AES uses one S-box to substitute all 16 bytes in one round. Will using 16 different S-boxes (with cryptographic properties similar to the AES S-box (i.e., non-linearity of 112, differential probability of $2^{-6}$ etc) increase some security against the following attacks?

  1. Differential
  2. Linear
  3. Truncated Differential
  4. Boomerang
  5. Higher Order Differential
  • 1
    $\begingroup$ In my opinion, this will make cryptanalysis much more difficult, as well as the designers' security analysis, by destroying some uniform algebraic structure, and possibly introducing weaknesses that are difficult to predict. Looking forward to interesting comments/answers. $\endgroup$
    – kodlu
    Jun 10, 2016 at 0:13
  • $\begingroup$ Changing anything on the design of AES would mean any past cryptanalysis is not valid any more.I don't think the question can be answered, "similar to AES" is not specific enough and I don't think those two properties are enough to make strong S-boxes. We do know however, that random S-boxes are a poor choice, so I doubt that it is even possible to make any statement without defining specific functions. $\endgroup$
    – tylo
    Oct 27, 2016 at 18:51
  • 1
    $\begingroup$ Rijndael wouldn't be the AES if it had 16 different 256-byte tables, as on requirement of the competition was "can be efficiently implemented on 8-bit platforms" and another one was "can be easily protected against side-channel attacks like DPA". With different tables you cannot have both. $\endgroup$ Oct 28, 2016 at 10:02

1 Answer 1


I can see at least one disadvantage of using 16 S-box to change the 16 bytes. The size of the code and the look up tables (should you use such implementation) would increase the size of the code. This increases the surface of exposure for cache timing attacks.

Due to the strong alignment of AES, i.e. differences are constrained within the byte, using one S-box or multiple ones (assuming that they share the same cryptographic properties: $P_{diff} < \frac{4}{256}$) would not really change the security of the whole algorithm. The probability of differential trails would be relatively similar.

So from a Linear and Differential cryptanalysis point of view, while making the research for differentials slightly harder, it would not increase the security against these attacks.

About Truncated Differentials, this attacks explores whether or not a difference is present on the bytes rather than on the bits. Therefore having multiple S-box or a single one, is likely to have no changes on it (only influence could be on the MixColumns).

About Boomerang and H.O.D I can't tell.

TL ; DR: using 16 S-box makes mainly the analysis of the block cipher harder (16 S-box to prove secure). It also makes the implementation of the block cipher harder (more places to screw up).


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.