2

I noticed that the wikipedia page for 'block cipher modes of encryption' states, "The disadvantage of this method is a lack of diffusion.", referring to ECB mode for block cipher encryption.

From some reading, ECB takes identical plaintext blocks to identical ciphertext blocks, as long as the key does not change. (making it insecure to use in general, as illustrated with the image of Tux the penguin on the aforementioned wiki page)

But my confusion is that this doesn't seem to have anything to do with diffusion? From reading,

Diffusion is an encryption operation where the influence of one plaintext symbol is spread over many ciphertext symbols with the goal of hiding statistical properties of the plaintext. [Paar, Understanding Cryptography 1st ed., 3.1.1]

Which seems to refer to the ability of an encryption method to obscure statistical properties such as those that arise in natural human language (for instance, letter frequencies) in order to stymie probabilistic attacks on the ciphertext.

Is there some other meaning/application of 'diffusion' that I'm not seeing at the moment?

WrinkleMonopoly
  • 21
  • 2
  • 1
    Consider that in ECB encryption, a plaintext symbol is a block of the plaintext (in the sense block has for the block cipher), and things should start to make sense. – fgrieu Oct 22 '21 at 16:44
  • 2
    I agree. Criticizing ECB on the basis of "lacking diffusion" seems to miss the mark in my opinion. It is true that one plaintext block influences only one ciphertext block in ECB. But CTR mode has an even more extreme "lack of diffusion" yet is much more secure than ECB. One plaintext *bit* influences only one ciphertext *bit* in CTR. – Mikero Oct 22 '21 at 18:41
  • ECB doesn't have the IV-reuse problem that can remove confidentiality. ECB enables block identification and as a result frequency attacks. – kelalaka Oct 22 '21 at 18:49
  • The diffusion is on the level of each block alone. Even in the CBC, if you change the last block, it will effect no other blocks. – user2357 Oct 23 '21 at 03:20

1 Answers1

2

I agree with your observation. The wiki's assessment of the weakness of ECB being a lack of diffusion is not very precise. I have a feeling that they're using diffusion in a generic sense, not the exact definition of diffusion in cryptography. Diffusion in the exact cryptographic sense happens inside the block cipher like AES.

What we need on the higher level (when we connect the block ciphers together, aka modes of operation) is randomization, not diffusion. Randomization, by using an IV or a nonce, makes sure that if an input (plaintext) is repeated, it will never produce the same output (ciphertext). This in fact gives us the notion of IND-CPA (indistinguishability against chosen plaintext attack). So in brief, ECB is broken because it doesn't meet the IND-CPA notion, not because of lack of diffusion. In plain English, if I choose two plaintext to be the same, I can easily distinguish the ciphertext (e.g. the Penguin example).

Wikipedia does not have the most precise language when it comes to cryptography. My advice if you want to learn more about the symmetric modes of encryption, is to either consult the NIST SP800 Recommendation for Block Cipher Modes of Operation or Rogaway's Evaluation of Some Blockcipher Modes of Operation.

hlayhel
  • 171
  • 6