This is a statistical companion to the 3D single-trial AES round animation: instead of watching one pair of plaintexts diverge, it runs a real AES-128 key schedule and round function (independently implemented in this page — SubBytes, ShiftRows, MixColumns, AddRoundKey) over many independent trials, each with a freshly random key and plaintext pair differing by exactly one bit, and asks a statistical question: for a given output bit, across many random trials, what fraction of the time does it end up different between the two ciphertexts?
for each trial:
key, plainA random; plainB = plainA with 1 random bit flipped
for round r = 0..10: apply AES round r to both states
for each of 128 bits: count[r][bit] += (bitA != bitB)
P(round, bit) = count[round][bit] / trials
The heatmap plots P(round, bit) as a 128-row × 11-column grid: blue means that bit almost never flips yet, red means it (almost) always flips, and the target teal-green band is 50% — the strict avalanche criterion. Round 0 (just the initial AddRoundKey) is a pure XOR, which is linear and does not diffuse at all, so exactly 1 of 128 bits differs, 100% of the time, in every single trial. From round 1 onward, SubBytes' non-linearity and MixColumns' byte-mixing spread that single difference across more and more bits, and by round 3–4 nearly every bit is statistically a coin flip.
- Run Batch — executes the chosen number of fresh independent trials and folds their bit-flip counts into the running heatmap and curve.
- Auto-Run — keeps running batches at the chosen rate so the estimate keeps tightening (more trials shrink the sampling noise, visible as the curve's bit-to-bit std-dev shrinking toward the theoretical binomial value
√(0.25/N)).
- Reset — clears all accumulated trial statistics and starts the estimate over from zero.
Why it matters: a cipher only resists differential and linear cryptanalysis if every output bit is statistically independent of small input changes, not just on average — a bit that is reliably biased even after several rounds would be a real weakness. This view exposes that per-bit uniformity directly, which a single-trial animation cannot show.