Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
-1 votes
1 answer
588 views

Question about DES S-boxes from Encryption to Decryption [duplicate]

While working on a homework assignment, I came across an interesting dilemma that I want to delve more into. The question essentially said to flip the first bit in the key string and then see what S ...
5 votes
1 answer
958 views

Security Implications of Fixed & Opposite Fixed Points of Sbox

Fixed point means when Sbox Input is equal to Sbox Output whereas Opposite Fixed Point means when Sbox Input is complement of Sbox Output. How does Fixed and Opposite Fixed Point affect the strength/ ...
4 votes
3 answers
3k views

What's happens if we use the weakest S-BOX for AES?

I'm in research of generating Dynamic Secret S-BOX for AES based on 2 Keys (Encryption Key and *I Called S-BOX key). If (worst scenario) I randomly generate the worst S-BOX in an encryption. What ...
1 vote
0 answers
953 views

how to compute Bit Independent Criteria on a 4-bit S-box?

The idea of Bit Independence Criterion (BIC ) was introduced by Webster and Tavares . For a given set of avalanche vectors generated by complementing a single plaintext bit, all avalanche variables ...
2 votes
0 answers
274 views

Strict Avalanche Criteria in Sage

Is there any inbuilt functionality in sage to check if any S-Box satisfies Strict Avalanche Criterion or not?
1 vote
1 answer
272 views

number of active s-boxes in a block cipher?

How can we find the minimum number of differentially active s-boxes in a block cipher (actually a Feistel network with several input cells) in a truncated characteristic form? In a recursive ...
0 votes
1 answer
100 views

what is the impact of smaller bit size sbox

There are multiple S-boxes type, as DES uses 4 bit S-box and AES uses 8 bit S-box. I want to know how this effect the security?? If we use 4 bit or 8 bit. apart from the DC attack. Both provides ...
2 votes
2 answers
672 views

AES alternate equation for the S-Box affine transformation

The Wikipedia article for the AES S-Box gives an alternate equation for the affine part of the S-Box transformation: $$b_{out} = (b_{in} \times 31_d) \operatorname{mod} 257_d \oplus 99_d$$ It is not ...
1 vote
2 answers
152 views

What are some design considerations for S-Boxes?

My studies in cryptography have been quite detailed so far, however, one area that hasn't been explained to me is how S-Boxes are typically designed. Typically, the S-boxes are provided "as is" by the ...
4 votes
3 answers
1k views

Calculate the Number of active s boxes

I really want to learn how to calculate the number of active s _boxes for block cipher cryptographic algorithms. I want to do that manually after running each round of an algorithm such as LED ...
2 votes
1 answer
1k views

AES with linear S-Box

If the AES S-Box is replaced with a linear or affine transformation, for instance the identity mapping $\sigma(x)=x$, does the cipher become entirely affine and hence trivially weak?
3 votes
2 answers
2k views

AES: How to create the S-box with Sage

The $Sage$ code for the AES $S-box$ is below and a link is here: Polynomial representation of the affine part of the AES S-box. An online version of $Sage$ to test this is here. I understand most of ...
3 votes
1 answer
752 views

Number of active s boxes

How can I calculate the minimum number of active s_boxes for block cipher algorithms such as present algorithm? I have read in that, but I couldn't understand the meaning of branch number.
6 votes
2 answers
1k views

Number of Sbox in a Cipher

Camellia has 4 SBOX and so does the TwoFish(key dependent 4 Sboxes). Where as AES uses only one. Would it have made AES more secure if AES had 4 or more SBOX too? Does using more Sbox with similar ...
0 votes
1 answer
660 views

S-box and Side Channel Attacks

S-boxes with non-linearity greater than 112 are considered prone to side channel attacks. If a non-linear S- box with non- linearity greater than 112 (excluding bent functions with non-linearity of ...
4 votes
2 answers
256 views

Building large S-Boxes from smaller ones

I would like to make an exhaustive list of all relevant techniques that have been studied in order to build a large S-Box from smaller ones. As far as I known, three structures are usually preferred: ...
5 votes
1 answer
364 views

Full diffusion or Partial diffusion between s-box applications?

In regards to maximizing active s-boxes: is it advantageous to apply the non-linear layer after complete diffusion of the state, rather after then partial diffusion? Using AES as an example, with ...
4 votes
1 answer
254 views

How many primitive cryptography operations are there? [closed]

Every cipher I've encountered seems to be built from slight variations of only three basic operations: the S-box, the P-box, and the XOR. I’m just wondering, are there any others? And if there aren'...
0 votes
1 answer
1k views

AES and GOST 28147-89 "Magma" Comparison

I am trying to understand how AES is comparable to GOST 28147-89 "Magma". Like for parameters such as bit shifting and addition of the subkey to the input, which are a part of Magma, what is their ...
0 votes
1 answer
8k views

Finding output given an S-box input of 8 bits

I'm given the following table: I'm told to find the output given an hexidecmal input of 2B. I know that 2B in binary = 001 01 011 So I took the first two and ...
5 votes
1 answer
3k views

AES s-box – How do I calculate the inverse of this field equation?

I want to implement AES algorithm,instead of LUT based S-box, but I’m stuck at point creating "Inverse of equation" during implementation. In creation of S-box I am using the following steps: ($...
2 votes
3 answers
2k views

Does the DES s-box only provide confusion, or does it also provide an avalanche effect?

In DES, does the s-box provide an avalanche effect or does it only provide confusion in the ciphertext?
2 votes
1 answer
43 views

Measure Strength of Mix Mode Modular Arithmetic based Confusion Layer

Strength of sboxes is generally measured by different properties eg non linearity, fixed points etc. If confusion is provided by Mixed Mode Modular Arithmetic (eg as in IDEA), how to measure the ...
6 votes
2 answers
1k views

Security of the AES with a Secret S-box

In this paper they change the $AES$ S-box to a uniformly random one and answer the questions: How does the security of AES change when the S-box is changed by a secret S-box? Would it be safe to ...
1 vote
1 answer
5k views

AES S-box calculation

I am trying to design the s-box for AES. Quoting from Wikipedia, the algorithm for applying affine transformation in AES s-box calculation is ...
4 votes
1 answer
368 views

Non Linearity of huge Sbox

Sboxes provide confusion in cipher. Non Linearity measures the strength of sbox layer. In order to measure non linearity of sbox, a table is computed to measure distances with its affine functions. If ...
0 votes
1 answer
214 views

Number of Substitution boxes

How many possible 16 bit S-boxes exist? (AES uses 8 bit substitution boxes) I first taught of calculating 128(keysize in bits)/8(bits) =16, but I believe it's wrong.
1 vote
1 answer
199 views

AES S-Box: How is value for 01 mapped to 7c?

If irreducible polynomial $m(x) = x^8+x^4+x^3+x+1$ is chosen, or even for any other value, the multiplicative inverse will not exist for $01$, as $0000 0001$ will perfectly divide $m(x) = 100011011$ ...
0 votes
1 answer
257 views

Affine of Inverse Sboxes

"All 8x8 s-boxes created using Galois Field inversion plus an Affine Transform have the same non-linearity, as the Affine Transform does not change the linear or differential properties" is what this ...
2 votes
1 answer
550 views

AES S-Box: Possible options for constant to calculate S-Box values

To calculate the values of S-Box in AES, I came across a lot of resources where constant {63} was chosen. It is said that {63} satisfies the condition of S-Box that it should not have any fixed points ...
2 votes
2 answers
4k views

AES S-Box Lookup Table Hardcoded?

From what I've looked up on various AES projects, the impression I get is the lookup table is hardcoded with the values from this Wikipedia entry page: https://en.wikipedia.org/wiki/Rijndael_S-box ...
0 votes
0 answers
153 views

Turning an S-box into a keyed S-box

Assume that $S(x): \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ is a good S-box. Is there anyway we can construct a keyed S-box $T(k, x): \{0, 1\}^{n} \times \{0, 1\}^{n} \rightarrow \{0, 1\}^{n}$ from it ...
2 votes
1 answer
618 views

Relying on a 4-bit S-box instead of an 8-bit one

I've discovered that generating good S-boxes with only modular addition, bitwise XOR, bitwise AND, bitwise OR, bitwise NOT, rotations, and, shifts is difficult. I figure that using them to make a good ...
1 vote
1 answer
142 views

Are there any security flaws in using an involutive S-box?

I know that it is difficult to answer these questions without knowing the full scheme it would be used in, but are there any problems that could be introduced into a block cipher if an involutive S-...
2 votes
1 answer
774 views

How are Rijndael's S-Boxes generated?

Wikipedia: Rijndael's Forward S-box I'm writing C Code to generate S-boxes but I'm stuck. Would you mind explaining one entry of the S-box? (say for x = 0x2). ...
4 votes
2 answers
1k views

How can we create the AES S-box using a different irreducible polynomial?

The substitution-value of input byte $\mathtt{C2}$ is $S[\mathtt{C2}]=\mathtt{2F}$. This comes from applying the Euclidean algorithm to $A(x)A^{-1}(x)\equiv 1\pmod{p(x)}$, where $A(x) = x^7+x^6+x$ (...
0 votes
1 answer
394 views

How are calculated input S-box?

a) if input 1011 = 0 1 1 1 b) if input 0110 = 1 1 0 0 my answer right?
2 votes
1 answer
291 views

Are SHA-2's $\mathit{Maj}$ and $\mathit{Ch}$ functions non-linear?

SHA-2 has two functions: $\mathit{Maj}(x, y, z) = (x \land y) \oplus (y \land z) \oplus (x \land z)$ $\mathit{Ch}(x, y, z) = (x \land y) \lor (\neg x \land z)$ Are these two functions non-linear? ...
1 vote
1 answer
102 views

Identification of Confusion Component in a Cipher

Confusion is a necessary component of any encryption algorithm. S-boxes play an important role in ensuring confusion. If an encryption algorithm does not use any S-box (rather some other Operations/...
3 votes
1 answer
4k views

Non-Linearity of an Sbox

Non-Linearity of an Sbox affects its resistance towards Linear Cryptanalysis. What happens, if an Sbox has low non-linearity (specially with respect to Linear Cryptanalysis)?
1 vote
1 answer
447 views

Degree of a big S-box

Assume we have a big S-box (i.e. $15*15$). We have truth table of it. (so $2^{15}$ output). How can we find its degree without using Algebraic Normal Form of its Boolean functions. Or with ANF, can ...
7 votes
1 answer
331 views

AES s-box representation

I have seen in various papers like in this one page 4, that the AES s-box equation is: $S=A \circ φ^{-1}(φ(x)^{254})$ where $φ$ is the isomorphism from $\mathbb{F}_2^{8}$ to $\mathbb{F}_{2^{8}}$ with ...
2 votes
2 answers
364 views

What rule(s) for a good S-box is this one violating and how does it relate to non-linearity etc.?

I generated this single-cycle substitution box and I want to post it as an example for understanding what a good S-box would be like. I get the feeling that this particular one is weak. Here it is (...
2 votes
1 answer
1k views

AES S-Box implementation: from a byte-by-byte to 2-bytes-by-2bytes?

The S-Box in AES encryption is a byte substitution step. Is it possible to perform the substitution 2 bytes at a time, rather than 1 byte? What are the challenges/trade-offs involved?
0 votes
1 answer
4k views

How are S-box calculated in S-AES?

Read the Reference for Simplified AES ( S-AES ) Q1 Explain how the S- box is constructed taking example $b_0b_1b_2b_3=1010$ What I did $\begin{bmatrix} 1 &0 &1 &1 \\ 1 &...
1 vote
2 answers
1k views

How can AES-like block cipher without non-linear component be broken?

I am taking a course on block ciphers and recently I have faced up with such an exercise: if an original AES's highly non-linear Sbox is replaced by a linear substitution (see example below), how one ...
2 votes
1 answer
1k views

How can one construct the weakest S-box ever?

Is it possible to come up with an NxN S-box which would have a difference distribution table with N entries of 100% probability? I am studying the properties of S-boxes and I don't quite understand ...
17 votes
2 answers
2k views

Why do we keep designing new static s boxes?

As I understand s box properties, they primarily need high non linearity and low auto correlation. But most importantly for this question, they're not secret. There are many questions on this site ...
3 votes
0 answers
116 views

Can a stream cipher with a big S-box create ASIC-resistance?

For a proof of work system a hash algorithm generates one pseudorandom index each round, in the same manner as RC4 and Spritz do. And it uses a bigger S-box, e.g. 2^20 numbers. The actual hash would ...
9 votes
2 answers
8k views

How to build a difference distribution table?

i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...