# AES with other SBoxes

I'm not a cryptologist, just an interested engineer (& now retired). I used to design hardware with AES en/decryption blocks & generate test vectors using my own Tcl script using the embedded AES function.

However, I was wondering if modifying AES to use more than 1 SBox (& inverse), it would be "more secure", or is that not the case? I've found 1108 SBoxes that meet the original criteria (out of 256! possible combinations). My view would be to have a short table to indicate which SBox to use for each round of 14 (assuming 256 key). I realise this would complicate h/w a bit, but not be very complicated to modify a C program. Initially just using 2 SBoxes, the original & one other, but easily expandable to use 3,4.. etc in software.

• AES has a very regular structure that enables it easy to analyze. That is a design change that will complicate the security analysis. It was a nice question for DES since the NSA modifications and people wondered about the resasons. Dec 29, 2020 at 17:54
• Also it wouldn't be AES. AES is a standard. If you change it, it ceases to be AES, it's some other cipher. Possibly a Rijndael variant, possibly something entirely different. There's no such thing as "AES with other SBoxes". It's like "US 2020 issue one dollar bills with faces other than George Washington", they don't exist, and can't exist, since they wouldn't meet the criteria of being 2020 issue US one dollar bills! Dec 29, 2020 at 18:28

Honestly, it would be more secure, but not by much, and that is assuming you are using finite field inversion s-boxes.

A better use of multiple 8-bit s-boxes would be to make them key dependent, however in software that can have the unfortunate side effect of creating another side channel to leak information about the key.

If you want something based on the AES design but with small modifications that make it more secure, what you want is not more s-boxes, but a better s-box with more algebraic complexity. In terms of round design that is probably the only modification you can make before it strays too much from the original design.

The other place to look is the key schedule, which is very simple and fast. This is both beneficial and detrimental, as it is probably the weakest point of the cipher, but makes applications requiring key changes usable. Think a wifi chip that needs a different key for each connected device and needs to constantly switch keys to communicate with them. It can also "roll" to save memory on embedded systems, but this means that round subkeys can be used to recover the key.

From a software only perspective, security can be improved with changes to the key schedule, slowing it down and generating the subkeys using a one way function with less linearity.

There is a nice tool, SBox Generator, which generates SBoxes and inverses from a given irreducible polynomial. GF($$2^8$$) has 30 so-called characteristic polynomials. Rijndael authors simply took the first one in the list. Think the offset (the first table entry, image of 0x00) is fix 0x63; that would be another parameter to optimize diffusion.

• Yes, I wrote a C program to find all possible irreducible polynomials and did find 30, which I've since confirmed agree with a web search. I then took these 30 polys and created a set of S-Boxes following the same rules as Rijndael, and got a total of 1108 S-Boxes. Not that many when there are a possible 256! possibilities (which is approx 8x10^506)!
– KevP
Apr 19 at 7:04
• Interesting! ... probably with Rabin-irredicibility ... Did you find criteria for an alternative $GF(2)^8$-matrix transforms or offset at Rijndael's?? There should be better measures than just avoiding fix-points apprize.best/security/cryptography/9.html Apr 19 at 7:51
• Once I had the multiplicative inverse of the 30 polynomials, I applied the same affine transform to them as Rijndael, then added all possible offsets, if any SBox position was unchanged or the direct inverse, that whole set was discarded, that's how I got only 1108 possible SBoxes. But I'm not a cryptologist, just a retired hardware electronic design engineer with a passing interest.
– KevP
Apr 20 at 9:24