I don't understand what an active s-box is (in reference of design criteria 8 of the DES).
Because according to DES, all 8 s-boxes are used every round. But this is not what active means.
So my question: What is an active S-Box, and what does it mean when an s-box is active (or when two or three s-boxes are active)?
You run the algorithm with two different plaintexts (whose difference is usually small – just a few bits, everything else being equal).
Wherever these plaintexts lead to different inputs to an S-box (in any layer/round of the algorithm), we call this S-Box “active” (since the other S-boxes produce the same result for both plaintexts, they are called “passive” and are not considered further).
A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are not talking specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes.
Specifically, they are talking in regards to linear/differential characteristics over a given round count. When the differences for the characteristic are either both zero or both nonzero, the characteristic is considered consistent. Any s-box where the input/output masks for this characteristic are nonzero is considered active.
Any substitution that passes through a linear transformation can then be branched into the next substitution. In AES, there is the MixColumns transformation between the nonlinear s-box of one round and the next. This linear transformation has a branch number of 5, resulting in 5 active s-boxes across 2 rounds.
This is probably not the best description, it may be better to read the initial papers on linear and differential cryptanalysis and come up with a better definition, since mine may not be applicable to a Feistel cipher.
