Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
0
votes
0answers
24 views

What is degree of state bits and how do i count it?

in the this paper,section 3,autors attack hamsi-256.Also they explain the weakness that are exploited.Im not so good at math,and also not native english speacker, so i dont understand term "degree of ...
2
votes
0answers
43 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
1
vote
0answers
38 views

Do the keys in AES determine the S and P boxes? [closed]

I once read somewhere that the keys determine the S and P boxes. If so, how does that work?
1
vote
1answer
44 views

A bit-sliced implementation (or the algebraic normal form) of the two FIDES S-Boxes

I want to see a bit-sliced implementation of 5-bit and 6-bit S-Boxes of FIDES or, at least, a representation of these two functions in algebraic normal form. Where can I find it?
0
votes
1answer
46 views

Can I change the S-box and P-box in DES?

I am a newbie to crypto and just one quick question on the s-box and p-box of DES. I understood that the s-box is where the security comes from and NSA has somehow decided how it should be filled in. ...
1
vote
0answers
41 views

How TAU function of SM4ni cipher is implemented?

I am trying to understand the SIMD implementation of TAU function of SM4 which is as follows: ...
1
vote
2answers
111 views

Is the following s-box more linear or more non-linear?

I am trying to figure out whether the following simple s-box configuration I created is more linear than non-linear or vice versa more non-linear than linear? The parameters for this 16*4 table of ...
0
votes
2answers
109 views

how can I test quality of sbox?

I have 11 sboxes, I want to test them and find the best one. How can I do that, I found several criterions for that but I could not understand.
0
votes
0answers
33 views

how to compute Bit Independence criterion of SBOX?

I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?
0
votes
2answers
101 views

$\alpha^{2^{m} + 1}$ is a generator of $\operatorname{GF}(2^m)$?

This is from a paper (Partitions in the S-Box of Streebog and Kuznyechik) about S-Boxes: Let $\operatorname{GF}(2^{2m}) = \mathbb{F}_2[X]/p(X)$ be a finite field of even degree defined by a ...
3
votes
1answer
139 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
1
vote
1answer
71 views

Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
1
vote
0answers
29 views

Are there any publicly available Serpent s-boxes of a non-linear order 3, optimized for x86_64?

The original serpent paper claims that the s-boxes provided are of non-linear order 3, the maximum. However, this has turned out to be false, as some of them are of order 2. Are there any s-boxes ...
1
vote
1answer
55 views

Generate $4\times 4$ Sboxes with a given branch number

Say, I want to generate a lot of $4\times4$ Sboxes with linear (or differential) branch numbre of $3$. One idea is to take all the $302$ affine classes, expand each of those classes and check if any ...
3
votes
2answers
201 views

Choosing the size of an S-box

The most common S-boxes that I've seen are 4-bit and 8-bit (I've seen a 3-bit S-box in PRINTcipher, but I'm pretty sure they only did so due to significant hardware constraints). I understand that ...
1
vote
0answers
66 views

How to find multiplicative inverse of a hexadecimal number in the finite field GF(2^8)? [duplicate]

I am new to cryptography. As I was reading a note regarding S-box construction, I found a step mentioning multiplicative inverse of a number in the finite field GF(2^8). I couldn't understand it!! Can ...
2
votes
2answers
66 views

Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
3
votes
1answer
82 views

What does it mean : “Canonical representative of Sbox is 0123468A5BCF79DE”? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
1
vote
1answer
128 views

What is the inverse function of the finite field GF($2^3$) and GF($2^4$)?

I am currently reading a paper Cryptanalysis of a Theorem Decomposing the Only Known Solution to the Big APN Problem. In this paper, they mention that they used $I$ which is the inverse of the finite ...
1
vote
0answers
141 views

If the S-Box is given. How to calculate the affine transformation matrix?

Example using SAGE sage: sr = mq.SR(1, 1, 1, 8, gf2=True) sage: S = sr.sbox(); S (99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, ...
2
votes
1answer
66 views

What does $x^{1/e}$ mean in cryptography in this open butterfly structure?

I am currently reading a research paper that introduces this thing called a butterfly structure. I am confused about the structure of the open butterfly in this paper which has the equation $H^{\...
-1
votes
1answer
77 views

Find substitution of a decimal number from s-box

...
0
votes
1answer
60 views

Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
1
vote
1answer
89 views

Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
3
votes
1answer
300 views

How do the Serpent S-boxes work?

Warning: The link in the answer explain the S-Box well, but there is an error in the pseudocode. $K_i = K_{i-8} \oplus K_{i-5} \oplus K_{i-3} \oplus K_{i-1} \oplus 0x9e3779b9 \oplus i$; Instead, ...
0
votes
0answers
66 views

Calculating the inverse for a Rijndael s-box [duplicate]

I want to calculate a Rijndael S-box but something went wrong. How can I calculate the inverse? In the following is my approach: given: $f(x)=x^8+x^4+x^3+x+1 \rightarrow$ binary: 100011011 0x12 = ...
1
vote
1answer
227 views

AES oracle with bad S-box

Say you run in to a messed up AES (128) implementation which has the s-box configured as [0x0, 0x1, ..., 0xFE, 0xFF] and where you can query a few plaintexts to get the corresponding ciphertexts. How ...
0
votes
0answers
24 views

What are dual codes and the codewords denoted by these dual codes in terms of trace?

I am currently reading a research paper (linked below) that mentions "Consider only maps that vanish at 0, their short codes $C_f$ and their duals $C_f^\perp$. The duals can be written as $C_f^\perp = ...
1
vote
1answer
46 views

What is the link between the parity check matrix, double-error-correcting codes and APN permutations?

I am currently reading a research paper (linked below) which mentions that a map $f:V:=GF(2^{m}) \rightarrow V$ which vanishes at 0 is APN if it satisfies the condition that it is a binary code $C_{f}$...
3
votes
1answer
58 views

What does 2-flat mean when discussing APN permutations?

I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means. For example, the paper mentions in its definition of APN that for all distinct $a$,...
6
votes
1answer
175 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
7
votes
1answer
168 views

How does Twofish avoid weak keys if it uses key-dependent S-boxes?

From section 7.2.2 of the Twofish paper, the four S-boxes for the 128-bit cipher are generated with: $$\begin{align} s_0(x) &= q_1[q_0[q_0[x] \oplus s_{0,0}] \oplus s_{1,0}]\\ s_1(x) &= q_0[...
1
vote
1answer
389 views

Inversion in $GF(2^8)$ AES [duplicate]

I was wondering how you would calculate the S-box in AES. I found that you have to calculate the inverse of the polynomials in $GF(2^8)$. I found out that to calculate the inverse, you have to use the ...
2
votes
0answers
96 views

How can the Rijndael SBox be written as a linearized polynomial?

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk state (in Appendix A) that the Rijndael SBox can be written as a "linearized polynomial" $S(...
3
votes
1answer
112 views

Countermeasures to prevent integral cryptanalysis against 4-rounds AES

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:...
0
votes
1answer
308 views

S-Box and it's linearity

I am trying to figure out why it is necessary S-box's to be nonlinear. I have been searching for some materials but was not able to find out clear proof why it means that if we use S-box in DES, it ...
1
vote
3answers
339 views

What is the time complexity of the basic components of a symmetric cipher?

I have a very basic knowledge on time complexity and even less on programming, so please bear with me. I am interested to know the time complexity in big-O notation of some of the basic operations in ...
1
vote
0answers
107 views

Perfect Nonlinearity of AES S Boxes

Can someone give a clear definition of what a perfectly nonlinear function is? Can we say that AES s-boxes are perfectly nonlinear and why?
-1
votes
1answer
161 views

Question about DES S-boxes from Encryption to Decryption [duplicate]

While working on a homework assignment, I came across an interesting dilemma that I want to delve more into. The question essentially said to flip the first bit in the key string and then see what S ...
1
vote
2answers
768 views

How we can calculate AES Inverse SBox?

I am trying to find out the inverse of and SBox, but in vain, I have seen multiple questions over StackExchange, But I cant be able to solve my issue. As in this question, How are the AES inverse S-...
4
votes
3answers
842 views

What's happens if we use the weakest S-BOX for AES?

I'm in research of generating Dynamic Secret S-BOX for AES based on 2 Keys (Encryption Key and *I Called S-BOX key). If (worst scenario) I randomly generate the worst S-BOX in an encryption. What ...
1
vote
1answer
297 views

how to compute the correlation between two binary vectors?

We find different equations to compute the correlation or correlation coefficient: $\begin{align*} corr &= \frac{a+d}{a+b+c+d}\\ &= \frac{(a+d) - (b+d)}{a+b+c+d}\\ &= \frac{(a+...
2
votes
0answers
94 views

Strict Avalanche Criteria in Sage

Is there any inbuilt functionality in sage to check if any S-Box satisfies Strict Avalanche Criterion or not?
1
vote
0answers
307 views

how to compute Bit Independent Criteria on a 4-bit S-box?

The idea of Bit Independence Criterion (BIC ) was introduced by Webster and Tavares . For a given set of avalanche vectors generated by complementing a single plaintext bit, all avalanche variables ...
0
votes
1answer
57 views

what is the impact of smaller bit size sbox

There are multiple S-boxes type, as DES uses 4 bit S-box and AES uses 8 bit S-box. I want to know how this effect the security?? If we use 4 bit or 8 bit. apart from the DC attack. Both provides ...
2
votes
2answers
192 views

AES alternate equation for the S-Box affine transformation

The Wikipedia article for the AES S-Box gives an alternate equation for the affine part of the S-Box transformation: $$b_{out} = (b_{in} \times 31_d) \operatorname{mod} 257_d \oplus 99_d$$ It is not ...
2
votes
1answer
321 views

AES with linear S-Box

If the AES S-Box is replaced with a linear or affine transformation, for instance the identity mapping $\sigma(x)=x$, does the cipher become entirely affine and hence trivially weak?
1
vote
2answers
101 views

What are some design considerations for S-Boxes?

My studies in cryptography have been quite detailed so far, however, one area that hasn't been explained to me is how S-Boxes are typically designed. Typically, the S-boxes are provided "as is" by the ...
3
votes
3answers
297 views

Calculate the Number of active s boxes

I really want to learn how to calculate the number of active s _boxes for block cipher cryptographic algorithms. I want to do that manually after running each round of an algorithm such as LED ...
3
votes
1answer
319 views

Number of active s boxes

How can I calculate the minimum number of active s_boxes for block cipher algorithms such as present algorithm? I have read in that, but I couldn't understand the meaning of branch number.