# What are the standard properties of an S-Box [duplicate]

Apart form the following, what are the other properties of a good cryptographic Substitution box or the S-Box:

1. Changing one input bit should change about half of the output bits.
2. Each output bit should depend on every input bit.

Another very common criteria for an S-box with $$n$$ input bits and $$m$$ output bits with $$m\le n$$ (as most commonly used S-boxes are) is that each of the $$2^m$$ output values should be reached for exactly (or at least near) $$2^{n-m}$$ input values.

The question's criterion 1 can be made strict and become the Strict Avalanche Criterion. There are even stricter /higher-order versions. There also is the Bit independence criterion. The desirability of these properties depends on the overall design of the cryptographic construction using the S-box, and is not easy to assess.

More generally, S-boxes are typically optimized with use as part of a particular cryptographic construction in mind, aiming at improving it's overall resistance against cryptanalytic attacks, as pointed in comment.

• Also relevant are the resistance to the various forms of linear and differential cryptanalysis... – SEJPM Apr 20 at 11:40
• @SEJPM: is there another property of S-boxes likely to improve resistance to linear or differential cryptanalysis mostly regardless of the cipher? No universal one not already mentioned in the question or this answer comes to mind. – fgrieu Apr 20 at 12:12
• I know that having a uniform differential probability (?; and the linear equivalent) is important for S-Boxes in the two standard designs with S-Boxes (i.e. Feistel and SPN). I'm not currently aware of other designs with S-Boxes and whether they'd use different metrics (e.g. MARS may do something weird?). – SEJPM Apr 20 at 12:25