Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
Say, I want to generate a lot of $4\times4$ Sboxes with linear (or differential) branch numbre of $3$. One idea is to take all the $302$ affine classes, expand each of those classes and check if any of the Sboxes has the desired branch number.
Is there any better way/known result (such as, this particular class does not contain any Sbox with linear branch number $3$) that can be used to reduce the search space?
The differential branch number is the sum of hamming weight between input and output difference distribution table (DDT). it is similar to linear branch number.
One way to construct S-box with branch number 3 is to use concept of differential-equivalence, DDT-equivalence and the $\gamma$-equivalence as shown in paper "Two Notions of Differential Equivalence on Sboxes".
The new paper accepted "Reconstructing an S-box from its Difference Distribution Table " provides algorithm to reconstruct S-box . therefore, you could apply the concept on $\gamma$-equivalence DDT to find S-Box with branch number as you want.
