Two properties every good cipher needs, one page to make them concrete. Read the definitions, then watch each property appear, or fail, in a 16‑bit toy cipher you can switch apart piece by piece.
Make the relationship between the key and the ciphertext as tangled as possible, so that no amount of ciphertext statistics hands the attacker a simple set of equations to solve for the key.
Spread the statistical structure of the plaintext across the whole ciphertext, so that every plaintext symbol influences many ciphertext symbols and local redundancy is dissipated.
Shannon asked how a cipher could resist an attacker who has unlimited ciphertext and unlimited patience for statistics. Natural language is redundant: letters, digrams and words have skewed frequencies. A cipher that leaves that redundancy intact, or maps the key to the ciphertext by a simple rule, gives the analyst something to solve.
Diffusion attacks the first problem. If each plaintext symbol influences many ciphertext symbols, any one statistic of the plaintext is smeared over long stretches of ciphertext, and the analyst needs far more material to detect it. In bit terms: flipping one plaintext bit should flip about half of the ciphertext bits, in unpredictable positions. This is the avalanche effect.
Confusion attacks the second. Even with the plaintext known, the map from key to ciphertext should not decompose into independent, simple relations. A cipher whose ciphertext bits are each a linear combination of key bits is solved by Gaussian elimination from a handful of known plaintexts, no matter how well it diffuses. Confusion means every ciphertext bit depends on many key bits nonlinearly.
The mnemonic and its limit. “Confusion hides the key, diffusion hides the plaintext” is the standard shorthand and it works. Just remember Shannon defined both properties in terms of ciphertext statistics, and a modern cipher wants avalanche with respect to key bits as well as plaintext bits.
Shannon's proposal was a product cipher: alternate a confusing operation with a diffusing one, and repeat. The toy cipher on this page is the 16‑bit SPN from Heys' cryptanalysis tutorial. Each round XORs in a round key, pushes each 4‑bit nibble through the same 4×4 S‑box, then permutes the 16 wires so every S‑box output bit lands in a different S‑box next round.
No affine equation over GF(2) reproduces this table. That non‑linearity is the only thing in the cipher that isn't a linear function of its inputs.
Bit i moves to position 4·(i mod 4) + ⌊i/4⌋: the 4×4 transpose. Output bit j of S‑box k becomes input bit k of S‑box j. A one‑bit change that an S‑box turns into two or three changed bits is scattered to two or three different S‑boxes next round, which is what makes the avalanche grow.
Round keys here come from a fixed rotate‑and‑add schedule. The schedule is linear on purpose: it keeps the demos honest about where the confusion actually comes from.
Two plaintexts that differ in the highlighted bits are encrypted side by side under the same key. Each row shows the XOR of the two internal states after that round: teal cells are bits that differ. Switch off the permutation and the difference stays trapped in one nibble. Switch off the S‑box and the single difference just wanders, one bit forever.
Rows: state bit after that round. Columns: plaintext bit flipped. Colour: how often it changes, over 96 random plaintexts. Full diffusion is a uniform mid‑teal square.
Bars: observed count of flipped ciphertext bits. Dashed outline: the ideal Binomial(16, ½) a random permutation would give. Diffusion means matching the outline, not maximising the flips.
What good looks like. After enough rounds the last row shows about 8 of 16 bits differing, with the positions changing as you move Δ. The average in the panel converges toward 8.0 under the full cipher. It is not 16: a cipher that flipped every bit would be just as predictable as one that flipped none.
Two ways to break it. Without the permutation, each nibble is its own independent 4‑bit cipher and the difference never leaves its lane. Without the S‑box, the whole cipher is C = P ⊕ f(K) for some fixed linear f, so the difference between two ciphertexts equals the difference between the plaintexts, moved around. Diffusion needs the nonlinear step to multiply differences and the permutation to spread them.
For a batch of random plaintexts, flip one key bit at a time and record which ciphertext bits change. Each cell is the probability that flipping key bit j (column) flips ciphertext bit i (row). A cipher with confusion paints the whole square a uniform mid‑tone: every key bit affects every ciphertext bit, about half the time, and no cell is predictable. A linear cipher paints a crisp pattern of certain and never, which is a system of equations written out in colour.
Reading the linear case. Turn the S‑box off. Every cell becomes exactly 0 or 1, and the panel lists the equations the map encodes: ciphertext bit i equals plaintext bit i XOR a fixed subset of key bits. One known plaintext–ciphertext pair gives 16 linear equations in 16 unknown key bits. Solve, done. The permutation slider changes which key bits appear in each equation, never the fact that they are equations.
Reading the confused case. With the S‑box on and a few rounds, the cells settle near 0.5 and none is outlined. There is still a deterministic function from key to ciphertext, but it has no short algebraic description: the attacker's “equations” are the cipher itself. That is what confusion means in practice, and it is why cryptanalysis of real ciphers has to settle for statistical approximations (linear and differential cryptanalysis) rather than direct solving.
Zoom into one 4×4 S‑box. The difference distribution table counts, for each input difference Δin (row) and output difference Δout (column), how many of the 16 inputs produce that pair. The linear approximation table counts, for each input mask (row) and output mask (column), how far the parity relation “mask·x = mask·S(x)” departs from holding half the time. A good S‑box keeps every entry small. Swap in an affine S‑box and watch each row collapse to a single certain entry: that is the picture of no confusion.
Difference table. The top row is trivial (no input difference, no output difference). Everywhere else, a large entry is a differential that holds with high probability through one S‑box; differential cryptanalysis chains such entries across rounds. The largest entry off the top row, divided by 16, is the best single‑round differential probability. AES's S‑box holds this to 4/256.
Linear table. An entry of ±8 means a linear relation between input and output bits holds always or never: the S‑box is affine along that mask. Entries near 0 mean the relation is a coin flip. Linear cryptanalysis needs about 1/ε² known plaintexts for a bias ε, so small entries here translate directly into more material than an attacker can get.
Type any English text. A monoalphabetic substitution replaces letters but leaves each ciphertext letter depending on exactly one plaintext letter, so the frequency profile survives with the bars relabelled. A columnar transposition scatters positions but never touches letter values, so the histogram is identical. Either way the analyst starts with the same letter counts they would have had for the plaintext.
Combining the two is Shannon's product cipher, and a product of a weak substitution with a weak transposition is already much harder than either: the substitution stops the histogram from being trivially the plaintext's, and the transposition stops each ciphertext symbol from being a function of one plaintext symbol. Iterate the pair with a fresh key contribution each round and you arrive at the SPN above.
| Cipher | Confusion comes from | Diffusion comes from | Key enters via |
|---|---|---|---|
| AES (SPN, 128‑bit block) | SubBytes: the byte‑wise S‑box built from inversion in GF(2⁸) plus an affine map, chosen for low differential and linear bias. | ShiftRows moves bytes across columns; MixColumns multiplies each column by an MDS matrix so one changed byte affects all four. Full diffusion in two rounds. | AddRoundKey, XOR of a 128‑bit round key each round. |
| DES (Feistel, 64‑bit block) | Eight 6→4 S‑boxes in the round function f, the only nonlinear component. | The expansion E duplicates bits into two S‑boxes, and the permutation P scatters S‑box outputs; the Feistel swap carries them to the other half. | XOR of a 48‑bit subkey with the expanded half‑block inside f. |
| ChaCha20 (ARX stream cipher) | 32‑bit modular addition: carries make it nonlinear over GF(2), which is the only nonlinearity in ARX designs. | Rotations and XORs in the quarter‑round move bits across word positions; the column/diagonal round schedule spreads across the 16‑word state. | Key, nonce and counter fill the initial state; the final feed‑forward addition makes the permutation one‑way. |
The pattern is constant across designs: one cheap nonlinear operation supplies confusion, one cheap linear operation supplies diffusion, and rounds multiply their effect. Designers choose S‑boxes for resistance to differential and linear cryptanalysis, and linear layers for a high branch number, which is a guarantee about how many S‑boxes any difference must pass through.
All of these are necessary, none sufficient. A cipher can pass every avalanche test and still fall to an attack that exploits algebraic structure, weak key schedules or side channels. Confusion and diffusion tell you what a cipher must at least do; cryptanalysis tells you whether it did it well enough.
“More rounds means more diffusion.” Diffusion saturates: once every bit depends on every other with probability ½, extra rounds do not add more. They add security margin against attacks that trace probabilistic paths through the rounds, which is a different quantity.
“Diffusion means a small change changes everything.” It means about half, at unpredictable positions. A cipher that reliably flipped all 16 bits would be one XOR away from leaking the difference unchanged.
“Confusion and diffusion are separate layers you can grade separately.” The demos let you toggle them for teaching, but in practice each depends on the other: the S‑box only multiplies differences that the permutation delivers, and the permutation only spreads differences the S‑box created.