Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
AES uses one S-box to substitute all 16 bytes in one round. Will using 16 different S-boxes (with cryptographic properties similar to the AES S-box (i.e., non-linearity of 112, differential probability of $2^{-6}$ etc) increase some security against the following attacks?
I can see at least one disadvantage of using 16 S-box to change the 16 bytes. The size of the code and the look up tables (should you use such implementation) would increase the size of the code. This increases the surface of exposure for cache timing attacks.
Due to the strong alignment of AES, i.e. differences are constrained within the byte, using one S-box or multiple ones (assuming that they share the same cryptographic properties: $P_{diff} < \frac{4}{256}$) would not really change the security of the whole algorithm. The probability of differential trails would be relatively similar.
So from a Linear and Differential cryptanalysis point of view, while making the research for differentials slightly harder, it would not increase the security against these attacks.
About Truncated Differentials, this attacks explores whether or not a difference is present on the bytes rather than on the bits. Therefore having multiple S-box or a single one, is likely to have no changes on it (only influence could be on the MixColumns).
About Boomerang and H.O.D I can't tell.
TL ; DR: using 16 S-box makes mainly the analysis of the block cipher harder (16 S-box to prove secure). It also makes the implementation of the block cipher harder (more places to screw up).
