Are there any other alternatives to Sbox's or SP networks to provide diffusion preferably more basic alternatives which still provide a good degree of security?
$\begingroup$
$\endgroup$
4
-
5$\begingroup$ You might want to take a look at ARX ciphers like Salsa20/ChaCha. Keccak doesn't use sboxes either. $\endgroup$– CodesInChaosCommented Feb 18, 2017 at 11:51
-
2$\begingroup$ You might also want to narrow down the question. An S box is a substitution box. A SP network is a substitution & permutation network typically employing S boxes. So one is the sub set of the other. The two are different and ergo so would be the potential answers... $\endgroup$– Paul UszakCommented Feb 18, 2017 at 13:36
-
$\begingroup$ @PaulUszak thanks for the comment is there anythink alternative to an sbox then instead of an SP network? $\endgroup$– NatCommented Feb 18, 2017 at 18:38
-
$\begingroup$ Only a note aside for your future questions: it frequently helps to describe your research efforts, what you found, and why it didn't fit your needs. Doing so makes questions less broad and helps getting more on-point answers. $\endgroup$– e-sushiCommented Feb 19, 2017 at 15:43
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
3
There are alternatives to an s box. You might say that they are evolutionary extensions of the traditional s box. But they are all very much more complex.
As you know, an s box is typically implemented as a RAM based look up table. So for an 8 bit s box, there are 256 possible inputs and outputs, requiring 256 bytes of storage. This is 2^8. If you had a primitive that required a 16 bit s box, you'll need 2^16 or 65,536 lookup values. So this would be suitable for a 16 bit processor.
If you go wider, the memory required for a look up table becomes onerous for today's processors. (You might manage a 24 bit lookup table, but processing 24 bit words on 32 bit processor is a PITA.) You can opt for a real time computed s-box.
Instead of a static lookup table, you perform a computation on the inputs to the real time computed s-box, and output a value determined in accordance with some formula you've devised. It's usually some form of mini hash. It allows s boxes of arbitrarily large width. A good example is The Diffusion Layer (MR) algorithm of the Whirlpool hash. That's 256 bits wide and uses clever Galois field theory. A passive s box would be impossible at this width. That transformation matrix could easily be widened to 16 * 16 values creating a 512 bit s box and a Whirlpool block size of 2048 bits. Or even more.
Another form of active s box can be implemented without the clever Galois mathematics using Pearson hashes. An 8 bit hash output is generated per each pass over the input bits. Using a unique permutation table for each byte means that the active s box can be extended to any size. I've successfully used this for a 2048 bit box. The penalty is 256 permutation tables, but this is easily within the capacity of a small desktop /tablet. The security of this technique may be acceptable when used in conjunction with a good permutation and key round functions.
You'll find that any reasonably secure algorithm can be used to compute the outputs of a real time computed s-box. There's also this question regarding similar active s boxes. The security of a primitive doesn't just come from an s box. Indeed Keccak has no real s box but is ostensibly secure at the moment. And a great deal of security comes from the number of rounds, not just the complexity of the rounds. The upshot is that it doesn't have to be dead clever to be dead 'ard. Skein follows this principle.
answered Feb 18, 2017 at 23:15
-
4$\begingroup$ An "s-box" is usually just a memoized function. An "active s-box" actually has a pretty well defined meaning in cryptography already. Redefining the vocabulary may confuse people. I think it is more clear and less confusing to say that an s-box is an NxM bit mapping that is typically computed lazily via a lookup table, as opposed to explicitly evaluating the complicated function it represents. Also, you do not mention linear diffusion layers at all, which is basically the only other component and source of diffusion of many algorithms. $\endgroup$ Commented Feb 18, 2017 at 23:36
-
1$\begingroup$ I agree, "active s-box" should be replaced with "realtime computed s-box" $\endgroup$ Commented Feb 19, 2017 at 6:57
-
$\begingroup$ @EllaRose I think the omission of a linear layer was intentional, as this answer addresses the diffusion provided by the s-box alone, as his comment to the question indicates $\endgroup$ Commented Feb 19, 2017 at 7:00