Incryptography, theavalanche effect is the desirable property of cryptographicalgorithms, typically block ciphers[1] andcryptographic hash functions, wherein if an input is changed slightly (for example, flipping a single bit), the output changes significantly (e.g., half the output bits flip). In the case of high-quality block ciphers, such a small change in either thekey or theplaintext should cause a drastic change in theciphertext. The actual term was first used byHorst Feistel,[1] although the concept dates back to at leastShannon'sdiffusion.
If a block cipher or cryptographic hash function does not exhibit the avalanche effect to a significant degree, then it has poor randomization, and thus acryptanalyst can make predictions about the input, being given only the output. This may be sufficient to partially or completely break the algorithm. Thus, the avalanche effect is a desirable condition from the point of view of the designer of the cryptographic algorithm or device. Failure to incorporate this characteristic leads to the hash function being exposed to attacks includingcollision attacks,length extension attacks, andpreimage attacks.[2]
Constructing a cipher or hash to exhibit a substantial avalanche effect is one of the primary design objectives, and mathematically the construction takes advantage of thebutterfly effect.[3] This is why most block ciphers areproduct ciphers. It is also why hash functions have large data blocks. Both of these features allow small changes to propagate rapidly through iterations of the algorithm, such that everybit of the output should depend on every bit of the input before the algorithm terminates.[citation needed]
Thestrict avalanche criterion (SAC) is a formalization of the avalanche effect. It is satisfied if, whenever a single input bit iscomplemented, each of the output bits changes with a 50% probability. The SAC builds on the concepts ofcompleteness and avalanche and was introduced by Webster and Tavares in 1985.[4]
Higher-order generalizations of SAC involve multiple input bits.Boolean functions which satisfy the highest order SAC are alwaysbent functions,also called maximally nonlinear functions,also called "perfect nonlinear" functions.[5]
Thebit independence criterion (BIC) states that output bitsj andk should change independently when any single input biti is inverted, for alli,j andk.[6]
{{cite book}}: CS1 maint: location missing publisher (link)