Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I don't understand what an active s-box is (in reference of design criteria 8 of the DES).

Because according to DES, all 8 s-boxes are used every round. But this is not what active means.

So my question: What is an active S-Box, and what does it mean when an s-box is active (or when two or three s-boxes are active)?

share|improve this question

You run the algorithm with two different plaintexts (whose difference is usually small – just a few bits, everything else being equal).

Wherever these plaintexts lead to different inputs to an S-box (in any layer/round of the algorithm), we call this S-Box “active” (since the other S-boxes produce the same result for both plaintexts, they are called “passive” and are not considered further).

share|improve this answer

A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are not talking specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes.

Specifically, they are talking in regards to linear/differential characteristics over a given round count. When the differences for the characteristic are either both zero or both nonzero, the characteristic is considered consistent. Any s-box where the input/output masks for this characteristic are nonzero is considered active.

Any substitution that passes through a linear transformation can then be branched into the next substitution. In AES, there is the MixColumns transformation between the nonlinear s-box of one round and the next. This linear transformation has a branch number of 5, resulting in 5 active s-boxes across 2 rounds.

This is probably not the best description, it may be better to read the initial papers on linear and differential cryptanalysis and come up with a better definition, since mine may not be applicable to a Feistel cipher.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.