# Are non bijective sboxes weaker (on feistel networks)?

I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible)

Is that a fact?

The first thought I had on this was that it may related to the fact that the probabilities of S are not uniformly distributed and so, if you choose the most favorable outcomes you may have an edge over the bijective counterpart in e.g. bruteforcing.

But again I new to the field, so any insights on the matter would be greatly appreciated.

• Actually, having the output domain be larger than the input (8-in 32-out for example) should provide superior security, if done correctly – Richie Frame Mar 31 '17 at 12:40

• Agree. Furthermore, some security measures can be better if $n\geq 2m$ for an $n\times m$ SBox, such as in CAST. – kodlu Mar 31 '17 at 22:00