Have any good 8-bit S-boxes made using ARX principles been found yet? I found Alzette, but it's a huge S-box at 64 bits.

I know that with a combination of addition, rotation, and XOR that any S-box permutation can be achieved, but working backwards would be way too hard for the effort.

  • $\begingroup$ I'd guess that it's hard to find good 8 bit ARX sboxes, the authors would have mentioned it otherwise. but maybe I'm wrong $\endgroup$
    – kodlu
    Commented Sep 15, 2023 at 20:16

1 Answer 1


Alzette is relatively weak S-box for its size. It has comparable linear and differential properties to AES S-box as described in paper.

There is also SPARX cipher with 32-bit ARX-box. I'm unaware of 8-bit ARX.

It would probably be possible to make a good 8-bit ARX-box, but it would be very inefficient. ARX really works well when it is bigger. You have more possible rotations to choose, additions are bigger, and more is done in parallel.

In my recent experiment 4 rounds of ARX had best differential characteristic weight of 36 when 64-bit. However, 16-bit ARX had just 16 and reached same weight of 36 after 9 rounds.

To find good 8-bit S-box from ARX you could make ARX with 4-bit words and use all 3 possible rotations and try it with different constants and number of rounds. However, it would be better to use 2 bitsliced 4-bit S-boxes to build 8-bit S-box, like in Anubis cipher or just use 4-bit bitsliced S-box (you can find many).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.