1
$\begingroup$

Apart form the following, what are the other properties of a good cryptographic Substitution box or the S-Box:

  1. Changing one input bit should change about half of the output bits.
  2. Each output bit should depend on every input bit.
Improve this question
$\endgroup$
1
1
$\begingroup$

Another very common criteria for an S-box with $n$ input bits and $m$ output bits with $m\le n$ (as most commonly used S-boxes are) is that each of the $2^m$ output values should be reached for exactly (or at least near) $2^{n-m}$ input values.

The question's criterion 1 can be made strict and become the Strict Avalanche Criterion. There are even stricter /higher-order versions. There also is the Bit independence criterion. The desirability of these properties depends on the overall design of the cryptographic construction using the S-box, and is not easy to assess.

More generally, S-boxes are typically optimized with use as part of a particular cryptographic construction in mind, aiming at improving it's overall resistance against cryptanalytic attacks, as pointed in comment.

Improve this answer
$\endgroup$
3
  • $\begingroup$ Also relevant are the resistance to the various forms of linear and differential cryptanalysis... $\endgroup$ – SEJPM♦ Apr 20 '20 at 11:40
  • $\begingroup$ @SEJPM: is there another property of S-boxes likely to improve resistance to linear or differential cryptanalysis mostly regardless of the cipher? No universal one not already mentioned in the question or this answer comes to mind. $\endgroup$ – fgrieu♦ Apr 20 '20 at 12:12
  • $\begingroup$ I know that having a uniform differential probability (?; and the linear equivalent) is important for S-Boxes in the two standard designs with S-Boxes (i.e. Feistel and SPN). I'm not currently aware of other designs with S-Boxes and whether they'd use different metrics (e.g. MARS may do something weird?). $\endgroup$ – SEJPM♦ Apr 20 '20 at 12:25

Not the answer you're looking for? Browse other questions tagged or ask your own question.