Difference between Confusion and Diffusion in Cryptography

A ciphertext has the possibility of being broken by using statistical analysis that could provide some information on the frequency of characters, which can then be compared to common characters in a known language. For example, the letter 'e' has the highest usage in English language and therefore a cryptanalyst may match the highest frequency of a character in the ciphertext to letter 'e' and starts attacking the ciphertext. Similarly, a digram like 'th' or trigram like 'the' can also be used, as they have the highest usage in English. The same method can then be experimented with other letters, until a reasonable number of characters could be revealed to break the ciphertext.

For a ciphertext to be secure enough, it is important that statistical or frequency analyses on the ciphertext would not yield enough information to break it. This is possible by providing "confusion" and "diffusion" through the encryption process.

The purpose of confusion is to make the relationship between the ciphertext and its key to be as complex as possible. The encryption operation performed should keep the relationship between the key and ciphertext obscured. The goal of confusion is - even if the cryptanalyst has some knowledge about the statistics, it would still be difficult to deduce the key.

Claude Shannon proposed that to make it hard for the statistical attacks, the cryptographer could dissipate the statistical structure of the plaintext, in the long range statistics of the ciphertext. This process is called as diffusion. This is possible if many of the plaintext characters can affect each of the ciphertext characters. When such a process takes place, the ciphertext characters will no longer have matching characters in the plaintext in terms of statistics.

In binary block ciphers, such as Data Encryption Standard (DES) and Advanced Encryption Standard (AES), diffusion can be provided by applying permutations on the plaintext data.The output data from the permutations can then be channeled to a function that will produce the ciphertext. This will complicate the statistics of the ciphertext. 

In DES and AES, confusion is done by using substitution while diffusion is achieved by using permutation. More will be discussed on these in other posts.

Cryptanalysis and Types of Attacks on Ciphertexts

Cryptanalysis is the process of analyzing the ciphertext or cryptogram to discover the actual text (plaintext) or the key used in the cryptosystem. There are a number of strategies to do this but the chosen strategy usually depends on the characteristics of the encryption scheme used and how much information is available about the ciphertext.

An encryption scheme is considered to be secure if the ciphertext created using the cryptanalysis methods could not provide enough details or information that can be helpful in determining the corresponding plaintext.

The types of attacks are:

• Ciphertext only
• Known plaintext
• Chosen plaintext
• Chosen ciphertext

In ciphertext only attack, only the ciphertext is available for analysis. The attacker do not have any other knowledge about the actual message.

In the known plaintext attack, the plaintext and ciphertext pair(s) is(are) available. The secret key is not known.

In the chosen plaintext attack, the pair of plaintext and ciphertext is available. The attacker may have temporary access to the encryption process and therefore can choose plaintexts and generate the corresponding ciphertexts. The possibility of such an attack is not high. Systems that can withstand such an attack is considered very secure. In this type of attacks, the goal is to recover the secret key.

In the chosen ciphertext attack, the attacker can choose a random ciphertext and find some information from the corresponding decrypted plaintext. In this type of attack, the attacker may have temporary access to the decryption process. During this temporary availability, the attacker can choose ciphertexts and generate the corresponding plaintexts.

Chances of Breaking Cryptograms in Different Scenarios

Suppose that an attacker intercepts a cryptogram and wants to try an exhaustive key search to find the message. What are his chances if:

(a)      he does not know the encryption algorithm used

Plaintext | Algorithm | Key | Ciphertext

Without the knowledge of the plaintext and algorithm, the attacker will have the highest level of difficulty in figuring out the message. The attacker may not be able to retrieve the message.

This also known as Cipher-text Only Attack.

(b)     he knows the algorithm but has no other information except that the plaintext is random

Plaintext | Algorithm | Key | Ciphertext

The attacker has chances of retrieving the message. However, this may still be very time-consuming as the plaintext could be in any language.

This attack probably still falls under the Chosen Plaintext Attack.

(c)      he knows the algorithm used and that the message is in English

Plaintext - English | Algorithm | Key | Ciphertext

The attacker has better chances of successfully gaining the message. The knowledge that the plaintext is in English can greatly reduce the time as all the other languages can be eliminated.

(d)     he knows the algorithm and has some corresponding plaintext/ciphertext obtained by using the same key

Plaintext | Algorithm | Key | Ciphertext

The attacker has very high chances of being able to retrieve the message as he has the algorithm, has the pairs and the key. With all the available information, the attacker will have the best opportunity to successfully gain the message compared to the all the other attacks described above.

This falls under the Chosen Chiper-text Attack.

Main Differences Between Symmetric and Public Key Cryptography

Symmetric key cryptography systems use the same key for both to encrypt the plaintext and to decrypt the ciphertext. Symmetric key systems have the advantage of being simple and fast. However, the important factor to be considered is that the parties involved must exchange the key in a secured way.

In comparison to symmetric key, public key cryptography systems use different keys to encrypt to plaintext and to decrypt the ciphertext.

Public key uses 2 different keys – a public key for encryption and a private key for decryption. Using this encryption system, the public key can be distributed in a non-secure way. The private key is never transmitted and is only available at the recipient’s side. As the keys are different, the decryption of the chipertext computationally is assumed to be not feasible without the private key.

Differences between Cryptography, Steganography and Digital Watermarking

Cryptography is defined as the art and science of secret writing. The word itself comes from Greek where the words kruptos (κρυπτοσ) and graphen (ϒραφην) mean secret and writing, respectively. The focus in cryptography is to protect the content of the message and to keep it secure from unintended audiences.

The purpose of cryptography is to create schemes or protocols which can still complete the intended tasks even in the presence of an adversary. Cryptography’s main task is to ensure users able to communicate securely over an insecure channel. This communication however must ensure the transmission’s privacy and authenticity. [1]

Steganography is the art and science of hiding information in ways that prevent the detection of hidden messages. Steganography literally means “covered writing” and is usually interpreted to mean hiding information in other information. Comparing it to cryptography, steganography has its advantage because the message itself will not attract the audiences, as the very nature of a steganography system is to hide the message in an imperceptible manner.

Another definition given for steganography is “hiding in plain sight”. The message is still in the open, but it goes undetected because the existence of the message itself is a secret. It is explained as a communication that takes place in open, but unless they are in the know (the sender or recipient), the message goes unnoticed. [2]

Watermarking is the process of embedding a message on a host signal.  Watermarking, as opposed to steganography, has the additional requirement of robustness against possible attacks. A watermark can be either visible or invisible.

Using digital watermarking, copyright information can be embedded into the multimedia data. This is done by using some algorithms. Information such the serial number, images or text with special significance can be embedded. The function of this information can be for copyright protection, secret communication, authenticity distinguish of data file, etc. [3]

In cryptography, the message is usually scrambled and unreadable. However, when the communication happens, it is known or noticed. Although the information is hidden in the cipher, an interception of the message can be damaging, as it still shows that there is communication between the sender and receiver. In contrast, steganography takes a different approach in hiding the evidence that even a communication is taking place.[2]

Some of the differences between steganography and watermarking are [4]:

• the information hidden by a watermarking system is always associated to the digital object to be protected or to its owner while steganographic systems just hide any information
• “robustness” criteria are also different, since steganography is mainly concerned with detection of the hidden message while watermarking concerns potential removal by a pirate
• steganographic communications are usually point-to-point (between sender and receiver) while watermarking techniques are usually one-to-many

References:

1. Coron, J.-S., What is cryptography? IEEE Security and Privacy, 2006. 4(1): p. 70-73.
2. Wiles, J. and R. Rogers, Techno Security's Guide to Managing Risks for IT Managers, Auditors, and Investigators. Security & Networking. 2007: Syngress. 1.
3. Jiang, X. Digital watermarking and its application in image copyright protection. in 2010 International Conference on Intelligent Computation Technology and Automation, ICICTA 2010, May 11, 2010 - May 12, 2010. 2010. Changsha, China: IEEE Computer Society.
4. Stefan Katzenbeisser, Fabien A. P. Petitcolas, “Information Hiding Techniques for Steganography and Digital Watermarking”, 2000, pp. 2.