xor-streaming ciphers have no (0, zero, zilch) diffusion - you switch 1 bit in the ciphertext, you know which single bit in the plaintext after decryption will be flipped.
Indeed, there is no plaintext to ciphertext diffusion in a stream cipher. But that's by design, and not a weakness when the Initialization Vector changes at each use as it's hypothesized to do. So this consideration of plaintext to ciphertext diffusion is not meaningful to compare stream ciphers. The corresponding metric that matters for these is IV to keystream diffusion.
I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon), and if possible, specifically for their SAC and BIC quality.
For modern unbroken ciphers, it's impossible to make such comparison based on experiments with the cipher tested as a black box, because the moment we could prove a cipher A lesser than a cipher B on some meaningful criteria, cipher A would be broken, by definition of broken and meaningful. Something like diffusion from plaintext to ciphertext (for block cipher) or IV to keystream (for stream cipher) would be meaningful, but we can't practically measure that experimentally for a practical cipher: it's immensely too compute-intensive.
In fact, we can't make any measure that experimentally distinguish ciphertext or keystream of one cipher from that of another cipher (under hypothesis on format that is met in practice), unless one of the two is broken or we know it's key. Therefore, efforts in the direction of the question must allow examination of the inside of the cipher.
One of the metric for comparison among ciphers consisting of essentially identical rounds (as most modern ones are) could be: define the better cipher has the one with the highest security margin for a certain experimental test, defined e.g. as $r/r'$ where $r$ is the number of rounds in the cipher, and $r'$ is the smallest number of rounds such that the experimental test can not distinguish the cipher from a perfect one. Some problems with this approach:
- We know some ciphers that are unbroken for $r_1$ rounds but break abruptly for some $r_2>r_1$ rounds, including at least one where this has happened by accident (I wish I could remember which). We could actually live with that issue, because we have some insight on why it can happen, and hope we know how to design a cipher to avoid it.
- Knowing a simple test, it's reasonably easy to make a cipher with a high security margin (even if we add some speed constraint or upper limit on $r$), but we know that does not give any assurance of security, because sometime a different test will uncover a devastating weakness the original did not.
- If we allow complex rounds, we know how to make a cipher that's unbreakable by any fixed test for $r'=1$ round, yet is trivially breakable for any number $r\ge1$ of rounds with a new test devised with knowledge of (a constant in) the algorithm. There demonstrably is no workaround to that one!
- An actual cryptanalyst tailors attacks to the cipher, and that's known to often make the attack immensely more effective than a generic one, but that varies immensely.
All that combined, security margin for a certain experimental test is a poor metric to rank ciphers. This approach only works, somewhat, to compare ciphers with simple and comparable rounds. It's used to some degree to tune parameters of a class of ciphers; like, determining number of bits in rotations in ARX ciphers.
Currently, the only known way to improve that strategy for the variety of ciphers around is to modify the criteria to security margin for the best experimental test devised by experts in cryptanalysis after examining the cipher in detail. This is somewhat part of how AES (and the SHA-3 hashes) are chosen. But that process takes years of efforts by multiple experts in cryptanalysis. AI could conceivably help there, but I don't know that it's ready for that yet.
Summary: there are attempts at ranking of ciphers. But those that pretend to rank unbroken ciphers by black box testing are flawed. Even when opening the cipher, I know no automated sound alternative.
