Ghost imaging is closely related to image encryption, since the random speckle patterns are often utilized. In the two-dimensional (2D) case, computational ghost imaging can be realized through $ \boldsymbol{L}\boldsymbol{X}{\boldsymbol{R}}^{\mathrm{T}}=\boldsymbol{Y} $, where $ \boldsymbol{X} $ is a 2D object, $ \boldsymbol{Y} $ is the bucket detection signals reshaped into a 2D form, and $ \boldsymbol{L} $ and $ \boldsymbol{R} $ are two random matrices. In this work, a scenario of flexible image encryption in ghost imaging in the 2D case is proposed. The image is encrypted into the bucket detection signals by arbitrarily arranging the two random matrices ($ \boldsymbol{L} $ and $ \boldsymbol{R} $) and other two permutation matrices ($ {\boldsymbol{P}}_{1} $ and $ {\boldsymbol{P}}_{2} $). The permutation matrices are used to disrupt the distribution of the bucket signals. Considering that the specific size of the image may not be square but rectangle, eight ways of image encryption are investigated in this work. Four of them use only one permutation matrix ($ {\boldsymbol{P}}_{1} $ or $ {\boldsymbol{P}}_{2} $), and they are $ {\boldsymbol{P}}_{1}\boldsymbol{L}\boldsymbol{X}{\boldsymbol{R}}^{\mathrm{T}}={\boldsymbol{Y}}_{1} $, $ \boldsymbol{L}{\boldsymbol{P}}_{1}\boldsymbol{X}{\boldsymbol{R}}^{\mathrm{T}}={\boldsymbol{Y}}_{2} $, $ \boldsymbol{L}\boldsymbol{X}{\boldsymbol{P}}_{2}{\boldsymbol{R}}^{\mathrm{T}}={\boldsymbol{Y}}_{3} $, $ \boldsymbol{L}\boldsymbol{X}{\boldsymbol{R}}^{\mathrm{T}}{\boldsymbol{P}}_{2}={\boldsymbol{Y}}_{4} $. The other four use two permutation matrices ($ {\boldsymbol{P}}_{1} $ and $ {\boldsymbol{P}}_{2} $), and they are $ {\boldsymbol{P}}_{1}\boldsymbol{L}\boldsymbol{X}{\boldsymbol{P}}_{2}{\boldsymbol{R}}^{\mathrm{T}}={\boldsymbol{Y}}_{5} $, $ {\boldsymbol{P}}_{1}\boldsymbol{L}\boldsymbol{X}{\boldsymbol{R}}^{\mathrm{T}}{\boldsymbol{P}}_{2}={\boldsymbol{Y}}_{6} $, $ \boldsymbol{L}{\boldsymbol{P}}_{1}\boldsymbol{X}{\boldsymbol{P}}_{2}{\boldsymbol{R}}^{\mathrm{T}} $$ ={\boldsymbol{Y}}_{7} $, and $ \boldsymbol{L}{\boldsymbol{P}}_{1}\boldsymbol{X}{\boldsymbol{R}}^{\mathrm{T}}{\boldsymbol{P}}_{2}={\boldsymbol{Y}}_{8} $.Specifically, in experiment, the measurement matrix is generated by the Kronecker product of the random matrices and permutation matrices. According to the 8 ways of image encryption, the 8 measurement matrices are $ {\boldsymbol{A}}_{1}=\left({\boldsymbol{P}}_{1}\boldsymbol{L}\right)\otimes \boldsymbol{R}, $ $ {\boldsymbol{A}}_{2}=\left(\boldsymbol{L}{\boldsymbol{P}}_{1}\right)\otimes \boldsymbol{R}, $ $ {\boldsymbol{A}}_{3}=\boldsymbol{L}\otimes \left(\boldsymbol{R}{\boldsymbol{P}}_{2}^{\mathrm{T}}\right) $, $ {\boldsymbol{A}}_{4}=\boldsymbol{L}\otimes \left({\boldsymbol{P}}_{2}^{\mathrm{T}}\boldsymbol{R}\right) $, $ {\boldsymbol{A}}_{5}=\left({\boldsymbol{P}}_{1}\boldsymbol{L}\right)\otimes \left(\boldsymbol{R}{\boldsymbol{P}}_{2}^{\mathrm{T}}\right) $, $ {\boldsymbol{A}}_{6}=\left({\boldsymbol{P}}_{1}\boldsymbol{L}\right)\otimes $$ \left({\boldsymbol{P}}_{2}^{\mathrm{T}}\boldsymbol{R}\right) $, $ {\boldsymbol{A}}_{7}=\left(\boldsymbol{L}{\boldsymbol{P}}_{1}\right)\otimes \left(\boldsymbol{R}{\boldsymbol{P}}_{2}^{\mathrm{T}}\right) $, and $ {\boldsymbol{A}}_{8}=\left(\boldsymbol{L}{\boldsymbol{P}}_{1}\right)\otimes \left({\boldsymbol{P}}_{2}^{\mathrm{T}}\boldsymbol{R}\right) $. These measurement matrices are used to form the random speckle patterns which are then projected onto the object. A spatial light modulator (SLM) is employed to load the objects and random speckle patterns. A charge coupled device (CCD) is used to obtain the bucket detection signals.As truncated singular value decomposition (TSVD) is an effective denoising method, it is used to obtain the pseudoinverse matrices of the random matrices used in the decryption process. Only when the pseudoinverse matrices of the random matrices, as well as the correct sequences of the random and permutation matrices, are known in each way, can the image be successfully decrypted. Otherwise, image decryption will not be successful. The structural similarity (SSIM), peak signal-to-noise ratio (PSNR), and correlation coefficient (CC) are used to evaluate the quality of the decrypted images. The SSIMs of object and the 2D bucket detection signals are very low, indicating the successfully encryption. The PSNRs and CCs of the successfully decrypted images are better than those of unsuccessful images. The successfully decrypted images clearly reconstruct the image of the object, while the unsuccessful images are in a mess.Our method provides a new idea of image encryption in ghost imaging, and image encryption is therefore enhanced and made flexible. Moreover, the present protocol can be combined with other image encryption techniques to form a more flexible protocol, which also has some application prospects in other image processing such as watermarking and image hiding.