I don't understand what an active s-box is (in reference of design criteria 8 of the DES).

Because according to DES, all 8 s-boxes are used every round. But this is not what active means.

So my question: What is an active S-Box, and what does it mean when an s-box is active (or when two or three s-boxes are active)?


2 Answers 2


You run the algorithm with two different plaintexts (whose difference is usually small – just a few bits, everything else being equal).

Wherever these plaintexts lead to different inputs to an S-box (in any layer/round of the algorithm), we call this S-Box “active” (since the other S-boxes produce the same result for both plaintexts, they are called “passive” and are not considered further).

  • $\begingroup$ this is about differential active Sbox, right? How is it in case of linear active sbox? $\endgroup$
    – crypt
    Sep 28, 2017 at 9:54

A linear transformation in a block cipher is also considered an substitution, just not a non linear one. When they talk about active s-boxes, they are not talking specifically about the nonlinear s-box, but a level of input being substituted with a different output. Combining these across multiple rounds results in what they call 'active' s-boxes.

Specifically, they are talking in regards to linear/differential characteristics over a given round count. When the differences for the characteristic are either both zero or both nonzero, the characteristic is considered consistent. Any s-box where the input/output masks for this characteristic are nonzero is considered active.

Any substitution that passes through a linear transformation can then be branched into the next substitution. In AES, there is the MixColumns transformation between the nonlinear s-box of one round and the next. This linear transformation has a branch number of 5, resulting in 5 active s-boxes across 2 rounds.

This is probably not the best description, it may be better to read the initial papers on linear and differential cryptanalysis and come up with a better definition, since mine may not be applicable to a Feistel cipher.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.