# Tag Info

15

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief summary and some context. Hopefully this will help you understand the paper by Daemen and Rijmen (paywal-free preprint) better. Since the (public) discovery of ...

13

AES diffusion is taking cared of by 3 main functions: SubBytes Shift Rows Mix Columns SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this step, each bit of a byte depend of each other. This modification on the byte is then translated through the state via Shift Rows (still 1 byte affected) and ...

10

Put simply: The add key layer ensures the encryption function is only computable by someone who knows the key Adds some confusion because the key is (psuedo) random The subBytes s-box layer creates confusion each symbol is mapped to another symbol in a way that impedes common methods of cryptanalysis (high resistance to linear and differential ...

8

I should start by saying that the notions confusion and diffusion can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to understanding the choice of the steps in the round transformation is the wide trail strategy. That said, we can of course try to understand the effect of each ...

6

The table lookup implementations usually combine the SubBytes and ShiftRows steps with the MixColumns step. Different implementations/hardware/etc make general statements impossible, but this paper gives some benchmarks and information on a table-lookup implementation. It won't necessarily be quicker across all systems. As per this paper: It must be noted,...

5

The One-Time Pad employs neither confusion nor diffusion, as defined by Shannon: "Two methods (other than recourse to ideal systems) suggest themselves for frustrating a statistical analysis. These we may call the methods of diffusion and confusion. In the method of diffusion the statistical structure of $M$ which leads to its redundancy is “dissipated” ...

5

The dear user @kodlu has answered to the similar question with excellent discussion but I want to answer with linear algebra argument. We have two definitions for MDS (Maximum Distance Separable) Matrix: First definition: A matrix $M$ of order $n$ is an MDS matrix if and only if every sub-matrix of $M$ is non-singular. Second definition: A matrix $M_{n\... 5 Yes, EME is a wideblock cipher. Theorem 1 (in Section 4, top of page 5) states that EME is secure as a wideblock (tweakable) cipher under the assumption that AES (or whatever blockcipher you use) is secure. Specifically, to someone who doesn't know the key, EME will look like a set of random, independent permutations (one for each tweak). This is true even ... 4 You've been confused by the placement of the "-". It's not$\mathbb F_{2^-}$(Latex:$\mathbb F_{2^-}$), this does not exist. What was actually meant is$\mathbb F_2$-adjective (Latex:$\mathbb F_2$-adjective), where the hyphen binds the field and the adjective (eg "linear" or "affine") to bring more specific meaning to the adjective. Example: [...]with ... 4 Concretely, given an element$x \in$GF($2^8), to multiply it by 2, we simply do a left shift and xor with 0b100011011 if the result of the shift gets above 0b11111111 (255). To multiply by 3, we multiply by 2 and add the input. Those two multiplications can be described with 8x8 binary matrices. The easiest way to find the matrices is to think how those ... 4 If you are doing a software implementation, the MixColumns would take the longest because you have to do a multiply after pulling from memory and then putting it back. Generally speaking, in software you would use lookup tables for the naive approach, so everything that is not cached would be expensive. I say this is naive because it is susceptible to ... 3 It should be hard to perform a KPA. I believe the diffusion concept makes it hard to perform such an attack? Assuming the context of traditional symmetric encryption: confusion (combined with diffusion) is what makes this hard. For simplicity, suppose we have a 4-bit message. Suppose the equations for each bit of ciphertext are: \begin{align} c_0 &= ... 3 This is already covered by Ella's response, but in short the added nonlinearity at the start buys you very little in terms of security, compared to its cost in number of operations. It would be more effective, and make for a simpler design, for example, to trade all these constant xors by an extra round. Since that part of BLAKE was not pulling its own ... 3 As explained in the answer to the question here the branch number of a linear mapping $$A:F_q^n \rightarrow F_q^n, \quad x\mapsto A\cdot x$$ is the minimum weight of the linear code generated by the matrix $$G=[~I~|~A].$$ For an arbitrary matrixA$this problem is NP hard, i.e., very hard. For structured matrices like the MDS matrix in AES the answer is ... 3 If we have such property that every round change 50% of bits, how to be sure that in many rounds in the end we will also end up with 50% of bits changed? Well, obviously one can construct artificial examples where this doesn't happen; the most obvious (and trivial) being if round 1 and round 2 are inverses of each other (that is, round 1 followed by round 2 ... 3 Yes, there are modes of operation that achieve the property that you are describing. For example, the Propagating Cipher Block Chaining (PCBC) mode of operation: This mode is similar to CBC but the output for each block is propagated to the input of the next one, so a small error will propagate indefinitely, both for encryption and decryption. There may ... 3 Here is a Sage code that creates the MDS matrix over$F_2$. mds = matrix(GF(2), [ [0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0], [0,0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0], [0,0,0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0], [1,0,0,0,1,0,0,0,1,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,... 3 This question can be used to get what you want. There we use bytes (so expand those to bits) and you have to use extra XOR's (i.e. binary additions) to get the field multiplications. 3 The$x^4+1$is implicit in the matrix. What you are doing is that you consider formal sums$z_0 + z_1 \alpha + z_2 \alpha^2 + z_3 \alpha^3$for$z_i$elements of the field$\mathbb{F}_{256}$, and a formal value$\alpha$which is not in$\mathbb{F}_{256}$, but is such that$\alpha^4+1 = 0$. You can add and multiply such elements, always keeping the result in ... 2 AES is a mode of operation, and confusion/diffusion are what we use to achieve a certain mode. AES is a block cipher, which replaces one fixed-length block of bits (plaintext) with another fixed-length block of bits (ciphertext) according to the key. A block cipher is not a mode of operation. Confusion and diffusion are a description of how AES behaves to ... 2 If the linear diffusion layer were applied twice without applying the s-boxes between them, it is possible there might be an iterative differential characteristic with only four active s-boxes per modified 'round' (i.e. instead of a provable minimum of 25 active s-boxes over 4 rounds there could be as few as 16 active s-boxes over 4 'rounds'). Consider for ... 2 Yes, but. While EME is a secure block cipher, its security is not as good as a regular block cipher of that size would be. Theorem 1 of the linked paper shows that the adversary has an advantage after ~$2^{n/2}$oracle queries, which is expected with an$n$-bit block cipher, rather than$2^{m/2}$as we would desire for an$m$-bit wide block cipher. Since ... 2 what types of MDS matrices can be applied to serial or round-based implementations or both of them? Serial matrices utilise a trade-off to reduce hardware requirement while incurring additional time cost. Examples of MDS matrices that can be serialized implemented are : cyclic , Hadmard, linear feedback serial (LFS), sparse diagonal serial invertible (DSI)... 2 What are the benefits of guaranteeing early propagation of carries Addition without carries is equivalent to XOR. Consider the addition of the following two bit strings performed modulo$2^8$: 0000 0001 0000 0010 + --------- 0000 0011 You can see how this is equivalent to the XOR of the two bit strings, despite the fact that we evaluated addition modulo$...

2

The topic is a little dated, but similar concepts are discussed using slightly different language. People have questioned whether the computation of individual bits of discrete logarithms, or RSA decryptions is as hard as the overall problem. This particularly relevant in the design of PKC based random number generators such as Blum-Blum-Shub or Micauli-...

2

I agree with your observation. The wiki's assessment of the weakness of ECB being a lack of diffusion is not very precise. I have a feeling that they're using diffusion in a generic sense, not the exact definition of diffusion in cryptography. Diffusion in the exact cryptographic sense happens inside the block cipher like AES. What we need on the higher ...

2

if we will change one bit in the plaintext, more than one bit will be changed in the ciphertext? In Output Feedback Mode, no, it does not. Specifically, if you change one bit of the plaintext and nothing else (e.g. you don't modify the IV), then only the corresponding bit of the ciphertext will change. Output Feedback Mode works by internally generating a ...

1

In asymmetric crypto, security of schemes typically relies on some underlying problem, which seems hard to solve (root extraction for RSA, discrete log for DH, short lattice vectors for lattice-based crypto, etc.). In symmetric crypto, on the other hand, security is ad hoc and we have to rely on heuristics such as diffusion and confusion (which are though ...

1

That depends on how you define sufficient. AES achieves full diffusion after only two rounds, where diffusion is defined as the ability for every bit in the state to affect every other bit. That does not mean that a mere two rounds can protect against cryptanalysis. The number of rounds necessary to avoid fatal cryptanalysis is something that can only be ...

Only top voted, non community-wiki answers of a minimum length are eligible