Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more secure than the others.


There is no such specific algorithm to find the best S-box but you can construct a Diference Distribution Table(DDT) like this and check out the values in it .A DDT is a matrix containing input differences as rows and corresponding output differences in column.

A better S-box has- 1- Lower values in its DDT 2- Less occurence of higher or highest value

  • $\begingroup$ this Differential approximation probability, right?can you elaborate it a little?that how is the first value 64?thanks dear $\endgroup$ – faiz Jul 12 '16 at 5:32
  • 1
    $\begingroup$ Yes these are probability, let me explain why first value is 64 The first row show the probability of output differences(which can be between 0000-1111 for input difference 000000. So as you can see column 1 (i.e. 0000) has 64 because if the input differencial will be 000000 then output differential will always be 0000 i.e probability 64/64= 1. $\endgroup$ – Abhinav singh Jul 12 '16 at 5:34
  • $\begingroup$ i am alittle weak in mathematics and probability, sorry for asking dumb questions but i am confused about "64" for output, because output should be 4 bits, maximum different values should be 16, for input 2^6=64 , but how 64 for input?and how other all values are zeros?thanks in advance brother $\endgroup$ – faiz Jul 12 '16 at 7:37
  • 1
    $\begingroup$ output differences are in 4 bit , 64 in the first row shows the frequency of 0000 as output difference when input difference is 000000. $\endgroup$ – Abhinav singh Jul 12 '16 at 7:50
  • $\begingroup$ can we chat here?i mean individual discussion?i don't want to bother other reviewer ...i don't know how to chat personally in this website? $\endgroup$ – faiz Jul 12 '16 at 8:35

AES S-Box is not just a non linear substitution table, it is the result of a precalculation based on two operations. This is, imho, the greatest value of Rijndael, everything rests with maths.

The first operation is a non linear transformation $g: x\rightarrow y = x^{-1} \in \frac{\mathbb{F}_{2}[z]}{m(z)} $ with $m(z) = z^8+z^4+z^3+z+1$ who is irreducible that tells us all the elements are invertible. The second operation is an affine map in $(\mathbb{F}_2)^8$.

Do you like to build a different S-Box but with the same good properties? Lets use a different $m(z)$ (with the same degree) but this will not provide to you any extra feature. Do you like to build table from scratch? Any linearity introduced by mistake will be a weakness. The maths behind the Rijndael helps to avoid mistakes.

  • $\begingroup$ no i didn't made in this way, i am using chaotic maps to generate s-box by my own algo, i have already 100 different s-boxes , now i want to select best of them through any fast searching method. $\endgroup$ – faiz Jul 12 '16 at 8:07
  • $\begingroup$ ok, then I think you are working with a variant of the Rijndael. The subBytes operation provides shannon's "confusion", perhaps a way to evaluate your SBoxes candidates is to measure this confusion. How many bits are changed when the input changes by one bit. $\endgroup$ – srgblnch Jul 12 '16 at 8:26
  • $\begingroup$ sometimes 3 sometimes 6, 4, varies $\endgroup$ – faiz Jul 12 '16 at 8:33
  • $\begingroup$ So, I think it must change as much as possible as a minimum. I mean, if there is an SBox that has a case that doesn't change any one, discard it. Then I would select the one that provides more confusion. $\endgroup$ – srgblnch Jul 12 '16 at 8:36
  • $\begingroup$ all of my sbox have this property. i need any recent research clue about this... $\endgroup$ – faiz Jul 12 '16 at 8:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.