13

AES diffusion is taking cared of by 3 main functions: SubBytes Shift Rows Mix Columns SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this step, each bit of a byte depend of each other. This modification on the byte is then translated through the state via Shift Rows (still 1 byte affected) and ...


11

Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief summary and some context. Hopefully this will help you understand the paper by Daemen and Rijmen (paywal-free preprint) better. Since the (public) discovery of ...


9

Put simply: The add key layer ensures the encryption function is only computable by someone who knows the key Adds some confusion because the key is (psuedo) random The subBytes s-box layer creates confusion each symbol is mapped to another symbol in a way that impedes common methods of cryptanalysis (high resistance to linear and differential ...


5

The One-Time Pad employs neither confusion nor diffusion, as defined by Shannon: "Two methods (other than recourse to ideal systems) suggest themselves for frustrating a statistical analysis. These we may call the methods of diffusion and confusion. In the method of diffusion the statistical structure of $M$ which leads to its redundancy is “dissipated” ...


5

The dear user @kodlu has answered to the similar question with excellent discussion but I want to answer with linear algebra argument. We have two definitions for MDS (Maximum Distance Separable) Matrix: First definition: A matrix $M$ of order $n$ is an MDS matrix if and only if every sub-matrix of $M$ is non-singular. Second definition: A matrix $M_{n\...


5

Yes, EME is a wideblock cipher. Theorem 1 (in Section 4, top of page 5) states that EME is secure as a wideblock (tweakable) cipher under the assumption that AES (or whatever blockcipher you use) is secure. Specifically, to someone who doesn't know the key, EME will look like a set of random, independent permutations (one for each tweak). This is true even ...


5

I should start by saying that the notions "confusion" and "diffusion" can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to understanding the choice of the steps in the round transformation is the wide trail strategy. That said, we can of course try to understand the effect of ...


4

Concretely, given an element $x \in$ GF($2^8$), to multiply it by 2, we simply do a left shift and xor with 0b100011011 if the result of the shift gets above 0b11111111 (255). To multiply by 3, we multiply by 2 and add the input. Those two multiplications can be described with 8x8 binary matrices. The easiest way to find the matrices is to think how those ...


4

You've been confused by the placement of the "-". It's not $\mathbb F_{2^-}$ (Latex: $\mathbb F_{2^-}$), this does not exist. What was actually meant is $\mathbb F_2$-adjective (Latex: $\mathbb F_2$-adjective), where the hyphen binds the field and the adjective (eg "linear" or "affine") to bring more specific meaning to the adjective. Example: [...]with ...


3

The $x^4+1$ is implicit in the matrix. What you are doing is that you consider formal sums $z_0 + z_1 \alpha + z_2 \alpha^2 + z_3 \alpha^3$ for $z_i$ elements of the field $\mathbb{F}_{256}$, and a formal value $\alpha$ which is not in $\mathbb{F}_{256}$, but is such that $\alpha^4+1 = 0$. You can add and multiply such elements, always keeping the result in ...


3

It should be hard to perform a KPA. I believe the diffusion concept makes it hard to perform such an attack? Assuming the context of traditional symmetric encryption: confusion (combined with diffusion) is what makes this hard. For simplicity, suppose we have a 4-bit message. Suppose the equations for each bit of ciphertext are: \begin{align} c_0 &= ...


3

If we have such property that every round change 50% of bits, how to be sure that in many rounds in the end we will also end up with 50% of bits changed? Well, obviously one can construct artificial examples where this doesn't happen; the most obvious (and trivial) being if round 1 and round 2 are inverses of each other (that is, round 1 followed by round 2 ...


3

This is already covered by Ella's response, but in short the added nonlinearity at the start buys you very little in terms of security, compared to its cost in number of operations. It would be more effective, and make for a simpler design, for example, to trade all these constant xors by an extra round. Since that part of BLAKE was not pulling its own ...


3

Here is a Sage code that creates the MDS matrix over $F_2$. mds = matrix(GF(2), [ [0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0,0], [0,0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0,0], [0,0,0,1,0,0,0,0,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,0,0,0], [1,0,0,0,1,0,0,0,1,0,0,1,1,0,0,0,0,0,0,1,0,0,0,0,0,0,0,1,0,0,...


3

This question can be used to get what you want. There we use bytes (so expand those to bits) and you have to use extra XOR's (i.e. binary additions) to get the field multiplications.


3

Yes, there are modes of operation that achieve the property that you are describing. For example, the Propagating Cipher Block Chaining (PCBC) mode of operation: This mode is similar to CBC but the output for each block is propagated to the input of the next one, so a small error will propagate indefinitely, both for encryption and decryption. There may ...


2

If the linear diffusion layer were applied twice without applying the s-boxes between them, it is possible there might be an iterative differential characteristic with only four active s-boxes per modified 'round' (i.e. instead of a provable minimum of 25 active s-boxes over 4 rounds there could be as few as 16 active s-boxes over 4 'rounds'). Consider for ...


2

Yes, but. While EME is a secure block cipher, its security is not as good as a regular block cipher of that size would be. Theorem 1 of the linked paper shows that the adversary has an advantage after ~$2^{n/2}$ oracle queries, which is expected with an $n$-bit block cipher, rather than $2^{m/2}$ as we would desire for an $m$-bit wide block cipher. Since ...


2

What are the benefits of guaranteeing early propagation of carries Addition without carries is equivalent to XOR. Consider the addition of the following two bit strings performed modulo $2^8$: 0000 0001 0000 0010 + --------- 0000 0011 You can see how this is equivalent to the XOR of the two bit strings, despite the fact that we evaluated addition modulo $...


2

what types of MDS matrices can be applied to serial or round-based implementations or both of them? Serial matrices utilise a trade-off to reduce hardware requirement while incurring additional time cost. Examples of MDS matrices that can be serialized implemented are : cyclic , Hadmard, linear feedback serial (LFS), sparse diagonal serial invertible (DSI)...


1

That depends on how you define sufficient. AES achieves full diffusion after only two rounds, where diffusion is defined as the ability for every bit in the state to affect every other bit. That does not mean that a mere two rounds can protect against cryptanalysis. The number of rounds necessary to avoid fatal cryptanalysis is something that can only be ...


1

They are completely different. In short, Confusion and Diffusion for constructing block cipher, Mode of operation for encrypting longer messages and provide confidentiality or authenticity. From Wiki Confusion and Diffusion Confusion means that each binary digit (bit) of the ciphertext should depend on several parts of the key, obscuring the connections ...


1

AES is a mode of operation, and confusion/diffusion are what we use to achieve a certain mode. AES is a block cipher, which replaces one fixed-length block of bits (plaintext) with another fixed-length block of bits (ciphertext) according to the key. A block cipher is not a mode of operation. Confusion and diffusion are a description of how AES behaves to ...


Only top voted, non community-wiki answers of a minimum length are eligible