My studies in cryptography have been quite detailed so far, however, one area that hasn't been explained to me is how S-Boxes are typically designed. Typically, the S-boxes are provided "as is" by the developers of the algorithm, but I am looking for information on what type of considerations cryptographers evaluate when they design an S-box. Are the numbers in the lookup table chosen at random? Are they generated mathematically? If so, what are some types of maths used and why? Feel free to choose an example cipher or two in your explanation.
The main consideration is to ensure no strong differential or affine properties.
Random S-Boxes are actually not bad in this regard though not necessarily optimal.
However Most would not trust "Random" S-boxes and prefer a Nothing-Up-My-Sleeve choice. For fear the designer may have cleverly selected the values to enable some unknown attack. We want some plausible explanation for why the specific values were chosen.
The AES S-boxes are such, they were selected based on a simple mathematical formula, and yet can be shown to be fairly resilient to differential and linear cryptanalysis.
you mainly consider cryptographically properties such as differential, linear , algebraic and others. However, there are different ways to generate sbox , one way is to do the inverse in galois field and affine transformation, another is using genetic algorithm (ref), also another way is to create larger s-boxes from smaller s-boxes. the later way is good when you have constrains such as size especially when you implement the sbox with masking.