In a 128-bits Feistel Cipher:

I need suggestions about two variations of the Round Function


  1. $64$ bit input is divided into $8$ bytes
  2. Byte $0,1,2,3$ are substituted with Sbox1
  3. Byte $4,5,6,7$ are substituted with Sbox2.
  4. Then a $8 \times 8$ Binary Matrix is applied on the 8 bytes from 8 rows (Matrix similar to Camellia).



  1. 64 bit input of the round function is expressed as $8 \times 8$ binary matrix.
  2. Sbox1 is applied on the rows (on 8 bytes).
  3. Sbox2 is applied on the columns (on 8 bytes).
  4. 8 Bytes are made using bits of Rows.
  5. Then a $8 \times 8$ Binary Matrix is applied on the 8 bytes from 8 rows (Matrix similar to Camellia).

Variation - 2

Keeping in view that both S-boxes have non-linearity of 112 and maximum Differential Probability of $2^{-6}$ ($\approx$ the same level of security of AES).

Which variation is better in terms of security ? The same S-boxes are used in both the variations. Variation-2 is slow and more complex to implement, but thats not a issue

  • 2
    $\begingroup$ And exactly what is the question ? O.o $\endgroup$
    – Biv
    Commented May 11, 2016 at 11:57
  • $\begingroup$ i mean which variation is better in terms of security. bcz same sboxes are used in both the variations. Variation-2 is slow and more complex to impliment, but thats not a issue $\endgroup$
    – crypt
    Commented May 11, 2016 at 14:50
  • $\begingroup$ You ever hear of a P-box? $\endgroup$ Commented May 11, 2016 at 15:40
  • $\begingroup$ it is used in camellia. 8x8 Binary Matrix. $\endgroup$
    – crypt
    Commented May 11, 2016 at 16:42
  • 1
    $\begingroup$ You should specify what exactly you mean by "security". For example, do you wish to optimize for resistance against linear/differential cryptanalysis? Also, can you provide more detail on the smaller S-boxes, ideally their complete specification (in general the end result will depend on more than just the non-linearity). The easiest way to check is just to construct both round functions and test their properties. If you want a theoretical result (for any small Sbox), that's a lot more work (and then you should show some of your own effort, IMHO). $\endgroup$
    – Aleph
    Commented May 12, 2016 at 15:37

1 Answer 1


About the security of your first variation, it is sort of answered here.

This is your 1st variation. enter image description here

This is your 2nd variation (your $8 \times 8$ matrix idea is equivalent to apply a permutation). enter image description here

In your first variation, the application of the matrix is useless, one can consider the $S1$ (or $S2$) and the matrix as a single S-box. Hence you have no security gain.

In the second variation, you can see that even if you find the right differential on $S1$, it became harder to exploit because you apply a permutation before the following $S2$ (and subsequently the application of the matrix which is equivalent to another S-box).

Remark: Because in the second scheme you use a permutation, they cannot really be compared (apple vs oranges...)

With this in mind, I will let you decide which of these two variations is the most secure...

Given that you ask such a question (meaning you are not familiar enough to find a weakness),
I HIGHLY RECOMMEND YOU TO NOT USE SUCH A BLOCK CIPHER in production environment and stick to the standards !

  • $\begingroup$ If I understand the (unclear) question correctly, your link to the related answer is unrelated: I think what the OP describes is only the round function, not the full Feistel cipher. Although the composition of several substitutions indeed remains a substitution, its various security properties for use as a round function will in general change drastically . In this regard it also makes perfect sense to compare both schemes, if only the OP gave us a more specific definition of "security" (e.g. he seems to be mainly interested in resistance against differential and linear cryptanalysis?)... $\endgroup$
    – Aleph
    Commented May 12, 2016 at 15:42
  • $\begingroup$ Using 2 S-box one after the other is why I think the answer linked is related while I do agree it does not fully answer the question. But at least it provides a nice explanation for the security about the first variation. $\endgroup$
    – Biv
    Commented May 12, 2016 at 17:08
  • $\begingroup$ But when two S-boxes are applied after each other, the security properties can be completely different. Obviously the result is another S-box, but what matters is what the properties of this S-box are. $\endgroup$
    – Aleph
    Commented May 12, 2016 at 17:12
  • $\begingroup$ True but given the security margin he gave for his 8 bit S-box, I hardly think he could have something better. $\endgroup$
    – Biv
    Commented May 12, 2016 at 17:15
  • $\begingroup$ @Biv Thanks alot for making a clear diagram for the variation-2. But may i ask why you are applying Mcamellia 8 times to all 8 bytes separately treating 8 bits as input? (or i understood it wrong way, and Mcamellia is being applied to 8 bytes just like in camellia) From the Diagram you made, it make clear the Variation 2 will have better diffusion, changing one bit in input of sbox1, will cause change of atleast 4 different inputs to sbox2. which after passing from Mcamellia will propogate more change as compared to variation-1 $\endgroup$
    – crypt
    Commented May 12, 2016 at 18:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.