# Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

178 questions
17 views

### how to compute Bit Independence criterion of SBOX?

I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?
254 views

### Explain the fast Walsh–Hadamard transform in simple steps or pseudocode

I've read that the fast Walsh–Hadamard transform is a way to efficiently calculate the linearity/non-linearity of an S-box. Can I get a description of it in simple steps or pseudocode that is ...
84 views

### $\alpha^{2^{m} + 1}$ is a generator of $\operatorname{GF}(2^m)$?

This is from a paper (Partitions in the S-Box of Streebog and Kuznyechik) about S-Boxes: Let $\operatorname{GF}(2^{2m}) = \mathbb{F}_2[X]/p(X)$ be a finite field of even degree defined by a ...
52 views

### DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
62 views

### Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
159 views

### Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
97 views

### What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
253 views

### Simplified AES S-box multiplication - calculation error

I have a problem to calculate the S-box in S-AES. The affine transformation is defined: I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ ...
27 views

### Are there any publicly available Serpent s-boxes of a non-linear order 3, optimized for x86_64?

The original serpent paper claims that the s-boxes provided are of non-linear order 3, the maximum. However, this has turned out to be false, as some of them are of order 2. Are there any s-boxes ...
168 views

### How do the Serpent S-boxes work?

Warning: The link in the answer explain the S-Box well, but there is an error in the pseudocode. $K_i = K_{i-8} \oplus K_{i-5} \oplus K_{i-3} \oplus K_{i-1} \oplus 0x9e3779b9 \oplus i$; Instead, ...
235 views

### Is order of Correlation Immunity of AES S_box Zero?

I am working on AES S_box and trying to find out its properties like Correlation Immunity, Balancedness, Algebraic Degree, ANF form etc. These Papers 1, 2 give a nice definitions to above said terms. ...
49 views

### Generate $4\times 4$ Sboxes with a given branch number

Say, I want to generate a lot of $4\times4$ Sboxes with linear (or differential) branch numbre of $3$. One idea is to take all the $302$ affine classes, expand each of those classes and check if any ...
49 views

...
1k views

### More suitable Substitution Box

Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more ...
84 views

### Choosing the size of an S-box

The most common S-boxes that I've seen are 4-bit and 8-bit (I've seen a 3-bit S-box in PRINTcipher, but I'm pretty sure they only did so due to significant hardware constraints). I understand that ...
564 views

### S-box with differential uniformity = 2

I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2. I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?
631 views

55 views

### Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
36k views

### How are the AES S-Boxes calculated?

I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over $GF(2^8)$, but I'm confused by the description of the affine transformation. ...
62 views

### Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
60 views

### Calculating the inverse for a Rijndael s-box [duplicate]

I want to calculate a Rijndael S-box but something went wrong. How can I calculate the inverse? In the following is my approach: given: $f(x)=x^8+x^4+x^3+x+1 \rightarrow$ binary: 100011011 0x12 = ...
159 views

51 views

### What does 2-flat mean when discussing APN permutations?

I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means. For example, the paper mentions in its definition of APN that for all distinct $a$,...
777 views

### Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
4k views

### How are the AES inverse S-Boxes calculated?

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value ...
1k views

### Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...
243 views

### Inversion in $GF(2^8)$ AES [duplicate]

I was wondering how you would calculate the S-box in AES. I found that you have to calculate the inverse of the polynomials in $GF(2^8)$. I found out that to calculate the inverse, you have to use the ...
85 views

229 views

### S-Box and it's linearity

I am trying to figure out why it is necessary S-box's to be nonlinear. I have been searching for some materials but was not able to find out clear proof why it means that if we use S-box in DES, it ...
248 views

### What is the time complexity of the basic components of a symmetric cipher?

I have a very basic knowledge on time complexity and even less on programming, so please bear with me. I am interested to know the time complexity in big-O notation of some of the basic operations in ...
671 views

### Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
84 views

### Perfect Nonlinearity of AES S Boxes

Can someone give a clear definition of what a perfectly nonlinear function is? Can we say that AES s-boxes are perfectly nonlinear and why?
120 views

### Question about DES S-boxes from Encryption to Decryption [duplicate]

While working on a homework assignment, I came across an interesting dilemma that I want to delve more into. The question essentially said to flip the first bit in the key string and then see what S ...
245 views

### Security Implications of Fixed & Opposite Fixed Points of Sbox

Fixed point means when Sbox Input is equal to Sbox Output whereas Opposite Fixed Point means when Sbox Input is complement of Sbox Output. How does Fixed and Opposite Fixed Point affect the strength/ ...