New
Stack Overflow Jobs powered by Indeed: A job site that puts thousands of tech jobs at your fingertips (U.S. only). Search jobs

# Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

273 questions
Filter by
Sorted by
Tagged with
66 views

### How to design a reversible shifted XOR with an S-box?

According to this post, S-boxes are invertible. Inverting S-boxes can be very easy: you simply create a lookup table that reverse all the possible substitutions of the S-box. E.g. if the S-box maps ...
• 123
37 views

### In the context of Hardware Security and Cryptography, how do I calculate the Algebraic Normal Form for sboxes [duplicate]

In our hardware security exercise, I am trying to calculate the ANF function manually (Sboxes) for the given table: And I came up with the result as: I thought I was calculating it correctly using ...
61 views

### How does MixColumn collapse 4 active S-boxes into 1?

In AES Proposal: Rijndael, page 34, there is the following figure with MixColumn transformation pattern for two columns: I'm trying to reproduce these paterns. The pattern in the column marked in ...
70 views

### AES encryption step: calculate the byte substitution process

I am a self learner and tried to learn AES, so I have a book written in my native language. It has some practical examples about finite fields and AES. It has a question that asks me to calculate the ...
54 views

### How to estimate the bias of linear cryptanalysis given the input and output masks

Assume the input linear mask is $a$, and output mask is $b$，for a block cipher $F$ with $r$ round,How to accurately and quickly estimate the bias of linear cryptanalysis? which is \begin{equation*} ...
60 views

### Midori block cipher design: importance of $S_b$ as the S-box

With a use of almost MDS the Midori cipher provides a good diffusion. But why $S_b$ is used as S-box and what is its actual importance?
• 21
77 views

### AES SBOX Masking in Python

I am trying to create an AES Sbox masking based on this paper. In the paper, they tried to mask the sbox described in this other paper. The inversion is been done in GF(4). I know that it is mostly ...
• 1
1 vote
45 views

### Cryptanalysis of S-box [closed]

Because of implementation constrains, I merge some 4-bit S-boxes to find a 8-bit S-box with good properties such as nonlinearity, resistance against differential and linear cryptanalysis. Does the ...
• 11
42 views

### How to make sure that $S$ & $S^{-1}$($S$ inverse) is a permutation of bytes?

Assume you have implemented the S-box and Inverse S-box of AES as code (or hardware) instead of a lookup table copy-pasted from the AES standard. An obvious test you want do is to check that S−1(S(B)) ...
• 1
151 views

### What is the inverse of this variant of the Gimli SP-box?

Consider a slightly modified variant of the Gimli SP-box: ...
• 1,337
92 views

### A 5-bit S-Box whose differential branch number is equal to 4 and the linear branch number is not less than 3

The last paragraph of Section 1 (Introduction) of the paper “On the Relationship between Resilient Boolean Functions and Linear Branch Number of S-boxes” [S. Sarkar, K. Mandal, D. Saha] contains the ...
• 1,337
1 vote
163 views

### What is the inverse of this generalised automaton (based on bitwise XOR and modular addition)?

Section 4.1 of the paper “Nonlinear Diffusion Layers” [Y. Liu, V. Rijmen, G. Leander] defines the nonlinear function $\rho$ over $\mathbb{F}_{2^m}$ as follows: \rho : \mathbb{F}_{2^m}^4 \to \mathbb{...
• 1,337
1 vote
84 views

### DDT for boolean functions must contain only powers of two

I see in many discussion on differential cryptanalysis of SBOX (and others boolean functions, see SIMON-like round functions, SPECK-like round function) the idea of reasoning in terms of weights ...
114 views

### Good S-boxes from ARX designs

Have any good 8-bit S-boxes made using ARX principles been found yet? I found Alzette, but it's a huge S-box at 64 bits. I know that with a combination of addition, rotation, and XOR that any S-box ...
• 3,655
75 views

### Which reordering should I use for an 8-bit S-box?

I'm designing a cipher which has key-dependent S-boxes. The procedure is like this: Transform the key (a string of bytes) into 96 16-bit words (the high bits are ignored, but make a difference when ...
• 221
220 views

### How is the $\chi$ step of the Keccak permutation invertible?

I would like to understand how Keccak's permutation function is reversible. The difficulty I have is with the $\chi$ step that uses the and operator which is not revertible. All the other ...
• 23
1 vote
109 views

### In hardware, why using an algebraic implementation of a (small) S-Box instead of a LUT?

There is this cool paper https://eprint.iacr.org/2017/395.pdf exposing a side channel protected implementation of keccak, in particular Domain Oriented Masking for the Chi function. The Chi function ...
• 11
32 views

### AES S-Box design goal [duplicate]

First layer of each AES round is the Byte Substitution layer. It is the only nonlinear element of AES. What would happen if this layer was not in the path? And the lack of it would create a problem in ...
216 views

### Linear approximation table of AES S-Box

I am trying to create linear approximation table of AES SBox to better understand linear cryptanalysis, I have followed the formula in this paper (page 7 of pdf file) to be able to generate the linear ...
• 117
1 vote
90 views

### How many $S$-Boxes of length $3$ are there over $\mathbb{F}_{2}$?

Is there a simple way if counting the number of $S$-Boxes of length $\ell$ over $\mathbb{F}_{2}$? By $S$-box I mean an $S$-box satisfying the avalanche condition. I mean it is quite easy to see that ...
215 views

### How to determine cryptographic properties of AES S-Box?

In the book The Design by Rijndael states that the design criteria for the S-box are nonlinearity and algebraic complexity. Can these two criteria be considered as two specific cryptographic ...
• 117
1 vote
113 views

### Is it fatal if a blockcipher uses a sbox with a fixed point at 0?

In a previous question, I asked how to implement arbitrary s-box in side-channel-free fashion. The code I posted in the question loops over all 256 values of a byte to avoid timing channel, and I want ...
• 9,399
1 vote
866 views

### Example of S-Box truth table in AES

I'm trying to understand some cryptographic properties of the s-box so I can have my own code. Example of balanced properties I read in this document that they say A boolean function S : $GF(2^n)$ ...
• 117
1 vote
285 views

### How changing a single byte/word in a substitution box affects the inverse result?

Let's suppose I have a 8-bit substitution box composed of 256-bytes and invert it. Does changing one byte in the substitution box will make the inverse result completely different than if I didn't ...
• 393
82 views

### How to calculate Correlation, Difference propagation probability and Algebraic complexity a particular S-box?

I'm learning about AES. According to the book The Design of Rijndael refers to the design criteria S-box $S_{RD}$ as follows: Design criteria for $S_{RD}$. We have applied the following design ...
• 117
1 vote
61 views

### Pbox and S-Box values in AUT64

I am looking to get P-box and S-box from firmware Decided to search the firmware for Pbox - 8 nibbles from 0-7 i.e pbox = [2, 0, 6, 5, 7, 4, 3, 1] Found it :) And ...
• 145
1 vote
55 views

### Getting permutation box and S-box for AUT64 block cipher

Want to get 32 bits from 0x8000 address as 8 bytes (perm box) ...
• 145
1 vote
137 views

### How do AES Substitution box's offer any additional security since it's 1 to 1?

If the Substitution box is 1 to 1 (a specific value can only ever be a specific box value), and the contents of Rijndael S-box is public, how does this offer any additional security? With AES the ...
1 vote
203 views

### AES - SBOX avalanche effect question

I am making a program that verifies the avalanche effect for the SBOX of the AES block cipher for a certain number of iterations. This program changed one bit randomly in one of the elements of the ...
187 views

### How do you arrive at this algorithm for dividing by 3 in the Galois field?

This function from Wikipedia calculates the sbox used in AES: ...
670 views

### AES vs Kuznechik (GOST R 34.12-2015) comparsion [closed]

Which algorithm is more crypto-resistant: AES or Kuznechik (GOST R 34.12-2015)?
• 109
516 views

### Non-Linearity of an S-Box [duplicate]

This should be pretty simple question I presume. So let's say I have an 8x8 S-Box. I can easily treat it as 8 different boolean functions for each of the 8 input bits. Is the non-linearity the lowest ...
• 123
58 views

### Can a byte/word inserted as an entry in a Feistel S-box be breakable?

Let's suppose I insert these two 4-byte words (32-bits) in a feistel S-box with 1024-bytes of size (256*32-bits), (like Blowfish does): blah bleh What kind of attacks could possible be made to ...
• 877
75 views

### How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$

How to caculate the inverse of function $x^3$ in $\mathbb{F}_{2^n}$?, Any monomial $x^d$ is a permutation in the field $\mathbb{F}_{2^n}$ iff $gdc(d,2^{n}-1)=1$,why?
81 views

### How to calculate the inversion fucntion $S: \mathbb{F}_{2^n} \rightarrow \mathbb{F}_{2^n}$,with $S(x)=x^{-1}$

The S-box is defined as the generalised inverse function $S:\mathbb{F}_{2^n}\rightarrow \mathbb{F}_{2^n}$,in quotient ring $\mathcal{R}:=\mathbb{F}_{2^n}[X]/(X^{2^n}-X)$ with $S(x)=x^{-1}$, is ...
1 vote
78 views

### 99 in AES s-box, where it came from? [duplicate]

The multiplicative inverse in AES s-box is transformed using the following affine transformation: $s = b \oplus (b \lll 1) \oplus (b \lll 2) \oplus (b \lll 3) \oplus (b \lll 4) \oplus 99_{10}$ Where ...
• 1,221
178 views

• 1,337
272 views

### DES SBOX Output with Bitslice

I am not understanding how to compute the output bits of a 6-to-4-SBOX with bitslice technique in DES. Matthew Kwan made a brief recap in his paper "Reducing the Gate Count of Bitslice DES" ...
1 vote
1k views

### How to solve this S Box?

I have performed the XOR and the result comes as 1001. Now my confusion is that in standard S-Box (DES) the input is 6 bit where the first and last bit together specifies row and 4-middle bits column. ...
• 113