# A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3

The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the following text:

For an $$n \times n$$ S-box $$S$$, its linear branch number, denoted by $$\mathcal{LBN}(S)$$, satisfies $$\mathcal{LBN}(S) \leq n - 1,$$ and its differential branch number, denoted by $$\mathcal{DBN}(S)$$, satisfies $$\mathcal{DBN}(S) \leq \lceil \frac{2n}{3} \rceil.$$ It is also interesting to note that ASCON and SYCON use $$5 \times 5$$ S-boxes that have differential branch number $$3$$ and linear branch number $$3.$$

Section VI.B of the paper “Finding Desirable Substitution Box with SASQUATCH” [M. Wadhwa, A. Baksi, K. Hu, A. Chattopadhyay, T. Isobe, D. Saha] contains an example of the $$5$$-bit S-Box with the differential branch number equal to $$4,$$ but its linear branch number is $$2.$$

Does there exist a $$5$$-bit S-Box $$S$$ such that the differential branch number of $$S$$ is equal to $$4$$ and the linear branch number of $$S$$ is not less than $$3?$$ If no, why? If yes, is there any known example of such an S-Box (assuming that $$S$$ is cryptographically useful — for example, its algebraic degree is not less than $$2,$$ nonlinearity greater than $$0$$ etc.)?

• can you give more context? what is known? reference? Commented Oct 6, 2023 at 16:42