Editing Confusion and diffusion (section)

==Practical applications==
Design of a modern [[block cipher]] uses both confusion and diffusion,{{sfn|Stamp|Low|2007|p=182}}
with confusion changing data between the input and the output by applying a key-dependent non-linear transformation (linear calculations are easier to reverse and thus are easier to break).

Confusion inevitably involves some diffusion,{{sfn|Daemen|Rijmen|2013|p=130}} so a design with a very wide-input [[S-box]] can provide the necessary diffusion properties,{{citation needed|date=April 2023}} but will be very costly in implementation. Therefore, the practical ciphers utilize relatively small S-boxes, operating on small groups of bits ("bundles"{{sfn|Daemen|Rijmen|2013|p=20}}). For example, the design of AES has 8-bit S-boxes, [[Serpent (cipher)|Serpent]] − 4-bit, [[BaseKing]] and [[3-way]] − 3-bit.{{sfn|Daemen|Rijmen|2013|p=21}} Small S-boxes provide almost no diffusion, so the resources are spent on simpler diffusion transformations.{{sfn|Daemen|Rijmen|2013|p=130}} For example, the [[wide trail strategy]] popularized by the [[Rijndael]] design, involves a linear mixing transformation that provides high diffusion,{{sfn|Daemen|Rijmen|2013|p=126}} although the security proofs do not depend on the diffusion layer being linear.{{sfn|Liu|Rijmen|Leander|2018|p=2}}

One of the most researched cipher structures uses the [[substitution-permutation network]] (SPN) where each [[Round (cryptography)|round]] includes a layer of local nonlinear permutations ([[S-box]]es) for confusion and a '''linear diffusion''' transformation (usually a multiplication by a matrix over a [[finite field]]).{{sfn|Li|Wang|2017}} Modern block ciphers mostly follow the  confusion layer/diffusion layer model, with the efficiency of the diffusion layer estimated using the so-called [[branch number]], a numerical parameter that can reach the value <math>s+1</math> for {{mvar|s}} input bundles for the perfect diffusion transformation.{{sfn|Sajadieh|Dakhilalian|Mala|Sepehrdad|2012}} Since the transformations that have high branch numbers (and thus require a lot of bundles as inputs) are costly in implementation, the diffusion layer is sometimes (for example, in the AES) composed from two sublayers, "local diffusion" that processes subsets of the bundles in a [[Bricklayer function|bricklayer]] fashion (each subset is transformed independently) and  "dispersion" that makes the bits that were "close" (within one subset of bundles) to become "distant" (spread to different subsets and thus be locally diffused within these new subsets on the next round).{{sfn|Daemen|Rijmen|2013|p=131}}

===Analysis of AES===
{{Unreferenced section|date=June 2019}}The [[Advanced Encryption Standard]] (AES) has both excellent confusion and diffusion. Its confusion look-up tables are very non-linear and good at destroying patterns.<ref>{{Cite book|title=Cryptography and Network Security: Principles and Practice, Global Edition|last=William|first=Stallings|publisher=Pearson|year=2017|isbn=978-1292158587|pages=177}}</ref> Its diffusion stage spreads every part of the input to every part of the output: changing one bit of input changes half the output bits on average. Both confusion and diffusion are repeated multiple times for each input to increase the amount of scrambling. The secret key is mixed in at every stage so that an attacker cannot precalculate what the cipher does.
None of this happens when a simple one-stage scramble is based on a key. Input patterns would flow straight through to the output. It might look random to the eye but analysis would find obvious patterns and the cipher could be broken.