Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
-1 votes
1 answer
122 views

AES vs Kuznechik (GOST R 34.12-2015) comparsion [closed]

Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?
  • 109
3 votes
1 answer
332 views

Non-Linearity of an S-Box [duplicate]

This should be pretty simple question I presume. So let's say I have an 8x8 S-Box. I can easily treat it as 8 different boolean functions for each of the 8 input bits. Is the non-linearity the lowest ...
  • 111
0 votes
0 answers
49 views

Can a byte/word inserted as an entry in a Feistel S-box be breakable?

Let's suppose I insert these two 4-byte words (32-bits) in a feistel S-box with 1024-bytes of size (256*32-bits), (like Blowfish does): blah bleh What kind of attacks could possible be made to ...
0 votes
1 answer
63 views

How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$

How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$?, Any monomial $x^d$ is a permutation in the field $\mathbb{F}_{2^n}$ iff $gdc(d,2^{n}-1)=1$,why?
0 votes
1 answer
34 views

How to calculate the inversion fuction S:S:\mathbb{F}_{2^n}\rightarrow \mathbb{F}_{2^n},with S(x)=x^{-1}

The S-box is defined as the generalised inverse function $S:\mathbb{F}_{2^n}\rightarrow \mathbb{F}_{2^n}$,in quotient ring $\mathcal{R}:=\mathbb{F}_{2^n}[X]/(X^{2^n}-X)$ with $S(x)=x^{-1}$, is ...
1 vote
0 answers
71 views

99 in AES s-box, where it came from? [duplicate]

The multiplicative inverse in AES s-box is transformed using the following affine transformation: $s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll 3) \oplus (b \lll 4) \oplus 99_{10}$ Where ...
  • 1,043
0 votes
3 answers
107 views

Generalizing AES s-box circular shifts in bigger GF

According to wikipedia: https://en.wikipedia.org/wiki/Rijndael_S-box AES is doing interesting thing (where $<<<$ is circular shift): $s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll ...
  • 1,043
1 vote
1 answer
49 views

Does inserting an entry of 32/64-bits into a Feistel S-box would consume the same cycles per byte as inserting a single byte?

Blowfish splits a 32-bit word into 4 bytes and insert each byte as an entry in a S-box. Let's suppose I do the same but with an entire word, 32 or 64-bits. MARS block cipher does the same with 32-bit ...
0 votes
0 answers
27 views

Fast implementations in c++ to find linearity of 16! sboxes?

I have to analize 16! of 16 bytes sboxes but my code is to slow to handle it. Anyone have any fast implementation on that? Thank you.
0 votes
0 answers
34 views

Entering a word in a S-Box (like Feistel ciphers do) and keeping the S-Box secret: Could this be called encryption?

Let's suppose I take a data block of 64-bits and use it as an entry in a (big) S-box, and keep the S-box secret. S-box would be the "key". For "decryption" I just enter the result ...
0 votes
0 answers
54 views

Security of Blowfish with secret S-boxes

There are similar questions about secret S-box(es), but none of them about secret Blowfish (or any other canonical Feistel cipher) S-Boxes, only about secret AES S-Box. Let's suppose that instead of ...
1 vote
1 answer
49 views

16-bit entry in a S-Box of a SPN block cipher: Would it have the same speed/performance than a 8-bit entry?

I learned that in Substitution–permutation block ciphers, the maximum size of S-Box set to receive an entry from a data is the max numeric count of the data, for example, if the entry is 8-bits the S-...
1 vote
1 answer
125 views

Is it possible to use words of bits as entries in S-Boxes bigger than 4/8 bits and achive similar security/speed in SPN block ciphers?

Blowfish splits a 32-bit word into 4 sets of 8-bits (1 byte) and use them as entries in its S-Boxes. Kuznyechick splits two 64-bits words in many nibbles (4-bits chunks), use them as entries in its S-...
0 votes
1 answer
54 views

If keeping the S-Boxes secret in SPN ciphers increase they security, does using one different S-Box set per round in them increases even more? [duplicate]

I read in this paper that keeping the S-boxes secret in AES raise its security from 128-256-bits to 1812-1940-bits. Let's suppose I use one different S-Boxes set per single round. /\ Does this ...
0 votes
1 answer
45 views

If converting a SPN Block Cipher to a version with larger block size, should its S-boxes be enlarged too?

Let's suppose I want to convert a Substitution-permutation network block cipher like Kuznyechik to a version with a larger block size. Should its S-boxes be enlarged too in order to achieve similar ...
2 votes
2 answers
263 views

How to calculate/generate the inverse S-box of Kuznyechik block cipher?

Let's suppose I want to modify Kuznyechik block cipher by choosing a random S-box (taken from /dev/random for example). How can I calculate/generate the inverse S-box? Does anyone know the formula or ...
4 votes
1 answer
668 views

Why is this function bijective?

I cannot seem to understand why the function $F$ defined in Theorem 7.1 of the paper “Permutation rotation-symmetric Sboxes, liftings and affine equivalence” is described as “a bijection on $\mathbb{F}...
2 votes
1 answer
124 views

DES SBOX Output with Bitslice

I am not understanding how to compute the output bits of a 6-to-4-SBOX with bitslice technique in DES. Matthew Kwan made a brief recap in his paper "Reducing the Gate Count of Bitslice DES" ...
1 vote
1 answer
199 views

How to solve this S Box?

I have performed the XOR and the result comes as 1001. Now my confusion is that in standard S-Box (DES) the input is 6 bit where the first and last bit together specifies row and 4-middle bits column. ...
  • 113
-1 votes
1 answer
121 views

What is the time and space complexity of the AES S-boxes? [closed]

What are the time and space complexity of the AES S-boxes? Could someone please explain how these are determined?
0 votes
0 answers
61 views

How is the polynomial multiplicative inverse calculated here? [duplicate]

How is the multiplicative inverse calculated in the following? Please explain with details. Note: I understood how polynomial value 283 is calculated.
1 vote
1 answer
323 views

How does this code calculating AES S-Box work?

How does this code calculating the AES S-Box work? I don't understand the overall calculation procedure. Code is attached below: ...
2 votes
1 answer
196 views

How to calculate the Inverse of random AES S-BOX (asuming we don't know how the S-BOX built)?

I'm recently studying cryptography, and I have a task for collecting the s-boxes for AES, and then implementing that s-boxes for encrypting & decrypting, but most of the S-boxes I found are not ...
  • 23
1 vote
1 answer
55 views

Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?

The context is iterated ciphers. Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
1 vote
0 answers
37 views

Shark cipher SBox

In the literature, I can’t find the S-Box component of SHARK block cipher. I appreciate if anyone help to find the elements of the S-Box of this cipher.
3 votes
1 answer
95 views

Construction of S-Box in PRESENT

I'm currently working on an hardware implementation (with verilog) of PRESENT-80 for research purposes. Due to our goal to strengthen the security of PRESENT-80 with Masking and Error Detection I need ...
0 votes
1 answer
37 views

Calculate number of active S-boxes for a cipher where one word observes multiple times overlapped S-box substitution in a single encryption round

There are many ways in which the number of active sboxes of a cipher for one round can be calculated. Like, a manual approach (all possible input differential are applied in the two plaintexts $P_0, ...
  • 157
2 votes
1 answer
190 views

Why key reuse is not an issue in a Feistel cipher?

I have a good understanding of stream ciphers and one time pad. I also know the dangers of using the same key in a PRG for a stream cipher. However as far as I can tell, the Feistel block cipher uses ...
0 votes
2 answers
71 views

Implementing the sbox components using lookup tables

Does it is possible to implement the components of a SBOX tables using lookup_tables. For example for a 4-bit SBOX it is possible to obtain the component 3 using SAGE in the following way ...
  • 2,591
0 votes
2 answers
83 views

Algebraic Normal Form of a function in $\operatorname{GF}(2^{n})$

Consider the function $f(x)=x^{2k+1}$ in $\operatorname{GF}(2^{n})$ for $n$ odd and $\gcd(k,n)=1$, which is differentially 2-uniform function. For $n=3$, $k=1$, I want to find the Algebraic Normal ...
  • 13
-1 votes
1 answer
61 views

LAT of sboxes, sum of coloms and rows

let we have sbox s: Vn -> Vn. If we make LAT table for s, fix any row and get a sum by columns, that sum would be $+-2^{n-1}$. And vice versa, if we fix any column and get a sum by rows, that sum ...
  • 1
1 vote
1 answer
125 views

Why is it not possible to attack an AES by creating a function to model the substitution that occurs in a s-box?

I realise that s boxes are able to make the transformations done in AES non-linear. However I am unsure how this makes AES secure. For instance if we had no s box then it is possible to calculate the ...
  • 11
2 votes
1 answer
106 views

How to use sagemath to find nonlinear invariants of S-box?

I read a paper about a nonlinear invariant attack that is "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64" And I've found a website of sagemath : https://...
1 vote
1 answer
60 views

Quadratic Equations to Describe SBox

I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations ...
  • 11
8 votes
3 answers
547 views

What is this AES SBOX triplet property?

While playing around with the AES SBOX, I found out that there are 85 unordered triplets (a, b, c) that have the following characteristics: ...
  • 181
4 votes
1 answer
163 views

Division property table of SBox

In Table 12 (page 23) of the GIFT paper, the "Division property" table is given. I could not understand how it has been computed. My questions: May I have an algorithm on how to compute the ...
  • 593
2 votes
1 answer
206 views

Building a 4-bit S-box with a 4-uniform DDT

I am looking for a 4-bit S-box which has only 4s in its difference distribution table (except the top left corner) but I was not able to find one in the literature. Has such an S-box been already ...
  • 2,704
0 votes
0 answers
62 views

SHA3_512 as dynamic SBOX generator

I'm creating a substitution-permutation cipher (for learning purposes only of course) and I'd like to implement dynamic SBOXs. The cipher will have a block size of 128, and 32 rounds. These SBOXs will ...
  • 421
2 votes
0 answers
57 views

What does "the input difference of each Sbox should be zero" mean?

While going through the article, The MALICIOUS Framework: Embedding Backdoors into Tweakable Block Ciphers. I came across this statement in order to have a deterministic differential characteristic ...
2 votes
2 answers
200 views

AES with other SBoxes

I'm not a cryptologist, just an interested engineer (& now retired). I used to design hardware with AES en/decryption blocks & generate test vectors using my own Tcl script using the embedded ...
  • 71
3 votes
2 answers
207 views

Why is the nonlinearity of this Boolean function evaluating to $\frac12$?

I am using the method presented in this paper to find the nonlinearity of the function $$ f: \mathbb{F}^1_2 \to \mathbb{F}^1_2 \\ f(x) = x$$ The truth table is $f = [0 \space \space 1]$. Now, I read ...
  • 175
0 votes
2 answers
211 views

Differential and Linear Cryptanalysis on Random Sbox

Assume that we use the key to perform a uniform permutation to generate a sbox. The literature is rich supporting the statement that a random Sbox can make any cryptographic scheme weaker. I have ...
  • 157
1 vote
1 answer
70 views

Is it possible to use an S-box similar to the one used in DES in AES? How would this work?

I'm reviewing some questions given to me by a professor and am stumped on this one. My initial guess is that yes, this is possible, but I do not know how to explain it, specifically for a function $\{...
2 votes
1 answer
75 views

Problems on ANF equation?

I tried to solve SBox as given in this link I am trying to understand this paper SBox. In this on page no.4 the correct equation of given SBox is mentioned. I am not getting how to design ANF equation ...
3 votes
1 answer
438 views

AES-CTR security if S-boxes substituion is omitted?

I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
  • 383
1 vote
0 answers
71 views

Generate ANF equation? [duplicate]

Given an SBox, how can I generate its component equations (in ANF)? given in this link: https://en.wikipedia.org/wiki/Algebraic_normal_form For example, let's say I have this SBox: $$\{1, a, 4, c ,6 ,...
3 votes
1 answer
112 views

LAT of an SBox, values are even

This is probably a silly question, but I could not find any reference. For the DDT of an SBox, it is easy to see why all the values are even. Is there any related result for LAT (i.e., all its values ...
  • 593
7 votes
0 answers
224 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
  • 7,168
1 vote
1 answer
321 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
2 votes
1 answer
69 views

Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES

Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES It seems like these two are equal, can someone explain in theoretically?
  • 35

1
2 3 4 5