Apart form the following, what are the other properties of a good cryptographic Substitution box or the S-Box:
- Changing one input bit should change about half of the output bits.
- Each output bit should depend on every input bit.
$\begingroup$
$\endgroup$
-
2$\begingroup$ Does this answer your question? Desirable S-box properties also, related S-box design criteria and random sboxes $\endgroup$ – kelalaka Apr 20 at 12:40
$\begingroup$
$\endgroup$
Another very common criteria for an S-box with $n$ input bits and $m$ output bits with $m\le n$ (as most commonly used S-boxes are) is that each of the $2^m$ output values should be reached for exactly (or at least near) $2^{n-m}$ input values.
The question's criterion 1 can be made strict and become the Strict Avalanche Criterion. There are even stricter /higher-order versions. There also is the Bit independence criterion. The desirability of these properties depends on the overall design of the cryptographic construction using the S-box, and is not easy to assess.
More generally, S-boxes are typically optimized with use as part of a particular cryptographic construction in mind, aiming at improving it's overall resistance against cryptanalytic attacks, as pointed in comment.
-
$\begingroup$ Also relevant are the resistance to the various forms of linear and differential cryptanalysis... $\endgroup$ – SEJPM♦ Apr 20 at 11:40
-
$\begingroup$ @SEJPM: is there another property of S-boxes likely to improve resistance to linear or differential cryptanalysis mostly regardless of the cipher? No universal one not already mentioned in the question or this answer comes to mind. $\endgroup$ – fgrieu♦ Apr 20 at 12:12
-
$\begingroup$ I know that having a uniform differential probability (?; and the linear equivalent) is important for S-Boxes in the two standard designs with S-Boxes (i.e. Feistel and SPN). I'm not currently aware of other designs with S-Boxes and whether they'd use different metrics (e.g. MARS may do something weird?). $\endgroup$ – SEJPM♦ Apr 20 at 12:25
