Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am a beginner in cryptography. I designed an password based encryption-decryption algorithm, which uses a random salt and a password to encrypt a message. I'm using SHA-512 for hashing, matrix operations for shuffling, bitwise XOR for mixing data and retrieving. The length of the salt and the ciphertext is 256 letters.

To my knowledge, the avalanche effect means that a slight change in any of the following:

  • cipher
  • password
  • salt

must change the output drastically.

In my implementation, if I change the salt or the cipher, I don't see any big changes in my output. However when there is a slight change in password, the output changes drastically.

So, my questions:

  • Is my understanding of the avalanche effect generally correct? If not, what should it be?
  • What can I do to best produce the avalanche effect in my (or any) cipher? should I reduce the salt length less and generate a smaller ciphertext to create an avalanche effect? If not, then how can I achieve this?
share|improve this question

migrated from Nov 30 '11 at 13:20

This question came from our site for professional and enthusiast programmers.

Out of curiosity, what are you using the hash for? – bdares Nov 28 '11 at 4:17
Welcome to Cryptography Stack Exchange. @Avinash, your question was migrated here because it is more on-topic here than on Stack Overflow. Please register your account here to be able to comment and accept an answer. – Paŭlo Ebermann Nov 30 '11 at 13:27
If you want any constructive answers, you should show how your cipher currently works (in mathematical formulas, preferable). Then we can have a look to see how to improve it. – Paŭlo Ebermann Nov 30 '11 at 13:35
I've removed comments along the lines of "don't design your own cipher" - here on crypto it's perfectly acceptable to try, although you should understand it is all at your own risk of course :) I've also edited the question a little to focus more on the avalanche effect in the absence of the relevant cipher constructions. If anyone feels that is unnecessary, feel free to roll back and or improve on what I've done. – user46 Nov 30 '11 at 13:51
up vote 5 down vote accepted

Don't bother with changing the actual cipher algorithm. Read about Kerckhoffs's principle: you should only change things like the key and the IV, not the actual algorithm.

In order to test your avalanche, flip one bit in your key. That should change about half the bits in your output.

For cipher design, Applied Cryptography has already been suggested. As well as that you need to look at introducing Diffusion and Confusion into your algorithm. Also it is well worth while studying existing algorithms to see how they go about things. I started by designing my own simple Feistel cipher, that way a lot of the surrounding structure is already done for you. It also simplifies the design, in that the F function does not have to be invertible. That allows you a lot more flexibility in that area.

The warning about not using your own design for anything other than a learning exercise is a good one.

share|improve this answer
Thanx a lot.... – Avinash Nov 28 '11 at 14:28
Cypher/cipher is a UK/US thing. – rossum Dec 5 '11 at 12:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.