I understand the concepts of confusion (substitution) and diffusion (permutation).
My understanding of what a mode is that it's an algorithm that lets us encrypt arbitrary message size. i.e. AES is a mode of operation, and confusion/diffusion are what we use to achieve a certain mode.
But that doesn't sound right.
AES is a mode of operation, and confusion/diffusion are what we use to achieve a certain mode.
AES is a block cipher, which replaces one fixed-length block of bits (plaintext) with another fixed-length block of bits (ciphertext) according to the key. A block cipher is not a mode of operation.
Confusion and diffusion are a description of how AES behaves to ensure that given a/many plaintext-ciphertext pairs, you cannot recover the key, as well as given a ciphertext, you cannot recover the plaintext.
"Confusion" basically means that the equations that represent the ciphertext are too complicated and cannot be worked with, while diffusion means that each bit of the plaintext influences many (half) of the bits of the ciphertext. These two properties help to ensure that extracting the key from plaintext-ciphertext pairs is difficult or infeasible.
Since AES only operates on blocks of 128-bits, you require a mode of operation to encrypt plaintexts of size > 128 bits. So a mode of operation is a way of using a block cipher to encrypt (effectively) arbitrary length messages.
Since for a fixed key AES is deterministic, a mode of operation also provides a means to randomize plaintext-ciphertext pairs, so that multiple encryptions of a plaintext cannot be distinguished from each other. This is necessary to properly provide confidentiality of the plaintext.
They are completely different. In short, Confusion and Diffusion for constructing block cipher, Mode of operation for encrypting longer messages and provide confidentiality or authenticity.
From Wiki Confusion and Diffusion
Confusion means that each binary digit (bit) of the ciphertext should depend on several parts of the key, obscuring the connections between the two.
Diffusion means that if we change a single bit of the plaintext, then (statistically) half of the bits in the ciphertext should change, and similarly, if we change one bit of the ciphertext, then approximately one half of the plaintext bits should change.2 Since a bit can have only two states, when they are all re-evaluated and changed from one seemingly random position to another, half of the bits will have changed state.
Also see Substitution-permutation network
Mode of operation from Wikipedia:
In cryptography, a block cipher mode of operation is an algorithm that uses a block cipher to provide an information service such as confidentiality or authenticity. A block cipher by itself is only suitable for the secure cryptographic transformation (encryption or decryption) of one fixed-length group of bits called a block. A mode of operation describes how to repeatedly apply a cipher's single-block operation to securely transform amounts of data larger than a block
In Diffusion the statistical structure of the plaintext is dissipated into long range statistics of the cipher text. This is achieved by having each plaintext digit affect the value of many cipher text digits. Which is equivalent to saying that each cipher text digit is affected by many plaintext digits.
Confusion seeks to make a relationship between the statistics of the cipher text and the value of the encryption key as complex as possible. Thus even if the attacker can get some handle on the statistics of the cipher text, the way in which the key was used to produce that cipher text is so complex as to make it difficult to deduce the key.
