Dispersion and Diffusion

In Shannon’s landmark 1949 paper Communication Theory of Secrecy Systems, the idea of diffusive functions is briefly mentioned. We consider two common definitions of such functions mapping between binary strings of fixed length. Given the dimension of the input space, we determine the minimum dimension of the output space for which such a function exists, by explicit construction and with respect to each definition. It will follow that each larger output dimension allows for such a function as well. It has been noted in cryptography conferences and workshops that diffusion is a desirable property for certain functions. However, what is diffusion precisely? Shannon [1] says “In the method of diffusion the statistical structure of M which leads to its redundancy is “dissipated” into long range statistics i.e. into statistical structure involving long combinations of letters in the cryptogram. The effect here is that the enemy must intercept a tremendous amount of material to tie down this structure, since the structure is evident only in blocks of very small individual probability. Furthermore, even when he has sufficient material, the analytical work required is much greater since the redundancy has been diffused over a large number of individual statistics.” Our functions will map between fixed length strings of 0s and 1s. One notion is that if a bit is flipped (0 to 1, or 1 to 0) in any fixed input, then some half of the bits in the corresponding output flips; we call this dispersion. A second concept is that if a bit is flipped in any fixed input, then, for each bit in the corresponding output, the probability of it flipping is half; we accept this as diffusion. Some make no distinction between the two, but we will see that the terms are not interchangeable. Definition. For each n ∈ Z: 1. The set of n-bit binary strings are n-tuples of elements from F2 = {0, 1}, denoted by F n 2 . The bits of each x ∈ Fn2 are indexed from 1 to n, from left to right. 2. The XOR binary operation ⊕ on Fn2 is defined as bitwise “addition” in the field F2. A generalization to arbitrary pairs of finite bit strings is that 0s are first appended to the left of the shorter string to force the same length. 3. The Hamming weight w : Fn2 → Z of x ∈ F n 2 is the number of non-zero bits of x. 4. The Hamming distance h : Fn2 × F n 2 → Z between x, y ∈ F n 2 is the number of bits on which they disagree, so h(x, y) = w(x ⊕ y). 5. An injective function f : Fn2 → F m 2 is said to be dispersive if m is even and ∀x, y ∈ Fn2 : h(x, y) = 1 =⇒ h(f(x), f(y)) = m 2 . 6. For each i ∈ Z such that 1 ≤ i ≤ n, let πi : F n 2 → Z be defined by taking i th bit of the input, and mapping 0, 1 ∈ F2 to 0, 1 ∈ Z respectively. 7. Let En = {{x, y} ⊆ F n 2 : h(x, y) = 1}, which is all pairs at a distance of 1, so it is our sample space. It follows from elementary combinatorial reasoning that the cardinality of En is n2 . [email protected]