18
votes
Accepted
Understanding the wide trail design strategy
Given the importance of the wide-trail strategy in modern symmetric-key cryptography, this question really deserves an answer (and a much better score). Since nobody else has tried, I'll give a brief ...
- 1,876
14
votes
Accepted
How 2 rounds in AES achieve full diffusion?
AES diffusion is taking cared of by 3 main functions:
SubBytes
Shift Rows
Mix Columns
SubBytes works as a 8-bit S-box. Thus if one bit change, the 8 bits of the byte are likely to change. With this ...
- 10k
11
votes
How does AES introduce confusion and diffusion?
Put simply:
The add key layer ensures the encryption function is only computable by someone who knows the key
Adds some confusion because the key is (psuedo) random
The subBytes s-box layer creates ...
- 19.8k
10
votes
Accepted
Confusion and Diffusion in the AES functions
I should start by saying that the notions confusion and diffusion can not provide an in-depth understanding of the design of the AES, simply because they are not specific enough. Instead, the key to ...
- 1,876
6
votes
Which sub operation is more expensive in the AES encryption process?
The table lookup implementations usually combine the SubBytes and ShiftRows steps with the MixColumns step.
Different implementations/hardware/etc make general statements impossible, but this paper ...
- 1,463
5
votes
Accepted
Prove the branch of number of Advanced Encryption Standard
The dear user @kodlu has answered to the similar question with excellent discussion but I want to answer with linear algebra argument.
We have two definitions for MDS (Maximum Distance Separable) ...
- 204
4
votes
Accepted
What does this notation means $\mathbb{F}_{2^{-}}$?
You've been confused by the placement of the "-".
It's not $\mathbb F_{2^-}$ (Latex: $\mathbb F_{2^-}$), this does not exist. What was actually meant is $\mathbb ...
- 46.3k
4
votes
Accepted
How do we reduce the multiplications in the AES mix column layer using $x^4 +1$
The $x^4+1$ is implicit in the matrix.
What you are doing is that you consider formal sums $z_0 + z_1 \alpha + z_2 \alpha^2 + z_3 \alpha^3$ for $z_i$ elements of the field $\mathbb{F}_{256}$, and a ...
- 87.7k
4
votes
How can I get the binary form of AES's MDS matrix in MixColumns tranformation?
Concretely, given an element $x \in$ GF($2^8$), to multiply it by 2, we simply do a left shift and xor with 0b100011011 if the result of the shift gets above 0b11111111 (255). To multiply by 3, we ...
- 121
4
votes
Which sub operation is more expensive in the AES encryption process?
If you are doing a software implementation, the MixColumns would take the longest because you have to do a multiply after pulling from memory and then putting it back. Generally speaking, in ...
- 4,950
4
votes
Accepted
Confusion+Diffusion comparison table? (e.g. with Avalanche Criterion / SAC)
xor-streaming ciphers have no (0, zero, zilch) diffusion - you switch 1 bit in the ciphertext, you know which single bit in the plaintext after decryption will be flipped.
Indeed, there is no ...
- 144k
3
votes
How to check whether function provides full diffusion or not?
Diffusion is the same as mixing.
Read section 8.3 as they suggest. A lot of it for this simple structure depends on the choice of the rotation constants, and those were experimentally optimized using ...
- 23.1k
3
votes
Is 50% of bits changed in every round always gives 50% of changed bits in the end?
If we have such property that every round change 50% of bits, how to be sure that in many rounds in the end we will also end up with 50% of bits changed?
Well, obviously one can construct artificial ...
- 150k
3
votes
Accepted
How to calculate the branch number of a linear mapping?
As explained in the answer to the question here
the branch number of a linear mapping
$$
A:F_q^n \rightarrow F_q^n, \quad x\mapsto A\cdot x
$$
is the minimum weight of the linear code generated by the ...
- 23.1k
3
votes
Accepted
How can I get the binary form of AES's MDS matrix in MixColumns tranformation?
Here is a Sage code that creates the MDS matrix over $F_2$.
...
- 80
3
votes
How can I get the binary form of AES's MDS matrix in MixColumns tranformation?
This question can be used to get what you want.
There we use bytes (so expand those to bits) and you have to use extra XOR's (i.e. binary additions) to get the field multiplications.
- 3,852
3
votes
Accepted
Early propagation of carries in the BLAKE hash function
This is already covered by Ella's response, but in short the added nonlinearity at the start buys you very little in terms of security, compared to its cost in number of operations. It would be more ...
- 12.8k
3
votes
Algorithm for symmetric encryption (diffusion without confusion)?
It should be hard to perform a KPA. I believe the diffusion concept makes it hard to perform such an attack?
Assuming the context of traditional symmetric encryption: confusion (combined with ...
- 19.8k
3
votes
Accepted
Is there a 4 by 4 NMDS matrix which is better than M= [[0,1,1,1], [1,0,1,1], [1,1,0,1], [1,1,1,0]] used in MIDORI?
Let us consider "bricklayer" designs such as AES, MIDORI, SKINNY and MANTIS where such matrices are used to "mix columns" of 4 4-bit or 8-bit cells which make up the state. The ...
- 25.4k
2
votes
Accepted
Full diffusion or Partial diffusion between s-box applications?
If the linear diffusion layer were applied twice without applying the s-boxes between them, it is possible there might be an iterative differential characteristic with only four active s-boxes per ...
- 4,465
2
votes
AES Diffusion at Block Level
That depends on how you define sufficient. AES achieves full diffusion after only two rounds, where diffusion is defined as the ability for every bit in the state to affect every other bit. That does ...
- 15.4k
2
votes
Early propagation of carries in the BLAKE hash function
What are the benefits of guaranteeing early propagation of carries
Addition without carries is equivalent to XOR. Consider the addition of the following two bit strings performed modulo $2^8$:
...
- 19.8k
2
votes
Why is confusion and diffusion never talked about in asymmetric crypto?
The topic is a little dated, but similar concepts are discussed using slightly different language. People have questioned whether the computation of individual bits of discrete logarithms, or RSA ...
- 25.4k
2
votes
ECB... lacks diffusion(?)
I agree with your observation. The wiki's assessment of the weakness of ECB being a lack of diffusion is not very precise. I have a feeling that they're using diffusion in a generic sense, not the ...
- 376
2
votes
Accepted
does OFB mode has diffusion on the plaintext?
if we will change one bit in the plaintext, more than one bit will be changed in the ciphertext?
In Output Feedback Mode, no, it does not. Specifically, if you change one bit of the plaintext and ...
- 150k
2
votes
Accepted
What's the difference between confusion/diffusion and mode of operation?
AES is a mode of operation, and confusion/diffusion are what we use to achieve a certain mode.
AES is a block cipher, which replaces one fixed-length block of bits (plaintext) with another fixed-...
- 19.8k
2
votes
Accepted
Application of MDS matrices in serial and round-based implementations
what types of MDS matrices can be applied to serial or round-based
implementations or both of them?
Serial matrices utilise a trade-off to reduce hardware requirement while incurring additional ...
- 2,268
2
votes
Accepted
What are “weak” and “strong” output-input bit dependencies?
There can be various measures of bit dependency. A classical measure would be how close the process is to achieving what Claude Shannon termed diffusion, which is sometimes termed the strict avalanche ...
- 25.4k
2
votes
Shannon's Diffusion: classical ciphers vs modern ciphers
Many resources describe diffusion as Changing one symbol in the plain text should affect many positions of the ciphertext.
That's a proper definition of a particular kind of diffusion: plaintext-to-...
- 144k
Only top scored, non community-wiki answers of a minimum length are eligible