I asked a question about using 16 different Sboxes in AES each for one state byte instead of using same One Sbox for substituting 16 state bytes (See the Question Increase in AES SBox). The answers i got are like given below

at least one disadvantage of using 16 S-box to change the 16 bytes. The size of the code and the look up tables (should you use such implementation) would increase the size of the code. This increases the surface of exposure for cache timing attacks.

Now i wonder, why Cameillia designers used 4 Sboxes with almost similar properties? What is the main advantage of using more than one? Even Twofish uses 4 key dependent Sboxes.


1 Answer 1


The only way you will have a certain answer will be by mailing their designers.

Using multiple S-boxes increases the size of the code and decreases the possibility of working with different blocs in parallel.

Using a single S-box also simplify the way the specifications have to be written. The simpler the specifications are, the less prone to make error at the implementation step you are.

Not related to Camellia but on the same idea:

JP Aumasson: why nobody uses SHA-3? FIPS 202, a 29-page specs written for cryptographers, not for users [source]

JP Aumasson: seriously NIST, in 2.5 years no one had the idea that, perhaps, it would be good to simplify that thing? like, ditch the greek part [source]

However, using a single S-box implies some sort of symmetry in your bloc cipher which MIGHT be the reason why the designers of Camellia preferred to use 4 S-boxes instead of only one.

  • 1
    $\begingroup$ but onething good they did was the three sboxes can be drived from the 1st one, so that in memory constraint environments user can just save one sbox and calculate remaining at runtime $\endgroup$
    – crypt
    Nov 12, 2016 at 13:50

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.