transparencies, and then stacking them. The participants in aquali�ed set X will be able to see the secret image without any knowledge of Cryptographyand without performing any cryptographic computation.In this paper we propose two techniques to construct visual cryptography schemes forgeneral access structures. We analyze the structure of visual cryptography schemes andwe prove bounds on the size of the shares distributed to the participants in the scheme.We provide a novel technique to realize k out of n threshold visual cryptography schemes.Our construction for k out of n visual cryptography schemes is better with respect topixel expansion than the one proposed in [11] and for the case of 2 out of n is the bestpossible. Finally, we consider graph-based access structures, i.e., access structures in whichany quali�ed set of participants contains at least an edge of a given graph whose verticesrepresent the participants of the scheme.Index terms : Visual Cryptography, Secret Sharing, and Data Security.

1 IntroductionA visual cryptography scheme for a set P of n participants is a method to encode a secretimage SI into n shadow images called shares, where each participant in P receives oneshare. Certain quali�ed subsets of participants can \visually" recover the secret image,but other, forbidden, sets of participants have no information (in an information-theoreticsense) on SI . A \visual" recovery for a set X � P consists of xeroxing the shares given tothe participants in X onto transparencies, and then stacking them. The participants in aquali�ed set X will be able to see the secret image without any knowledge of cryptographyand without performing any cryptographic computation.The best way to understand visual cryptography is by resorting to an example. Supposethat there are four participants, that is P = f1; 2; 3; 4g, and that the quali�ed sets are allsubsets of P containing at least one of the three sets f1; 2g, f2; 3g, or f3; 4g. Hence, thefamily of quali�ed sets is�Qual = ff1; 2g; f2; 3g; f3; 4g; f1; 2; 3g; f1; 2; 4g; f1; 3; 4g; f2; 3; 4g; f1; 2; 3; 4gg:We will stipulate that all remaining subsets of P are forbidden.We want to encode the secret image \IC". The four shares generated by a visual cryp-tography scheme for �Qual are given in the Appendix. They look like random patternsand, indeed, no individual share provides any information, even to an in�nitely powerfulcomputer, on the original image. To decrypt the secret image the reader should xeroxeach pattern on a separate transparency, stack together the transparencies associated toparticipants in any quali�ed set, and project the result with an overhead projector. Ifthe transparencies are aligned carefully, then the reader will get the images showed in theremaining part of the Appendix.This new cryptographic paradigm has been recently introduced by Naor and Shamir[11]. They analyzed the case of a k out of n threshold visual cryptography scheme, in whichthe secret image is visible if and only if any k transparencies are stacked together.A possible application, mentioned in [11], is the following. The 2 out of 2 visual cryp-tography scheme can be thought of as a private key cryptosystem. We encode the secretprinted message into two random looking shares. One of the two shares will be a printedpage of ciphertext which can be sent by mail or fax, whereas the other share serves as thesecret key. The original image is revealed by stacking together the two transparencies. Thissystem is similar to the one-time pad, as each page of ciphertext is decoded by using adi�erent transparency. However, it does not require any cryptographic computation | thedecoding is done by the human visual system.Visual cryptography schemes with extended capabilities have been analyzed in [3]. Theauthors present a general technique to implement extended visual cryptography schemeswhich uses hypergraph colourings.In this paper we extend Naor and Shamir's model to general access structures, where anaccess structure is a speci�cation of all quali�ed and forbidden subsets of participants. Wepropose two di�erent techniques to construct visual cryptography schemes for any accessstructure. We analyze the structure of visual cryptography schemes and we prove boundson the size of the shares distributed to the participants in the scheme. We provide a noveltechnique to realize k out of n threshold visual cryptography schemes. Our construction fork out of n visual cryptography schemes is better with respect to pixel expansion than theone proposed in [11] and for the case of 2 out of n is the best possible. Our constructionfor 2 out of n schemes has pixel expansion of only about logn (see Theorem 7.3) while1

the scheme proposed in [11] has pixel expansion n. Also, we consider graph-based accessstructures, i.e., access structures in which any quali�ed set of participants contains at leastone edge of a given graph whose vertices represent the participants of the scheme.2 The ModelLet P = f1; : : : ; ng be a set of elements called participants, and let 2P denote the set ofall subsets of P . Let �Qual � 2P and �Forb � 2P , where �Qual \ �Forb = ;. We refer tomembers of �Qual as quali�ed sets and we call members of �Forb forbidden sets. The pair(�Qual;�Forb) is called the access structure of the scheme.De�ne �0 to consist of all the minimal quali�ed sets:�0 = fA 2 �Qual : A0 62 �Qual for all A0 � Ag:A participant P 2 P is an essential participant if there exists a set X � P such thatX [ fPg 2 �Qual but X 62 �Qual. If a participant P is not essential then we can constructa visual cryptography scheme giving him a share completely \white" or even nothing ashis share. In fact, a non-essential participant does not need to participate \actively" in thereconstruction of the image, since the information he has is not needed by any set in Pin order to recover the shared image. In any VCS having non-essential participants, theseparticipants do not require any information in their shares. Therefore, unless otherwisespeci�ed, we assume throughout this paper that all participants are essential.In the case where �Qual is monotone increasing, �Forb is monotone decreasing, and�Qual[�Forb = 2P , the access structure is said to be strong, and �0 is termed a basis. (Thissituation is the usual setting for traditional secret sharing.) In a strong access structure,�Qual = fC � P : B � C for some B 2 �0g;and we say that �Qual is the closure of �0.For sets X and Y and for elements x and y, to avoid overburdening the notation, weoften will write x for fxg, xy for fx; yg, xY for fxg [ Y , and XY for X [ Y .We assume that the message consists of a collection of black and white pixels. Each pixelappears in n versions called shares, one for each transparency. Each share is a collection ofmblack and white subpixels. The resulting structure can be described by an n �m Booleanmatrix S = [sij ] where sij = 1 i� the j-th subpixel in the i-th transparency is black.Therefore the grey level of the combined share, obtained by stacking the transparenciesi1; : : : ; is, is proportional to the Hamming weight w(V ) of them-vector V = OR(ri1; : : : ; ris)where ri1 ; : : : ; ris are the rows of S associated with the transparencies we stack. This greylevel is interpreted by the visual system of the users as black or as white in according withsome rule of contrast.De�nition 2.1 Let (�Qual;�Forb) be an access structure on a set of n participants. Twocollections (multisets) of n�m boolean matrices C0 and C1 constitute a visual cryptographyscheme (�Qual;�Forb; m)-VCS if there exist the value �(m) and the set f(X; tX)gX2�Qualsatisfying:1. Any (quali�ed) set X = fi1; i2; : : : ; ipg 2 �Qual can recover the shared image bystacking their transparencies.Formally, for any M 2 C0, the \or" V of rows i1; i2; : : : ; ip satis�es w(V ) � tX ��(m) �m; whereas, for any M 2 C1 it results that w(V ) � tX .2

2. Any (forbidden) set X = fi1; i2; : : : ; ipg 2 �Forb has no information on the sharedimage.Formally, the two collections of p � m matrices Dt, with t 2 f0; 1g, obtained byrestricting each n �m matrix in Ct to rows i1; i2; : : : ; ip are indistinguishable in thesense that they contain the same matrices with the same frequencies.Each pixel of the original image will be encoded into n pixels, each of which consists ofm subpixels. To share a white (black, resp.) pixel, we randomly choose one of the matricesin C0 (C1, resp.), and distribute row i to participant i. The chosen matrix de�nes the msubpixels in each of the n transparencies. Notice that in the previous de�nition C0 (C1) is amultiset of n�m boolean matrices, therefore we allow a matrix to appear more than oncein C0 (C1). Finally, observe that the size of the collections C0 and C1 does not need to bethe same.The �rst property is related to the contrast of the image. It states that when a quali�edset of users stack their transparencies they can correctly recover the shared image. Thevalue �(m) is called relative di�erence, the number �(m) �m is referred to as the contrast ofthe image, the set f(X; tX)gX2�Qual is called the set of thresholds, and tX is the thresholdassociated to X 2 �Qual. We want the contrast to be as large as possible and at least one,that is, �(m) � 1=m. The second property is called security, since it implies that, even byinspecting all their shares, a forbidden set of participants cannot gain any information indeciding whether the shared pixel was white or black.There are few di�erences between the model of visual cryptography we propose and theone presented by Naor and Shamir [11]. Our model is a generalization of the one proposedin [11], since with each set X 2 �Qual we associate a (possibly) di�erent threshold tX .Further, the access structure is not required to be strong in our model.Notice that if a set of participants X is a superset of a quali�ed set X 0, then they canrecover the shared image by considering only the shares of the set X 0. This does not initself rule out the possibility that stacking all the transparencies of the participants in Xdoes not reveal any information about the shared image.We make a couple of observations about the structure of �Qual and �Forb in light ofthe above de�nition. First, it is clear that any subset of a forbidden subset is forbidden,so �Forb is necessarily monotone decreasing. Second, it is also easy to see that no supersetof a quali�ed subset is forbidden. Hence, a strong access structure is simply one in which�Qual is monotone increasing and �Qual [ �Forb = 2P .Notice also that, given an (admissible) access structure (�Qual;�Forb), we can \embed"it in a strong access structure (�0Qual;�0Forb) in which �Qual � �0Qual and �Forb � �0Forb.One way to do this is to take (�0Qual;�0Forb) to be the strong access structure having asbasis �0, where �0 consists of the minimal sets in �Qual.In view of the above observations, it su�ces to construct VCS for strong access struc-tures. However, we will sometimes give constructions for arbitrary access structures aswell.2.1 The Size of the Collections C0 and C1In this paper we consider only VCS in which the collections C0 and C1 have the same size, i.e.,jC0j = jC1j = r. Actually, this is not a restriction at all. Indeed, given an access structure(�Qual;�Forb), we will show how to obtain, from an arbitrary VCS for (�Qual;�Forb), a3

VCS having the same parameters m, �(m), and f(X; tX)gX2�Qual, with equally sized C0and C1.Let M be a matrix in the collection C0 [ C1 of a (�Qual;�Forb; m)-VCS on a set ofparticipants P . For X � P , let MX denote the m-vector obtained by considering the orof the rows corresponding to participants in X ; whereas M [X ] denotes the jX j�m matrixobtained from M by considering only the rows corresponding to participants in X .Now, suppose that jC0j = r0 and jC1j = r1 6= r0. Let X 2 �Forb and letM 2 C0[C1. Fori 2 f0; 1g, let �iX denote the number of times that the matrixM [X ] appears in the collectionfA[X ] : A 2 Cig. From Property 2. of De�nition 2.1 we have that �0X=r0 = �1X=r1. Weconstruct the collections C 00 and C 01 of a new (�Qual;�Forb; m)-VCS, termed �0, by takingr1 copies of each matrix in C0 and r0 copies of each matrix in C1, respectively, obtainingjC00j = jC 01j = r = r0 � r1.We have to show that Properties 1 and 2 of De�nition 2.1 are satis�ed. Clearly, Property1 of De�nition 2.1 holds. Let X 2 �Forb and let M 2 C 00 [ C 01. For i 2 f0; 1g, let �iX denotethe number of times that the matrix M [X ] appears in the collection fA[X ] : A 2 C 0ig. Itresults that �0X = �0X � r1 and �1X = �1X � r0. Therefore,�0Xr = �0X � r1r0 � r1 = �0Xr0 = �1Xr1 = �1X � r0r1 � r0 = �1Xr :Thus, Property 2. of De�nition 2.1 is satis�ed. It is worthwhile to notice that the relativedi�erence �(m), the pixel expansion m, and set of thresholds f(X; tX)gX2�Qual do notchange when we go from � to �0. Hence, without loss of generality, in this paper we restrictour attention to VCS in which the collections C0 and C1 have the same size.2.2 Basis MatricesMost of the constructions in this paper are realized using two n �m matrices, S0 and S1,called basis matrices satisfying the following de�nition.De�nition 2.2 Let (�Qual;�Forb) be an access structure on a set of n participants. A(�Qual;�Forb; m)-VCS with relative di�erence �(m) and set of thresholds f(X; tX)gX2�Qualis realized using the two n � m basis matrices S0 and S1 if the following two conditionshold.1. If X = fi1; i2; : : : ; ipg 2 �Qual (i.e., if X is a quali�ed set), then the \or" V of rowsi1; i2; : : : ; ip of S0 satis�es w(V ) � tX � �(m) � m; whereas, for S1 it results thatw(V ) � tX .2. If X = fi1; i2; : : : ; ipg 2 �Forb (i.e., if X is a forbidden set), then the two p � mmatrices obtained by restricting S0 and S1 to rows i1; i2; : : : ; ip are equal up to acolumn permutation.The collections C0 and C1 are obtained by permuting the columns of the correspondingbasis matrix (S0 for C0, and S1 for C1) in all possible ways. Note that, in this case, thesize of the collections C0 and C1 is the same (it is equal to m!) and it is denoted by r. Thistechnique has been introduced in [11]. The algorithm for the VCS based on the previousconstruction of the collections C0 and C1 has small memory requirements (it keeps only thebasis matrices S0 and S1) and it is e�cient (to choose a matrix in C0 (C1, resp.) it onlygenerates a permutation of the columns of S0 (S1, resp.)).4

We give two examples to illustrate the de�nitions, the use of basis matrices, and theway the subpixels are arranged.Example 2.3 Suppose n = 4, so P = f1; 2; 3; 4g. De�ne�Qual = ff1; 2g; f2; 3g; f3; 4g; f1; 2; 3ggand �Forb = ff1g; f2g; f3g; f4g; f1; 3g; f1; 4g; f2; 4gg:Then �0 = nf1; 2g; f2; 3g; f3; 4go.We will construct a (�Qual;�Forb; 3)-VCS using basis matrices. The basis matrices S0and S1 are as follows: S0 = 26664 1 0 11 0 01 0 01 1 0 37775 S1 = 26664 0 1 11 0 00 0 11 1 0 37775 :In this scheme, �(m) = 1=3, so the contrast is one. Let's �rst look at the quali�ed subsets.It is easy to check that the following values hold with regard to Property 1 of De�nition 2.2.tf1;2g = 3tf2;3g = 2tf3;4g = 3; andtf1;2;3g = 3:Property 2 of De�nition 2.2 is easily veri�ed for the forbidden sets. Finally, the sets f1; 2; 4g,f1; 3; 4g, f2; 3; 4g, and f1; 2; 3; 4g are neither forbidden nor quali�ed, so the scheme is not ascheme for a strong access structure. 4Example 2.4 Suppose P = f1; 2; 3; 4; 5; 6g and consider the strong access structures withbasis �0 = nfi; jg : i; j 2 P and i 6= jo. This access structure is based on the completegraph with 6 vertices and it is equivalent to a 2 out of 6 threshold structure. The followingbasis matrices represent a VCS for the strong access structure on the set of participants Pwith basis �0. S0 = 266666664 110011001100110011001100 377777775 S1 = 266666664 101010011100011001010011 377777775 :In this scheme any pixel of the original image is encoded into four subpixels. To do notdistort the aspect ratio of the original image it is convenient to arrange the subpixels in a2 � 2 array where each share has the form depicted in Figure 1. These shares correspond5

to the rows of the basis matrices S0 and S1, respectively. The subpixels are disposed in aclock-wise fashion starting from the upper-left corner of the 2 � 2 array. Clearly, to anypermutation of the columns of S0 and S1 will correspond a new re-arrangement of thesubpixels into the 2� 2 array. Encoding of a white pixel61 2 3 4 5Encoding of a black pixel61 2 3 4 5Figure 1: Shares of a 2 out of 6 threshold VCS. 4In the previous example we have seen how to arrange the subpixels forming a share inorder to avoid the distortion of the aspect ratio of the original image. Thus, the best resultsare obtained when the pixel expansion m is a square. If this is not the case, we can expandthe shares by \padding" the share with m0 white subpixels in such a way that m+m0 is asquare and then we can apply the technique seen in Example 2.4. This construction works(see Lemma 5.3), but we get a VCS with worse relative di�erence than the one we startedwith. If m is not a square, then a second method to realize a VCS is to consider c copiesof the share in such a way that c �m is a square and then to apply the technique seen inExample 2.4. A third construction is to let each subpixel of the share to occupy a m-th of asquare surface. For example, each subpixel can have a rectangular shape of height 1 and ofwidth 1=m. This is the way the images of the example given in the Appendix are obtained.3 An (n; n)-Threshold SchemeA (k; n)-threshold VCS realizes the strong access structure with basis�0 = fB � P : jBj = kg:Thus, the original message is visible (that is, Property 1: of De�nition 2.1 is satis�ed) if anyk of n participants stack their transparencies, but totally invisible (that is, Property 2: ofDe�nition 2.1 is satis�ed) if fewer than k transparencies are stacked together or analysedby any other method. In this section we recall some of the results presented in [11] for(n; n)-threshold VCS. In such a scheme, the original message is visible if and only if all ntransparencies are stacked together, but totally invisible if fewer than n transparencies arestacked together or analysed by any other method.The construction of an (n; n)-threshold VCS is obtained by means of the constructionof the basis matrices S0 and S1 de�ned as follows: S0 is the matrix whose columns are allthe boolean n-vectors having an even number of `1's, and S1 is the matrix whose columnsare all the boolean n-vectors having an odd number of `1's.6

Lemma 3.1 ([11]) The above scheme is an (n; n)-threshold VCS with parameters m =2n�1, �(m) = 1=2n�1 and r = 2n�1!Example 3.2 Let n = 4. Then, the two basis matrices are:S0 = 26664 0 0 0 0 1 1 1 10 0 1 1 0 0 1 10 1 0 1 0 1 0 10 1 1 0 1 0 0 1 37775 S1 = 26664 0 0 0 0 1 1 1 10 0 1 1 0 0 1 10 1 0 1 0 1 0 11 0 0 1 0 1 1 0 37775 : 4The scheme realized using the previous construction is optimal with respect to the valuesof m and �(m), as stated in the next theorem.Theorem 3.3 ([11]) In any (n; n)-threshold VCS, �(m) � 1=2n�1 and m � 2n�1.In general, we will be interested in minimizing m for a given access structure. Hence,we de�ne m�(�Qual;�Forb) to be the smallest value m such that an (�Qual;�Forb; m)-VCSexists.Let (�Qual;�Forb) be an access structure on a set P of participants. Given a subset ofparticipants P 0 � P , we de�ne the access structure induced by P 0 to be the families of setsde�ned as follows: �[P 0]Qual = fX 2 �Qual : X � P 0g; and�[P 0]Forb = fX 2 �Forb : X � P 0g:The following lemma is immediate.Lemma 3.4 Let (�Qual;�Forb) be an access structure on a set P of participants, and let(�[P 0]Qual;�[P 0]Forb) be the induced access structure on the subset of participants P 0. Thenm�(�[P 0]Qual;�[P 0]Forb) � m�(�Qual;�Forb):The next corollary is a consequence of Theorem 3.3 and Lemma 3.4.Corollary 3.5 Let (�Qual;�Forb) be an access structure. Suppose that X 2 �0, and supposethat Y 2 �Forb for all Y � X, Y 6= X. Then m�(�Qual;�Forb) � 2jXj�1.4 General ConstructionsIn this section we will present two construction techniques to realize visual cryptographyschemes for any access structure. 7

4.1 A Construction for VCS Using Cumulative ArraysThe �rst construction we consider is based on the cumulative array method introducedin [13]. Let (�Qual;�Forb) be a strong access structure on the set of participants P =f1; 2; : : : ; ng. Let ZM denote the collection of the maximal forbidden sets of �:ZM = fB 2 �Forb : B [ fig 2 �Qual for all i 2 P nBg:A cumulative map (�; T ) for �Qual is a �nite set T along with a mapping � : P �! 2T suchthat for Q � P we have that [a2Q�(a) = T () Q 2 �Qual:We can construct a cumulative map (�; T ) for any �Qual by using the collection of themaximal forbidden sets ZM = fF1; : : : ; Ftg as follows. Let T = fT1; : : : ; Ttg and for anyi 2 P let �(i) = fTj j i 62 Fj ; 1 � j � tg: (1)It is easy to see that for any X 2 �Qual we have[i2X �(i) = T ;whereas any set X 2 �Forb will be missing at least one Tj 2 T .From the cumulative mapping (1) for �Qual, we can obtain a cumulative array for �Qual,as follows. A cumulative array is a jPj � jT j boolean matrix, denoted by CA, such thatCA(i; j) = 1 if and only if i 62 Fj .Example 4.1 Let P = f1; 2; 3; 4g;�0 = nf1; 2g; f2; 3g; f3; 4go; ZM = nf1; 4g; f1; 3g; f2; 4go,and let F1 = f1; 4g; F2 = f1; 3g; and F3 = f2; 4g. Therefore, jT j = 3. The cumulative arrayfor �Qual is the following: CA = 26664 0 0 11 1 01 0 10 1 0 37775 : 4At this point we can realize a visual cryptography scheme for any strong access structure.Our technique is based on the (n; n)-threshold VCS of Section 3. Let ZM be set of themaximal forbidden sets and let t = jZM j. Let CA be the cumulative array for �Qual obtainedusing the cumulative map (1). Let bS0 and bS1 be the basis matrices for a (t; t)-thresholdVCS. The basis matrices S0 and S1 for a VCS for the access structure (�Qual;�Forb) canbe constructed as follows. For any �xed i let ji;1; : : : ; ji;gi be the integers j such thatCA(i; j) = 1. The i-th row of S0 (S1, resp.) consists of the or of the rows ji;1; : : : ; ji;gi ofbS0 ( bS1, resp.). An example will help in illustrating this technique.Example 4.1 (cont.) Let P = f1; 2; 3; 4g; �0 = nf1; 2g; f2; 3g; f3; 4go; and ZM =nf1; 4g; f1; 3g; f2; 4go. Hence, jT j = 3. Let bS0 and bS1 be8

bS0 = 264 0 0 1 10 1 0 10 1 1 0 375 bS1 = 264 1 1 0 01 0 1 01 0 0 1 375 :The basis matrices S0 and S1 in a VCS realizing the strong access structure with basis �0are: S0 = 26664 0 1 1 00 1 1 10 1 1 10 1 0 1 37775 S1 = 26664 1 0 0 11 1 1 01 1 0 11 0 1 0 37775 :The second row of S0 is the or of rows 1 and 2 of bS0, that is,[0; 1; 1; 1] = [0; 1; 1; 0] or [0; 1; 0; 1];and the third row of S0 is the or of rows 1 and 3 of bS0. The �rst and the fourth rows of S0are equal to rows 3 and 2 of bS0, respectively, and similarly for S1. 4The next theorem holds.Theorem 4.2 Let (�Qual;�Forb) be a strong access structure, and let ZM be the familyof the maximal forbidden sets in �Forb. Then there exists a (�Qual;�Forb; m)-VCS withm = 2jZM j�1 and tX = m for any X 2 �Qual.4.2 Constructing VCS from Smaller SchemesIn this section we present a construction for visual cryptography schemes using smallschemes as building blocks in the construction of larger schemes.Let (�0Qual;�0Forb) and (�00Qual;�00Forb) be two access structures on a set of n participantsP . If a participant i 2 P is non-essential for (�0Qual;�0Forb), we assume that i 2 �0Forb andthat i does not receive nothing as share. Analogously for (�00Qual;�00Forb). Suppose thereexist a (�0Qual;�0Forb; m0)-VCS and a (�00Qual;�00Forb; m00)-VCS with basis matrices R0, R1and T 0, T 1, respectively. We will show how to construct a VCS for the access structure(�Qual;�Forb) = (�0Qual [ �00Qual;�0Forb \ �00Forb). From the matrices R0, R1, T 0, and T 1 weconstruct two pairs of matrices, ( bR0; bR1) and ( bT 0; bT 1), each consisting of n rows, as follows.Let us �rst show how to construct bR0. For i = 1; : : : ; n, the i-th row of bR0 has all zeroes asentries if the participant i is not an essential participant of (�0Qual;�0Forb); otherwise, it isthe row of R0 corresponding to participant i. The matrices bR1, bT 0, and bT 1 are constructedsimilarly. Finally, the basis matrices S0 (S1, resp.) for (�Qual;�Forb) will be realizedby concatenating the matrices bR0 and bT 0 ( bR1 and bT 1, resp.). (That is, S0 = bR0 � bT 00and S1 = bR1 � bT 1, where � denotes the operator \concatenation" of two matrices.) InTheorem 4.4 we will prove that the scheme obtained using this method realizes a VCS. Anexample will help in illustrating the previous technique.Example 4.3 Let P = f1; 2; 3; 4; 5g and let �0 = nf1; 2g; f2; 3g; f3; 4g; f4; 5g; f1; 5g; f2; 5go.We can construct a visual cryptography scheme for the strong access structure (�Qual;�Forb)9

having basis �0 by using VCS for the strong access structures with bases �00 = nf1; 2g; f1; 5goand �000 = nf2; 3g; f3; 4g; f4; 5g; f2; 5go, respectively.R0 = 264 101010 375 ; R1 = 264 100101 375 and T 0 = 26664 10101010 37775 ; T 1 = 26664 10011001 37775 :From the above matrices we obtain the matrices bR0, bR1, bT 0, and bT 1.bR0 = 2666664 1010000010 3777775 ; bR1 = 2666664 1001000001 3777775 and bT 0 = 2666664 0010101010 3777775 ; bT 1 = 2666664 0010011001 3777775 :Concatenating the matrix bR0 with bT 0 and the matrix bR1 with bT 1, we obtain the followingbasis matrices S0 and S1 for a visual cryptography scheme for the strong access structurewith basis �0: S0 = 2666664 10001010001000101010 3777775 S1 = 2666664 10000110000100100101 3777775 : 4The next theorem holds.Theorem 4.4 Let (�0Qual;�0Forb) and (�00Qual;�00Forb) be two access structures on a set of nparticipants P. Suppose there exist a (�0Qual;�0Forb; m0)-VCS and a (�00Qual;�00Forb; m00)-VCSwith basis matrices R0, R1 and T 0, T 1, respectively. Then the previous construction yieldsa (�0Qual [ �00Qual;�0Forb \ �00Forb; m0 + m00)-VCS. If the original access structures are bothstrong, then so is the resulting access structure.Proof. Letm = m0+m00. Let f(X; t0X)gX2�0Qual and f(X; t00X)gX2�00Qual be the set of thresh-olds satisfying De�nition 2.2 for the access structures (�0Qual;�0Forb) and (�00Qual;�00Forb),respectively. Finally, let �0(m0) and �00(m00) be the relative di�erences of the two VCSs.De�ne �(m) to be �(m) = minf�0(m0) �m0; �00(m00) �m00gm :We have to show that the matrices S0 and S1, constructed using the previously describedtechnique, are basis matrices for the access structure (�Qual;�Forb) = (�0Qual[�00Qual;�0Forb\�00Forb). 10

Let X be a subset of participants. First, suppose that X 2 �0Qual \ �00Qual and let tX =t0X + t00X . It results thatw(S0X) = w( bR0X � bT 0X)= w( bR0X) + w( bT 0X)= w(R0X) + w(T 0X)� t0X � �0(m0) �m0 + t00X � �00(m00) �m00� tX � �(m) �m;whereas w(S1X) = w( bR1X � bT 1X)= w( bR1X) + w( bT 1X)� t0X + t00X= tX :If X 2 �0Qualn�00Qual, then let tX = t0X + w( bT 0X). It results thatw(S0X) = w( bR0X � bT 0X)= w( bR0X) + w( bT 0X)� t0X � �0(m0) �m0 + w( bT 0X)� t0X � �(m) �m+ w( bT 0X)= tX � �(m) �m;whereas w(S1X) = w( bR1X � bT 1X)= w( bR1X) + w( bT 1X)� t0X + w( bT 1X)= t0X + w( bT 0X)= tX :If X 2 �00Qualn�0Qual, then let tX = t00X + w( bR0X). We can prove that w(S0X) � tX � �(m) �m and w(S1X) � tX . Using the reasoning applied to the previous case, Property 1. ofDe�nition 2.2 is satis�ed.Now, suppose that X 2 �0Forb\�00Forb. We have to show that S0[X ] = S1[X ] up to a columnpermutation. We have that S0[X ] = bR0[X ] � bT 0[X ]= bR1[X ] � bT 1[X ]= S1[X ];where the second equality is satis�ed up to a column permutation. Hence, Property 2. ofDe�nition 2.2 is satis�ed, too. It is easy to see that if the original access structures arestrong, then so is the resulting access structure. Therefore, the theorem holds.11

The construction technique employed in the proof of Theorem 4.4 does not work forgeneral VCS (i.e., if they are not constructed from basis matrices). That is, given a(�0Qual;�0Forb; m0)-VCS and a (�00Qual;�00Forb; m00)-VCS the \concatenation" of the matricesof the two schemes does not give rise to a (�0Qual [ �00Qual;�0Forb \ �00Forb; m0 + m00)-VCS.Indeed, consider the collections C0 and C1 of a possible (2; 2)-threshold VCS, denoted by�, obtained as follows. The collection C0 is realized considering the matrices obtained bypermuting the columns of the matrices" 100010 # " 110110 #whereas the collection C1 is obtained by considering the matrices obtained by permutingthe columns of the matrices " 100011 # " 110001 # :Suppose that we use � to realize VCSs for the strong access structures having bases ff1; 2ggand ff2; 3gg. To construct the collections C0 and C1 of a VCS for the strong access structurehaving basis ff1; 2g; f2; 3gg we cannot just \concatenate" the matrices of the two schemes.Indeed, it is easy to see thatM = 264 110000110110000110 375 2 C0 and M 0 = 264 110000001100000011 375 2 C1:Hence, we get w(Mf1;2g) = w(M 0f1;2g) = 4 contradicting Property 1. of De�nition 2.1.Therefore, the construction technique employed in the proof of Theorem 4.4 does not workfor general VCSs.It is not di�cult to see that given a (�0Qual;�0Forb; m0)-VCS and a (�00Qual;�00Forb; m00)-VCSthe \concatenation" of all matrices of the two schemes gives rise to a (�0Qual[�00Qual;�0Forb\�00Forb; m0 + m00)-VCS if and only if for all X 2 �0Qual [ �00Qual the following condition issatis�ed. minM2C01w(cMX) + minM2C001 w(cMX) > maxM2C00w(cMX) + maxM2C000 w(cMX):Recall that, for M 2 C0 [ C1, cM is the matrix in which the i-th row has all zeroes asentries if the participant i is not an essential participant; otherwise, it is the row of Mcorresponding to participant i, as de�ned at the beginning of Section 4.2. The previouscondition states that for any X 2 �0Qual [�00Qual and for any M 2 C1 and M 0 2 C0 it resultsthat w(MX) > w(M 0X). Therefore, there will be always a di�erence between a white and ablack pixel. That is, the relative di�erence will be positive. More precisely, let m = m0+m00and let Wmin(X) = minM2C01w(cMX) + minM2C001 w(cMX)and Wmax(X) = maxM2C00w(cMX) + maxM2C000 w(cMX):The contrast �(m) is equal to�(m) = minX2�0Qual[�00Qual Wmin(X)�Wmax(X)m :12

The next corollary is an immediate consequence of Theorem 4.4.Corollary 4.5 Let (�Qual;�Forb) be an access structure. If �Qual = [qi=1�(i;Qual), �Forb =\qi=1�(i;Forb), and, for i = 1; : : : ; q, there exists a (�(i;Qual);�(i;Forb); mi)-VCS constructedusing basis matrices, then there exists a (�Qual;�Forb; m)-VCS constructed using basis ma-trices, where m = Pqi=1mi. If the q original access structures are strong then so is theresulting access structure.From Lemma 3.1 and Corollary 4.5 the following theorem holds.Theorem 4.6 Let (�Qual;�Forb) be a strong access structure having basis �0. There existsa (�Qual;�Forb; m)-VCS where m = XX2�0 2jXj�1.The previous theorem states a general result on the existence of VCS for any strongaccess structure. For special classes of access structures it is possible to achieve a smallervalue of m, as we will show in Section 6 for threshold access structures, and in Section 7for graph-based access structures.5 On the Structure of VCSIn this section we provide some useful properties of VCS. First, we investigate the case of\isolated" participants. Then, we show how to construct VCS for any non-connected accessstructure using VCS for its connected parts. Finally, we prove that any matrix M in thecollection C0 [ C1 has to contain some prede�ned sub-matrices, which we call \unavoidablepatterns".5.1 Isolated ParticipantsIn this section we show that we do not need to consider access structures containing \iso-lated" participants, i.e., we can suppose that jX j � 2 for any X 2 �Qual.This is shown as follows. Suppose that (�Qual;�Forb) is an access structure on partic-ipant set P , and suppose that x 62 P . Let C0 and C1 be the collections of matrices in a(�Qual;�Forb; m)-VCS.First, we show how to construct a VCS for the access structure (�Qual [ ffxgg;�Forb).Lemma 5.1 Let (�Qual;�Forb) be an access structure on a set of participants P, and letx 62 P. If there exists a (�Qual;�Forb; m)-VCS, then there exists a (�Qual[ffxgg;�Forb; m)-VCS.Proof. Let C0 and C1 be the collections of matrices in a (�Qual;�Forb; m)-VCS. Then, forany M 2 C0, adjoin a new row (for participant x) consisting entirely of `0's. Similarly, forany M 0 2 C1, adjoin a new row (for participant x) consisting entirely of `1's.Of course, Lemma 5.1 can be applied as many times as desired, if there is more thanone isolated participant.We now give a modi�cation of Lemma 5.1 which shows how to construct a VCS in whichevery subset of participants containing x is quali�ed.13

Lemma 5.2 Let (�Qual;�Forb) be an access structure on a set of participants P, and letx 62 P. If there exists a (�Qual;�Forb; m)-VCS, then there exists a (�0Qual;�Forb; m + 1)-VCS, where �0Qual = �Qual [ fX [ fxg : X � Pg:Proof. Let C0 and C1 be the collections of matrices in a (�Qual;�Forb; m)-VCS. Then, forany M 2 C0, adjoin a new row (for participant x) consisting entirely of `0's, and adjoin acolumn of `0's. Similarly, for any M 0 2 C1, adjoin a new row (for participant x) consistingentirely of `1's, and a column of `0's, except that the entry in row x and column m+ 1 is a`1'. As with the previous lemma, Lemma 5.2 can be iterated.5.2 Non-Connected Access StructuresAn access structure (�Qual;�Forb) on a set of participants P is said to be connected if thereis no partition of P into two non-empty sets P 0 and P 00 such that �0 � 2P 0 [ 2P 00. Thenext technical lemma will be used in the construction of VCSs for non-connected accessstructures, given VCSs for its connected parts.Lemma 5.3 Let (�Qual;�Forb) be an access structure. Let C0 and C1 be the matrices in a(�Qual;�Forb; m)-VCS and let D be any n � p boolean matrix. The collections of matricesC 00 = fM �D :M 2 C0g and C 01 = fM �D :M 2 C1g comprise a (�Qual;�Forb; m+ p)-VCS.Proof. Since we concatenate the same matrix D to any M 2 C0 [ C1, then Properties1. and 2. of De�nition 2.1 are satis�ed. Moreover, the frequencies of matrices associatedwith forbidden sets and the set of thresholds f(X; tX)gX2�Qual do not change in going fromC0 and C1 to C 00 and C 01. Only the relative di�erence �0(m0) changes, becoming �0(m0) =(�(m) �m)=(m+ t).The next example will help in illustrating the technique employed in the previous lemma.Example 5.4 The following collections C0 and C1 represent a (2; 2)-threshold VCS withm = 2. C0 = (" 1010 # ; " 0101 #) C1 = (" 1001 # ; " 0110 #) :Setting D = " 11 # we get C 00 = (" 101101 # ; " 011011 #) and C 01 = (" 101011 # ; " 011101 #) :The collections C 00 and C 01 constitute a 2 out of 2 threshold VCS with m = 3. 4Let (�0Qual;�0Forb) and (�00Qual;�00Forb) be two access structures on disjoint sets of partic-ipants P 0 and P 00, respectively. De�ne the sum of the two access structures on the set ofparticipants P 0 [ P 00 to be (�Qual;�Forb), where�Qual = �0Qual [ �00Qual14

and �Forb = fX [ Y : X 2 �0Forb; Y 2 �00Forbg:If an access structure is not connected, then we can realize a VCS for it simply byconstructing VCS for its connected parts and then by putting together the schemes in asuitable way, as shown in the next theorem.Theorem 5.5 Let (�0Qual;�0Forb) and (�00Qual;�00Forb) be two access structures on disjointsets of participants P 0 and P 00, respectively, and let (�Qual;�Forb) be their sum. If there exista (�0Qual;�0Forb; m0)-VCS and a (�00Qual;�00Forb; m00)-VCS, then there is a (�Qual;�Forb; m)-VCS, where m = maxfm0; m00g.Proof. Let C 00, C 01 and C 000 , C 001 be the collections of matrices in the VCSs for accessstructures (�0Qual;�0Forb) and (�00Qual;�00Forb), respectively. Without loss of generality, sup-pose that jC 00j = jC 01j = r0, jC 000 j = jC 001 j = r00 and m0 > m00. From Lemma 5.3 thereexists a (�00Qual;�00Forb; m0)-VCS. Let C 0000 and C 0001 be the collections of matrices in this(�00Qual;�00Forb; m0)-VCS. The collections of matrices C0 and C1 of a VCS for the access struc-ture (�Qual;�Forb) are constructed as follows.C0 = fM :M [P 0] 2 C 00; M [P 00] 2 C 0000 g and C1 = fM :M [P 0] 2 C 01; M [P 00] 2 C 0001 g:Notice that jC0j = jC1j = r = r0 � r00 as from any matrix T in C 00 (resp. C 01) we get r00matrices to insert in C0 (resp. C1) by \padding" T with all the matrices in C 0000 (resp. C 0001 )one at a time. It is immediate to verify that Property 1. of De�nition 2.1 is satis�ed. Let'sverify Property 2. of De�nition 2.1 Let X 2 �0Forb (X 2 �00Forb, resp.) and let M 2 C 00 [ C 01(M 2 C 0000 [ C 0001 , resp.). By �iX (�iX , resp.), where i 2 f0; 1g, we denote the number oftimes that the matrix M [X ] appears in the collection fA[X ] : A 2 C 0ig (fA[X ] : A 2 C 000i g,resp.). From Property 2. of De�nition 2.1 we have that �0X = �1X and �0X = �1X . Finally, forM 2 C0 [ C1, let iX , where i 2 f0; 1g, denote the number of times that the matrix M [X ]appears in the collection fA[X ] : A 2 Cig. Recall that jC0j = jC1j = r = r0 � r00. To provethat Property 2. of De�nition 2.1 is satis�ed we have to show that for any X 2 �Forb itholds that 0X = 1X . Let X 2 �Forb. If X � P 0nP 00 (the case X � P 00nP 0 is analogous),then 0X = �0X � r00 = �1X � r00 = 1X :If X = Y [ Z where Y 2 �0Forb and Z 2 �00Forb, then 0X = �0Y � �0Z = �1Y � �1Z = 1X :Hence the theorem follows.The next example will help in illustrating the technique employed in the previous theorem.Example 5.6 Suppose that (�0Qual;�0Forb) is a (2; 2)-threshold access structure on partici-pant set P 0 = f1; 2g, and (�00Qual;�00Forb) is a (2; 2)-threshold access structure on participantset P 0 = f3; 4g. The sum of these two access structures is (�Qual;�Forb), where�Qual = ff1; 2g; f3; 4gg15

and �Forb = ff1g; f2g; f3g; f4g; f1; 3g; f1; 4g; f2; 3g; f2; 4gg:A VCS for the access structure (�Qual;�Forb) is obtained by considering the followingcollections C0 and C1.C0 = 8>>><>>>:26664 10101010 37775 ; 26664 01010101 37775 ; 26664 10100101 37775 ; 26664 01011010 377759>>>=>>>; :C1 = 8>>><>>>:26664 10011001 37775 ; 26664 01101001 37775 ; 26664 10010110 37775 ; 26664 01100110 377759>>>=>>>; :The access structure (�Qual;�Forb) has �0 = �Qual. It is interesting to observe that theVCS constructed above is not a VCS for the strong access structure where �Qual is theclosure of �0, and by a result that we prove later (Theorem 5.12), it can be shown thatthere is no VCS with m = 2 for the strong access structure having basis �0. It can also beshown that there is no VCS with m = 2 constructed from basis matrices with m = 2, forthe access structure (�Qual;�Forb). 45.3 Unavoidable PatternsLetM be a matrix in the collection C0[C1 of a (�Qual;�Forb; m)-VCS on a set of participantsP . Recall that, forX � P ,MX denotes them-vector obtained considering the or of the rowscorresponding to participants in X ; whereas M [X ] denotes the jX j � m matrix obtainedfrom M by considering only the rows corresponding to participants in X .Lemma 5.7 Let (�Qual;�Forb) be an access structure on a set of participants P. LetX; Y � P be two non-empty subsets of participants, such that X \ Y = ;, X 2 �Forband X [ Y 2 �Qual. Then in any (�Qual;�Forb; m)-VCS, for any matrix M 2 C1 it holdsthat w(MXY )� w(MX) � �(m) �m:Proof. Let M be any matrix in C1. From Property 1. of De�nition 2.1 we have thatw(MXY ) � tXY . Since X 2 �Forb, then from Property 2. of De�nition 2.1, there is at leastone matrix M 0 2 C0 such that M [X ] =M 0[X ]. Therefore, we havew(MX) = w(M 0X)� w(M 0XY )� tXY � �(m) �m� w(MXY )� �(m) �m;where the second inequality of the above expression derives from Property 1. of De�ni-tion 2.1. Thus, the lemma is proved. 16

The matrices in C0[C1 have to contain some prede�ned patterns which we call unavoid-able patterns. For instance, suppose X 2 �Qual and Xnfig 2 �Forb. Then for any M 2 C1,the matrix M [X ] contains at least �(m) �m columns with a `1' in the i-th row and `0's inthe other rows. This is an immediate consequence of Lemma 5.7. Indeed, by consideringX = Y [ fig we get w(MY [fig)� w(MY ) � �(m) �m:Therefore, there must be at least �(m) �m columns in M [X ] with a `1' in row i and `0's inthe other rows.The next corollaries are immediate consequences of the existence of unavoidable patterns.Recall that a participant i is an essential participant if there exists a set X � P suchthat X [ fig 2 �Qual but X 62 �Qual. We say that i is a strongly essential participant ifthere exists a set X � P such that X [ fig 2 �Qual and X 2 �Forb.Corollary 5.8 Let (�Qual;�Forb) be an access structure on a set of participants P. Sup-pose that i is a strongly essential participant, and suppose that fig 2 �Forb. Then in any(�Qual;�Forb; m)-VCS, for any matrix M 2 C0 [ C1 it holds thatw(Mi) � �(m) �m:Proof. Let X be a subset such that X [ fig 2 �Qual and X 2 �Forb. For any matrixM 2 C1, because of the unavoidable patterns (Lemma 5.7), the matrix M [X ] contains atleast �(m) �m columns with a `1' in the i-th row and `0's in the other rows. Therefore,w(Mi) � �(m) �m. Since fig 2 �Forb, the result also holds for any matrix M 2 C0 byProperty 2. of De�nition 2.1.Corollary 5.9 Let (�Qual;�Forb) be an access structure, Suppose that X 2 �Qual andXnfig 2 �Forb for all i 2 X. Then, in any (�Qual;�Forb; m)-VCS , we have tX � jX j ��(m) �m.Proof. Let i 2 X , and de�ne Y = Xnfig. Let M 2 C0. From Property 1. of De�nition 2.1it results that w(MY ) � w(MX) � tX � �(m) �m. From Property 2. of De�nition 2.1 wehave that there exists at least a matrix M 0 2 C1 such that w(M 0Y ) = w(MY ). Because ofthe unavoidable patterns, we have thatw(M 0Y ) � jY j � �(m) �m = (jX j � 1)�(m) �m:Hence, we get that tX � jX j � �(m) �m.The next lemma states the existence of other unavoidable patterns in any matrix in C0[C1.Basically, it says that for any Y 2 �Forb and for anyM 2 C0[C1, the matrixM [Y ] containsat least �(m) �m columns whose entries are all equal to zero.Lemma 5.10 Let (�Qual;�Forb) be a strong access structure, and suppose that Y 2 �Forb.Then, in any (�Qual;�Forb; m)-VCS, for any matrix M 2 C0 [ C1 it holds thatw(MY ) � minftX : Y � X; X 2 �Qualg � �(m) �m:Proof. Because of Property 2. of De�nition 2.1, we prove the lemma only for M 2 C0. LetX 2 �Qual, Y � X . From Property 1. of De�nition 2.1 we get w(MX) � tX � �(m) �m.Since Y � X we have that w(MY ) � w(MX), and the result follows.17

The next lemma shows the existence of unavoidable patterns in any matrix M 2 C0. Itstates that for any X 2 �Qual and anyM 2 C0, the matrixM [X ] contains at least �(m) �mcolumns with entries all equal to `0'.Lemma 5.11 Let (�Qual;�Forb) be an access structure on a set P of participants. SupposeX 2 �Qual. Then, in any (�Qual;�Forb; m)-VCS for any M 2 C0, the matrix M [X ] has atleast �(m) �m columns with entries all equal to zero.Proof. From Property 1. of De�nition 2.1, we have the following:w(MX) � tX � �(m) �m � m� �(m) �m:Therefore, the lemma holds.We now look at a consequence of the unavoidable patterns for (2; n)-threshold access struc-tures. In a VCS for such an access structure, the rows of any matrix M 2 C1 represent aSperner family1. In fact, letM 2 C1 be an n�m boolean matrix and let G = fg1; : : : ; gmg bea ground set. For i = 1; : : : ; n, row i of M represents the subset Ai = fgq :M(i; q) = 1g ofG. Since any two rows of M contain the patterns h 10 i and h 01 i , then the sets A1; : : : ; Anconstitute a Sperner family in the ground set G. Therefore, the rows of the matrix Mrepresent a Sperner family. This will be exploited further in Theorem 6.6 and in Section 7.The scheme given in Example 2.4 is constructed from a Sperner family in a ground setcontaining four elements.The next two theorems provide a characterization of VCS having m = 2 and of (3; 3)-threshold VCS with m = 4. Both theorems are based on the existence of unavoidablepatterns.Theorem 5.12 Let (�Qual;�Forb) be a strong access structure on the set of participants Pcontaining no isolated participants. If there exists a (�Qual;�Forb; 2)-VCS, then the basis�0 is the edge-set of a complete bipartite graph.Proof. Suppose there exists a (�Qual;�Forb; 2)-VCS. Then for any X 2 �0 it results thatjX j = 2. Indeed, there are no isolated participants, and hence jX j � 2. On the otherhand, jX j � 2, since otherwise Corollary 3.5 would imply that m � 4. Therefore, �0 is theedge-set of some graph G with vertex-set P .We �rst show that the graphG is connected. Indeed, suppose by contradiction that there ex-ists a (�Qual;�Forb; 2)-VCS and that G is not connected. Therefore, there exists a partitionof P into two non-empty sets P 0 and P 00 such that �0 � 2P 0 [ 2P 00 . Let fi; jg 2 �Qual \ 2P 0and ` 2 P 00. Because of the unavoidable patterns and since the access structure does notcontain isolated participants, we have that for any M 2 C1 the matrix M [fi; j; `g] is equal,up to a column permutation, to one of the following two matricesM 0 = 264 M 0[i]M 0[j]M 0[`] 375 = 264 100101 375 M 00 = 264 M 00[i]M 00[j]M 00[`] 375 = 264 100110 375 :1A Sperner family SF over a ground set G is a family SF = fA1; : : : ;Atg of subsets of G such that Ajis not a subset of Aj for i 6= j, for other information see [9].18

Since the access structure is strong and w(M 0fi;j;`g) = w(M 00fi;j;`g) = 2, from Property 1. ofDe�nition 2.1, it result that for any cM 2 C0 the matrix cM [X[f`g] is equal, up to a columnpermutation, to 264 101010 375 :In this case we have that w(M 0fi;`g) > w(cMfi;`g) and w(M 00fj;`g) > w(cMfj;`g) contradictingProperty 2. of De�nition 2.1 since fi; `g and fj; `g belong to �Forb. Therefore, �0 is theedge-set of some connected graph G.Now, suppose that G is not a complete multipartite graph. Then from Theorem 4.2 in [5],G contains an induced subgraph which is isomorphic either to H or to P3, where V (H) =V (P3) = f1; 2; 3; 4g,E(H) = nf1; 2g; f2; 3g; f3; 4g; f2; 4go, andE(P3) = nf1; 2g; f2; 3g; f3; 4go.First, suppose that G is isomorphic to H . The graph H contains K3 as induced subgraphwhich can represent the basis of a (2; 3)-threshold structure. There does not exist a Spernerfamily on a ground set of cardinality two (see [9] for details). Hence by consideration of theunavoidable patterns and Lemma 3.4, it must be the case that m � 3.Next, we prove that if G is isomorphic to P3, then m � 3. Let �0Qual be the closure of�00 = nf1; 2g; f2; 3g; f3; 4go. Suppose by contradiction that there exists a (�0Qual;�0Forb; 2)-VCS. Let M 2 C1. Since f1; 2g; f2; 3g; f3; 4g 2 �00, because of the unavoidable patternsthe matrix M has to be equal, up to a column permutation, toM = 26664 10011001 37775 :From Property 2. of De�nition 2.1 any row of any matrix M 0 2 C0 has weight 1. FromProperty 1. of De�nition 2.1, for any X 2 �00, we have that w(MX) > w(M 0X). Hence, thematrix M 0 is equal, up to a column permutation, toM 0 = 26664 10101010 37775 :Considering the matricesM andM 0 we have that w(M14) > w(M 014) contradicting Property2. of De�nition 2.1 since f1; 4g 2 �0Forb. Thus, there does not exist a (�0Qual;�0Forb; 2)-VCSwhere �0Qual is the closure of �00 = nf1; 2g; f2; 3g; f3; 4go.Finally, suppose that G is a complete multipartite graph having at least three parts. Thegraph G contains K3 as induced subgraph, and, as above, m � 3.Therefore, �0 is the edge-set of a complete bipartite graph.The condition of above theorem is necessary and su�cient. We will see in Theorem 7.5that, for any strong access structure having as basis the edge-set of a complete bipartitegraph, there exists a visual cryptography scheme with m = 2.By exploiting the unavoidable patterns the following theorem proves that in any (3; 3)-threshold VCS with m = 4 all matrices have a (speci�ed) unique form up to a column19

permutation. To be speci�c, any matrix M 2 C0 has as its columns all the boolean 3-vectors having an even number of `1's; whereas, any matrix M 0 2 C1 has as its columns allthe boolean 3-vectors having an odd number of `1's.Theorem 5.13 Let (�Qual;�Forb) be the access structure of a (3; 3)-threshold VCS on theset of participants P = f1; 2; 3g. In any (�Qual;�Forb; 4)-VCS all matrices have a uniqueform up to a column permutation. That is, any matrix M 2 C1 and any matrix M 0 2 C0 isequal, up to a column permutation, (respectively) toM = 264 100101010011 375 M 0 = 264 011001010011 375 :Proof. First, let M 2 C1. Because of the unavoidable patterns we have that, up to acolumn permutation, M = 264 1 0 0 ?0 1 0 ?0 0 1 ? 375 ;where ? denotes the presence of either a one or a zero. Assume that the fourth entry of arow of M is zero: Without loss of generality, suppose that M [1] = [1; 0; 0; 0]. Because ofthe unavoidable patterns (see Lemma 5.11), any matrix in C0 has a column with all entriesequal to zero. From Property 2. of De�nition 2.1 there exists at least a matrix M 0 2 C0such that w(M 01) = 1. Therefore, the matrix M 0, up to a column permutation, looks likeM 0 = 264 0 1 0 00 ? ? ?0 ? ? ? 375 :By consideration of two rows of M , it is immediate to see that other unavoidable patternsof any matrix in the collection C0 are the following columns264 10? 375 264 1?0 375 264 ?10 375 264 ?01 375 :From Property 2. of De�nition 2.1 and from the existence of the unavoidable patterns, thematrix M 0 has to be, up to a column permutation, the followingM 0 = 264 010000100001 375 :The matrix M 0 and Property 2. of De�nition 2.1 imply that any matrix M 2 C1 withw(M1) = 1 is equal, up to a column permutation, toM = 264 100001000010 375 ;20

leading to a contradiction, i.e., w(M123) = w(M 0123) = 3. Therefore, any matrix M 2 C1does not have a row of weight 1, and it is equal, up to a column permutation, toM = 264 100101010011 375 :Hence, any matrix M 0 2 C0 is equal, up to column permutation, toM 0 = 264 011001010011 375 ;which proves that for any (3; 3)-threshold VCS with m = 4, any matrix M 2 C0 has ascolumns all the boolean 3-vectors having an even number of `1's; whereas, any matrixM 0 2 C1 has as columns all the boolean 3-vectors having an odd number of `1's.6 Threshold SchemesIn this section, we study (k; n)-threshold VCS. We can construct such schemes by usingthe two techniques described in Sections 4.1 and 4.2. By using the technique based oncumulative arrays we obtain a (k; n)-threshold VCS in which m = 2( nk�1)�1 and tX = mfor any set X of cardinality k; whereas by using the technique of Section 4.2 we obtain a(k; n)-threshold VCS in which m = �nk� � 2k�1 and tX has the same value for any set X ofcardinality k.In the following section we describe a method to construct threshold VCSs achievingbetter results.6.1 A More E�cient Construction for Threshold SchemesIn this section we describe a construction for threshold VCSs based on perfect hashing[8, 10, 4].De�nition 6.1 A starting matrix SM(n; `; k) is a n� ` matrix whose entries are elementsof a ground set fa1; : : : ; akg, with the property that, for any subset of k rows, there exists atleast one column such that the entries in the k given rows of that column are all distinct.Given a matrix SM(n; `; k) we can construct a (k; n)-threshold VCS as follows: Then� (` � 2k�1) basis matrices S0 and S1 are constructed by replacing the symbols a1; : : : ; ak,respectively, with the 1-st,: : : ; k-th rows of the corresponding basis matrices of the (k; k)-threshold VCS described in Section 3. The scheme obtained is a (k; n)-threshold VCS asthe following theorem shows.Theorem 6.2 If there exists a SM(n; `; k) then there exists a (k; n)-threshold VCS withm = ` � 2k�1.Proof. Let S0k and S1k be basis matrices of the (k; k)-threshold VCS described in Section 3and let SM(n; `; k) be a starting matrix whose entries are elements of a set fa1; : : : ; akg.Finally, let M0 and M1 be two n� (` � 2k�1) matrices constructed by replacing the symbols21

a1; : : : ; ak, with the 1-st,: : : ; k-th rows of the basis matrices S0k and S1k , respectively. In theprevious construction, when we replace the symbols a1; : : : ; ak of SM with the rows of S0k(S1k , resp.) the column i of SM is expanded into an n� 2k�1 matrix referred to as the basicblock B0;i (B1;i, resp.). We will show that the matrices M0 and M1 are basis matrices of a(k; n)-threshold VCS.Fix any d � k rows of a basic block B0;i (B1;i, resp.). Either these rows comprise all therows of S0k (S1k , resp.), where any row of S0k (S1k, resp.) can appear more than once, andthus their \or" has weight 2k�1 � 1 (2k�1, resp.), or they contain at most k � 1 distinctrows of S0k (S1k , resp.) whose \or" has the same weight in both basic blocks B0;i and B1;i.Therefore, Property 1. of De�nition 2.2 is satis�ed.To prove that Property 2. of De�nition 2.2 is satis�ed we have to show that for any setX � f1; : : : ; ng of cardinality at most k � 1, M0[X ] is equal to M1[X ] up to a columnpermutation. This is true since, for any i 2 f1; : : : ; `g, it holds that B0;i[X ] is equal toB1;i[X ] up to a column permutation.Example 6.3 To construct a (2; n)-threshold VCS consider the matrix SM(n; dlogne; 2)in which the dlog ne entries in row i are equal to a1+bidlog ne�1 , � � � ; a1+bi1 ; a1+bi0 , where thebits bij are the coe�cients in the binary representation of i� 1, that isi� 1 = bi0 + bi12 + � � �+ bidlogne�12dlogne�1:The two basis matrices are constructed by substituting 01 for a1 and a2 in SM to obtainS0 and 01 and 10 for a1 and a2 in SM to obtain S1, respectively.The resulting scheme has m = 2 � dlogne which is a considerable improvement comparedto the scheme proposed in [11] where m = n. However, we will provide in Section 7 an evenbetter construction, which is in fact optimal with respect to m.Here are two examples to illustrate. If n = 4 we obtain the two 4� 4 matrices:S0 = 26664 10 1010 1010 1010 10 37775 S1 = 26664 10 1010 0101 1001 01 37775 :If n = 8 we obtain the two 8� 6 matrices:S0 = 26666666666664 10 10 1010 10 1010 10 1010 10 1010 10 1010 10 1010 10 1010 10 10 37777777777775 S1 = 26666666666664 10 10 1010 10 0110 01 1010 01 0101 10 1001 10 0101 01 1001 01 01 37777777777775 : 422

Example 6.4 A (3; 6)-threshold VCS can be constructed considering the matrix SM(6; 3; 3):SM = 266666664 a1a2a3a1a3a2a2a1a3a2a3a1a3a1a2a3a2a1 377777775 :Substituting 0011, 0101, 0110 for a1; a2; a3 in SM to obtain S0 and 0011, 0101, 1001 fora1; a2; a3 in SM to obtain S1 we obtain the two 6� 12 matrices:S0 = 266666664 0011 0101 01100011 0110 01010101 0011 01100101 0110 00110110 0011 01010110 0101 0011 377777775 S1 = 266666664 0011 0101 10010011 1001 01010101 0011 10010101 1001 00111001 0011 01011001 0101 0011 377777775 : 4Example 6.5 A (3; 9)-threshold visual cryptography scheme can be constructed consider-ing the matrix SM(9,4,3): SM = 2666666666666664 a1a1a1a1a1a2a3a2a1a3a2a3a2a1a3a3a2a2a2a1a2a3a1a2a3a1a2a2a3a2a1a3a3a3a3a1 3777777777777775 :The above 9 � 4 matrix SM is equivalent to the classical a�ne plane of order three,see for example [9], and is a special case of a general construction given in [4]. This matrixis also described by Elias in [12] in a di�erent context. Substituting 0011, 0101, 0110 fora1; a2; a3 in SM to obtain S0 and 0011, 0101, 1001 for a1; a2; a3 in SM to obtain S1 weobtain the two 9� 16 matrices:S0 = 2666666666666664 0011 0011 0011 00110011 0101 0110 01010011 0110 0101 01100101 0011 0110 01100101 0101 0101 00110101 0110 0011 01010110 0011 0101 01010110 0101 0011 01100110 0110 0110 0011 3777777777777775 S1 = 2666666666666664 0011 0011 0011 00110011 0101 1001 01010011 1001 0101 10010101 0011 1001 10010101 0101 0101 00110101 1001 0011 01011001 0011 0101 01011001 0101 0011 10011001 1001 1001 0011 3777777777777775 : 423

The SM matrix is a representation of a Perfect Hash Family (or PHF). Fredman andKoml�os [8] proved that for any PHF it holds that ` = (kk�1=k!) logn. They also proved theweaker but simpler bound ` = (1= logk) logn. Mehlhorn [10] proved that there exist PHFswith ` = O(kek) logn. These bounds are in general, non-constructive, but in [4] there can befound some (constructive) recursive constructions for PHFs with ` = O �(logn)log((k2)+1)� :Naor and Shamir [11] showed that there exist (k; n)-threshold visual cryptographyschemes with m = 2O(k logk) � log n. Our construction produces a smaller value of m thantheir construction, but this has been achieved by relaxing the condition that all thresholdstX are equal as required in [11].In the following we provide a lower bound on the pixel expansion m for any (k; n)-threshold VCS. Let C0 and C1 the collections of n�m boolean matrices of a (k; n)-thresholdVCS on the set P of n participants. Moreover, let G = fg1; : : : ; gmg be a ground set of melements and letM 2 C1. For i = 1; : : : ; n, row i ofM represents the setAi = fgp :M(i; p) =1g. Because of the unavoidable patterns, for any set Y = fj1; : : : ; jkg � f1; : : : ; ng, thematrix M [Y ], for each row i 2 f1; : : : ; kg, has at least a column with a `1' in the i-th rowand `0's in the other rows. This implies that the sets Aj1 ; : : : ; Ajk are such that the union ofany k�1 of them does not contain the remaining one. Hence, any matrixM 2 C1 representsa family A = fA1; : : : ; Ang of subsets over the ground set G having the property that theunion of any k�1 of them does not cover any of the remaining set (i.e, Aj1 6� Aj2 [� � �[Ajkfor any distinct j1; : : : ; jk 2 f1; : : : ; ng). Such set A is called a (k � 1)-cover-free family [7]over a ground set of m elements. Therefore, for �xed n, the pixel expansion m is lowerbounded by the size (n; k) of the smallest ground set G for which a (k � 1)-cover-freefamily consisting of n sets exists.Theorem 6.6 In any (k; n)-threshold VCS the pixel expansion is m � (n; k).In the following we derive a simple lower bound on the value (n; k). Let A =fA1; : : : ; Ang be a (k � 1)-cover-free family over a ground set G = fg1; : : : ; g g, where = (n; k). Let F be a family of subsets over the ground set G constructed from A asfollows. F = n[k�1i=1Aji : fj1; : : : ; jk�1g � f1; : : : ; ng and Aj1 ; : : : ; Ajk�1 2 Ao:That is, F comprises all the unions of any k � 1 sets in A. Hence, jFj = � nk�1�. It isimmediate to see that F is a Sperner family over the ground set G. It is well-known(see for example [9]) that the maximum size of a Sperner family F in a ground set G ofcardinality is at most � b =2c�; and equality occurs if and only if F consists of all subsetsof G of cardinality j 2 k (or all subsets of G of cardinality l 2 m). Hence, it has to be thatjFj � � b =2c� which implies that nk � 1! � b =2c!:Since � b =2c� � 2 and � nk�1� � ( nk�1)k�1 we have that in any (k � 1)-cover-free family = (k log(n=k)).In [7] it has been proved a stronger asymptotic result: A (k � 1)-cover-free family CFover a ground set of m elements exists only ifjCFj � e(1+o(1))m=(k�1):24

From the above arguments and because of Theorem 6.6 we get the following necessaryconditions on the pixel expansion for a (k; n)-threshold VCS to exist.Corollary 6.7 In any (k; n)-threshold VCS with pixel expansion m, it results that nk � 1! � mbm=2c!and m = (k logn).7 VCS for Graph Access StructuresIn this section, we study access structures based on graphs. We �rst recall some terminologyfrom graph theory. Given a graph G = (V (G); E(G)) a vertex cover of G is a subset ofvertices A � V (G) such that every edge in E(G) is incident with at least one vertexin A. The complete graph Kn is the graph on n vertices in which any two vertices arejoined by an edge. A graph G0 = (V (G0); E(G0)) is a subgraph of a given graph G =(V (G); E(G)) if V (G0) � V (G) and E(G0) � E(G). A clique of a graph G is any completesubgraph of G. The complete multipartite graph Ka1;a2;:::;an is a graph on Pni=1 ai vertices,in which the vertex set is partitioned into subsets of size ai (1 � i � n) called parts, suchthat vw is an edge if and only if v and w are in di�erent parts. An alternative way tocharacterize a complete multipartite graph is to say that the complementary graph is avertex-disjoint union of cliques. Note that the complete graph Kn can be thought of as acomplete multipartite graph with n parts of size 1.Let P denote the set of participants, and let G be a graph on vertex set V (G) =P , having edge set E(G). From G, we can de�ne a (strong) access structure �(G) =(�(G)Qual;�(G)Forb) by specifying that the basis is E(G). Thus a subset X of participantsis quali�ed if the induced subgraph G[X ] contains at least one edge (and X is forbidden,otherwise). As is always the case, we are interested in the minimum value m for which sucha VCS exists. We will use the notation m�(G) to denote the value m�(�(G)Qual;�(G)Forb)in this section.Example 7.1 Consider the \prism" graph G6 on six vertices, depicted in Figure 2., havingedges 12, 13, 23, 14, 25, 36, 45, 46, and 56.6

1

23

4

5Figure 2: The graph G625

De�ne S0 and S1 as follows:S0 = 266666664 1 1 01 1 01 1 01 0 01 0 01 0 0 377777775 and S1 = 266666664 1 1 01 0 10 1 10 0 10 1 01 0 0 377777775 :Then it is straightforward to verify that S0 and S1 are basis matrices of a VCS for thestrong access structure �(G6). Hence, m�(G6) � 3. 4In the case where G = Kn (a complete graph), we are talking about (2; n)-thresholdVCS. By Theorem 6.6 and Corollary 6.7, a (�(Kn); m)-VCS implies the existence of aSperner family of size n over a ground set of size m, and hence n � � mbm2 c�. A converseresult is also true, as we now show.Theorem 7.2 Suppose that the sets B1; : : : ; Bn form a Sperner family in a ground setG = fg1; : : : ; gmg of cardinality m. Then m�(Kn) � m.Proof. We de�ne basis matrices for a VCS with strong access structure �(Kn). For1 � i � n and 1 � j � m, de�neS0(i; j) = ( 1 if 1 � j � jBij0 if jBij+ 1 � j � m:Also, for 1 � i � n and 1 � j � m, de�neS1(i; j) = ( 1 if gj 2 Bi0 if gj 62 Bi:It is easy to see that we obtain the desired VCS by this construction.Next theorem holds.Theorem 7.3 The value m�(Kn) is the smallest integer m such that n � � mbm2 c�.Thus m�(K2) = 2; m�(K3) = 3; m�(Kn) = 4 for n = 4; 5; 6; m�(Kn) = 5 for n =7; 8; 9; 10; etc.Theorem 7.3 proves a lower bound on the value of m�(Kn) which is met with equalitywhen the VCS for � is constructed from a Sperner family in a ground set of m elements.In such a scheme we have �(m) = 1=m. In [2] the authors propose k out of n visualcryptography schemes achieving a greater relative di�erence. In the case of 2 out of nvisual cryptography schemes the scheme given in [2] achieves the best possible value for therelative di�erence.Let !(G) denote the maximum size of a clique in a graph G. The following result is animmediate consequence of Lemma 3.4 and Corollary 6.7.Theorem 7.4 Let G be a graph. Then there exists a (�(G); m)-VCS only if !(G) � � mbm2 c�.26

Recall the graph G6 considered in Example 7.1. It is easy to see that !(G6) = 3, andthus it follows that m�(G6) = 3.A modi�cation of Theorem 7.3, using the well-known \splitting technique" from secretsharing schemes [6], together with Theorem 7.4, can be used to prove the following resultfor complete multipartite graphs.Theorem 7.5 There exists a (Ka1;:::;an ; m)-VCS if and only if n � � mbm2 c�.Proof. Let S0 and S1 be the basis matrices for a (�(Kn); m)-VCS, where n � � mbm2 c�.Then for every q, 1 � q � n, replicate row q of S0 and S1 aq times. The result is a(�(Ka1;:::;an); m)-VCS.Conversely, suppose that a (�(Ka1;:::;an); m)-VCS exists. It is easy to see that !(Ka1;:::;an) =n. Therefore it follows from Theorem 7.4 that n � � mbm2 c�.For a graph G, let �(G) denote the minimum cardinality of a vertex cover of G. Givena graph G on vertex set P , for any x 2 P , de�neInc(x) = fy 2 P : xy 2 E(G)g:Inc(x) represents the set of all vertices adjacent to x. For any participant x 2 P , letGx = (Vx; Ex) be the subgraph of G whereVx = fxg [ Inc(x)and Ex = fxy 2 E(G)g:We will refer to Gx as the star graph with centre x.Exploiting the construction used in Theorem 4.4 we can prove the following theorem.Theorem 7.6 For any graph G, we have that m�(G) � 2�(G).Proof. Let X � P be a vertex cover of G having cardinality �(G). For each x 2 X , thereexists a (�(Gx); 2)-VCS by Theorem 7.5.Note that [x2XEx = E(G), where Ex � E(G) for all x 2 X . Hence, if we applyCorollary 4.5, we obtain a (�(G); 2�(G))-VCS.If G is bipartite, with bipartition (V1; V2), we get the following corollary.Corollary 7.7 Suppose G is a bipartite graph having bipartition (V1; V2). Then m�(G) �2�minfjV1j; jV2jg.Proof. V1 and V2 are both vertex covers of G, so �(G) � minfjV1j; jV2jg. Apply Theorem7.6. 27

8 A Decomposition Construction to Achieve Higher Con-trastGiven an access structure (�Qual;�Forb), consider a (�Qual;�Forb; m)-VCS having con-trast one, that is constructed using basis matrices S0 and S1. To construct a VCS for(�Qual;�Forb) having higher contrast c > 1, we could simply concatenate c copies of S0 andS1 to get a (�Qual;�Forb; m � c)-VCS with contrast c. In this section we describe a generaltechnique to construct VCS having any higher contrast, which provides better schemes withrespect to the value of m. This technique was introduced by Stinson [14] in the context ofsecret sharing schemes and it is referred to as a ( ; �)-decomposition.For the rest of this section, we con�ne our attention to strong access structures. Let(�Qual;�Forb) be a strong access structure having basis �0 and let �; � 1 be integers.A ( ; �)-decomposition of �0 consists of a collection f�1; : : : ;� g such that the followingproperties are satis�ed:1. �q � �0 for 1 � q � 2. ��0 � [ q=1�q (i.e., the multiset union of the �q's contains every basis subset at least� times).The following theorem holds.Theorem 8.1 Let �0 be the basis of a strong access structure (�Qual;�Forb). Let f�1; : : : ;� gbe a ( ; �)-decomposition of �0. For 1 � i � , let (�iQual;�iForb) be the access structurehaving basis �i. Suppose, for i = 1; : : : ; , that there is a (�iQual;�iForb; mi)-VCS constructedusing basis matrices. Then there is a (�Qual;�Forb; m)-VCS, constructed from basis matri-ces, having contrast at least �, where m =P i=1mi.Proof. The construction used in the proof of this theorem is similar to the one employedin Theorem 4.4. For i = 1; : : : ; , let S0;i and S1;i be the basis matrices of a VCS forthe access structure (�iQual;�iForb). From S0;i and S1;i we construct a pair of matrices,( bS0;i; bS1;i), consisting of n rows. Let us show how to construct bS0;i. For j = 1; : : : ; n, thej-th row of bS0;i has all zeroes as entries if the participant j is not an essential participant of(�iQual;�iForb); otherwise, it is the row of S0;i corresponding to participant j. The matrix bS1;iis constructed similarly. Finally, the matrices S0 and S1 for (�Qual;�Forb) will be realizedby concatenating the matrices bS0;1; : : : ; bS0; and the matrices bS1;1; : : : ; bS1; , respectively(i.e., S0 = bS0;1 � � � � � bS0; and S1 = bS1;1 � � � � � bS1; ).Let m = P i=1mi. For i = 1; : : : ; , let f(X; tiX)gX2�i0 be the set of thresholds satisfyingDe�nition 2.1 for the access structure (�iQual;�iForb), and let �i(mi) be the relative di�erenceof this VCS. De�ne �(m) to be�(m) = �m � min1�i� f�i(mi) �mig: (2)We have to show that the matrices S0 and S1, constructed using the previously describedtechnique, are basis matrices of a VCS for the access structure (�Qual;�Forb), having con-trast at least �. 28

Let X 2 �0 be a set of participants. Let Y � f1; : : : ; g be the set of maximum cardinalitysuch that X 2 \i2Y �i0. Since f�1; : : : ;� g is a ( ; �)-decomposition of �0, we have thatjY j � �. Let W = f1; : : : ; gnY and de�netX = Xi2Y tiX + Xi2W w(S0;iX ):It results that w(S0X) = w( bS0;1X � � � � � bS0; X )= Xi2Y w( bS0;iX ) + Xi2W w( bS0;iX )= Xi2Y w(S0;iX ) + Xi2W w(S0;iX )� Xi2Y (tiX � �i(mi) �mi) + Xi2W w(S0;iX )� Xi2Y tiX � � �mini2Y f�i(mi) �mig+ Xi2W w(S0;iX )� tX � �(m) �m:Whereas, w(S1X) = w( bS1;1X � � � � � bS1; X )= Xi2Y w( bS1;iX ) + Xi2W w( bS1;iX )= Xi2Y w(S1;iX ) + Xi2W w(S1;iX )� Xi2Y tiX + Xi2W w(S0;iX )= tX :Hence, Property 1. of De�nition 2.2 is satis�ed.Now, suppose that X 62 [ i=1�i. We have to show that S0[X ] = S1[X ] up to a columnpermutation. For i = 1; : : : ; , up to a column permutation, we have that bS0;i[X ] = bS1;i[X ].Hence, it results thatS0[X ] = bS0;1[X ] � � � � � bS0; [X ] = bS1;1[X ] � � � � � bS1; [X ] = S1[X ];where the second equality is satis�ed up to a column permutation. Hence, Property 2. ofDe�nition 2.2 is satis�ed, too. From (2) it follows that the resulting scheme has contrast�(m) �m at least �.Let G be a graph on vertex set P of cardinality n, and de�ne the access structure �(G)as in Section 7. Recall also from Section 7 that Gx is de�ned to be the star graph withcentre x, for x 2 P . It is not di�cult to see that fGx : x 2 Pg is an (n; 2)-decompositionof G. Applying Theorem 8.1, we obtain a visual cryptography scheme for �(G) havingcontrast 2, with m = 2n and �(m) = 1n . The next theorem holds.Theorem 8.2 Let G be a graph on a set of n vertices. Then there exists a (�(G); 2n)-VCSwith contrast equal to 2. 29

The previous theorem gives a (�(G); 2n)-VCS with contrast 2. Using two copies ofthe VCS constructed in Theorem 7.6 we would get a (�(G); 4�(G))-VCS with contrast 2,where �(G) is the size of the minimum vertex cover of G. Therefore, for �(G) > n=2 the(n; 2)-decomposition provides a VCS with shorter shares.Example 8.3 To demonstrate the techniques presented in Theorems 4.4 and 8.1, considerthe access structure �(Cn), where Cn is a cycle on n vertices, and n � 5. From Theorem 7.6,there is a (�(Cn); 2dn=2e)-VCS with contrast one. Two copies of this scheme produce a(�(Cn); 4dn=2e)-VCS with contrast two.On the other hand, from Theorem 8.2 there exists a (�(Cn); 2n)-VCS with contrast two.Therefore, for odd values of n � 5, the decomposition construction produces a VCS withcontrast two with shorter length of shares. 49 VCS for Strong Access Structures on at Most Four Par-ticipantsIn this section we give upper and lower bounds on the minimum value m�(�Qual;�Forb) forall strong access structures on at most four participants. We consider only connected accessstructures without isolated participants. The bounds on m� are summarized in Table 1.The results are obtained as follows:� Access structures 1; 2; 3; 6; 7; 9, and 10 represent complete multipartite graphs and theoptimal value of m� is determined by Theorem 7.5.� The optimal value of m� for access structures 4 and 18 is determined by Lemma 3.1and Theorem 3.3.� Since access structure 8 is an induced subgraph of the graph G6, The upper boundm� � 3 can be obtained from Example 7.1 by applying Lemma 3.4.� For the all the remaining access structures the upper bounds onm� are obtained usingthe basis matrices given in Table 2. For all the above schemes, we have �(m) �m = 1.� The lower boundm� � 3 for the access structures 5 and 8 is determined by Lemma 5.12.� The lower bound m� � 4 for the access structures 11; 13, and 14 comes from Corol-lary 3.5.� The lower bound m� � 5 for the access structure 12 comes from Theorem 9.2 (seebelow).� The lower bound m� � 5 for the access structures 15; 16, and 17 comes from Theo-rem 9.1 (see below).Theorem 9.1 Let (�Qual;�Forb) be a strong access structure on participant set P = f1; 2; 3; 4gsuch that f1; 2; 4g; f1; 3; 4g 2 �0. If there exists a (�Qual;�Forb; 4)-VCS, then there is noX 2 �0 such that f2; 3g � X. 30

Proof. From Lemma 3.4 any (�Qual;�Forb; 4)-VCS contains (induced) a VCS for the strongaccess structures �0 and �00 having basis �00 = ff1; 2; 4gg and �000 = ff1; 3; 4gg, respectively.Therefore, from Theorem 5.13 any matrix M 2 C1 and any matrix M 0 2 C0 are equal, upto a column permutation, respectively, toM = 26664 1001010101010011 37775 M 0 = 26664 0110010101010011 37775 :If this is the case, then, for any M 2 C1 the matrix M [23] does not contain the columns� 10 � and � 01 �. Because of the unavoidable patterns, there is no X 2 �0 such thatf2; 3g � X . Thus, the theorem holds.access structure n basis subsets m�1 2 12 m� = 22 3 12; 23 m� = 23 3 12; 13; 23 m� = 34 3 123 m� = 45 4 12; 23; 34 m� = 36 4 12; 13; 14 m� = 27 4 12; 14; 23; 34 m� = 28 4 12; 23; 24; 34 m� = 39 4 12; 13; 14; 23;24 m� = 310 4 12; 13; 14; 23;24;34 m� = 411 4 123; 14 m� = 412 4 123; 14; 34 m� = 513 4 134; 122; 23;24 m� = 414 4 123; 124 m� = 415 4 124; 134; 23 m� = 516 4 123; 124; 134 5 � m� � 617 4 123; 124; 134;234 5 � m� � 618 4 1234 m� = 8Table 1: VCS for strong access structures on at most four participants.The next theorem proves that for the strong access structure 12, a VCS with m = 4does not exist.Theorem 9.2 Let (�Qual;�Forb) be the strong access structure on participant set P =f1; 2; 3; 4g having basis �0 = f123; 14; 34g. Then there is no (�Qual;�Forb; 4)-VCS.Proof. Suppose by contradiction that there exists a (�Qual;�Forb; 4)-VCS. From Lemma 3.4and Theorem 5.13 any matrix M 2 C1 and any matrix M 0 2 C0 are equal, up to a columnpermutation, respectively, toM = 26664 1 0 0 10 1 0 10 0 1 1? ? ? ? 37775 M 0 = 26664 0 1 1 00 1 0 10 0 1 10 ? ? ? 37775 ;31

where ? denotes the presence of either a one or a zero. Notice that for any matrix M 0 2 C0it holds that w(M 0124) = w(M 0234) = 3. Since the scheme is for the strong access structurehaving basis �0, for any matrix M 2 C1, we must have w(M124) = w(M234) = 4. Hence,any matrix M 2 C1 is equal, up to a column permutation toM = 26664 1 0 0 10 1 0 10 0 1 11 ? 1 ? 37775 :For any matrixM 2 C1 we have that w(M24) = 4. Since 24 2 �Forb is has to be w(M 024) = 4for at least one matrix M 0 2 C0. This is a contradiction since for any M 0 2 C0 it holds thatw(M 024) � 3. Therefore, the theorem holds.10 ConclusionIn this paper we have analyzed visual cryptography schemes. We have extended the Naorand Shamir's model to general access structures and we have proposed two techniquesto construct visual cryptography schemes for general access structures. We proved lowerbounds on the size of the shares distributed to the participants in the scheme. We provideda novel technique to realize k out of n threshold visual cryptography schemes. Our construc-tion for k out of n visual cryptography schemes is better with respect to pixel expansionthan the one proposed in [11] and for the case of 2 out of n is the best possible. Finally, weconsidered graph-based access structures giving both lower and upper bounds on the sizeof the shares.AcknowledgementsWe would like to express our gratitude to Ugo Vaccaro for illuminating discussions. Manythanks go to Carmine Di Marino who implemented some of the techniques presented in thispaper and provided us with the images depicted in the Appendix.References[1] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, Constructions and Bounds forVisual Cryptography, to appear in the proceedings of the \23rd International Colloquium onAutomata, Languages and Programming" (ICALP '96), Friedhelm Meyer auf der Heide Ed.,\Lecture Notes in Computer Science", Springer{Verlag, Berlin, 1996.[2] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, New Schemes for Visual Cryptog-raphy, preprint, 1996.[3] G. Ateniese, C. Blundo, A. De Santis, and D. R. Stinson, Extended Schemes for VisualCryptography, preprint, 1995.[4] M. Atici, S. S. Magliveras, D. R. Stinson, and W.-D. Wei, Some Recursive Constructions forPerfect Hash Families, to appear in Journal of Combinatorial Designs.[5] C. Blundo, A. De Santis, D. R. Stinson, and U. Vaccaro, Graph Decomposition and SecretSharing Schemes, Journal of Cryptology, Vol. 8, pp. 39-64, 1995.32

access structure S0 S1#5 2664 100110110010 3775 2664 100011110001 3775#11 2664 0011010101100011 3775 2664 0011010110011100 3775#12 2664 01100110001010000100 3775 2664 10001110001010000010 3775#13 2664 0011011101010110 3775 2664 0011111001011001 3775#14 2664 0011010101100110 3775 2664 0011010110011001 3775#15 2664 01100101001010011000 3775 2664 10001100101010011000 3775#16 2664 000111110101110011110110 3775 2664 111000110101110011110110 3775#17 2664 000111001011001101001110 3775 2664 111000110100110010110001 3775Table 2: Basis matrices for VCS for strong access structures on at most four participants.33

[6] E. F. Brickell and D. R. Stinson, Some Improved Bounds on the Information Rate of PerfectSecret Sharing Schemes, Journal of Cryptology, Vol. 5, pp. 153-166, 1992.[7] P. Erd�os, P. Frankl, and Z. F�uredi, Families of Finite Sets in Which no Set is Covered by theUnion of r Others, Israel Journal of Mathematics, Vol. 51, pp. 79{89, 1985.[8] M. L. Fredman and J. Koml�os, On the Size of Separating System and Families of Perfect HashFunctions, SIAM J. Alg. Disc. Meth., Vol 5, N. 1, March 1984.[9] J. H. van Lint and R. M. Wilson, A Course in Combinatorics, Cambridge University Press,1992.[10] K. Mehlhorn, On the Program Size of Perfect and Universal Hash Functions, in Proceedingsof 23rd Annual IEEE Symposium on Foundation of Computer Science, pp. 170{175, 1982.[11] M. Naor and A. Shamir, Visual Cryptography, in \Advances in Cryptology { Eurocrypt '94",A. De Santis Ed., Vol. 950 of Lecture Notes in Computer Science, Springer-Verlag, Berlin, pp.1{12, 1995.[12] P. Elias, Zero Error Capacity Under List Decoding, IEEE Trans. Inform. Theory, Vol. 34, N.5, pp. 1070{1074, 1988.[13] G. J. Simmons, W. Jackson, and K. Martin, The Geometry of Shared Secret Schemes, Bulletinof the ICA, Vol. 1, pp. 71{88, 1991.[14] D. R. Stinson, Decomposition Constructions for Secret Sharing Schemes, IEEE Trans. Inform.Theory, Vol. 40, N. 1, pp. 118{125, 1994.

34

AppendixExample of a Visual Cryptography SchemeIn this appendix an example of the secret image, the shares corresponding to singleparticipants, and few groups of participants are depicted. The family of quali�ed sets is�Qual = ff1; 2g; f2; 3g; f3; 4g; f1; 2; 3g; f1; 2; 4g; f1; 3; 4g; f2; 3; 4g; f1; 2; 3; 4gg:All remaining subsets of participants are forbidden.The visual cryptography scheme used for this example is described in Table 2 of Sec-tion 9. Secret ImageShare of participant 1 Share of participant 2Share of participant 3 Share of participant 4

35

Image of participants 1 and 2 Image of participants 2 and 3Image of participants 3 and 4 Image of participants 1 and 3

36