Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it with it retaining its good properties?

Update: A preferable property for the keyed S-box $T$ would be that for any fixed $k$ the relation $T(k, x) = S(x)$ does hold true for every $x$. In formal notation, $\forall{k}(\neg\forall{x}(T(k, x)=S(x)))$.

  • $\begingroup$ there can be multiple options, simplest cane be to xor the n keybits with all values of sbox OR use p bits of n key bits where p<n to decide integer value for left or right rotation of all sbox values. Check how camellia derive 3 sboxes from one sbox. Or use a larger set of Sboxes and select one out of them based upon the key bits. But all these variations may have implications on the security of the cipher $\endgroup$ – khan Jan 12 '18 at 20:07
  • $\begingroup$ I think Twofish used 8x32-bit sboxes because what you want does not always turn out so well $\endgroup$ – Richie Frame Jan 13 '18 at 2:25
  • $\begingroup$ @RichieFrame How is using 8×32 S-boxes a replacement for a keyed S-box? And why don't keyed S-boxes turn out well? $\endgroup$ – Melab Jan 13 '18 at 4:37

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.