Questions tagged [s-boxes]
(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).
267
questions
1
vote
0
answers
38
views
Cryptanalysis of S-box [closed]
Because of implementation constrains, I merge some 4-bit S-boxes to find a 8-bit S-box with good properties such as nonlinearity, resistance against differential and linear cryptanalysis.
Does the ...
- 11
0
votes
0
answers
38
views
How to make sure that $S$ & $S^{-1}$($S$ inverse) is a permutation of bytes?
Assume you have implemented the S-box and Inverse S-box of AES as code (or hardware) instead of a lookup table copy-pasted from the AES standard. An obvious test you want do is to check that S−1(S(B)) ...
- 1
0
votes
1
answer
139
views
What is the inverse of this variant of the Gimli SP-box?
Consider a slightly modified variant of the Gimli SP-box:
...
- 1,327
2
votes
0
answers
76
views
A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3
The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
- 1,327
1
vote
1
answer
156
views
What is the inverse of this generalised automaton (based on bitwise XOR and modular addition)?
Section 4.1 of the paper “Nonlinear Diffusion Layers” [Y. Liu, V. Rijmen, G. Leander] defines the nonlinear function $\rho$ over $\mathbb{F}_{2^m}$ as follows: $$\rho : \mathbb{F}_{2^m}^4 \to \mathbb{...
- 1,327
1
vote
1
answer
60
views
DDT for boolean functions must contain only powers of two
I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
2
votes
1
answer
96
views
Good S-boxes from ARX designs
Have any good 8-bit S-boxes made using ARX principles been found yet? I found Alzette, but it's a huge S-box at 64 bits.
I know that with a combination of addition, rotation, and XOR that any S-box ...
- 3,645
2
votes
1
answer
57
views
Which reordering should I use for an 8-bit S-box?
I'm designing a cipher which has key-dependent S-boxes. The procedure is like this:
Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
- 221
2
votes
4
answers
163
views
How is the $\chi$ step of the Keccak permutation invertible?
I would like to understand how Keccak's permutation function is reversible. The difficulty I have is with the $\chi$ step that uses the and operator which is not revertible. All the other ...
- 23
1
vote
1
answer
89
views
In hardware, why using an algebraic implementation of a (small) S-Box instead of a LUT?
There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function.
The Chi function ...
- 11
0
votes
0
answers
30
views
AES S-Box design goal [duplicate]
First layer of each AES round is the Byte Substitution layer. It is the only nonlinear element of AES. What would happen if this layer was not in the path? And the lack of it would create a problem in ...
0
votes
1
answer
140
views
Linear approximation table of AES S-Box
I am trying to create linear approximation table of AES SBox to better understand linear cryptanalysis, I have followed the formula in this paper (page 7 of pdf file) to be able to generate the linear ...
- 117
1
vote
1
answer
89
views
How many $S$-Boxes of length $3$ are there over $\mathbb{F}_{2}$?
Is there a simple way if counting the number of $S$-Boxes of length $\ell$ over $\mathbb{F}_{2}$? By $S$-box I mean an $S$-box satisfying the avalanche condition.
I mean it is quite easy to see that ...
4
votes
1
answer
195
views
How to determine cryptographic properties of AES S-Box?
In the book The Design by Rijndael states that the design criteria for the S-box are nonlinearity and algebraic complexity. Can these two criteria be considered as two specific cryptographic ...
- 117
1
vote
1
answer
100
views
Is it fatal if a blockcipher uses a sbox with a fixed point at 0?
In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
- 9,001
1
vote
1
answer
310
views
Example of S-Box truth table in AES
I'm trying to understand some cryptographic properties of the s-box so I can have my own code. Example of balanced properties I read in this document that they say
A boolean function S : $ GF(2^n) $ ...
- 117
1
vote
2
answers
283
views
How changing a single byte/word in a substitution box affects the inverse result?
Let's suppose I have a 8-bit substitution box composed of 256-bytes and invert it.
Does changing one byte in the substitution box will make the inverse result completely different than if I didn't ...
- 391
2
votes
1
answer
73
views
How to calculate Correlation, Difference propagation probability and Algebraic complexity a particular S-box?
I'm learning about AES. According to the book The Design of Rijndael refers to the design criteria S-box $S_{RD}$ as follows:
Design criteria for $S_{RD}$. We have applied the following design ...
- 117
0
votes
0
answers
38
views
Implementation of XSL attacks on block ciphers using dynamic S-Boxes
For those who are not familiar with; XSL attacks basically focus on deriving a set of equations from the internal mechanics of a block cipher and then solving the same equations to recover the secret ...
1
vote
0
answers
53
views
Pbox and S-Box values in AUT64
I am looking to get P-box and S-box from firmware
Decided to search the firmware for
Pbox - 8 nibbles from 0-7
i.e
pbox = [2, 0, 6, 5, 7, 4, 3, 1]
Found it :)
And ...
- 145
1
vote
0
answers
48
views
Getting permutation box and S-box for AUT64 block cipher
Want to get 32 bits from 0x8000 address as 8 bytes (perm box)
...
- 145
1
vote
1
answer
108
views
How do AES Substitution box's offer any additional security since it's 1 to 1?
If the Substitution box is 1 to 1 (a specific value can only ever be a specific box value), and the contents of Rijndael S-box is public, how does this offer any additional security?
With AES the ...
- 13
1
vote
1
answer
189
views
AES - SBOX avalanche effect question
I am making a program that verifies the avalanche effect for the SBOX of the AES block cipher for a certain number of iterations. This program changed one bit randomly in one of the elements of the ...
5
votes
1
answer
148
views
How do you arrive at this algorithm for dividing by 3 in the Galois field?
This function from Wikipedia calculates the sbox used in AES:
...
- 53
-1
votes
1
answer
466
views
AES vs Kuznechik (GOST R 34.12-2015) comparsion [closed]
Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?
- 109
3
votes
1
answer
480
views
Non-Linearity of an S-Box [duplicate]
This should be pretty simple question I presume. So let's say I have an 8x8 S-Box. I can easily treat it as 8 different boolean functions for each of the 8 input bits. Is the non-linearity the lowest ...
- 123
0
votes
0
answers
55
views
Can a byte/word inserted as an entry in a Feistel S-box be breakable?
Let's suppose I insert these two 4-byte words (32-bits) in a feistel S-box with 1024-bytes of size (256*32-bits), (like Blowfish does):
blah bleh
What kind of attacks could possible be made to ...
- 877
0
votes
1
answer
75
views
How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$
How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$?,
Any monomial $x^d$ is a permutation in the field $\mathbb{F}_{2^n}$ iff $gdc(d,2^{n}-1)=1$,why?
- 25
0
votes
1
answer
77
views
How to calculate the inversion fucntion $S: \mathbb{F}_{2^n} \rightarrow \mathbb{F}_{2^n}$,with $S(x)=x^{-1}$
The S-box is defined as the generalised inverse function $S:\mathbb{F}_{2^n}\rightarrow \mathbb{F}_{2^n}$,in quotient ring $\mathcal{R}:=\mathbb{F}_{2^n}[X]/(X^{2^n}-X)$
with $S(x)=x^{-1}$, is ...
- 25
1
vote
0
answers
78
views
99 in AES s-box, where it came from? [duplicate]
The multiplicative inverse in AES s-box is transformed using the following affine transformation:
$s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll 3) \oplus (b \lll 4) \oplus 99_{10}$
Where ...
- 1,211
0
votes
3
answers
163
views
Generalizing AES s-box circular shifts in bigger GF
According to wikipedia:
https://en.wikipedia.org/wiki/Rijndael_S-box
AES is doing interesting thing (where $<<<$ is circular shift):
$s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll ...
- 1,211
1
vote
1
answer
60
views
Does inserting an entry of 32/64-bits into a Feistel S-box would consume the same cycles per byte as inserting a single byte?
Blowfish splits a 32-bit word into 4 bytes and insert each byte as an entry in a S-box.
Let's suppose I do the same but with an entire word, 32 or 64-bits. MARS block cipher does the same with 32-bit ...
- 877
0
votes
0
answers
46
views
Entering a word in a S-Box (like Feistel ciphers do) and keeping the S-Box secret: Could this be called encryption?
Let's suppose I take a data block of 64-bits and use it as an entry in a (big) S-box, and keep the S-box secret. S-box would be the "key". For "decryption" I just enter the result ...
- 877
0
votes
0
answers
81
views
Security of Blowfish with secret S-boxes
There are similar questions about secret S-box(es), but none of them about secret Blowfish (or any other canonical Feistel cipher) S-Boxes, only about secret AES S-Box.
Let's suppose that instead of ...
- 877
1
vote
1
answer
107
views
16-bit entry in a S-Box of a SPN block cipher: Would it have the same speed/performance than a 8-bit entry?
I learned that in Substitution–permutation block ciphers, the maximum size of S-Box set to receive an entry from a data is the max numeric count of the data, for example, if the entry is 8-bits the S-...
- 877
1
vote
1
answer
153
views
Is it possible to use words of bits as entries in S-Boxes bigger than 4/8 bits and achive similar security/speed in SPN block ciphers?
Blowfish splits a 32-bit word into 4 sets of 8-bits (1 byte) and use them as entries in its S-Boxes.
Kuznyechick splits two 64-bits words in many nibbles (4-bits chunks), use them as entries in its S-...
- 877
0
votes
1
answer
120
views
If keeping the S-Boxes secret in SPN ciphers increase they security, does using one different S-Box set per round in them increases even more? [duplicate]
I read in this paper that keeping the S-boxes secret in AES raise its security from 128-256-bits to 1812-1940-bits.
Let's suppose I use one different S-Boxes set per single round.
/\ Does this ...
- 877
0
votes
1
answer
58
views
If converting a SPN Block Cipher to a version with larger block size, should its S-boxes be enlarged too?
Let's suppose I want to convert a Substitution-permutation network block cipher like Kuznyechik to a version with a larger block size.
Should its S-boxes be enlarged too in order to achieve similar ...
- 877
2
votes
2
answers
682
views
How to calculate/generate the inverse S-box of Kuznyechik block cipher?
Let's suppose I want to modify Kuznyechik block cipher by choosing a random S-box (taken from /dev/random for example).
How can I calculate/generate the inverse S-box?
Does anyone know the formula or ...
- 877
4
votes
1
answer
694
views
Why is this function bijective?
I cannot seem to understand why the function $F$ defined in Theorem 7.1 of the paper “Permutation rotation-symmetric Sboxes, liftings and affine equivalence” is described as “a bijection on $\mathbb{F}...
- 1,327
2
votes
1
answer
245
views
DES SBOX Output with Bitslice
I am not understanding how to compute the output bits of a 6-to-4-SBOX with bitslice technique in DES.
Matthew Kwan made a brief recap in his paper "Reducing the Gate Count of Bitslice DES" ...
1
vote
1
answer
874
views
How to solve this S Box?
I have performed the XOR and the result comes as 1001.
Now my confusion is that in standard S-Box (DES) the input is 6 bit where the first and last bit together specifies row and 4-middle bits column. ...
- 113
-1
votes
1
answer
188
views
What is the time and space complexity of the AES S-boxes? [closed]
What are the time and space complexity of the AES S-boxes? Could someone please explain how these are determined?
- 13
0
votes
0
answers
61
views
How is the polynomial multiplicative inverse calculated here? [duplicate]
How is the multiplicative inverse calculated in the following? Please explain with details.
Note: I understood how polynomial value 283 is calculated.
- 13
1
vote
1
answer
793
views
How does this code calculating AES S-Box work?
How does this code calculating the AES S-Box work? I don't understand the overall calculation procedure. Code is attached below:
...
- 13
2
votes
1
answer
489
views
How to calculate the Inverse of random AES S-BOX (asuming we don't know how the S-BOX built)?
I'm recently studying cryptography, and I have a task for collecting the s-boxes for AES, and then implementing that s-boxes for encrypting & decrypting, but most of the S-boxes I found are not ...
- 23
1
vote
1
answer
64
views
Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?
The context is iterated ciphers.
Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
1
vote
0
answers
53
views
Shark cipher SBox
In the literature, I can’t find the S-Box component of SHARK block cipher. I appreciate if anyone help to find the elements of the S-Box of this cipher.
3
votes
1
answer
348
views
Construction of S-Box in PRESENT
I'm currently working on an hardware implementation (with verilog) of PRESENT-80 for research purposes. Due to our goal to strengthen the security of PRESENT-80 with Masking and Error Detection I need ...
- 86
0
votes
1
answer
59
views
Calculate number of active S-boxes for a cipher where one word observes multiple times overlapped S-box substitution in a single encryption round
There are many ways in which the number of active sboxes of a cipher for one round can be calculated. Like, a manual approach (all possible input differential are applied in the two plaintexts $P_0, ...
- 157