(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

learn more… | top users | synonyms

5
votes
1answer
226 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
-2
votes
1answer
73 views

What is the security gain of applying Two S-boxes in Different Ways?

In a 128-bits Feistel Cipher: I need suggestions about two variations of the Round Function Variation-1 $64$ bit input is divided into $8$ bytes Byte $0,1,2,3$ are substituted with Sbox1 Byte ...
1
vote
2answers
50 views

Converting a 5-bit s-box to its bit-sliced format

I'm currently trying to convert a 5-bit sbox (the one from this cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf) to its bit-sliced format (i.e. to a boolean network). Most papers ...
0
votes
0answers
33 views

Can we use more than one irreducible polynomial in AES?

I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key ...
1
vote
0answers
26 views

AES - Size of T-Boxes and obtaining T-Box values

In article "A high performance ST-Box based unified AES encryption/decryption architecture on FPGA" (http://www.sciencedirect.com/science/article/pii/S0141933115001945) two 32Kb dual-port BRAMs are ...
1
vote
1answer
75 views

DES: Computing the output of S-Box 1?

If the 48-bit input to the S-box is 0xAAAAAAAAAAAA, what are the first four bits emitted by S-box 1? Answer: 0110 I know that an S-Box takes n inputs and give m outputs and that n != m, but I really ...
0
votes
0answers
51 views

I am trying to understand how AES works

I am trying to understand how AES encryption operates. I am trying to run through the steps on paper to understand. So far, I am creating a simple example. I have the plain text "MESSAGE TESTTEXT" ...
1
vote
0answers
69 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
3
votes
1answer
103 views

Why is not there any ideal S-Box?

i read about linear cryptanalysis and about S-Box that there is not any ideal S-Box (ideal S-Box is a random S-Box in another words S-Box that bias of input and output bits is zero) then i read about ...
0
votes
0answers
43 views

Active s-box of 8x8 MDS for AES

one way to enhance the security of AES by increasing the number of active s-boxes .larger MDS matrices are used to increase the number of active s-boxes. using 4x4 MDS matrix generate 25 active s-box ...
2
votes
2answers
75 views

BOOLEAN FUNCTIONS: generate a function $f: \{0, 1\}^n \rightarrow \{0, 1\}$ from a $n \times n$ S-Box

I want to calculate the hamming weight of a S-Box using this formula: $\text{hw}(f) = \sum_{x=0}^{2^n-1} f(x)$. Where $f: \{0, 1\}^n \rightarrow \{0, 1\}$ My problem is that I don't know how to get ...
4
votes
0answers
38 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
0
votes
0answers
48 views

What are the negative consequences for choosing 8 S-boxes for DES vs 1 S-box for AES?

DES has 8 different S-boxes, and AES has only 1. What are the negative consequences of such choices?
0
votes
1answer
136 views

How does non-linearity (S-box) add security to AES?

I'm trying to understand how AES guarentees security. One of the named points on the web is that AES uses a non-linear step (the SubBytes step). But how exactly does the Rijndael key schedule add ...
3
votes
1answer
240 views

How to build a difference distribution table?

i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...
1
vote
1answer
124 views

DES and using the S-Box 1

Can someone please check my work and correct me if I am wrong, I am just starting to learn about DES. I am trying to solve the following problem: Show that ...
1
vote
2answers
100 views

AES S-Box Affine Mapping - how to do it?

For the byte substitution layer in AES how do we determine B(i)? I follow how to use the multiplicative inverse table and using that to get B`(i), but how do I actually calculate the affine mapping? ...
0
votes
0answers
84 views

How do we generate AES S-BOX?

I am new to AES and I am too much confused about the generation of S-box in AES. I don't have any idea of $GF(2)^8$ field and how the things are happening around. Please answer this question with a ...
3
votes
0answers
110 views

How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...
-1
votes
1answer
66 views

Are more S boxes more secure in a SP-Network?

The classic DES uses 8 different fixed S boxes. If computer memory was not an issue, would say 800 different S boxes be more secure? I'm thinking of a SP-network that would only run on a server like ...
1
vote
1answer
101 views

How to generate the APA SBox?

I am trying to generate the S-Box provided in the Affine Power Affine paper (PDF) but I'm not sure I understand it fully. The essence of the paper is this: ...
0
votes
1answer
83 views

AES inversion operation in sub byes

I was wondering why in the AES sub-bytes operation one can represent the inversion as computing $x^{254}$. What is the reason for this? Moreoever, I was wondering what the text on page 212 of ...
0
votes
1answer
115 views

What makes this mixer function resistant to differential cryptanalysis?

I recently learned how differential cryptanalysis works, and decided to have a play around with testing various designs for resistance against attack. My testing algorithm is essentially to loop ...
2
votes
0answers
156 views

How to calculate the non-linearity of an s-box? [duplicate]

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
0
votes
1answer
168 views

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...
2
votes
1answer
154 views

Performing differential cryptanalysis for randomly generated S-boxes

As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random ...
5
votes
0answers
333 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
2
votes
1answer
854 views

How are the AES inverse S-Boxes calculated?

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value ...
1
vote
1answer
205 views

How are calculated numbers in AES S-box?

I have a problem calculating the 0x02 value of the AES S-Box. I followed the steps descibed in “How are the AES S-Boxes calculated?”, but my answer is not correct. ...
0
votes
2answers
209 views

Is the DES F-function injective for a given subkey?

Is it possible for two different half-block inputs to the DES F-function, with the same round subkey, to produce the same output? That is, if we feed two different half-block inputs $b_1$ and $b_2$ ...
1
vote
0answers
164 views

CAST-256 (CAST6) versions or S-Boxes

Are there different versions of CAST-256 - also known as CAST6 - available? Are there different S-Boxes available for CAST-256? If there are different versions or S-Boxes what identifier should I use ...
1
vote
0answers
234 views

About the Algebraic Normal Form (ANF) of S-Box in DES

I've thought up a way to represent the transformation of S-Box in DES by ANF. Let $x_i\;(1\le i\le 6)$ be the input of an S-Box, $y_i\;(1\le i\le 4)$ be the output, for example, then $$y_1= 1\oplus ...
1
vote
1answer
567 views

What benefits do substitution boxes and permutation boxes offer in DES?

I understand that with more encryption rounds the more complex the ciphertext becomes due to multiple substitutions and permutations. What I don't understand is the purpose of these features. I am ...
2
votes
1answer
129 views

Generating S boxes that satisfy Coppersmith's criteria?

I'd like to generate all possible 6-bit to 4-bit S-Boxes that satisfy the criteria for S-Box design given by Coppersmith, but I have a few doubts: How many such S-Boxes are possible? Is there any ...
1
vote
0answers
435 views

DES S-Box properties

Two of the properties that lead to the design of DES S-Boxes are: 1)For any non-zero 6-bit difference between inputs, no more than 8 of the 32 pairs of inputs exhibiting that difference may result ...
2
votes
2answers
509 views

Polynomial representation of the affine part of the AES S-box

I have been reading up on the polynomial representation of the AES Sbox (PDF: “Essential Algebraic Structure Within the AES” by Murphy and Robshaw) and I can't get it to produce the correct output. ...
2
votes
1answer
840 views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
3
votes
1answer
197 views

Math to replace s-boxes - Good or bad idea?

The following was going through my brain for the past week. If my thoughts are generally known to the cryptographic community would someone provide a link or two. Even if I’m making a classic newbie ...
12
votes
1answer
591 views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
1
vote
1answer
324 views

How can I find the multiplicative inverse in the first transformation of the SubBytes() transformation in AES?

In FIPS-197 §5.1.1 , it says the first transformation in the SubBytes() transformation is: Take the multiplicative inverse in the finite field $\text{GF}(2^8)$ described in Sec. 4.2; the ...
3
votes
1answer
886 views

How to calculate inverse affine transform in AES from forward affine transform?

In AES the forward affine tranformation matrix is defined as: $$ \begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& ...
1
vote
1answer
410 views

About the Rijndael/AES sbox polynomial (subBytes)

I've recently read a question about the irreducible polynomial behind the subBytes() operation in the Rijndael that has awakened and old curiosity I have: Why $\,m(x)$ was chosen as ...
2
votes
1answer
350 views

Are the MD5 constants an S-Box?

I noticed that several hash algorithms, in this case MD5, defines some constants. MD5 defines 64 constant values (the shift count per round) which also gets expand (via sine) to a summand for a ...
14
votes
2answers
2k views

Why xor is a linear operation but ordinary adding is not

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
2
votes
2answers
465 views

Two-dimensional S-Box

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key. If S-box is standard then this ...
3
votes
1answer
163 views

How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...
5
votes
3answers
702 views

AES column mixing and S-Box confusion

I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ...
3
votes
1answer
603 views

Serpent cipher : Osvik S-Boxes confusion and test vectors

I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. ...
2
votes
1answer
713 views

Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...
7
votes
1answer
13k views

How are the AES S-Boxes calculated?

I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over GF(2^8), but I'm confused by the description of the affine transformation. I ...