I want to generate a 16,8 perfectly nonlinear S-box for an encryption algorithm I am working on. I don't have a background in math, and I'm an undergrad, so a lot of the math involved is very confusing.
I want the perfectly nonlinear S-box to have 16 bits of input and 8 bits of output.
I have been reading Kaisa Nyberg's 1991 paper Perfect nonlinear S-boxes, and I am having trouble understanding the method described.
In Section 4, A Construction based on Maiorana-McFarland method, the implementation is described as:
- Take n bits of input (where n >= 2m)
- Split the n bits into two parts (x1 and x2)
- Obtain the first digit of the output (of length m) by doing x1 • x2
- And the second digit of the output by shifting a n/2 size LFSR (with a primitive feedback polynomial) once, and the calculating • between LFSR's content and x2.
I am having trouble understanding how the two digits are to be used since both would be of length m..
- concatenating them would make the output size 2m
Which is not right. The problems I face are:
- Should there be a • operation between the two digits to produce an m-bit output? In a construction based on Maiorana-McFarland method?
Which (per my understanding modular) operation would be the optimal?
Is there anything else I should be considering in addition to perfect nonlinearity?