0
$\begingroup$

I'm creating a substitution-permutation cipher (for learning purposes only of course) and I'd like to implement dynamic SBOXs. The cipher will have a block size of 128, and 32 rounds. These SBOXs will be generated from the password. Is the following procedure secure for generating secure SBOXs assuming that the key (32 bits) is CSPRNG:

Suppose the key = "zjfe48rQQWNEh6WFH2ne4MpXXytVGvSA"

First, I take the sha3_512 of key and set it to hash1:

hash1 = sha3_512(key)

Then, I set hash2 to the sha3_512 of hash1:

hash2 = sha3_512(hash1)

Now, I have two hashes with length 64. I concatenate to make a string with length 128:

string = hash1+hash2

Now, I convert string to hex. Since string is 128 bytes, after conversion to hex, it will be 256:

string = string.toHex()

Finally, I use string as an SBOX by splitting the 256 hex characters into a 16x16 array, similar to AES's SBOX.

Assuming that sha3_512 is secure and the password is random, is this construction of an SBOX secure?

$\endgroup$
6
  • $\begingroup$ A randomly generated S-Box won't be secure, however, we have seen that even simple round functions can be safe after 32 rounds see TEA. $\endgroup$
    – kelalaka
    Jan 27 '21 at 22:18
  • $\begingroup$ Yes. My idea is to use 32 rounds of dynamic SBOXs and then use the AES SBOX as a safety net. $\endgroup$
    – Evan Su
    Jan 27 '21 at 22:26
  • 1
    $\begingroup$ As for using two calls to sha3_512 to generate the sbox, wouldn't it make more sense to use 128 bytes of shake_512 output? $\endgroup$
    – poncho
    Jan 27 '21 at 22:30
  • $\begingroup$ Ah, that's a great suggestion. I wanted to use the non-existent sha3_1024 at first :). Shake_512 outputs 128 bytes? I thought 512/8=64... Anyway, Shake_512 is a great suggestion. I'll use shake instead of sha3_512 to simply things. Thanks. $\endgroup$
    – Evan Su
    Jan 27 '21 at 22:33
  • $\begingroup$ The SHAKEs are "eXtensible Output Functions" or XOFs. So they generate as much output as you want. Also there's only SHAKE128 and SHAKE256, I suspect poncho mistyped. Do pay attention to the security concerns in section A.1 and A.2 of nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.202.pdf and consider adding a context string and the desired output length to the input of SHAKE. $\endgroup$ Jan 28 '21 at 2:33

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.