# How to calculate the avalanche effect in aes-256?

I am a beginner in cryptography. I'm testing AES-128 bit key, AES-256 bit key, and Camellia-256 bit key.

• I'm using AES-256, 9 character salt, CBC mode, PKCS #5 padding, and the ciphertext using BASE64encoder.

Avalanche effect is to calculate ”changed bits / total bits”. If I want to calculate the avalanche effect for AES-256, what are the right procedures to calculate the avalanche effect, and what are the rules in how long the plaintext, key, and ciphertext should be?

• 0-15 character plaintext produces 24 character ciphertext.

• 16-31 character plaintext produces 44 character ciphertext.

24 chars is 192 bits and 44 chars is 352 bits, how to get 256 bits in ciphertext?

• What makes you think it's a good idea? – fkraiem Aug 11 '15 at 1:07
• This reference has a description of what is happening when you are generating ciphertext: www.obviex.com/articles/CiphertextSize.pdf and in particular the parts of the process that can impact on output length. It could be as simple as the form of text encoding you are using in the original plaintext. – Mary Aug 11 '15 at 3:06
• @fkraiem What makes you think it’s a bad idea to learn how calculating an avalanche effect works? Whenever you drop a comment like your What makes you think it's a good idea?, you really should try to provide your reasoning… not doing so is far from constructive. From my point of view, it’s better to learn than to blindly trust – and I really can’t come up with any logic reason why learning how to calculate avalance effects could have any negative effect. Care to explain the reason for your comment? – e-sushi Aug 11 '15 at 13:42
• @Mary this helped me, thank you (Y). thanks for the support @e-sushi♦ – Ahmad Amran Aug 11 '15 at 22:05
• The whole purpose of base64 is to dilute entropy, and nonuniformly so; if you want to look at bit statistics, omit or reverse it. Using PBE how your password and salt are chosen affects how many and which 128-bit or 256-bit keys you reach so either understand that or use actual encryption not PBE. – dave_thompson_085 Aug 12 '15 at 0:05