While performing the linear and differential cryptanalysis a Linear Approximation Table(LAT) and a Different Distribution Table(DDT) is required which is created exploiting the S-box of the cipher which can be found in the tutorial of Howard heys. Now my question is if I take a random S-box for every other encryption and my cipher has a very good diffusion mechanism is my cipher still vulnerable to linear and differential attacks?
2
-
1$\begingroup$ A must read by Dan Coppersmith The Data Encryption Standard (DES) and its strength against attacks $\endgroup$– kelalakaAug 2, 2020 at 16:46
-
$\begingroup$ There is no thing as a good sbox nor a good linear layer. The (sbox, linear layer) pair can be good (ie resists differential or linear attack) $\endgroup$– holaMay 31, 2021 at 13:43
Add a comment
|
2 Answers
$\begingroup$
$\endgroup$
1
The question is contradicting with the title.
A random S-Box with a "very good diffusion mechanism" would be perfectly ok, assuming enough rounds.
A random S-Box without a "very good diffusion mechanism" would be worse.
For example, consider the AES with the S-Box replaced by a random S-Box. We can use known bounds on the number of active S-Boxes in AES (even the simple one - 5 active S-Boxes every two rounds), and use the differential uniformity / nonlinearity of the new random S-Box to give a provable bound on the differential/linear cryptanalysis. Possibly, we would need to increase the number of rounds a bit. Though, such proof would refer only to a single-trail cryptanalysis, but this is exactly what was done for AES. For example, truncated or higher-order differential cryptanalysis would not be covered.
Answering your question: security against linear/differential cryptanalysis depends both on the S-Box and the linear layer, though in a different way. Of course, in an edge case like fully linear S-Box, a strong linear layer won't help.
-
$\begingroup$ The way @Fractalic describe the differential cryptanalysis approach is quite convincing. I also found a [paper][eprint.iacr.org/2015/144.pdf] which justifies the idea in that same way. Can you share any idea what can be the approach for linear cryptanalysis? $\endgroup$– RadiumDec 27, 2020 at 8:38
$\begingroup$
$\endgroup$
If you want to incorporate random S-boxes, refer to the design of Twofish Algorithm which uses key-dependent S-boxes for encryption.
