# Turning an S-box into a keyed S-box

Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it with it retaining its good properties?

Update: A preferable property for the keyed S-box $T$ would be that for any fixed $k$ the relation $T(k, x) = S(x)$ does hold true for every $x$. In formal notation, $\forall{k}(\neg\forall{x}(T(k, x)=S(x)))$.

• there can be multiple options, simplest cane be to xor the n keybits with all values of sbox OR use p bits of n key bits where p<n to decide integer value for left or right rotation of all sbox values. Check how camellia derive 3 sboxes from one sbox. Or use a larger set of Sboxes and select one out of them based upon the key bits. But all these variations may have implications on the security of the cipher – khan Jan 12 '18 at 20:07
• I think Twofish used 8x32-bit sboxes because what you want does not always turn out so well – Richie Frame Jan 13 '18 at 2:25
• @RichieFrame How is using 8×32 S-boxes a replacement for a keyed S-box? And why don't keyed S-boxes turn out well? – Melab Jan 13 '18 at 4:37