3
$\begingroup$

I have heard it anecdotically that non-bijective sboxes are potentially weaker to be used in designs like feistel networks. (since by design, it is allowed for the sbox to be non-reversible)

Is that a fact?

The first thought I had on this was that it may related to the fact that the probabilities of S are not uniformly distributed and so, if you choose the most favorable outcomes you may have an edge over the bijective counterpart in e.g. bruteforcing.

But again I new to the field, so any insights on the matter would be greatly appreciated.

Improve this question
$\endgroup$
1
  • 1
    $\begingroup$ Actually, having the output domain be larger than the input (8-in 32-out for example) should provide superior security, if done correctly $\endgroup$
    – Richie Frame
    Mar 31, 2017 at 12:40

1 Answer 1

Reset to default
4
$\begingroup$

No.

It is one of the main features of a Feistel network that both decryption and encryption just need to evaluate the S-box in the same direction. It could potentially be a weakness if you used invertible functions in the S-boxes: First, you are limited to a much smaller set of functions to choose from. And then you might not be able to find a function which has the other important properties, which are actually needed for security, e.g. non-linearity, diffusion and confusion, a balanced output, etc.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Agree. Furthermore, some security measures can be better if $n\geq 2m$ for an $n\times m$ SBox, such as in CAST. $\endgroup$
    – kodlu
    Mar 31, 2017 at 22:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.