I know that it is difficult to answer these questions without knowing the full scheme it would be used in, but are there any problems that could be introduced into a block cipher if an involutive S-box is used?

  • 3
    $\begingroup$ That would depend entirely on how the rest of the cipher used the sbox... $\endgroup$
    – poncho
    Nov 10, 2017 at 15:01
  • $\begingroup$ Well if, as you say, the question is difficult to answer without the full scheme, by all means provide us with the full scheme! "Are there any problems that could be introduced into a block cipher if [X] is used." almost always has a positive answer. $\endgroup$
    – Aleph
    Nov 10, 2017 at 17:50

1 Answer 1


As pointed out by Aleph and poncho, it is difficult to provide an educated answer without seeing the whole cipher.

One one hand, involutive S-boxes can be used to attack a scheme: e.g., this key-recovery attack against MANTIS observes that since the SBox is involutive, its DDT is symmetric, and uses it against the scheme. This paper by Biryukov shows that involutional components can be used as a leverage to ease distinguishing attacks.

On the other hand, there are block ciphers like ICEBERG which heavily rely on involutional components and are still secure: in ICEBERG, the SBox is involutional, but also the multiplication matrix and even the whole cipher itself (up to the key schedule).

Also keep in mind that the rationale usually given for putting involutional components in block ciphers is that they allow compact hardware implementations (you can reuse the same components for encryption and decryption). So if hardware implementation is not your goal, I would advise against using involutions as they can introduce subtle weaknesses.* As there already exist many great block ciphers, I would also strongly advise against designing your own.*

*unless there is a strong incentive to do so (or if you are doing it for research/recreational purposes)

  • $\begingroup$ There's nothing wrong with designing your own. As long as you don't endanger people who don't know any better by deploying your novel design instead of a readily available, battle tested solution, there's no harm done. Telling others to not bother studying the art of cipher design because there are good enough ciphers in use already is like saying don't bother studying kung fu because we have a military. There are other benefits that come with the study, besides that one particular end. $\endgroup$
    – Ella Rose
    Nov 10, 2017 at 21:04
  • $\begingroup$ @EllaRose: we aren't telling people not to study ciphers; we're saying that the correct way to study is not to build your own (you learn little just by doing that); it's to learn how to analyze them. Now, if you immediately analyze the cipher you built, that's fine - relatively few people actually do that... $\endgroup$
    – poncho
    Nov 10, 2017 at 22:39
  • $\begingroup$ @poncho I most humbly and respectfully disagree that there is little benefit from building your own. The only reason I disagree is because I have personally learned much from practicing algorithm design. I agree that analysis is enlightening - Had the answer said "don't learn cryptanalysis because we already have enough users like poncho", I would have disagreed with that too. $\endgroup$
    – Ella Rose
    Nov 11, 2017 at 0:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.