Confusion, diffusion and attack models
Shannon's confusion and diffusion defined and distinguished, then the four cryptanalytic attack models (ciphertext-only, known-plaintext, chosen-plaintext and chosen-ciphertext), each with what the attacker has and what it buys them.
- State Shannon's definitions of confusion and diffusion, and say which technique achieves each.
- Distinguish the four cryptanalytic attack models by what the attacker has and what they can do.
- Match a real-world attack to the attack model it demonstrates.
14 min read
Intuition
A cipher can fail in two independent ways: the ciphertext might leak something about the key, or it might leak something about the plaintext’s own structure. Shannon split “make it strong” into two separate design goals so each could be checked on its own. Confusion targets the first leak, diffusion the second.
Mechanism
Confusion makes the relationship between ciphertext and key as complex and unpredictable as possible: each symbol of ciphertext should depend on several symbols of the key, so an attacker holding ciphertext gains as little traction as possible on recovering the key. Substitution is what builds confusion: replacing a symbol with another, in a way chosen to obscure the key’s fingerprint.
Diffusion spreads the influence of each plaintext bit across many ciphertext bits, so that patterns in the plaintext do not survive into the ciphertext. Every symbol of ciphertext should depend on many symbols of plaintext, and on average, flipping a single plaintext bit should flip about half of the ciphertext bits. Transposition is what builds diffusion: moving bits or characters around according to a pattern, spreading plaintext structure across the whole output.
Compare
Targets the relationship between ciphertext and key. Built from substitution. Goal: hide the key. Each ciphertext symbol depends on several key symbols.
Targets the relationship between ciphertext and plaintext. Built from transposition. Goal: blur plaintext structure. Each ciphertext symbol depends on many plaintext symbols; a single flipped plaintext bit should flip about half the ciphertext bits.
Pitfall
Confusion and diffusion are named for what they blur, not for what causes them. Confusion blurs the ciphertext-key relationship and comes from substitution; diffusion blurs plaintext structure and comes from transposition. Swapping which technique achieves which goal is a common mistake, and one the exam tests directly.
Exam detail
Modern block ciphers build both properties in structurally: substitution boxes for confusion, permutation boxes for diffusion, chained across many rounds. Later topics in this module cover exactly that construction.
Mechanism
A cryptographic system is compromised if an adversary can recover plaintext from ciphertext without authorisation, or recover the decryption key from the encryption key . Cryptanalysis is the science of decrypting without knowledge of the key, and the four standard attack models rank how much the attacker gets to work with.
Mechanism
Ciphertext-only: the attacker sees only ciphertext, nothing else, the weakest position an attacker can be in. Example: intercepted WWII military communications, with no known plaintext and no way to submit chosen messages, where the challenge is decrypting purely from the intercepted ciphertext.
Known-plaintext: the attacker has some plaintext and its corresponding ciphertext, but did not choose either. Example: Bletchley Park’s break of the Enigma cipher relied on known plaintext phrases, such as routine weather reports, that cryptanalysts could expect to appear, paired with the ciphertexts those messages produced.
Mechanism
Chosen-plaintext: the attacker picks a plaintext of their choosing and observes the resulting ciphertext, the standard model used to analyse asymmetric cryptography, since anyone can encrypt with a public key. Example: the BEAST attack on SSL/TLS chose plaintext blocks and studied the resulting ciphertext blocks to recover secret information.
Chosen-ciphertext: the attacker picks a ciphertext and gets back its decrypted plaintext, an oracle attack. Example: Bleichenbacher’s attack on PKCS#1 v1.5 exploited a decryption oracle, submitting crafted ciphertexts and studying the decrypted outputs to eventually recover the secret key.
Compare
Ciphertext-only: sees ciphertext alone.
Known-plaintext: also has
plaintext/ciphertext pairs, but did not choose them.
Chosen-plaintext: submits a plaintext, gets back its ciphertext.
Chosen-ciphertext: submits a ciphertext, gets back its plaintext.
Exam detail
The four models form a ladder of increasing attacker strength, in the order given above. Any attack a ciphertext-only attacker can mount, a known-plaintext attacker can also mount, and so on up the ladder: a cipher secure against chosen-ciphertext attacks is automatically secure against all three weaker models too.
Recall
An attacker submits crafted ciphertexts to a decryption service and studies the errors it returns. Which attack model is this?
Chosen-ciphertext: the attacker chooses the ciphertext and observes what decrypting it reveals, exactly the oracle structure behind Bleichenbacher’s attack on PKCS#1 v1.5.
Source
Week 4 notes PDF