{'fraction_non_alphanumeric': 0.044395946067147, 'fraction_numerical': 0.018744955006128734, 'mean_word_length': 4.252001884126236, 'pattern_counts': {'":': 0, '<': 1, '<?xml version=': 0, '>': 0, 'https://': 0, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 1, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
A New Chaotic Image Encryption Algorithm Based on Transversals in a Latin Square

In this paper, a new combinatorial structure is introduced for image encryption, which has an excellent encryption effect on security and efficiency. An n-transversal in a Latin square has the function of classifying all the matrix’s positions, and it can provide a pair of orthogonal Latin squares. Employing an n-transversal of a Latin square, we can permutate all the pixels of an image group by group for the first time, then use two Latin squares for auxiliary diffusion based on a chaotic sequence, and finally, make use of a pair of orthogonal Latin squares to perform the second scrambling. The whole encryption process is “scrambling–diffusion–scrambling”. The experimental results indicated that this algorithm passed various tests and achieved a secure and fast encryption effect, which outperformed many of the latest papers. The final information entropy was very close to 8, and the correlation coefficient was approximately 0. All these tests verified the robustness and practicability of the proposed algorithm.


Introduction
In recent years, network communication has developed very rapidly, and a large amount of public or private image information is transferred via the public Internet. How to transmit a great deal of image information safely and efficiently has become an increasingly important issue. Image encryption is the main solution. Digital image encryption is a new and relatively independent branch of computer cryptography and a research hot spot in the field of information security. Unlike ordinary text information, a digital image has a massive amount of data, a strong correlation between pixels, and other particularities, which make the traditional methods DES, IDEA, and RSA inappropriate. Therefore, various image encryption algorithms have been put forward in the last few years.
Chaos-based encryption algorithms play an important role in existing image encryption algorithms [1][2][3]. Some qualities of a chaotic system such as sensitivity to initial values, parameter sensitivity, ergodicity, etc., make it particularly appropriate to perform image encryption. However, there are some disadvantages in chaotic systems, such as being defined on a set of real numbers, accompanied by short-period phenomena, local linearity, and uneven distribution, and requiring discretization when used [4]; therefore, they are vulnerable to chosen plaintext attacks or known plaintext attacks. Accordingly, more and more high-dimensional chaotic systems [5][6][7] have been applied, along with increasing complexity and unpredictability. The higher the dimension of the chaotic system, the more computation is required. Hence, many new different techniques have been used in image encryption algorithms, including one-time keys [8], DNA coding [9][10][11], genetic manipulation [12][13][14], compressive sensing [15,16], semi-tensor product theory [17,18], finite-precision error [19], natural interval extensions [20], fractal sorting matrices [21], and so on.
Recently, many combinatorial design structures have been applied in cryptography, such as Latin squares [5,[22][23][24][25], Latin cubes [6,[26][27][28], the Hadamard matrix [29], etc. In particular, the Latin square is the most used. A Latin square defined on a finite integer set S is a square matrix, having uniformity for the same number of occurrences of each element in S, and the total number of Latin squares is also very large. These characteristics of Latin squares are very suitable for image encryption, so some algorithms according to Latin squares have been put forward. As early as 1949, Shannon pointed out that a perfect password can be expressed by a Latin square in his classic paper [30]. Wu et al. proposed an image encryption scheme by using Latin squares [22]. In this paper, a Latin square was used to generate a one-dimensional mapping for the scrambling process. However, the scrambling efficiency of this algorithm is low and it is vulnerable to attacks. Other algorithms that use Latin squares have the same problem [5]. Then, some algorithms using a pair of orthogonal Latin squares appeared [23][24][25], which can directly generate a two-dimensional mapping, instantly increasing the scrambling efficiency. In addition, these Latin squares can provide pseudo-random sequences for the diffusion process. For example, Xu et al. generated a self-orthogonal Latin square (SOLS) and proposed a new algorithm for image encryption [24]. The SOLS and its transpose form a pair of orthogonal Latin squares, and the SOLS can provide a pseudo-random sequence for the diffusion process. The experimental results showed that this algorithm is safe and highly efficient. The entropy value of the encrypted Lena image reached 7.997, and the correlation coefficient was small. The Latin cube is a kind of complex structure in combinatorial design, and the Latin cube contains several Latin squares. It is more widely used in color image encryption algorithms or grayscale images represented by a bit matrix. Xu et al. put forward a new image encryption scheme by using a 3D bit matrix and orthogonal Latin cubes [26]. Each original image was decomposed into a three-dimensional bit matrix, and a pair of orthogonal Latin cubes was used, not only for confusion, but also for diffusion, which proved that the algorithm is highly safe and efficient. The same as the algorithm in [27], the orthogonality of the 3D Latin cube was fully utilized. In 2021, Hua et al. designed a new CIEA using orthogonal Latin squares and 2D-LSM for color image encryption and realized point-to-point permutation and the random distribution of the pixels in a plain image [6]. The algorithm in [28] also makes full use of the orthogonality of a group of Latin cubes, and the images were transformed into one or several cubes.
As can be seen from the above discussion, the Latin cube is suitable for more complex situations. For grayscale images, the orthogonality and uniformity of Latin squares have better performance. Therefore, in this paper, we propose a novel chaos-based image encryption algorithm according to transversals in a Latin square. For a Latin square of order n, there exist plenty of n-transversals. Employing an n-transversal, we can divide all n 2 positions into n mutually disjoint groups, then permutate the pixels of the image group by group in the first round of substitution. We can also define two new Latin squares according to the n-transversal, which can be used for auxiliary diffusion on the basis of a chaotic sequence. Finally, a pair of orthogonal Latin squares is reused for the second scrambling. The whole structure is "scrambling-diffusion-scrambling". The simulation results showed that the proposed method outperformed many of the latest papers in terms of some statistical safety indicators. The main contributions of this article are presented as follows: • An n-transversal in a Latin square is used for image encryption. This combinatorial structure has two functions: classify all the positions of a square and generate two new orthogonal Latin squares. • We permutated the pixels of the image group by group in the first round of substitution according to an n-transversal. Two suitable Latin squares were used for auxiliary diffusion, and another pair of orthogonal Latin squares was also used for the second scrambling. • The experimental results indicated that this algorithm can make full use of the new combinatorial structure. It passed various tests and had a high security level and a fast speed. The comparison results indicated that it outperformed many of the latest papers.
In the rest of this article, some primary definitions and conclusions are introduced in Section 2. Section 3 is mainly introduces the detailed procedure of encryption and decryption. In Section 4, the experimental results and analysis are given. At the end, we summarize this article.

Latin Squares and Transversals
A Latin square of order n (defined on an n-set S) is an n × n array in which each cell contains a single symbol, such that each symbol occurs exactly once in each row and column. For consistency, we set S = {0, 1, . . . , n − 1}.
Two Latin squares of order n A = (a ij ) and B = (b ij ) are orthogonal if every ordered pair (a ij , b ij ) in S × S occurs exactly once. Figure 1 lists a pair of orthogonal Latin squares of order 4 A = (a ij ) and B = (b ij ). Denote C = (c ij ) as the juxtaposition array, where c ij = (a ij , b ij ). Each ordered pair in S × S occurs exactly once. Notation: Using a pair of orthogonal Latin squares A = (a ij ) and B = (b ij ) can directly generate a two-dimensional map φ : (i, j) → (a ij , b ij ), i, j = 0, 1, ..., n − 1.
Suppose M is a Latin square defined on S. A transversal in M is a set of n positions, with no two in the same row or column, including each of the n symbols exactly once. Two transversals are disjoint if there are no same positions in them. Any k disjoint transversal is called a k-transversal. If k = n, there exists an n-transversal in M.
In Figure 1, C is the juxtaposition array of A and B. Treat each column of C as a position element set of A. There are four positions in the first column; all row numbers and column numbers are different; the four elements at the four positions of A are 0, 3, 1, 2 respectively, so the first column of C is a transversal of A. The other columns of C are similar. All the positions of A are divided into four pairwise disjoint groups, so there is a four-transversal in A.
For an additive group G, a bijection θ of G is called a complete mapping if the mapping σ : Theorem 1 ([32]). The Cayley table M of the additive group G = {g 0 , g 1 , ..., g n−1 } is a Latin square with the (i, j)th entry g i + g j . For a bijection θ : G − → G, M θ is the Latin square with the (i, j)th entry g i + θ(g j ), and the cells {(g i , θ(g i ))|i = 0, 1, ..., n − 1} form a transversal of M if and only if θ is a complete mapping of G. Theorem 2. Let F = {g 0 , g 1 , ..., g n−1 } be a finite field with character p. M is the Cayley table of F. Let a ∈ F, a = 0, 1, and a ≡ −1 (mod p). Define a mapping γ j : x − → ax + g j (j = 0, 1, ..., n − 1). Then, the following conclusions hold: (1) These γ j s (j = 0, 1, ..., n − 1) are n different complete mappings over F under addition.
(2) Define an n × n array M γ with the (i, j)th entry γ j (g i ) = ag i + g j . Then, M γ is a Latin square on F.
(3) Define D = (d ij ) with d ij = (g i , γ j (g i )). All columns of D form n disjoint transversals of M (named D as the truncated decomposition array). Define the array M 1 with the (i, j)th entry g i + γ j (g i ). Then, M, M 1 , M γ are pairwise orthogonal Latin squares.
Appendix A shows the proof of Theorem 2. According to this theorem, there are n disjoint transversals in M, where the ith column index in the jth transversal is the (i, j)th element of M γ . Example 1. Let F be a finite field of order four. Suppose the primitive polynomial is Firstly, define the Cayley table M on the field F under addition with the (i, j)th entry g i + g j : Let a = ω. Construct another Latin square M γ with the (i, j)th entry γ j (g i ) = ag i + g j : Construct the truncated decomposition array D with the (i, j)th entry g i , γ j (g i ) : The four positions of each column of D form a transversal of M, and the set of all columns is a four-transversal of M.
Finally, define the array M 1 with the (i, j)th entry g i + γ j (g i ) = (1 + a)g i + g j : According to Theorem 2, M, M 1 , M γ are pairwise orthogonal Latin squares.

Logistic Map
In this article, we adopted the classical logistic map to generate two new sequences. One of them was used to generate a finite field, and the other was used to perform diffusion. We describe the logistic map as follows.

The Proposed Image Encryption Algorithm
For simplicity, some of the symbols are described as follows. n stands for a prime power. Q is used to represent an n × n original plaintext image. K is the encryption key. Cipher denotes the corresponding ciphertext. This algorithm is divided into two parts: Algorithm 1 generates three Latin squares and an n-transversal by the use of K and the features of Q; Algorithm 2 is mainly used for encryption, including three layers: scrambling, diffusion, and scrambling, then the encrypted image Cipher is formed. The encryption diagram is listed in Figure 2.

The Generation of Latin Squares M, M 1 , M γ and an n-Transversal
We used Algorithm 1 to construct three Latin squares and an n-transversal, all of which were directly generated on a finite field, using addition and multiplication in the finite field.
where floor is the downward integer function. Compute key 0_new = (key 0 + s)/2, key 1_new = (key 1 + s)/2. It is very essential because sumQ reflects the characteristics of the plaintext image. When the plaintext image changes a little, the chaotic sequence will change greatly because of the changed key. In other words, only one round of encryption is needed to achieve a high sensitivity to the plaintext image.
Step 2: Generate a logistic sequence of length n x1 = {x i | i = 0, 1, 2, ..., n − 1} with system parameter µ 0 and initial value x 0 = key 0_new . Sort x1 as follows: where sort is the function that sorts a sequence in ascending order. f x is the new sequence reordered by x1, and lx is the index position.
Step 3: Redefine the operations of addition and multiplication in lx, then generate a finite field F n with character p. Denote F n = {g 0 , g 1 , ..., g n−1 }. Select a ∈ F n , a = 0, 1, and a ≡ −1(mod p), and generate three Latin squares M, M 1 , M γ with the (i, j)th entry g i + g j , (1 + a)g i + g j , and ag i + g j , respectively. According to Theorem 2, M, M 1 , M γ are pairwise orthogonal.
Step 4: Generate the truncated decomposition array D with the (i, j)th entry (g i , ag i + g j ). Then, the column set of D is an n-transversal of M.

Image Encryption
We used Algorithm 2 to complete the rest of the encryption process. First of all, with the help of the truncated decomposition array D, we can permutate the image pixels of Q group by group. Secondly, we used two Latin squares M and M 1 for auxiliary diffusion based on another chaotic sequence x2. Finally, a pair of orthogonal Latin squares M 1 and M γ was used for the second scrambling. The following is the detailed procedure of Algorithm 2.

Algorithm 2:
The proposed encryption algorithm.
Step 1: Make use of Algorithm 1, Q, K, and a to generate M, M 1 , M γ , and D.
Step 2: Scramble Q for the first time. At first, convert D into a natural column index array D θ by bijection θ : g i → i. Starting from the first transversal, the first pixel of Q at D θ (0, 0) is placed at the position D θ (1, 0), the second pixel at the position D θ (2, 0) is placed at the position D θ (3, 0), and so on, until the last pixel at the position D θ (n − 1, 0) is placed at the position D θ (0, 0). After scrambling n times based on n transversals, we can obtain a temporary image P_1. The specific process is shown below.
(4) Figure 3 shows a fourth-order example to illustrate the scrambling process in this step. In Figure 3a, a Latin square M (generated on the field of Example 1) is converted into digital form. Select an element a = 2, then generate M γ with the (i, j)th entry (1 + a)g i + g j , resulting in a four-transversal D, distinguished by four different colors. All 16 positions of a fourth-order matrix are divided into four pairwise disjoint groups. Because g i = i, D θ = D, we can scramble Q according to D. In Figure 3b, starting from the first transversal, the first pixel 1 at (0,0) is placed at (1,2), the second pixel 7 at (1,2) is placed at (2,3), the third pixel 12 at (2,3) is placed at (3,1), and finally, the fourth pixel 14 at (3,1) is placed at (0,0), as is the scrambling of the other transversals. Because D is a four-transversal, the first scrambling can be completed after four times.
Step 3: Firstly, convert P_1 into a row vector P_2, then generate another new chaotic sequence of length n 2 + 100 with system parameter µ 0 and initial value key 1_new . To eliminate the effect of the initial value, delete the first 100 digits and the rest form a new chaotic sequence x2. M and M 1 are transposed into row vectors L M and L M1 , which are used as two pseudo-random sequences for auxiliary diffusion to form a new row vector {P_3(i)} n 2 −1 i=0 . The detailed diffusion formula is as follows.
where the initial value P_3(−1) = 0, b is a temporary variable, and mod is the module integer function.
Step 4: Transpose P_3 to an array P_4. By using the orthogonality of M 1 and M γ , we conducted the second scrambling according to (6), and the final ciphertext image Cipher was obtained.

Image Decryption
When we performed image decryption, followed the reverse procedure, and we needed to know the value sumQ in advance. The following Figure 4 is the decryption diagram.

Simulation Results and Security Analysis
We conducted simulation experiments and list all the results in this section. In order to reflect the superiority of this algorithm, we compared it with some representative algorithms [2,5,24,25,[33][34][35][36].
In our experiments, a total of six different 256 × 256 images were selected for testing, which were chosen from the USC-SIPI2 and CVG-UGR3 image sets. Every experiment required only one round of encryption, and the secret key K was: µ 0 = 3.99999, key 0 = 0.123456, key 1 = 0.234567. There were three public parameters a = ω (ω is a primitive root of F n ), The algorithm was tested from the following aspects: key space and sensitivity analysis, histogram test, correlation test, information entropy test, differential attack resistance test, robustness test, computational complexity, time efficiency analysis, and resistance to classical types of attacks.

Key Space Analysis
There are three real numbers in K = (µ 0 , key 0 , key 1 ), and the computational accuracy of each value is 10 −15 , so this algorithm can achieve a key space of 10 45 ≈ 2 149 , greater than 2 128 [37,38]. There are also three public parameters to select, so the algorithm has a large enough key space. In summary, it can resist brute-force attacks.

Key Sensitivity Analysis
An excellent image encryption algorithm desires strong sensitivity to the key, so sensitivity analysis is often considered a crucial indicator of resistance to brute-force attacks. It is usually evaluated from two aspects: sensitivity during encryption and sensitivity during decryption.
(1) Key sensitivity analysis during encryption: Take the Lena image for example. Firstly, set K = (3.99999, 0.123456, 0.234567), then modify each value slightly by adding 10 −15 after the decimal point. We used two sets of secret keys to encrypt Lena, Cipher1 being the image encrypted with the original key K and Cipher2 being the image encrypted with the modified key. Figure 5 shows the comparison of the results of the two ciphertext images. The percentages of different pixels were computed as shown in Table 1, which were all greater than 99.59%, fully indicating that the algorithm is extremely sensitive to the key during encryption.     (2) Key sensitivity analysis during decryption: Similarly, Lena was also used to perform key sensitivity analysis during decryption. Given the encrypted image Cipher, make a tiny change to the value 10 −15 in each value of K = (3.99999, 0.123456, 0.234567), then use the two sets of secret keys to decrypt Cipher. From Figure 6, we can find that the original image can only be obtained with the original key, while, when using the modified key, we cannot decrypt correctly. In addition, Table 2 records the percentages of different pixels of two deciphered images, all greater than 99.5%. From these results, we can discover that even though the key changes a little, we will fail to obtain the original image. Therefore this algorithm is key-sensitive during decryption.

Statistical Analysis
A good algorithm for image encryption should be capable of resisting any statistical attacks. The main statistical indicators include histogram analysis, the correlation coefficients of adjacent pixels (usually considering three directions), and information entropy analysis.

Histogram Analysis
In an image, the histogram is a representation of the frequency of each gray-level pixel. A well-encrypted image has as uniform a histogram distribution as possible. In general, it can be measured by variance S, and the formula is as follows: where hist i denotes the frequency of the ith gray-level pixel, and aver = 1 represents the variance of the histogram. Set the significance level as α = 0.05; if S < 293.25, the histogram can be regarded as a uniform distribution [39]. The smaller the value of S is, the better. Figure 7 shows the histogram distribution of six images before and after encryption. All the histograms of the ciphertext images tend to be evenly distributed. Table 3 shows the histogram values of the six images before and after encryption. All the values of S were smaller than 293.25, satisfying the requirements. All encrypted images passed the histogram analysis; especially, the encrypted Lena image's variance was as low as 195.766. The above results indicate that this algorithm can effectively resist histogram analysis.

Correlation Test
In a plaintext image, there exist strong correlations among adjacent pixels. To resist statistical analysis, the correlation in ciphertext images should be as small as possible [40]. We randomly selected 4000 pairs of neighboring pixels, including three directions (horizontal, vertical, and diagonal) to measure the correlations. The required calculation formula is listed in (8): where where u and v represent the grayscale values of two neighboring pixels in the image.
To visualize the distribution of the pixels before and after encryption, Figure 8 displays the correlation distributions of six different images in three directions. Observing the original image, we can note that the neighboring dots are mainly distributed around the diagonal, whereas, in an encrypted image, the dots are evenly distributed throughout the whole plane. That is, the plaintext images are highly correlated in any direction, but after encryption, the correlations were very low. Using the calculation formula in [24], we computed the correlation coefficients of six images before and after encryption and present the results in Table 3. We can see that, before encryption, the correlation coefficients were very large, the largest number being approximately 1. However, after encryption, all numerical results were very small, approximately 0. For comparison with other algorithms, Table 4 lists the comparison results in the case of Lena. Although the average correlation coefficient was inferior to [2,33,36], it was better than the other five References. The accuracy of the decimal point was 10 −3 , which implies that this algorithm passed the correlation test and achieved a good confusion effect.

Information Entropy Analysis
An important measure of testing randomness is information entropy, usually denoted as H, which can be measured according to (10): where m i is the gray value, and there are l kinds of gray values in an image. p(m i ) represents the probability of m i , and ∑ l−1 i=0 p(m i ) = 1. Generally, an image has 256 gray values. Only when the frequency of each gray level is the same, information entropy H reaches the theoretical ideal value of 8 [41].
We used (10) to calculate the entropy values of six images before and after encryption, then list the results in Table 3. From the table, we can see that all values were very close to 8, which shows a good encryption effect. Especially, the information entropy of Lena reached 7.99784, and the strong uncertainty of this algorithm was achieved. Table 4 lists Lena's entropy values in different algorithms. Our result was closest to 8, which was superior to the other contrast algorithms. Therefore, the ciphertext images have strong uncertainty, and our algorithm can resist entropy attacks.

Differential Attack Analysis
A good algorithm can resist differential analysis, requiring different plaintext images (even if with only one different pixel) corresponding to significantly different ciphertext images. In general, there are two commonly used criteria for testing resistance to differential attacks, NPCR and UACI. Let C 1 = (C 1 i,j ) and C 2 = (C 2 i,j ) denote two ciphertext images of size M × N, where their plaintext image has only one different pixel. Define the binary sequence of the images C 1 and C 2 : Then, define NPCR as (12), which means the percentage of different pixels between two ciphertext images.
Furthermore, define UACI as (13), which means the average of the absolute difference between two ciphertext images. Table 5 shows the encrypted Lena image's NPCR and UACI at four specific positions, from which we can discover that the values are different at different positions. That is to say, these two indicators have randomness. For unity, let us reduce the first pixel at position (0,0) by 1 and calculate the values of the NPCR and UACI of the six images based on (12) and (13). The numerical results are listed in Table 6. With a significance coefficient of 0.05, the ideal NPCR is 99.5693%, and the UACI is 33.2824% for images of size 256 × 256 [42]. Most results in Table 6 were all higher than the expected values, which proved that the algorithm in this article effectively passed the differential attack capability test. For the comparison with other algorithms in the case of Lena, the reader can refer to Table 4. The values of NPCR and UACI were all higher than the contrast algorithms. This means our results were better, indicating our algorithm's superiority.

Robustness Test
In the process of transmitting ciphertext images over the network, the data may be lost or attacked by noise, which requires the ciphertext image to have good anti-cutting and anti-noise attack performance. In other words, a good algorithm for image encryption should have robustness [43]. In addition, we can use the PSNR to evaluate the quality of the decrypted image and the original image. The higher the value is, the more similar the two images, and the formula (14) is as follows: Taking Lena as an example, from the encrypted Lena image, we, respectively, cut off 1/16, 1/8, 1/4, and 1/2 of the data at the top left corner, then decrypted the cut ciphertext images with the correct key. Figure 9 displays the results, which clearly show that, even after its data are cut in half, the body of the image is still visible. The corresponding PSNRs of Figure 9 and other images are shown in Table 7. It is obvious that all PSNR values were larger than 8, which means that this algorithm has a good cutting resistance.
Still taking Lena as an example, we, respectively, used salt and pepper noise with a density of 0.05 and 0.1 and Gaussian noise with a variance 0.01 and 0.1 to attack. As shown in Figure 10, the image is still visible, and the corresponding PSNRs of Figure 10 and other images are listed in Table 7. All PSNR values were larger than 9, indicating a good performance to resist noise attacks.

Computational Complexity and Time Efficiency
Any effective image encryption algorithm requires low computational complexity. In Algorithm 1, one chaotic sequence is generated with computational complexity O(n), and three Latin squares are constructed with computational complexity O(3n 2 ). In Algorithm 2, there is a three-layer encryption structure, the first scrambling, diffusion, and the second scrambling. The computational complexity is O(n 3 ), so the computational complexity of this algorithm is O(n 3 ).
The fast encryption speed of the proposed algorithm can meet the requirements of instant encryption. The experimental environment was MATLAB R2019b, Microsoft Windows 10 with Intel core i5-1135G7, 2.40 GHz processor, and 16 GB RAM. Table 8 shows the encryption and decryption time of the six images, which is the mean value of 20 calculations. We can find that all encryption times were approximately equal to 0.31 s, and the decryption times were approximately equal to 0.27 s. The comparison results of Lena and other algorithms are listed in the Table 4. It can be seen that our algorithm had a relatively faster encryption speed than the other algorithms. There are four classical types of attacks: ciphertext only, known plaintext, chosen plaintext, chosen ciphertext. Among them, the chosen plaintext attack is the most powerful attack. If an algorithm can resist this attack, it can resist others [27].
The proposed algorithm only needs one round of encryption to achieve a safe effect. It depends on the plaintext image and is very sensitive to the initial parameters µ 0 and initial values key 0 , key 1 . If the plaintext image or one key has changed, M, M 1 , M γ , and D would be totally different. Furthermore, in the diffusion stage, the encrypted value is not only related to the plaintext value and former ciphered value, but also related to the second chaotic sequence. Therefore, the proposed algorithm can resist the chosen plaintext/ciphertext attack, as well as other types of attacks. In addition, hackers often use all-black or all-white images to attack the encryption algorithm. We also performed experiments on these images. The performances are shown in Table 9 and Figure 11.  From Figure 11, the encrypted images became meaningless, and the histograms were uniformly distributed. In addition, from Table 9, we can see that the correlation coefficients were approximately equal to 0.02, the NPCR and UACI were close to the ideal values, and the information entropy was equal to 7.9969. In [15], the information entropy of encrypted all-black and all-white images was 7.9943 and 7.9941, respectively. Therefore, our algorithm performed better. Therefore, the proposed algorithm has the ability to resist the known plaintext attacks and chosen plaintext attacks.

Conclusions
In this article, a new combinatorial structure was introduced to perform image encryption. An n-transversal in a Latin square can not only group all the positions, but also provide a pair of orthogonal Latin squares. The good performance of the n-transversal is fully utilized throughout the encryption process. At first, we realized the first substitution group by group according to the n-transversal, then we selected two suitable and uniform Latin squares to perform auxiliary diffusion based on a chaotic sequence, achieving good diffusion results. In the end, a pair of orthogonal of Latin squares was made full use of by performing the second scrambling. Three layers of encryption structure were formed. The proposed algorithm successfully encrypted all test images and passed the key sensitivity test, statistical test, plaintext sensitivity test, robustness test, etc. Moreover, the entropy of each encrypted image was very close to 8, and the correlation coefficient was very small, close to 0. From the above analysis, the proposed algorithm had an excellent encryption effect on security and efficiency, outperformed many of the latest papers in terms of some statistical safety indicators, and simultaneously showed robustness and practicability.
This work established the link between the theory of combinatorial designs and image encryption. In the future, we will introduce more combinatorial structures into the image encryption algorithms.

Acknowledgments:
The authors would like to thank the Editor and the anonymous reviewers for their valuable comments and suggestions to improve the quality of this paper, and the authors are grateful to Jianguo Lei for some helpful discussions on the subject.

Conflicts of Interest:
The authors declare no conflict of interest.

Appendix A. Proof of Theorem 2
(1) Let F = {g 0 , g 1 , ..., g n−1 } be a finite field with character p. Cayley table M is a Latin square. The (i, j)th entry is g i + g j . By the definition of γ j , it is easy to see that these γ j s (j = 0, 1, ..., n − 1) are n different bijections.
Obviously, σ j is bijective, then γ j is a complete mapping of F under addition. By the definition of γ j , these γ j s are n different complete mappings of F.
(2) By the definition of M γ , it is easy to see that each element of F occurs exactly once in each row and column of M γ . Therefore M γ is a Latin square as well.
(3) According to Theorem 1 and the definition of D, all columns of D form n disjoint transversals of M.
Firstly, let us prove that M 1 is orthogonal to M. By the definition of M 1 , the (i, j)th entry is g i + γ j (g i ). That is, g i + γ j (g i ) = g i + (ag i + g j ) = (1 + a)g i + g j . (A2) Because a = 0, 1 and a ≡ −1(mod p), M 1 is still a Latin square different from M, M γ . Assuming M 1 is not orthogonal to M, there must exist two positions (i, j), (i , j ), where (i, j) = (i , j ), such that (g i + g j , (1 + a)g i + g j ) = (g i + g j , (1 + a)g i + g j ), namely g i + g j = g i + g j (1 + a)g i + g j = (1 + a)g i + g j (A3) Then, either (i, j) = (i , j ) or a ≡ −1(mod p). Whichever the case, it is a contradiction with the definition of a or the assumption. Therefore, M 1 is orthogonal to M.
Similarly, we can prove M 1 and M γ and M and M γ are pairwise orthogonal Latin squares. Theorem 2 is proven.