Branch number

In cryptography, the branch number is a numerical value that characterizes the amount of diffusion introduced by a transformation F that maps an input vector u to output vector v: $v=F(u)$. The value is produced by:

1. applying nonzero values of u (i.e., values that have at least one non-zero component of the vector) to the input of F;
2. counting for each input value the number of nonzero components in both u and v;
3. finding out the smallest count for all nonzero input values.

If both u and v have s components, the result is obviously limited on the high side by the value $s+1$ (any single nonzero component on u makes all components of v to be non-zero). A high branch number suggests higher resistance to the differential cryptanalysis: in the (usual) case of linear F small variations of input will produce large changes on the output and in order to obtain small variations of the output, large changes of the input value will be required.

The concept was introduced by Daemen and Rijmen in early 2000s and quickly became a typical tool to access the diffusion properties of the transformations.

Sources

• Liu, Meicheng; Sim, Siang Meng (25 July 2016). "Branch Number of the Diffusion Layer". In Thomas Peyrin (ed.). Fast Software Encryption: 23rd International Conference, FSE 2016, Bochum, Germany, March 20-23, 2016, Revised Selected Papers. Springer. pp. 101–121. ISBN 978-3-662-52993-5. OCLC 1008648217.
• Zhang, Wentao; Wu, Wenling; Feng, Dengguo; Su, Bozhan (2009). "Some New Observations on the SMS4 Block Cipher in the Chinese WAPI Standard". Information Security Practice and Experience. Springer Berlin Heidelberg. pp. 324–335. doi:10.1007/978-3-642-00843-6_28. eISSN 1611-3349. ISSN 0302-9743.