Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it with it retaining its good properties?

Update: A preferable property for the keyed S-box $T$ would be that for any fixed $k$ the relation $T(k, x) = S(x)$ does hold true for every $x$. In formal notation, $\forall{k}(\neg\forall{x}(T(k, x)=S(x)))$.

  • $\begingroup$ there can be multiple options, simplest cane be to xor the n keybits with all values of sbox OR use p bits of n key bits where p<n to decide integer value for left or right rotation of all sbox values. Check how camellia derive 3 sboxes from one sbox. Or use a larger set of Sboxes and select one out of them based upon the key bits. But all these variations may have implications on the security of the cipher $\endgroup$ – khan Jan 12 '18 at 20:07
  • $\begingroup$ I think Twofish used 8x32-bit sboxes because what you want does not always turn out so well $\endgroup$ – Richie Frame Jan 13 '18 at 2:25
  • $\begingroup$ @RichieFrame How is using 8×32 S-boxes a replacement for a keyed S-box? And why don't keyed S-boxes turn out well? $\endgroup$ – Melab Jan 13 '18 at 4:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.