# Questions tagged [diffusion]

Diffusion refers to the property of an encryption primitive that small changes in the plaintext result in big changes in the ciphertext and vice-versa.

44 questions
Filter by
Sorted by
Tagged with
1 vote
43 views

### Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?

Let $$M= \begin{bmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{bmatrix}$$ which is used in the block ciphers MIDORI and MANTIS. Of course this matrix ...
80 views

### Can a Substitution Cipher achieve Confusion and Diffusion

Can a substitution cipher achieve confusion and diffusion? By a substitution cipher I mean one where each character is replaced by another. By confusion my definition is that to solve the question, ...
• 75
1 vote
72 views

### When using AES-NI as a high-speed permutation, does AESDEC offer better diffusion?

If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the ...
• 197
55 views

### Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?

I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
181 views

### Shannon's Diffusion: classical ciphers vs modern ciphers

Is there an easy to understand and intuitive "one fits all" definition for the concept of diffusion that is applicable to both modern binary cryptosystems as well as classical ciphers? For a ...
81 views

### How Does S box introduce diffusion in DES?

According to a Lecture from Lecture notes of a Professor of Purdue University "Diﬀusion means that a change in any plaintext bit must propagate out to as many ciphertext bits as possible." ...
• 103
259 views

### Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)

I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon), and if possible, specifically for their SAC and BIC quality. For ...
• 144
1 vote
131 views

### Diffusion of arithmetic and bit operations

I want to estimate when and wether different types of functions provide full or partial diffusion. I'm trying to understand diffusion of basic operations, like: addtion, multiplication, xoring. If ...
• 1,221
106 views

### How to check whether function provides full diffusion or not?

In "The Skein Hash Function Family" paper authors wrote: The MIX/permute structure has been designed to provide full diffusion in 9 rounds for Threefish-256, 10 rounds for Threefish-512, ...
• 1,221
1 vote
94 views

### What are “weak” and “strong” output-input bit dependencies?

Section 3.3.5 of the paper “Schwaemm and Esch: Lightweight Authenticated Encryption and Hashing using the Sparkle Permutation Family” (the link to PDF can be found in this page) contains the following ...
• 1,347
1 vote
53 views

### differential diffusion property of addition in SPECK cipher

I'm studying Impossible Differential Cryptanalysis of SPECK paper and I'm having trouble understanding the differential diffusion property of addition in page 19 which is as follows: can someone ...
• 301
81 views

### Looking for a hash function (not necessarily cryptographic) where similar inputs return dissimilar outputs

I have the need to take a string and return a color. One requirement is that the same name always returns the same color. Another is that similar names should not return similar colors. I understand ...
351 views

### Why is confusion and diffusion never talked about in asymmetric crypto?

While talking about symmetric encryption schemes like AES we always have a goal of achieving confusion and diffusion. But when it comes to asymmetric encryption schemes like RSA, DH etc. we never talk ...
286 views

### What is the need of substitution and permutation networks in AES?

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me. Consider an alternate construction for a block cipher without any substitution and ...
399 views

### ECB... lacks diffusion(?)

I noticed that the wikipedia page for 'block cipher modes of encryption' states, "The disadvantage of this method is a lack of diffusion.", referring to ECB mode for block cipher encryption. ...
228 views

### does OFB mode has diffusion on the plaintext?

In some block modes, if we change one bit (or more) in the plaintext, the whole block\ciphertext will be changed (i.e ecb: block will be different. cbc: whole ciphertext will be different) Does ...
• 117
239 views

### How to calculate the branch number of a linear mapping?

Is there an efficient algorithm which can be used to determine the branch number of any given linear mapping?
• 35
341 views

### Which sub operation is more expensive in the AES encryption process?

In the AES encryption process, there are various sub-operations, like SubByte, MixColumns, ARK etc. My question is which of these operations is more expensive? In a video lecture by Dan Boneh, it is ...
• 177
1 vote
107 views

### Is 50% of bits changed in every round always gives 50% of changed bits in the end?

Let's say we have a cipher with such property, that every round change 50% of bits in every block in average. Is it obvious or it means that after few rounds we will get exactly 50% changed bits? If I ...
• 1,221
112 views

### How to decide which diffusion scheme is better for a block cipher design

There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
• 177
79 views

### Do there exist cryptographic algorithms where the "core" function is 96-to-32-bit?

There exists a FOX family of block ciphers (Wikipedia article: IDEA NXT). This cipher uses a function called "f32" which operates on three 32-bit words and outputs one 32-bit word. This function ...
• 1,347
81 views

### AES: Why ShiftRows() before MixColumns()? [duplicate]

In above picture you can see a AES state array over 2 rounds through the S- and P-Boxes of AES. It's taken from here and intends to show how 2 rounds of transformation are necessary to achieve full ...
• 31
1 vote
184 views

### Application of MDS matrices in serial and round-based implementations

We know that MDS matrices are used in the diffusion layers of block ciphers. My question: what types of MDS matrices can be applied to serial or round-based implementations or both of them? I ...
• 253
109 views

### Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
• 15.3k
1 vote
148 views

### Algorithm for symmetric encryption (diffusion without confusion)?

I'm looking for a symmetric encryption algorithm with specific characteristic. Having a key $k$ a message $m$ returns a ciphertext $c$, where $E_{k}[m] \rightarrow c$ It should be hard to perform a ...
• 418
1 vote
306 views

### AES Diffusion at Block Level [closed]

AES provides diffusion at the block level by implementing the ShiftRows and MixColumn sublayers. The former permutes data on a byte level, wheres the latter combines blocks of four bytes. Can it ...
• 321
241 views

### Early propagation of carries in the BLAKE hash function

The BLAKE paper uses round constants derived from $\pi$ to improve diffusion, even if the additions modulo $2^{32}$ are replaced with bitwise XOR when processing a null message and null initial state: ...
• 15.3k
1 vote
2k views

### What's the difference between confusion/diffusion and mode of operation?

I understand the concepts of confusion (substitution) and diffusion (permutation). My understanding of what a mode is that it's an algorithm that lets us encrypt arbitrary message size. i.e. AES is ...
• 511
250 views

### Cryptographic Strength of MDS Matrix

Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
• 389
2k views

### Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
• 15.3k
1 vote
665 views

### How do we reduce the multiplications in the AES mix column layer using $x^4 +1$

I recently learned AES uses $x^4 +1$ to reduce the multiplications in the MixCol layer. However, I used $p(x) = x^8 + x^4 + x^3 + x + 1$ not knowing it was the wrong polynomial and got the correct ...
• 1,025
943 views

### How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

I need to write a procedure for calculating the MixColumns's operation result in the following form: $M*X^T,$ where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state). My question ...
• 81
9k views

### Confusion and Diffusion in the AES functions

I am pondering, how each of the four functions that a full AES round does consist of (Add Round Key, Substitute Bytes, Shift Rows and Mix Columns) add to the confusion and diffusion of the full AES. ...
• 2,528
589 views

### Why did they choose $x^4+1$ for the MixColumns step in Rijndael/AES?

In The Design of Rijndael page 39, It describe the design criteria for MixColumns step Dimensions. The transformation is a bricklayer transformation operatingon 4-byte columns. Linearity. The ...
• 211
695 views

### Prove the branch of number of Advanced Encryption Standard

In the Advanced Encryption Standard (AES) document: page 27 section 7.3.1, It defines branch number. It said " Let F be a linear transformation acting on byte vectors and let the byte weight ...
• 211
367 views

### Full diffusion or Partial diffusion between s-box applications?

In regards to maximizing active s-boxes: is it advantageous to apply the non-linear layer after complete diffusion of the state, rather after then partial diffusion? Using AES as an example, with ...
• 19.7k
200 views

### What does this notation means $\mathbb{F}_{2^{-}}$?

I have seen various papers to use this notation $\mathbb{F}_{2^{-}}$ to describe the diffusion layer. As for example the permutation in AES (MixColumns). So, we have a field with order of 2, what does ...
1k views

### How 2 rounds in AES achieve full diffusion?

I have read somewhere that 2 rounds is AES provide full diffusion. So I looked it up to find out what it exactly meant. In The Design of Rijndael page 41, section 3.5 and it states that: Two ...
606 views

### Alternatives to sbox's for diffusion?

Are there any other alternatives to Sbox's or SP networks to provide diffusion preferably more basic alternatives which still provide a good degree of security?
• 415
8k views

### How does AES introduce confusion and diffusion?

I know that in AES the shift-rows and mix-columns operations introduce diffusion, but I don't understand how they create diffusion. Also, I know the add-round-key operation creates confusion, but I ...
• 101
45 views

### How were the diffusion statistics for norx calculated?

I was reading the norx specification and came across this section, which provides some kind of statistics about the diffusion of the norx round function. However, I don't see how these values were ...
• 19.7k
1k views

### Does the One Time Pad rely on confusion or diffusion?

From what I could research, XORing a random key adds confusion. But I do not undertand the rationale for that classification. Shannon's confusion is supposed to obscure the relationship between the ...
• 252
673 views

### Encrypt-Mix-Encrypt: Full Diffusion?

I've read "A Parallelizable Enciphering Mode" by Halevi and Rogaway about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker ...
• 46.1k