# Building large S-Boxes from smaller ones

I would like to make an exhaustive list of all relevant techniques that have been studied in order to build a large S-Box from smaller ones. As far as I known, three structures are usually preferred:

1. The Lai-Massey construction (used to design the IDEA block cipher)
2. Feistel networks (used to build $2n$-bit permutations from $n$-bit permutations)
3. MISTY networks (initially combines an $(n-1)$-bit S-Box with an $(n+1)$-bit one in this document)

Notably, this publication analyzes pros and cons of using either Feistel or MISTY networks to build 8-bit S-Boxes.

Are there any other relevant techniques to design large S-Boxes from smaller ones?

• also see unbalanced s-boxes like the 8x32-bit s-boxes in blowfish – Richie Frame Jun 22 '18 at 2:20