AES provides diffusion at the block level by implementing the ShiftRows and MixColumn sublayers. The former permutes data on a byte level, wheres the latter combines blocks of four bytes.

Can it ever be the case that this level of diffusion is insufficient?

  • 5
    $\begingroup$ How you define the insufficient? $\endgroup$ – kelalaka Jan 24 at 10:18
  • 1
    $\begingroup$ In the sense that there are still some patterns when ciphertext statistics is carried out for example. $\endgroup$ – CXB Jan 24 at 10:59
  • 1
    $\begingroup$ Are you talking about one round? It is sufficient up to now. You have to consider it for 10 rounds for AES-128. $\endgroup$ – kelalaka Jan 24 at 11:02
  • 4
    $\begingroup$ If ciphertext statistics can be shown then I guess that e.g. CTR mode would be broken. I'm afraid that this quickly scales up to the question: can AES be broken? As it cannot be proven to be secure, the answer to that is yes, it may be broken in the future. I don't think that we can prove that the diffusion part is "sufficient" so we cannot single that part out (just some thoughts, if somebody can substantiate this then I guess it would be an answer). $\endgroup$ – Maarten Bodewes Jan 24 at 13:20
  • 2
    $\begingroup$ AES requires 2 full rounds for full block diffusion $\endgroup$ – Richie Frame Jan 25 at 0:47

That depends on how you define sufficient. AES achieves full diffusion after only two rounds, where diffusion is defined as the ability for every bit in the state to affect every other bit. That does not mean that a mere two rounds can protect against cryptanalysis. The number of rounds necessary to avoid fatal cryptanalysis is something that can only be chosen by studying the cipher and attempting to break it. During the AES standardization process, the cipher Rijndael, which became AES, was given 10 rounds for the 128-bit key size because the best attack against it could break 6 rounds. The extra rounds were considered to be a safety net, or security margin, against future advances in cryptographic attacks.

Is this always going to be sufficient? We don't know. Right now, no attack more efficient than exhaustive search is known that can break every round in the cipher in order to violate its security properties. Some have argued that 10 rounds is not enough, and even suggested that it be raised to 18 or 24 during the AES process, but that never happened and it was standardized as 10, 12, and 14 rounds for each key size. However, as the years have passed, we still do not have any cryptanalysis that breaks every round.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.