I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible)

Is that a fact?

The first thought I had on this was that it may related to the fact that the probabilities of S are not uniformly distributed and so, if you choose the most favorable outcomes you may have an edge over the bijective counterpart in e.g. bruteforcing.

But again I new to the field, so any insights on the matter would be greatly appreciated.

  • 1
    $\begingroup$ Actually, having the output domain be larger than the input (8-in 32-out for example) should provide superior security, if done correctly $\endgroup$ – Richie Frame Mar 31 '17 at 12:40


It is one of the main features of a Feistel network that both decryption and encryption just need to evaluate the S-box in the same direction. It could potentially be a weakness if you used invertible functions in the S-boxes: First, you are limited to a much smaller set of functions to choose from. And then you might not be able to find a function which has the other important properties, which are actually needed for security, e.g. non-linearity, diffusion and confusion, a balanced output, etc.

  • $\begingroup$ Agree. Furthermore, some security measures can be better if $n\geq 2m$ for an $n\times m$ SBox, such as in CAST. $\endgroup$ – kodlu Mar 31 '17 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.