1
$\begingroup$

While performing the linear and differential cryptanalysis a Linear Approximation Table(LAT) and a Different Distribution Table(DDT) is required which is created exploiting the S-box of the cipher which can be found in the tutorial of Howard heys. Now my question is if I take a random S-box for every other encryption and my cipher has a very good diffusion mechanism is my cipher still vulnerable to linear and differential attacks?

$\endgroup$
1
$\begingroup$

The question is contradicting with the title.

A random S-Box with a "very good diffusion mechanism" would be perfectly ok, assuming enough rounds.

A random S-Box without a "very good diffusion mechanism" would be worse.

For example, consider the AES with the S-Box replaced by a random S-Box. We can use known bounds on the number of active S-Boxes in AES (even the simple one - 5 active S-Boxes every two rounds), and use the differential uniformity / nonlinearity of the new random S-Box to give a provable bound on the differential/linear cryptanalysis. Possibly, we would need to increase the number of rounds a bit. Though, such proof would refer only to a single-trail cryptanalysis, but this is exactly what was done for AES. For example, truncated or higher-order differential cryptanalysis would not be covered.

Answering your question: security against linear/differential cryptanalysis depends both on the S-Box and the linear layer, though in a different way. Of course, in an edge case like fully linear S-Box, a strong linear layer won't help.

$\endgroup$
  • $\begingroup$ The way @Fractalic describe the differential cryptanalysis approach is quite convincing. I also found a [paper][eprint.iacr.org/2015/144.pdf] which justifies the idea in that same way. Can you share any idea what can be the approach for linear cryptanalysis? $\endgroup$ – Radium Dec 27 '20 at 8:38
0
$\begingroup$

If you want to incorporate random S-boxes, refer to the design of Twofish Algorithm which uses key-dependent S-boxes for encryption.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.