New answers tagged


The point in the question makes senses, especially if one restricts to portable software implementations. But: Small or moderately large constant-time RAM tables are reasonable, efficient, and (thus) common hardware building blocks. They are often used in DPA-protected DES and AES hardware coprocessors. Thus we can't dismiss key-dependent S-tables in ...


About the security of your first variation, it is sort of answered here. This is your 1st variation. This is your 2nd variation (your $8 \times 8$ matrix idea is equivalent to apply a permutation). In your first variation, the application of the matrix is useless, one can consider the $S1$ (or $S2$) and the matrix as a single S-box. Hence you have no ...


A recent paper presented at FSE'2016 [1] addresses this exact question. In fact, it even provides a bitsliced implementation for the S-Box you are interested in Section 4. In summary: you first encode the existence of a bitsliced implementation as a SAT problem, use an off-th-shelf SAT-solver to solve it and finally retrieve the bitsliced encoding from the ...


Try to generate the Algebraic Normal Form (ANF) from the sbox step by step (i.e., with 2 bits and so on) or use something like

Top 50 recent answers are included