Skip to main content

Questions tagged [diffusion]

Diffusion refers to the property of an encryption primitive that small changes in the plaintext result in big changes in the ciphertext and vice-versa.

Filter by
Sorted by
Tagged with
1 vote
1 answer
43 views

Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?

Let $$M= \begin{bmatrix}0&1&1&1\\ 1&0&1&1\\ 1&1&0&1\\ 1&1&1&0\end{bmatrix}$$ which is used in the block ciphers MIDORI and MANTIS. Of course this matrix ...
Kurious Koder's user avatar
0 votes
1 answer
80 views

Can a Substitution Cipher achieve Confusion and Diffusion

Can a substitution cipher achieve confusion and diffusion? By a substitution cipher I mean one where each character is replaced by another. By confusion my definition is that to solve the question, ...
revision's user avatar
1 vote
0 answers
72 views

When using AES-NI as a high-speed permutation, does AESDEC offer better diffusion?

If I was to use AES-NI as a high performance 128-bit permutation/PRF would AESDEC offer faster/better diffusion than AESENC? The reason I ask is because both instructions have the same cost, but the ...
Chris_F's user avatar
  • 197
0 votes
0 answers
55 views

Is there a square matrix with applications in Cryptography such that the determinant of this matrix is 0 and all its sub minors are non-singular?

I am looking for a square matrix whose determinant is 0, however, all sub-minors of this matrix are non singular. This matrix needs to have applications in Cryptography. The matrix may be over any ...
Kurious Koder's user avatar
3 votes
2 answers
181 views

Shannon's Diffusion: classical ciphers vs modern ciphers

Is there an easy to understand and intuitive "one fits all" definition for the concept of diffusion that is applicable to both modern binary cryptosystems as well as classical ciphers? For a ...
MaximumFlo's user avatar
0 votes
1 answer
81 views

How Does S box introduce diffusion in DES?

According to a Lecture from Lecture notes of a Professor of Purdue University "Diffusion means that a change in any plaintext bit must propagate out to as many ciphertext bits as possible." ...
kzs's user avatar
  • 103
2 votes
1 answer
259 views

Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)

I'm looking for a general comparison of encryption algorithms in regard to Confusion and Diffusion (as defined by Claude Shannon), and if possible, specifically for their SAC and BIC quality. For ...
foo's user avatar
  • 144
1 vote
1 answer
131 views

Diffusion of arithmetic and bit operations

I want to estimate when and wether different types of functions provide full or partial diffusion. I'm trying to understand diffusion of basic operations, like: addtion, multiplication, xoring. If ...
Tom's user avatar
  • 1,221
2 votes
1 answer
106 views

How to check whether function provides full diffusion or not?

In "The Skein Hash Function Family" paper authors wrote: The MIX/permute structure has been designed to provide full diffusion in 9 rounds for Threefish-256, 10 rounds for Threefish-512, ...
Tom's user avatar
  • 1,221
1 vote
1 answer
94 views

What are “weak” and “strong” output-input bit dependencies?

Section 3.3.5 of the paper “Schwaemm and Esch: Lightweight Authenticated Encryption and Hashing using the Sparkle Permutation Family” (the link to PDF can be found in this page) contains the following ...
lyrically wicked's user avatar
1 vote
1 answer
53 views

differential diffusion property of addition in SPECK cipher

I'm studying Impossible Differential Cryptanalysis of SPECK paper and I'm having trouble understanding the differential diffusion property of addition in page 19 which is as follows: can someone ...
siba36's user avatar
  • 301
0 votes
0 answers
81 views

Looking for a hash function (not necessarily cryptographic) where similar inputs return dissimilar outputs

I have the need to take a string and return a color. One requirement is that the same name always returns the same color. Another is that similar names should not return similar colors. I understand ...
solowt's user avatar
  • 1
3 votes
2 answers
351 views

Why is confusion and diffusion never talked about in asymmetric crypto?

While talking about symmetric encryption schemes like AES we always have a goal of achieving confusion and diffusion. But when it comes to asymmetric encryption schemes like RSA, DH etc. we never talk ...
Chirag Parmar's user avatar
0 votes
1 answer
286 views

What is the need of substitution and permutation networks in AES?

I have tried to answer this question for quite some time now. But a complete intuitive understanding still eludes me. Consider an alternate construction for a block cipher without any substitution and ...
Abhisek Dash's user avatar
2 votes
1 answer
399 views

ECB... lacks diffusion(?)

I noticed that the wikipedia page for 'block cipher modes of encryption' states, "The disadvantage of this method is a lack of diffusion.", referring to ECB mode for block cipher encryption. ...
WrinkleMonopoly's user avatar
0 votes
1 answer
228 views

does OFB mode has diffusion on the plaintext?

In some block modes, if we change one bit (or more) in the plaintext, the whole block\ciphertext will be changed (i.e ecb: block will be different. cbc: whole ciphertext will be different) Does ...
Abra Cadabra's user avatar
2 votes
1 answer
239 views

How to calculate the branch number of a linear mapping?

Is there an efficient algorithm which can be used to determine the branch number of any given linear mapping?
Monster's user avatar
  • 35
4 votes
2 answers
341 views

Which sub operation is more expensive in the AES encryption process?

In the AES encryption process, there are various sub-operations, like SubByte, MixColumns, ARK etc. My question is which of these operations is more expensive? In a video lecture by Dan Boneh, it is ...
Radium's user avatar
  • 177
1 vote
2 answers
107 views

Is 50% of bits changed in every round always gives 50% of changed bits in the end?

Let's say we have a cipher with such property, that every round change 50% of bits in every block in average. Is it obvious or it means that after few rounds we will get exactly 50% changed bits? If I ...
Tom's user avatar
  • 1,221
3 votes
0 answers
112 views

How to decide which diffusion scheme is better for a block cipher design

There are several schemes that can be used to achieve the diffusion property in a block cipher. Schemes include MDS code, Bit permutation, Byte/ Nibble permutation, Diffusion Matrix, Diffusion ...
Radium's user avatar
  • 177
0 votes
0 answers
79 views

Do there exist cryptographic algorithms where the "core" function is 96-to-32-bit?

There exists a FOX family of block ciphers (Wikipedia article: IDEA NXT). This cipher uses a function called "f32" which operates on three 32-bit words and outputs one 32-bit word. This function ...
lyrically wicked's user avatar
3 votes
0 answers
81 views

AES: Why ShiftRows() before MixColumns()? [duplicate]

In above picture you can see a AES state array over 2 rounds through the S- and P-Boxes of AES. It's taken from here and intends to show how 2 rounds of transformation are necessary to achieve full ...
Andy Ef's user avatar
  • 31
1 vote
1 answer
184 views

Application of MDS matrices in serial and round-based implementations

We know that MDS matrices are used in the diffusion layers of block ciphers. My question: what types of MDS matrices can be applied to serial or round-based implementations or both of them? I ...
user0410's user avatar
  • 253
5 votes
0 answers
109 views

Effect of block size on diffusion rate

I've always been under the belief that larger block sizes require more rounds to achieve full diffusion. Rijndael, SPECK, and SIMON, for example, have a round multiplier based on the block size. The ...
forest's user avatar
  • 15.3k
1 vote
1 answer
148 views

Algorithm for symmetric encryption (diffusion without confusion)?

I'm looking for a symmetric encryption algorithm with specific characteristic. Having a key $k$ a message $m$ returns a ciphertext $c$, where $E_{k}[m] \rightarrow c$ It should be hard to perform a ...
shumy's user avatar
  • 418
1 vote
1 answer
306 views

AES Diffusion at Block Level [closed]

AES provides diffusion at the block level by implementing the ShiftRows and MixColumn sublayers. The former permutes data on a byte level, wheres the latter combines blocks of four bytes. Can it ...
CXB's user avatar
  • 321
5 votes
2 answers
241 views

Early propagation of carries in the BLAKE hash function

The BLAKE paper uses round constants derived from $\pi$ to improve diffusion, even if the additions modulo $2^{32}$ are replaced with bitwise XOR when processing a null message and null initial state: ...
forest's user avatar
  • 15.3k
1 vote
3 answers
2k views

What's the difference between confusion/diffusion and mode of operation?

I understand the concepts of confusion (substitution) and diffusion (permutation). My understanding of what a mode is that it's an algorithm that lets us encrypt arbitrary message size. i.e. AES is ...
Bastien's user avatar
  • 511
0 votes
0 answers
250 views

Cryptographic Strength of MDS Matrix

Maximum Distance Separable (MDS) Matrices are used for providing diffusion in a cipher. How to test the strength (with respect to cryptographic properties) of an MDS matrix used in a cipher?
R. Sam's user avatar
  • 389
19 votes
1 answer
2k views

Understanding the wide trail design strategy

I am trying to understand the wide trail design strategy. I have read the paper (paywall-free preprint) which describes it from the point of view of AES. From what I understand, it is a technique to ...
forest's user avatar
  • 15.3k
1 vote
1 answer
665 views

How do we reduce the multiplications in the AES mix column layer using $x^4 +1$

I recently learned AES uses $x^4 +1$ to reduce the multiplications in the MixCol layer. However, I used $p(x) = x^8 + x^4 + x^3 + x + 1$ not knowing it was the wrong polynomial and got the correct ...
Red Book 1's user avatar
  • 1,025
2 votes
3 answers
943 views

How can I get the binary form of AES's MDS matrix in MixColumns tranformation?

I need to write a procedure for calculating the MixColumns's operation result in the following form: $M*X^T,$ where $M$ is a 128x128 binary matrix, $X$ is a 128-bit vector (the state). My question ...
JoaoAlby's user avatar
7 votes
1 answer
9k views

Confusion and Diffusion in the AES functions

I am pondering, how each of the four functions that a full AES round does consist of (Add Round Key, Substitute Bytes, Shift Rows and Mix Columns) add to the confusion and diffusion of the full AES. ...
mat's user avatar
  • 2,528
2 votes
1 answer
589 views

Why did they choose $x^4+1$ for the MixColumns step in Rijndael/AES?

In The Design of Rijndael page 39, It describe the design criteria for MixColumns step Dimensions. The transformation is a bricklayer transformation operatingon 4-byte columns. Linearity. The ...
Rikeijin's user avatar
  • 211
3 votes
1 answer
695 views

Prove the branch of number of Advanced Encryption Standard

In the Advanced Encryption Standard (AES) document: page 27 section 7.3.1, It defines branch number. It said " Let F be a linear transformation acting on byte vectors and let the byte weight ...
Rikeijin's user avatar
  • 211
5 votes
1 answer
367 views

Full diffusion or Partial diffusion between s-box applications?

In regards to maximizing active s-boxes: is it advantageous to apply the non-linear layer after complete diffusion of the state, rather after then partial diffusion? Using AES as an example, with ...
Ella Rose's user avatar
  • 19.7k
2 votes
1 answer
200 views

What does this notation means $\mathbb{F}_{2^{-}}$?

I have seen various papers to use this notation $\mathbb{F}_{2^{-}}$ to describe the diffusion layer. As for example the permutation in AES (MixColumns). So, we have a field with order of 2, what does ...
Anton Paragas's user avatar
8 votes
1 answer
1k views

How 2 rounds in AES achieve full diffusion?

I have read somewhere that 2 rounds is AES provide full diffusion. So I looked it up to find out what it exactly meant. In The Design of Rijndael page 41, section 3.5 and it states that: Two ...
Anton Paragas's user avatar
0 votes
1 answer
606 views

Alternatives to sbox's for diffusion?

Are there any other alternatives to Sbox's or SP networks to provide diffusion preferably more basic alternatives which still provide a good degree of security?
Nat's user avatar
  • 415
10 votes
1 answer
8k views

How does AES introduce confusion and diffusion?

I know that in AES the shift-rows and mix-columns operations introduce diffusion, but I don't understand how they create diffusion. Also, I know the add-round-key operation creates confusion, but I ...
user40191's user avatar
  • 101
0 votes
0 answers
45 views

How were the diffusion statistics for norx calculated?

I was reading the norx specification and came across this section, which provides some kind of statistics about the diffusion of the norx round function. However, I don't see how these values were ...
Ella Rose's user avatar
  • 19.7k
4 votes
2 answers
1k views

Does the One Time Pad rely on confusion or diffusion?

From what I could research, XORing a random key adds confusion. But I do not undertand the rationale for that classification. Shannon's confusion is supposed to obscure the relationship between the ...
wmnorth's user avatar
  • 252
6 votes
2 answers
673 views

Encrypt-Mix-Encrypt: Full Diffusion?

I've read "A Parallelizable Enciphering Mode" by Halevi and Rogaway about the encrypt-mix-encrypt mode for ciphers and was asking myself if this mode provides "full" diffusion. So if an attacker ...
SEJPM's user avatar
  • 46.1k
0 votes
1 answer
1k views

Block cipher mode with diffusion on ciphertext

As I understand, diffusion property in AES-CBC ensures that one-bit change in plaintext will yield changes in all following blocks in ciphertext upon encryption. I'm looking for algorithm that will ...
dhuCerbin's user avatar
  • 103