# Building large S-Boxes from smaller ones

I would like to make an exhaustive list of all relevant techniques that have been studied in order to build a large S-Box from smaller ones. As far as I known, three structures are usually preferred:

1. The Lai-Massey construction (used to design the IDEA block cipher)
2. Feistel networks (used to build $2n$-bit permutations from $n$-bit permutations)
3. MISTY networks (initially combines an $(n-1)$-bit S-Box with an $(n+1)$-bit one in this document)

Notably, this publication analyzes pros and cons of using either Feistel or MISTY networks to build 8-bit S-Boxes.

Are there any other relevant techniques to design large S-Boxes from smaller ones?

• also see unbalanced s-boxes like the 8x32-bit s-boxes in blowfish – Richie Frame Jun 22 '18 at 2:20

Yes , there are others such as SPN (CLEFIA , Khazad Middori-128 ,etc)

in addition to xor-based Feistel structure , the Kuznyechik is based on product-based Feistel structure.

I suggest to read this thesis (it summaries all) : CRYPTANALYSIS, REVERSE-ENGINEERING AND DESIGN OF SYMMETRIC CRYPTOGRAPHIC ALGORITHMS

I think all the block cipher structures like spn or feistel can make small s-box into a big one since you can view the block cipher as a big s-box.

• I think the only time someone asked about a 64-bit s-box I told them to use DES with a fixed key – Richie Frame Jun 22 '18 at 2:19
• I agree with you. Small s-boxes with some good permutation layers will make a good big one. – Felix LL Jun 22 '18 at 2:47