I cant understand the concept of linearly active sbox. In the case of differential analysis it is more easy to understand the concept of 'active sbox' Also how the increase in number of (linearly) active sbox improves the security of cipher

If any generic software programs are available to calculate the number of active sboxes, just by giving sbox functioning and permutation pattern?


1 Answer 1


I highly recommend reading Howard Heys's Tutorial on Linear and Differential Cryptanalysis available online (google is your friend) for a detailed explanation for the SPN case.

In brief, if a linear expression $a\cdot x+ b\cdot S(x)$ is used then all the output wires that correspond to 1 bit in the vector $b$ turn on the Sboxes they are connected to in the next round. It's best to start with one active Sbox in the initial round to turn on as few Sboxes as possible in the next round (by choosing $a$ and $b$ so that $b$ has a minimum Hamming weight but at he linear expression has a large bias).

See also the answers to this question and this one.

AES turns on the maximum number of Sboxes in a different way, since there are no bit permutations but a diffusion matrix. See a nice explanation in this answer.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.