# Does the DES s-box only provide confusion, or does it also provide an avalanche effect?

In DES, does the s-box provide an avalanche effect or does it only provide confusion in the ciphertext?

Yes, in DES, S-boxes are the main contributors to diffusion and hence to the avalanche effect, because changing 1 input bit from an S-box has the potential to change up to 4 output bits. Another contributor is the expansion E, because 16 out of its 32 inputs have effect on 2 outputs (the 16 others provide no diffusion).

Another way to look at it is that thru the combination of E and the 8 S-boxes, 16 out of the 32 bits of one half of the state can each influence up to 8 bits of the other half; and 16 others can each influence up to 4 bits.

Permutation P does not in itself provide diffusion, but the way it permutes bits insures that the diffusion of E and the 8 S-boxes quickly spreads to the whole state in few rounds; that is, that the diffusion is about exponential; which is, the avalanche effect.

Well it goes a long way towards it. If you simply consider an S box on it's own, you'll virtually have the avalanche effect across it. Even with a randomly permuted one. This is just a function of the input /output non linearity.

The 100% avalanche effect is brought on by DES' S box in conjunction with other components such as permutations and xor operators on the outputs of these, as in the points where the 48 bit subkeys are mixed in. The number of rounds is also important. Generally, there is a relationship between the width of the S boxes, the number of adjacent s boxes and the number of rounds. It's entirely possible that without enough rounds, you might only get say 90% of avalanche effect.

It's easier to describe the avalanche effect itself, rather than the required steps to provide it. That's why testing is crucial to confirm that a primitive has it. You can have a pretty good suspicion that a construct might exhibit avalanche effect, but you won't be able to confirm it without testing.

S-Box Modifications and Their Effect in DES-like Encryption Systems is a good article on the DES S boxes and messing with them. Specifically look to section 4.2 regarding DES box 5.

• "This is just a function of the non linear bijection"; minor correction: the DES SBoxes are not bijections. Of course, that doesn't change the main point of your answer... – poncho Mar 20 '18 at 22:42
• @poncho Is bijection not the correct word for "one to one and onto"? One in, one out but different? – Paul Uszak Mar 21 '18 at 0:02
• That is the correct work for "one to one and onto"; however the DES sbox is not "one to one". Each sbox has 6 bits input and 4 bits output; that obviously cannot be "one to one" – poncho Mar 21 '18 at 7:56

In DES and AES its goal is mostly non-linearity and confusion and does not necessarily provide an avalanche effect, but it really varies according to the design and implementation of the system you are talking about.

• So which component of DES provides avalanche effect? – hhj8i Mar 19 '18 at 11:54
• How can different implementations of DES change DES's behaviour? – Paul Uszak Mar 19 '18 at 14:55
• @hhj8i There is no guarantee of the avalanche effect by default in DES, however you might be able to choose the S-boxes in order to get that effect. This is a good paper on the analysis of avalanche criterion of s boxes and might make for a good read. – onaheimi3 Mar 20 '18 at 10:19
• @PaulUszak The question was for general symmetric encryption schemes when first asked, so that was mainly what I was going for. But there are many DES like schemes that have different S boxes for example (for reference see this paper). – onaheimi3 Mar 20 '18 at 10:27