(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

learn more… | top users | synonyms

22
votes
2answers
4k views

How were the DES S-box values determined?

It seems like the S-boxes in DES have essentially random values. How were these chosen?
16
votes
2answers
2k views

Reason why “XOR” is a linear operation, but ordinary “addition” isn’t?

I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ...
13
votes
2answers
4k views

Why do block ciphers need a non-linear component (like an S-box)?

Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ...
13
votes
1answer
615 views

Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
10
votes
4answers
2k views

Desirable S-box properties

What desirable properties should an S-box have? My current standard selection process is to just pick them at random and verify that they fit the following criteria: The probability that any random ...
10
votes
1answer
1k views

Replacing the Rijndael S-Box?

The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?
10
votes
1answer
2k views

S-box design criteria and random sboxes

What are the disadvantages of using random s-boxes? In AES, the s-boxes had to obey certain mathematical rules, which? And why? What security does using hidden s-boxes (GOST) or generating them from ...
9
votes
3answers
2k views

Security of simple xor and s-box cipher?

What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode? A cipher's internal primitive might be a simple as this: $C = S[M \oplus k]$, where $...
8
votes
1answer
14k views

How are the AES S-Boxes calculated?

I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over GF(2^8), but I'm confused by the description of the affine transformation. I ...
6
votes
1answer
2k views

How can an S-Box be reversed?

So, as an exercise to greater understand some things about cryptography, I decided to try and implement GOST 28147-89, which uses eight 4x4 S-Boxes. I can grasp the concept of putting 4 bits through ...
5
votes
3answers
721 views

AES column mixing and S-Box confusion

I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ...
5
votes
1answer
236 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
5
votes
2answers
89 views

Is the difference distribution table of AES S-box uniform?

I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
5
votes
1answer
347 views

S-box Cryptanalytic Resistance

In DES, different S-boxes were tested for cryptanalytic resistance and the most secure one was chosen for the algorithm itself. How do different S-boxes offer different levels of security against ...
5
votes
0answers
350 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
4
votes
1answer
1k views

Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ...
4
votes
1answer
72 views

Number of Sbox in a Cipher

Camellia has 4 SBOX and so does the TwoFish(key dependent 4 Sboxes). Where as AES uses only one. Would it have made AES more secure if AES had 4 or more SBOX too? Does using more Sbox with similar ...
4
votes
1answer
98 views

Is this a better involution S-Box for the Anubis cipher?

After swapping random indexes of trivial involution $S[x] = ¬x$, I found the following involution S-Box with a non-linearity of $98$ and a differential uniformity of $6$. Is there an upper limit to ...
4
votes
1answer
13k views

How does DES decryption work? Is it the same as encryption or the reverse? [duplicate]

If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits?
4
votes
0answers
42 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
3
votes
2answers
64 views

Why DES s-box non-linear? Why it makes the cracking of the cypher more difficult?

I know that if we have a cypher which makes only linear transformations (let's say a bunch of $XOR$'s), we break it simply writing a system of equations with $\oplus$ operation starting from the ...
3
votes
1answer
72 views

How does one practically calculate the non-linearity of a multi-output boolean function like the AES s-box?

I am working on multi-output boolean function i.e. a function that takes an $n$-bit input and gives an $m$-bit output for all possible inputs (i.e. $2^n$ inputs). To be more exact: I am trying to do ...
3
votes
1answer
313 views

S-box with differential uniformity = 2

I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2. I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?
3
votes
1answer
111 views

Why is not there any ideal S-Box?

i read about linear cryptanalysis and about S-Box that there is not any ideal S-Box (ideal S-Box is a random S-Box in another words S-Box that bias of input and output bits is zero) then i read about ...
3
votes
1answer
198 views

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...
3
votes
1answer
324 views

How to build a difference distribution table?

i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...
3
votes
1answer
203 views

Math to replace s-boxes - Good or bad idea?

The following was going through my brain for the past week. If my thoughts are generally known to the cryptographic community would someone provide a link or two. Even if I’m making a classic newbie ...
3
votes
1answer
916 views

How to calculate inverse affine transform in AES from forward affine transform?

In AES the forward affine tranformation matrix is defined as: $$ \begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& 1&...
3
votes
1answer
617 views

Serpent cipher : Osvik S-Boxes confusion and test vectors

I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. Here'...
3
votes
1answer
875 views

How can I calculate the Rijndael SBox?

I would like to implement the Rijndael subBytes() operation using calculation instead of tables, because I like to play with this on different wordsizes, as an ...
3
votes
1answer
166 views

How would using only one s-box affect security of Blowfish?

Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ...
3
votes
0answers
115 views

How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...
2
votes
2answers
88 views

BOOLEAN FUNCTIONS: generate a function $f: \{0, 1\}^n \rightarrow \{0, 1\}$ from a $n \times n$ S-Box

I want to calculate the hamming weight of a S-Box using this formula: $\text{hw}(f) = \sum_{x=0}^{2^n-1} f(x)$. Where $f: \{0, 1\}^n \rightarrow \{0, 1\}$ My problem is that I don't know how to get ...
2
votes
2answers
538 views

Polynomial representation of the affine part of the AES S-box

I have been reading up on the polynomial representation of the AES Sbox (PDF: “Essential Algebraic Structure Within the AES” by Murphy and Robshaw) and I can't get it to produce the correct output. ...
2
votes
2answers
474 views

Two-dimensional S-Box

Consider the following simple cipher: $$c_1 = S(m_1 \oplus k_1) \oplus k_2$$ Where $S$ is S-box, $m_1$ - 16-bit plain text, $k_1$ and $k_2$ is two parts of 16-bit key. If S-box is standard then this ...
2
votes
1answer
363 views

Are the MD5 constants an S-Box?

I noticed that several hash algorithms, in this case MD5, defines some constants. MD5 defines 64 constant values (the shift count per round) which also gets expand (via sine) to a summand for a ...
2
votes
1answer
729 views

Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...
2
votes
1answer
165 views

Performing differential cryptanalysis for randomly generated S-boxes

As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random ...
2
votes
1answer
964 views

How are the AES inverse S-Boxes calculated?

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value ...
2
votes
1answer
356 views

How can I find the multiplicative inverse in the first transformation of the SubBytes() transformation in AES?

In FIPS-197 §5.1.1 , it says the first transformation in the SubBytes() transformation is: Take the multiplicative inverse in the finite field $\text{GF}(2^8)$ described in Sec. 4.2; the ...
2
votes
2answers
441 views

About the Rijndael/AES sbox polynomial (subBytes)

I've recently read a question about the irreducible polynomial behind the subBytes() operation in the Rijndael that has awakened and old curiosity I have: Why $\,m(x)$ was chosen as $\,x^8+x^4+x^3+x+...
2
votes
1answer
31 views

Last Sbox of a block cipher for Linear Cryptanalysis

I figured I should try to learn about linear cryptanalysis with a super simple cipher with only one Sbox. The problem is that with that approach the last subkey bits seem to be involved in the linear ...
2
votes
1answer
473 views

DES S-Box properties

Two of the properties that lead to the design of DES S-Boxes are: For any non-zero 6-bit difference between inputs, no more than 8 of the 32 pairs of inputs exhibiting that difference may result in ...
2
votes
1answer
115 views

How to generate the APA SBox?

I am trying to generate the S-Box provided in the Affine Power Affine paper (PDF) but I'm not sure I understand it fully. The essence of the paper is this: ...
2
votes
1answer
226 views

How are calculated numbers in AES S-box?

I have a problem calculating the 0x02 value of the AES S-Box. I followed the steps descibed in “How are the AES S-Boxes calculated?”, but my answer is not correct. ...
2
votes
1answer
133 views

Generating S boxes that satisfy Coppersmith's criteria?

I'd like to generate all possible 6-bit to 4-bit S-Boxes that satisfy the criteria for S-Box design given by Coppersmith, but I have a few doubts: How many such S-Boxes are possible? Is there any ...
2
votes
0answers
57 views

Active s-box of 8x8 MDS for AES

one way to enhance the security of AES by increasing the number of active s-boxes .larger MDS matrices are used to increase the number of active s-boxes. using 4x4 MDS matrix generate 25 active s-box ...
2
votes
0answers
167 views

How to calculate the non-linearity of an s-box? [duplicate]

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
1
vote
2answers
69 views

Converting a 5-bit s-box to its bit-sliced format

I'm currently trying to convert a 5-bit sbox (the one from this cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf) to its bit-sliced format (i.e. to a boolean network). Most papers ...
1
vote
2answers
45 views

substitution Box(s-box) for AES

can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes?for example ; if i have 100 different s-boxes. i want to pick any one which is secured ...