Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
0
votes
1answer
26 views

Calculate number of active S-boxes for a cipher where one word observes multiple times overlapped S-box substitution in a single encryption round

There are many ways in which the number of active sboxes of a cipher for one round can be calculated. Like, a manual approach (all possible input differential are applied in the two plaintexts $P_0, ...
2
votes
1answer
96 views

Why key reuse is not an issue in a Feistel cipher?

I have a good understanding of stream ciphers and one time pad. I also know the dangers of using the same key in a PRG for a stream cipher. However as far as I can tell, the Feistel block cipher uses ...
0
votes
2answers
38 views

Implementing the sbox components using lookup tables

Does it is possible to implement the components of a SBOX tables using lookup_tables. For example for a 4-bit SBOX it is possible to obtain the component 3 using SAGE in the following way ...
0
votes
2answers
53 views

Algebraic Normal Form of a function in $\operatorname{GF}(2^{n})$

Consider the function $f(x)=x^{2k+1}$ in $\operatorname{GF}(2^{n})$ for $n$ odd and $\gcd(k,n)=1$, which is differentially 2-uniform function. For $n=3$, $k=1$, I want to find the Algebraic Normal ...
-1
votes
1answer
47 views

LAT of sboxes, sum of coloms and rows

let we have sbox s: Vn -> Vn. If we make LAT table for s, fix any row and get a sum by columns, that sum would be $+-2^{n-1}$. And vice versa, if we fix any column and get a sum by rows, that sum ...
1
vote
1answer
87 views

Why is it not possible to attack an AES by creating a function to model the substitution that occurs in a s-box?

I realise that s boxes are able to make the transformations done in AES non-linear. However I am unsure how this makes AES secure. For instance if we had no s box then it is possible to calculate the ...
2
votes
1answer
80 views

How to use sagemath to find nonlinear invariants of S-box?

I read a paper about a nonlinear invariant attack that is "Nonlinear Invariant Attack: Practical Attack on Full SCREAM, iSCREAM, and Midori64" And I've found a website of sagemath : https://...
0
votes
0answers
21 views

Non-linear phase that's Side channel attack proof

I'm designing a cipher and I'm looking for a Non-linear phase in my cipher that is side channel attack proof, I know that Sboxes are vulnerable to to that because of accessing the cache. I'm thinking ...
1
vote
1answer
36 views

Quadratic Equations to Describe SBox

I am using a 8 bit Sbox having 16 entries with a lookup table of 4x4 in cryptographic algorithm. Sbox is constructed on subgroup of galois field 2^8. I want to calculate number of quadratic equations ...
8
votes
3answers
525 views

What is this AES SBOX triplet property?

While playing around with the AES SBOX, I found out that there are 85 unordered triplets (a, b, c) that have the following characteristics: ...
0
votes
0answers
38 views

nonlinearity and autocorrelation of common s-boxes

I cannot find publications comparing the properties of popular cipher s-boxes. First of all, I am interested in nonlinearity and autocorrelation of s-boxes, which are used in seed, cast-128, camellia ...
0
votes
0answers
20 views

Conditional probability being Constant in Threshold Cryptography

I am working on Threshold implementation of algorithms to prevent side channel attacks. I am not that much proficient in Statistics and Probability theory. I want to know what is the significance of ...
4
votes
1answer
130 views

Division property table of SBox

In Table 12 (page 23) of the GIFT paper, the "Division property" table is given. I could not understand how it has been computed. My questions: May I have an algorithm on how to compute the ...
2
votes
1answer
73 views

Building a 4-bit S-box with a 4-uniform DDT

I am looking for a 4-bit S-box which has only 4s in its difference distribution table (except the top left corner) but I was not able to find one in the literature. Has such an S-box been already ...
0
votes
0answers
49 views

SHA3_512 as dynamic SBOX generator

I'm creating a substitution-permutation cipher (for learning purposes only of course) and I'd like to implement dynamic SBOXs. The cipher will have a block size of 128, and 32 rounds. These SBOXs will ...
2
votes
0answers
46 views

What does "the input difference of each Sbox should be zero" mean?

While going through the article, The MALICIOUS Framework: Embedding Backdoors into Tweakable Block Ciphers. I came across this statement in order to have a deterministic differential characteristic ...
1
vote
1answer
69 views

AES with other SBoxes

I'm not a cryptologist, just an interested engineer (& now retired). I used to design hardware with AES en/decryption blocks & generate test vectors using my own Tcl script using the embedded ...
3
votes
2answers
153 views

Why is the nonlinearity of this Boolean function evaluating to $\frac12$?

I am using the method presented in this paper to find the nonlinearity of the function $$ f: \mathbb{F}^1_2 \to \mathbb{F}^1_2 \\ f(x) = x$$ The truth table is $f = [0 \space \space 1]$. Now, I read ...
0
votes
0answers
25 views

Calculating equivalent substitutions to AES operations(MixColumn/ ARK)

When the AES algorithm is implemented in a table lookup(SubByte, MixColumn) fashion, how many substitutions required in full round encryption? When AES is encrypted without using the table lookup(only ...
0
votes
0answers
26 views

How do I invert the final round S Boxes during linear cryptanalysis

I'm using Howard Hey's tutorial on linear cryptanalysis, however I don't understand the final stages. I understand using exhaustive partial subkeys to turn the ciphertext into the final round output, ...
0
votes
2answers
148 views

Differential and Linear Cryptanalysis on Random Sbox

Assume that we use the key to perform a uniform permutation to generate a sbox. The literature is rich supporting the statement that a random Sbox can make any cryptographic scheme weaker. I have ...
0
votes
0answers
51 views

Avalanche effect SBOX

It is possible to achieve the avalanche effect in an SPN or in a Feistel network that use a single round of an SPN in his function (like DES) using SBOX that receive 2 bit in input and output 2 bit?
1
vote
1answer
62 views

Is it possible to use an S-box similar to the one used in DES in AES? How would this work?

I'm reviewing some questions given to me by a professor and am stumped on this one. My initial guess is that yes, this is possible, but I do not know how to explain it, specifically for a function $\{...
2
votes
1answer
66 views

Problems on ANF equation?

I tried to solve SBox as given in this link I am trying to understand this paper SBox. In this on page no.4 the correct equation of given SBox is mentioned. I am not getting how to design ANF equation ...
3
votes
1answer
340 views

AES-CTR security if S-boxes substituion is omitted?

I understand why s-boxes are needed in general especially when ECB mode is used(because of using the same key for encryption of other blocks)but I wonder if it's ...
1
vote
0answers
69 views

Generate ANF equation? [duplicate]

Given an SBox, how can I generate its component equations (in ANF)? given in this link: https://en.wikipedia.org/wiki/Algebraic_normal_form For example, let's say I have this SBox: $$\{1, a, 4, c ,6 ,...
3
votes
1answer
78 views

LAT of an SBox, values are even

This is probably a silly question, but I could not find any reference. For the DDT of an SBox, it is easy to see why all the values are even. Is there any related result for LAT (i.e., all its values ...
7
votes
0answers
202 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
1
vote
1answer
207 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
2
votes
1answer
65 views

Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES

Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES It seems like these two are equal, can someone explain in theoretically?
2
votes
1answer
152 views

Cryptanalysis of a feedback shift reigister with an S-box

I’m just getting started on learning cryptography and here is a problem from exercises about which I'm totally confused: This is a 32-bit feedback shift register to encrypt some message. The register ...
0
votes
0answers
64 views

S-box for byte substitution where the s-box values are multiplicative inverses of 257

The title basically says it. We have a 16 by 16 s-box, $256$ entries total. And the first value is the multiplicative inverse of $257$, so $1 \times k \bmod 257, \space k = 1$. $2 \times k \bmod ...
1
vote
1answer
77 views

What are the standard properties of an S-Box [duplicate]

Apart form the following, what are the other properties of a good cryptographic Substitution box or the S-Box: Changing one input bit should change about half of the output bits. Each output bit ...
0
votes
0answers
36 views

AES S_BOX Generator additive constants

I try to generate other S_BOX for AES but I don't realize how to choose additive constants for S_BOX from decryption if for encryption it is 0x63 why is ...
3
votes
1answer
143 views

Inversion in $GF(2^{10})$ Using Composite Fields

I'm designing a circuit that uses many $GF(2^{10})$ inverters. Normally for this sort of thing I use lookup tables. (Itoh-Tsujii is not efficient for these smaller fields.) This application is for ...
2
votes
1answer
87 views

How to generate a 16 X 8 perfectly nonlinear S-box

I want to generate a 16,8 perfectly nonlinear S-box for an encryption algorithm I am working on. I don't have a background in math, and I'm an undergrad, so a lot of the math involved is very ...
2
votes
0answers
45 views

what if the S-boxes in DES were "optimal"

if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
2
votes
0answers
62 views

Design of SIMD-implemented cipher

Design of efficient of block ciphers needs consideration of many factors such as register size. i found that some ciphers can be SIMD implemented such as TWINE , SM4 , chacha20 ,SPIX ,and others. ...
4
votes
1answer
126 views

Would using perfect S-boxes in F function of an unbalanced Feistel network produce a simple and secure cipher?

When I read some articles about cryptography on wikipedia, I took note of the following statements (please, correct me, if any of these are wrong): Perfect S-box (based on bent functions) provides ...
2
votes
0answers
83 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
1
vote
0answers
140 views

Do the keys in AES determine the S and P boxes? [closed]

I once read somewhere that the keys determine the S and P boxes. If so, how does that work?
1
vote
1answer
89 views

A bit-sliced implementation (or the algebraic normal form) of the two FIDES S-Boxes

I want to see a bit-sliced implementation of 5-bit and 6-bit S-Boxes of FIDES or, at least, a representation of these two functions in algebraic normal form. Where can I find it?
0
votes
1answer
157 views

Can I change the S-box and P-box in DES?

I am a newbie to crypto and just one quick question on the s-box and p-box of DES. I understood that the s-box is where the security comes from and NSA has somehow decided how it should be filled in. ...
1
vote
0answers
87 views

How TAU function of SM4ni cipher is implemented?

I am trying to understand the SIMD implementation of TAU function of SM4 which is as follows: ...
1
vote
2answers
417 views

Is the following s-box more linear or more non-linear?

I am trying to figure out whether the following simple s-box configuration I created is more linear than non-linear or vice versa more non-linear than linear? The parameters for this 16*4 table of ...
0
votes
2answers
636 views

how can I test quality of sbox?

I have 11 sboxes, I want to test them and find the best one. How can I do that, I found several criterions for that but I could not understand.
0
votes
0answers
94 views

how to compute Bit Independence criterion of SBOX?

I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?
0
votes
2answers
126 views

$\alpha^{2^{m} + 1}$ is a generator of $\operatorname{GF}(2^m)$?

This is from a paper (Partitions in the S-Box of Streebog and Kuznyechik) about S-Boxes: Let $\operatorname{GF}(2^{2m}) = \mathbb{F}_2[X]/p(X)$ be a finite field of even degree defined by a primitive ...
4
votes
1answer
497 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
1
vote
1answer
93 views

Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...

1
2 3 4 5