I am new to crypto subject. I am studying the confusion and diffusion in AES etc. Is there any general quantitative method to measure these properties. Let us say Algorithm A produces cipher having more confusion/diffusion with respect to Algorithm B. How can one quantify these criteria? Any specific Model or formula for same?



Diffusion can be quantified by examining the branch number of the diffusion layer. The branch number indicates how much a difference in the input will spread around the rest of the state after the transformation has been applied.

The branch number can be used to prove lower bounds on the amount of diffusion that the permutation provides.

Measuring avalanche statistically can only tell you if your diffusion is awful, it can't really be used to prove that diffusion is complete and even throughout the state, or that one design is better then the other (assuming that both have decent diffusion).


Confusion, or non-linearity, can be quantified by measuring stats such as differential and linear probability. For small enough mappings, it is easy to take these metrics by simply building a difference distribution table and linear approximation table and simply examining the results. For larger mappings this may prove challenging if not intractable.

  • $\begingroup$ Your answer's better that mine, but I'm confused (clearly) re. your 3rd para. Surely the following must be true: Unless confusion ~ diffusion as Shannon suggested and each provide equivalent ciphering capability, how can you say a function with full avalanche effect can have awful diffusion? $\endgroup$
    – Paul Uszak
    Nov 18 '17 at 19:27
  • $\begingroup$ @PaulUszak response1: Confusion and diffusion do not each provide equivalent ciphering capability when used in isolation from each other. It is possible to design a cipher that is 1. totally linear (no confusion) 2. provides perfect diffusion. 3. uses arbitrary round counts 4. uses arbitrary key size and is still trivially broken. One helpful way to think of "Confusion" is circuit depth, or even simpler just the number of AND gates in the circuit, while "Diffusion" is the number or rather balance of xors/transpositions. $\endgroup$
    – Ella Rose
    Nov 18 '17 at 19:38
  • $\begingroup$ @PaulUszak response2: You can fool an avalanche test by having "enough" diffusion on average, certain bits in the state might have lower diffusion then other parts, but still enough to look random to a statistical test. (One of the design goals of Rijndael was to maximize the minimum amount of diffusion and equally spread it around each bit). Another way to think of diffusion is the number of terms that represent a given bit of the state, if you were to write it all as one giant expression with only XOR/AND. $\endgroup$
    – Ella Rose
    Nov 18 '17 at 19:40
  • $\begingroup$ Let me process your answer and comments... I will be back with doubts(if any). Thanks guys... $\endgroup$ Nov 19 '17 at 20:30

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.