Skip to main content
New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
2 votes
1 answer
66 views

How to design a reversible shifted XOR with an S-box?

According to this post, S-boxes are invertible. Inverting S-boxes can be very easy: you simply create a lookup table that reverse all the possible substitutions of the S-box. E.g. if the S-box maps ...
nalzok's user avatar
  • 123
0 votes
0 answers
37 views

In the context of Hardware Security and Cryptography, how do I calculate the Algebraic Normal Form for sboxes [duplicate]

In our hardware security exercise, I am trying to calculate the ANF function manually (Sboxes) for the given table: And I came up with the result as: I thought I was calculating it correctly using ...
TorJaks669's user avatar
0 votes
2 answers
61 views

How does MixColumn collapse 4 active S-boxes into 1?

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns: I'm trying to reproduce these paterns. The pattern in the column marked in ...
Alexey Kalmykov's user avatar
0 votes
0 answers
70 views

AES encryption step: calculate the byte substitution process

I am a self learner and tried to learn AES, so I have a book written in my native language. It has some practical examples about finite fields and AES. It has a question that asks me to calculate the ...
user avatar
0 votes
0 answers
54 views

How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$,for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
HelloSpace's user avatar
2 votes
1 answer
60 views

Midori block cipher design: importance of $S_b$ as the S-box

With a use of almost MDS the Midori cipher provides a good diffusion. But why $S_b$ is used as S-box and what is its actual importance?
Ranit's user avatar
  • 21
0 votes
0 answers
77 views

AES SBOX Masking in Python

I am trying to create an AES Sbox masking based on this paper. In the paper, they tried to mask the sbox described in this other paper. The inversion is been done in GF(4). I know that it is mostly ...
John's user avatar
  • 1
1 vote
0 answers
45 views

Cryptanalysis of S-box [closed]

Because of implementation constrains, I merge some 4-bit S-boxes to find a 8-bit S-box with good properties such as nonlinearity, resistance against differential and linear cryptanalysis. Does the ...
Vahid's user avatar
  • 11
0 votes
0 answers
42 views

How to make sure that $S$ & $S^{-1}$($S$ inverse) is a permutation of bytes?

Assume you have implemented the S-box and Inverse S-box of AES as code (or hardware) instead of a lookup table copy-pasted from the AES standard. An obvious test you want do is to check that S−1(S(B)) ...
Ali's user avatar
  • 1
0 votes
1 answer
151 views

What is the inverse of this variant of the Gimli SP-box?

Consider a slightly modified variant of the Gimli SP-box: ...
lyrically wicked's user avatar
3 votes
0 answers
92 views

A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3

The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
lyrically wicked's user avatar
1 vote
1 answer
163 views

What is the inverse of this generalised automaton (based on bitwise XOR and modular addition)?

Section 4.1 of the paper “Nonlinear Diffusion Layers” [Y. Liu, V. Rijmen, G. Leander] defines the nonlinear function $\rho$ over $\mathbb{F}_{2^m}$ as follows: $$\rho : \mathbb{F}_{2^m}^4 \to \mathbb{...
lyrically wicked's user avatar
1 vote
1 answer
84 views

DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
Alessio Proietti's user avatar
2 votes
1 answer
114 views

Good S-boxes from ARX designs

Have any good 8-bit S-boxes made using ARX principles been found yet? I found Alzette, but it's a huge S-box at 64 bits. I know that with a combination of addition, rotation, and XOR that any S-box ...
Melab's user avatar
  • 3,655
2 votes
1 answer
75 views

Which reordering should I use for an 8-bit S-box?

I'm designing a cipher which has key-dependent S-boxes. The procedure is like this: Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
Pierre Abbat's user avatar
2 votes
4 answers
220 views

How is the $\chi$ step of the Keccak permutation invertible?

I would like to understand how Keccak's permutation function is reversible. The difficulty I have is with the $\chi$ step that uses the and operator which is not revertible. All the other ...
glurks's user avatar
  • 23
1 vote
1 answer
109 views

In hardware, why using an algebraic implementation of a (small) S-Box instead of a LUT?

There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function. The Chi function ...
Gux's user avatar
  • 11
0 votes
0 answers
32 views

AES S-Box design goal [duplicate]

First layer of each AES round is the Byte Substitution layer. It is the only nonlinear element of AES. What would happen if this layer was not in the path? And the lack of it would create a problem in ...
Mohammadsadeq Borjiyan's user avatar
0 votes
1 answer
216 views

Linear approximation table of AES S-Box

I am trying to create linear approximation table of AES SBox to better understand linear cryptanalysis, I have followed the formula in this paper (page 7 of pdf file) to be able to generate the linear ...
Cat Dragon's user avatar
1 vote
1 answer
90 views

How many $S$-Boxes of length $3$ are there over $\mathbb{F}_{2}$?

Is there a simple way if counting the number of $S$-Boxes of length $\ell$ over $\mathbb{F}_{2}$? By $S$-box I mean an $S$-box satisfying the avalanche condition. I mean it is quite easy to see that ...
The Thin Whistler's user avatar
4 votes
1 answer
215 views

How to determine cryptographic properties of AES S-Box?

In the book The Design by Rijndael states that the design criteria for the S-box are nonlinearity and algebraic complexity. Can these two criteria be considered as two specific cryptographic ...
Cat Dragon's user avatar
1 vote
1 answer
113 views

Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
DannyNiu's user avatar
  • 9,399
1 vote
1 answer
866 views

Example of S-Box truth table in AES

I'm trying to understand some cryptographic properties of the s-box so I can have my own code. Example of balanced properties I read in this document that they say A boolean function S : $ GF(2^n) $ ...
Cat Dragon's user avatar
1 vote
2 answers
285 views

How changing a single byte/word in a substitution box affects the inverse result?

Let's suppose I have a 8-bit substitution box composed of 256-bytes and invert it. Does changing one byte in the substitution box will make the inverse result completely different than if I didn't ...
alpominth's user avatar
  • 393
2 votes
1 answer
82 views

How to calculate Correlation, Difference propagation probability and Algebraic complexity a particular S-box?

I'm learning about AES. According to the book The Design of Rijndael refers to the design criteria S-box $S_{RD}$ as follows: Design criteria for $S_{RD}$. We have applied the following design ...
Cat Dragon's user avatar
1 vote
0 answers
61 views

Pbox and S-Box values in AUT64

I am looking to get P-box and S-box from firmware Decided to search the firmware for Pbox - 8 nibbles from 0-7 i.e pbox = [2, 0, 6, 5, 7, 4, 3, 1] Found it :) And ...
dev's user avatar
  • 145
1 vote
0 answers
55 views

Getting permutation box and S-box for AUT64 block cipher

Want to get 32 bits from 0x8000 address as 8 bytes (perm box) ...
dev's user avatar
  • 145
1 vote
1 answer
137 views

How do AES Substitution box's offer any additional security since it's 1 to 1?

If the Substitution box is 1 to 1 (a specific value can only ever be a specific box value), and the contents of Rijndael S-box is public, how does this offer any additional security? With AES the ...
Mark Thomas's user avatar
1 vote
1 answer
203 views

AES - SBOX avalanche effect question

I am making a program that verifies the avalanche effect for the SBOX of the AES block cipher for a certain number of iterations. This program changed one bit randomly in one of the elements of the ...
Diogo Almeida's user avatar
5 votes
1 answer
187 views

How do you arrive at this algorithm for dividing by 3 in the Galois field?

This function from Wikipedia calculates the sbox used in AES: ...
user7048748's user avatar
-1 votes
1 answer
670 views

AES vs Kuznechik (GOST R 34.12-2015) comparsion [closed]

Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?
iEPCBM's user avatar
  • 109
3 votes
1 answer
516 views

Non-Linearity of an S-Box [duplicate]

This should be pretty simple question I presume. So let's say I have an 8x8 S-Box. I can easily treat it as 8 different boolean functions for each of the 8 input bits. Is the non-linearity the lowest ...
Keith's user avatar
  • 123
0 votes
0 answers
58 views

Can a byte/word inserted as an entry in a Feistel S-box be breakable?

Let's suppose I insert these two 4-byte words (32-bits) in a feistel S-box with 1024-bytes of size (256*32-bits), (like Blowfish does): blah bleh What kind of attacks could possible be made to ...
phantomcraft's user avatar
0 votes
1 answer
75 views

How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$

How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$?, Any monomial $x^d$ is a permutation in the field $\mathbb{F}_{2^n}$ iff $gdc(d,2^{n}-1)=1$,why?
mini minions's user avatar
0 votes
1 answer
81 views

How to calculate the inversion fucntion $S: \mathbb{F}_{2^n} \rightarrow \mathbb{F}_{2^n}$,with $S(x)=x^{-1}$

The S-box is defined as the generalised inverse function $S:\mathbb{F}_{2^n}\rightarrow \mathbb{F}_{2^n}$,in quotient ring $\mathcal{R}:=\mathbb{F}_{2^n}[X]/(X^{2^n}-X)$ with $S(x)=x^{-1}$, is ...
mini minions's user avatar
1 vote
0 answers
78 views

99 in AES s-box, where it came from? [duplicate]

The multiplicative inverse in AES s-box is transformed using the following affine transformation: $s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll 3) \oplus (b \lll 4) \oplus 99_{10}$ Where ...
Tom's user avatar
  • 1,221
0 votes
3 answers
178 views

Generalizing AES s-box circular shifts in bigger GF

According to wikipedia: https://en.wikipedia.org/wiki/Rijndael_S-box AES is doing interesting thing (where $<<<$ is circular shift): $s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll ...
Tom's user avatar
  • 1,221
1 vote
1 answer
65 views

Does inserting an entry of 32/64-bits into a Feistel S-box would consume the same cycles per byte as inserting a single byte?

Blowfish splits a 32-bit word into 4 bytes and insert each byte as an entry in a S-box. Let's suppose I do the same but with an entire word, 32 or 64-bits. MARS block cipher does the same with 32-bit ...
phantomcraft's user avatar
0 votes
0 answers
55 views

Entering a word in a S-Box (like Feistel ciphers do) and keeping the S-Box secret: Could this be called encryption?

Let's suppose I take a data block of 64-bits and use it as an entry in a (big) S-box, and keep the S-box secret. S-box would be the "key". For "decryption" I just enter the result ...
phantomcraft's user avatar
0 votes
0 answers
85 views

Security of Blowfish with secret S-boxes

There are similar questions about secret S-box(es), but none of them about secret Blowfish (or any other canonical Feistel cipher) S-Boxes, only about secret AES S-Box. Let's suppose that instead of ...
phantomcraft's user avatar
1 vote
1 answer
149 views

16-bit entry in a S-Box of a SPN block cipher: Would it have the same speed/performance than a 8-bit entry?

I learned that in Substitution–permutation block ciphers, the maximum size of S-Box set to receive an entry from a data is the max numeric count of the data, for example, if the entry is 8-bits the S-...
phantomcraft's user avatar
1 vote
1 answer
157 views

Is it possible to use words of bits as entries in S-Boxes bigger than 4/8 bits and achive similar security/speed in SPN block ciphers?

Blowfish splits a 32-bit word into 4 sets of 8-bits (1 byte) and use them as entries in its S-Boxes. Kuznyechick splits two 64-bits words in many nibbles (4-bits chunks), use them as entries in its S-...
phantomcraft's user avatar
0 votes
1 answer
134 views

If keeping the S-Boxes secret in SPN ciphers increase they security, does using one different S-Box set per round in them increases even more? [duplicate]

I read in this paper that keeping the S-boxes secret in AES raise its security from 128-256-bits to 1812-1940-bits. Let's suppose I use one different S-Boxes set per single round. /\ Does this ...
phantomcraft's user avatar
0 votes
1 answer
61 views

If converting a SPN Block Cipher to a version with larger block size, should its S-boxes be enlarged too?

Let's suppose I want to convert a Substitution-permutation network block cipher like Kuznyechik to a version with a larger block size. Should its S-boxes be enlarged too in order to achieve similar ...
phantomcraft's user avatar
2 votes
2 answers
804 views

How to calculate/generate the inverse S-box of Kuznyechik block cipher?

Let's suppose I want to modify Kuznyechik block cipher by choosing a random S-box (taken from /dev/random for example). How can I calculate/generate the inverse S-box? Does anyone know the formula or ...
phantomcraft's user avatar
4 votes
1 answer
698 views

Why is this function bijective?

I cannot seem to understand why the function $F$ defined in Theorem 7.1 of the paper “Permutation rotation-symmetric Sboxes, liftings and affine equivalence” is described as “a bijection on $\mathbb{F}...
lyrically wicked's user avatar
2 votes
1 answer
272 views

DES SBOX Output with Bitslice

I am not understanding how to compute the output bits of a 6-to-4-SBOX with bitslice technique in DES. Matthew Kwan made a brief recap in his paper "Reducing the Gate Count of Bitslice DES" ...
ChopaChupChup's user avatar
1 vote
1 answer
1k views

How to solve this S Box?

I have performed the XOR and the result comes as 1001. Now my confusion is that in standard S-Box (DES) the input is 6 bit where the first and last bit together specifies row and 4-middle bits column. ...
Bukaida's user avatar
  • 113
-1 votes
1 answer
204 views

What is the time and space complexity of the AES S-boxes? [closed]

What are the time and space complexity of the AES S-boxes? Could someone please explain how these are determined?
Aktar1990's user avatar
0 votes
0 answers
61 views

How is the polynomial multiplicative inverse calculated here? [duplicate]

How is the multiplicative inverse calculated in the following? Please explain with details. Note: I understood how polynomial value 283 is calculated.
Aktar1990's user avatar

1
2 3 4 5 6