Stack Exchange Network

Stack Exchange network consists of 175 Q&A communities including Stack Overflow, the largest, most trusted online community for developers to learn, share their knowledge, and build their careers.

Visit Stack Exchange

Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

0
votes
0answers
10 views

Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
1
vote
1answer
38 views

Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
1
vote
1answer
68 views

How do the Serpent S-boxes work?

For DES, you take the 4 inner bits as the column to choose from the S-Box, and the two outer bits to choose the row. However, for Serpent it doesn't make sense to me as the prekeys that are used to ...
0
votes
0answers
57 views

Calculating the inverse for a Rijndael s-box [duplicate]

I want to calculate a Rijndael S-box but something went wrong. How can I calculate the inverse? In the following is my approach: given: $f(x)=x^8+x^4+x^3+x+1 \rightarrow$ binary: 100011011 0x12 = ...
1
vote
0answers
19 views

How to find efficient hardware implementation of sbox of lightweight block ciphers? [migrated]

Lightweight block ciphers are usually optimized for compact hardware implementations and sbox values are computed by implementing circuit using basic logic gates(AND, XOR, OR, NOR etc). What is the ...
1
vote
1answer
122 views

AES oracle with bad S-box

Say you run in to a messed up AES (128) implementation which has the s-box configured as [0x0, 0x1, ..., 0xFE, 0xFF] and where you can query a few plaintexts to get the corresponding ciphertexts. How ...
0
votes
0answers
21 views

What are dual codes and the codewords denoted by these dual codes in terms of trace?

I am currently reading a research paper (linked below) that mentions "Consider only maps that vanish at 0, their short codes $C_f$ and their duals $C_f^\perp$. The duals can be written as $C_f^\perp = ...
1
vote
1answer
28 views

What is the link between the parity check matrix, double-error-correcting codes and APN permutations?

I am currently reading a research paper (linked below) which mentions that a map $f:V:=GF(2^{m}) \rightarrow V$ which vanishes at 0 is APN if it satisfies the condition that it is a binary code $C_{f}$...
3
votes
1answer
47 views

What does 2-flat mean when discussing APN permutations?

I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means. For example, the paper mentions in its definition of APN that for all distinct $a$,...
6
votes
1answer
143 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
6
votes
1answer
146 views

How does Twofish avoid weak keys if it uses key-dependent S-boxes?

From section 7.2.2 of the Twofish paper, the four S-boxes for the 128-bit cipher are generated with: $$\begin{align} s_0(x) &= q_1[q_0[q_0[x] \oplus s_{0,0}] \oplus s_{1,0}]\\ s_1(x) &= q_0[...
1
vote
1answer
97 views

Inversion in $GF(2^8)$ AES [duplicate]

I was wondering how you would calculate the S-box in AES. I found that you have to calculate the inverse of the polynomials in $GF(2^8)$. I found out that to calculate the inverse, you have to use the ...
2
votes
0answers
69 views

How can the Rijndael SBox be written as a linearized polynomial?

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk state (in Appendix A) that the Rijndael SBox can be written as a "linearized polynomial" $S(...
3
votes
1answer
81 views

Countermeasures to prevent integral cryptanalysis against 4-rounds AES

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:...
0
votes
1answer
117 views

S-Box and it's linearity

I am trying to figure out why it is necessary S-box's to be nonlinear. I have been searching for some materials but was not able to find out clear proof why it means that if we use S-box in DES, it ...
1
vote
3answers
223 views

What is the time complexity of the basic components of a symmetric cipher?

I have a very basic knowledge on time complexity and even less on programming, so please bear with me. I am interested to know the time complexity in big-O notation of some of the basic operations in ...
1
vote
0answers
65 views

Perfect Nonlinearity of AES S Boxes

Can someone give a clear definition of what a perfectly nonlinear function is? Can we say that AES s-boxes are perfectly nonlinear and why?
-1
votes
1answer
94 views

Question about DES S-boxes from Encryption to Decryption [duplicate]

While working on a homework assignment, I came across an interesting dilemma that I want to delve more into. The question essentially said to flip the first bit in the key string and then see what S ...
0
votes
2answers
233 views

How we can calculate AES Inverse SBox?

I am trying to find out the inverse of and SBox, but in vain, I have seen multiple questions over StackExchange, But I cant be able to solve my issue. As in this question, How are the AES inverse S-...
4
votes
3answers
425 views

What's happens if we use the weakest S-BOX for AES?

I'm in research of generating Dynamic Secret S-BOX for AES based on 2 Keys (Encryption Key and *I Called S-BOX key). If (worst scenario) I randomly generate the worst S-BOX in an encryption. What ...
1
vote
1answer
175 views

how to compute the correlation between two binary vectors?

We find different equations to compute the correlation or correlation coefficient: $\begin{align*} corr &= \frac{a+d}{a+b+c+d}\\ &= \frac{(a+d) - (b+d)}{a+b+c+d}\\ &= \frac{(a+...
2
votes
0answers
65 views

Strict Avalanche Criteria in Sage

Is there any inbuilt functionality in sage to check if any S-Box satisfies Strict Avalanche Criterion or not?
1
vote
0answers
155 views

how to compute Bit Independent Criteria on a 4-bit S-box?

The idea of Bit Independence Criterion (BIC ) was introduced by Webster and Tavares . For a given set of avalanche vectors generated by complementing a single plaintext bit, all avalanche variables ...
-1
votes
1answer
49 views

what is the impact of smaller bit size sbox

There are multiple S-boxes type, as DES uses 4 bit S-box and AES uses 8 bit S-box. I want to know how this effect the security?? If we use 4 bit or 8 bit. apart from the DC attack. Both provides ...
2
votes
2answers
138 views

AES alternate equation for the S-Box affine transformation

The Wikipedia article for the AES S-Box gives an alternate equation for the affine part of the S-Box transformation: $$b_{out} = (b_{in} \times 31_d) \operatorname{mod} 257_d \oplus 99_d$$ It is not ...
2
votes
1answer
213 views

AES with linear S-Box

If the AES S-Box is replaced with a linear or affine transformation, for instance the identity mapping $\sigma(x)=x$, does the cipher become entirely affine and hence trivially weak?
1
vote
2answers
89 views

What are some design considerations for S-Boxes?

My studies in cryptography have been quite detailed so far, however, one area that hasn't been explained to me is how S-Boxes are typically designed. Typically, the S-boxes are provided "as is" by the ...
3
votes
3answers
164 views

Calculate the Number of active s boxes

I really want to learn how to calculate the number of active s _boxes for block cipher cryptographic algorithms. I want to do that manually after running each round of an algorithm such as LED ...
3
votes
1answer
222 views

Number of active s boxes

How can I calculate the minimum number of active s_boxes for block cipher algorithms such as present algorithm? I have read in that, but I couldn't understand the meaning of branch number.
2
votes
1answer
207 views

Simplified AES S-box multiplication - calculation error

I have a problem to calculate the S-box in S-AES. The affine transformation is defined: I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ ...
4
votes
1answer
116 views

How many primitive cryptography operations are there? [closed]

Every cipher I've encountered seems to be built from slight variations of only three basic operations: the S-box, the P-box, and the XOR. I’m just wondering, are there any others? And if there aren'...
0
votes
1answer
177 views

AES and GOST 28147-89 “Magma” Comparison

I am trying to understand how AES is comparable to GOST 28147-89 "Magma". Like for parameters such as bit shifting and addition of the subkey to the input, which are a part of Magma, what is their ...
0
votes
1answer
810 views

Finding output given an S-box input of 8 bits

I'm given the following table: I'm told to find the output given an hexidecmal input of 2B. I know that 2B in binary = 001 01 011 So I took the first two and ...
5
votes
1answer
194 views

Security Implications of Fixed & Opposite Fixed Points of Sbox

Fixed point means when Sbox Input is equal to Sbox Output whereas Opposite Fixed Point means when Sbox Input is complement of Sbox Output. How does Fixed and Opposite Fixed Point affect the strength/ ...
3
votes
1answer
29 views

Measure Strength of Mix Mode Modular Arithmetic based Confusion Layer

Strength of sboxes is generally measured by different properties eg non linearity, fixed points etc. If confusion is provided by Mixed Mode Modular Arithmetic (eg as in IDEA), how to measure the ...
1
vote
3answers
272 views

Does the DES s-box only provide confusion, or does it also provide an avalanche effect?

In DES, does the s-box provide an avalanche effect or does it only provide confusion in the ciphertext?
5
votes
2answers
212 views

Security of the AES with a Secret S-box

In this paper they change the $AES$ S-box to a uniformly random one and answer the questions: How does the security of AES change when the S-box is changed by a secret S-box? Would it be safe to ...
4
votes
1answer
125 views

Non Linearity of huge Sbox

Sboxes provide confusion in cipher. Non Linearity measures the strength of sbox layer. In order to measure non linearity of sbox, a table is computed to measure distances with its affine functions. If ...
1
vote
1answer
936 views

AES S-box calculation

I am trying to design the s-box for AES. Quoting from Wikipedia, the algorithm for applying affine transformation in AES s-box calculation is ...
0
votes
1answer
68 views

Number of Substitution boxes

How many possible 16 bit S-boxes exist? (AES uses 8 bit substitution boxes) I first taught of calculating 128(keysize in bits)/8(bits) =16, but I believe it's wrong.
5
votes
1answer
693 views

AES s-box – How do I calculate the inverse of this field equation?

I want to implement AES algorithm,instead of LUT based S-box, but I’m stuck at point creating "Inverse of equation" during implementation. In creation of S-box I am using the following steps: ($...
0
votes
1answer
108 views

Affine of Inverse Sboxes

"All 8x8 s-boxes created using Galois Field inversion plus an Affine Transform have the same non-linearity, as the Affine Transform does not change the linear or differential properties" is what this ...
2
votes
1answer
50 views

AES S-Box: Possible options for constant to calculate S-Box values

To calculate the values of S-Box in AES, I came across a lot of resources where constant {63} was chosen. It is said that {63} satisfies the condition of S-Box that it should not have any fixed points ...
1
vote
1answer
75 views

AES S-Box: How is value for 01 mapped to 7c?

If irreducible polynomial $m(x) = x^8+x^4+x^3+x+1$ is chosen, or even for any other value, the multiplicative inverse will not exist for $01$, as $0000 0001$ will perfectly divide $m(x) = 100011011$ ...
1
vote
1answer
130 views

number of active s-boxes in a block cipher?

How can we find the minimum number of differentially active s-boxes in a block cipher (actually a Feistel network with several input cells) in a truncated characteristic form? In a recursive ...
2
votes
2answers
1k views

AES S-Box Lookup Table Hardcoded?

From what I've looked up on various AES projects, the impression I get is the lookup table is hardcoded with the values from this Wikipedia entry page: https://en.wikipedia.org/wiki/Rijndael_S-box ...
4
votes
2answers
116 views

Building large S-Boxes from smaller ones

I would like to make an exhaustive list of all relevant techniques that have been studied in order to build a large S-Box from smaller ones. As far as I known, three structures are usually preferred: ...
0
votes
0answers
82 views

Turning an S-box into a keyed S-box

Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it ...
-1
votes
1answer
165 views

Explain the fast Walsh–Hadamard transform in simple steps or pseudocode

I've read that the fast Walsh–Hadamard transform is a way to efficiently calculate the linearity/non-linearity of an S-box. Can I get a description of it in simple steps or pseudocode that is ...
2
votes
1answer
266 views

Relying on a 4-bit S-box instead of an 8-bit one

I've discovered that generating good S-boxes with only modular addition, bitwise XOR, bitwise AND, bitwise OR, bitwise NOT, rotations, and, shifts is difficult. I figure that using them to make a good ...