# More suitable Substitution Box

Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more secure than the others.

There is no such specific algorithm to find the best S-box but you can construct a Diference Distribution Table(DDT) like this and check out the values in it .A DDT is a matrix containing input differences as rows and corresponding output differences in column.

A better S-box has- 1- Lower values in its DDT 2- Less occurence of higher or highest value

• this Differential approximation probability, right?can you elaborate it a little?that how is the first value 64?thanks dear
– faiz
Jul 12 '16 at 5:32
• Yes these are probability, let me explain why first value is 64 The first row show the probability of output differences(which can be between 0000-1111 for input difference 000000. So as you can see column 1 (i.e. 0000) has 64 because if the input differencial will be 000000 then output differential will always be 0000 i.e probability 64/64= 1. Jul 12 '16 at 5:34
• i am alittle weak in mathematics and probability, sorry for asking dumb questions but i am confused about "64" for output, because output should be 4 bits, maximum different values should be 16, for input 2^6=64 , but how 64 for input?and how other all values are zeros?thanks in advance brother
– faiz
Jul 12 '16 at 7:37
• output differences are in 4 bit , 64 in the first row shows the frequency of 0000 as output difference when input difference is 000000. Jul 12 '16 at 7:50
• can we chat here?i mean individual discussion?i don't want to bother other reviewer ...i don't know how to chat personally in this website?
– faiz
Jul 12 '16 at 8:35

AES S-Box is not just a non linear substitution table, it is the result of a precalculation based on two operations. This is, imho, the greatest value of Rijndael, everything rests with maths.

The first operation is a non linear transformation $g: x\rightarrow y = x^{-1} \in \frac{\mathbb{F}_{2}[z]}{m(z)}$ with $m(z) = z^8+z^4+z^3+z+1$ who is irreducible that tells us all the elements are invertible. The second operation is an affine map in $(\mathbb{F}_2)^8$.

Do you like to build a different S-Box but with the same good properties? Lets use a different $m(z)$ (with the same degree) but this will not provide to you any extra feature. Do you like to build table from scratch? Any linearity introduced by mistake will be a weakness. The maths behind the Rijndael helps to avoid mistakes.

• no i didn't made in this way, i am using chaotic maps to generate s-box by my own algo, i have already 100 different s-boxes , now i want to select best of them through any fast searching method.
– faiz
Jul 12 '16 at 8:07
• ok, then I think you are working with a variant of the Rijndael. The subBytes operation provides shannon's "confusion", perhaps a way to evaluate your SBoxes candidates is to measure this confusion. How many bits are changed when the input changes by one bit. Jul 12 '16 at 8:26
• sometimes 3 sometimes 6, 4, varies
– faiz
Jul 12 '16 at 8:33
• So, I think it must change as much as possible as a minimum. I mean, if there is an SBox that has a case that doesn't change any one, discard it. Then I would select the one that provides more confusion. Jul 12 '16 at 8:36