I would like to make an exhaustive list of all relevant techniques that have been studied in order to build a large S-Box from smaller ones. As far as I known, three structures are usually preferred:
- The Lai-Massey construction (used to design the IDEA block cipher)
- Feistel networks (used to build $2n$-bit permutations from $n$-bit permutations)
- MISTY networks (initially combines an $(n-1)$-bit S-Box with an $(n+1)$-bit one in this document)
Notably, this publication analyzes pros and cons of using either Feistel or MISTY networks to build 8-bit S-Boxes.
Are there any other relevant techniques to design large S-Boxes from smaller ones?