Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
AES provides diffusion at the block level by implementing the ShiftRows and MixColumn sublayers. The former permutes data on a byte level, wheres the latter combines blocks of four bytes.
Can it ever be the case that this level of diffusion is insufficient?
That depends on how you define sufficient. AES achieves full diffusion after only two rounds, where diffusion is defined as the ability for every bit in the state to affect every other bit. That does not mean that a mere two rounds can protect against cryptanalysis. The number of rounds necessary to avoid fatal cryptanalysis is something that can only be chosen by studying the cipher and attempting to break it. During the AES standardization process, the cipher Rijndael, which became AES, was given 10 rounds for the 128-bit key size because the best attack against it could break 6 rounds. The extra rounds were considered to be a safety net, or security margin, against future advances in cryptographic attacks.
Is this always going to be sufficient? We don't know. Right now, no attack more efficient than exhaustive search is known that can break every round in the cipher in order to violate its security properties. Some have argued that 10 rounds is not enough, and even suggested that it be raised to 18 or 24 during the AES process, but that never happened and it was standardized as 10, 12, and 14 rounds for each key size. However, as the years have passed, we still do not have any cryptanalysis that breaks every round.
