Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

0
votes
0answers
17 views

how to compute Bit Independence criterion of SBOX?

I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?
0
votes
1answer
254 views

Explain the fast Walsh–Hadamard transform in simple steps or pseudocode

I've read that the fast Walsh–Hadamard transform is a way to efficiently calculate the linearity/non-linearity of an S-box. Can I get a description of it in simple steps or pseudocode that is ...
0
votes
2answers
84 views

$\alpha^{2^{m} + 1}$ is a generator of $\operatorname{GF}(2^m)$?

This is from a paper (Partitions in the S-Box of Streebog and Kuznyechik) about S-Boxes: Let $\operatorname{GF}(2^{2m}) = \mathbb{F}_2[X]/p(X)$ be a finite field of even degree defined by a ...
2
votes
1answer
52 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
1
vote
1answer
62 views

Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
3
votes
1answer
159 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
2
votes
1answer
97 views

What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
2
votes
1answer
253 views

Simplified AES S-box multiplication - calculation error

I have a problem to calculate the S-box in S-AES. The affine transformation is defined: I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ ...
1
vote
0answers
27 views

Are there any publicly available Serpent s-boxes of a non-linear order 3, optimized for x86_64?

The original serpent paper claims that the s-boxes provided are of non-linear order 3, the maximum. However, this has turned out to be false, as some of them are of order 2. Are there any s-boxes ...
2
votes
1answer
168 views

How do the Serpent S-boxes work?

Warning: The link in the answer explain the S-Box well, but there is an error in the pseudocode. $K_i = K_{i-8} \oplus K_{i-5} \oplus K_{i-3} \oplus K_{i-1} \oplus 0x9e3779b9 \oplus i$; Instead, ...
3
votes
1answer
235 views

Is order of Correlation Immunity of AES S_box Zero?

I am working on AES S_box and trying to find out its properties like Correlation Immunity, Balancedness, Algebraic Degree, ANF form etc. These Papers 1, 2 give a nice definitions to above said terms. ...
1
vote
1answer
49 views

Generate $4\times 4$ Sboxes with a given branch number

Say, I want to generate a lot of $4\times4$ Sboxes with linear (or differential) branch numbre of $3$. One idea is to take all the $302$ affine classes, expand each of those classes and check if any ...
-1
votes
1answer
49 views
2
votes
2answers
1k views

More suitable Substitution Box

Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more ...
3
votes
2answers
84 views

Choosing the size of an S-box

The most common S-boxes that I've seen are 4-bit and 8-bit (I've seen a 3-bit S-box in PRINTcipher, but I'm pretty sure they only did so due to significant hardware constraints). I understand that ...
5
votes
1answer
564 views

S-box with differential uniformity = 2

I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2. I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?
9
votes
2answers
631 views

Generate ANF from SBox

Given an SBox, how can I generate its component equations (in ANF)? For example, let's say I have this SBox: 6, 4, 7, 8, 0, 5, 2, 10, 14, 3, 13, 1, 12, 15, 9, 11 Then, the equations are: $y_0 =...
1
vote
0answers
40 views

How to find multiplicative inverse of a hexadecimal number in the finite field GF(2^8)? [duplicate]

I am new to cryptography. As I was reading a note regarding S-box construction, I found a step mentioning multiplicative inverse of a number in the finite field GF(2^8). I couldn't understand it!! Can ...
0
votes
2answers
456 views

How we can calculate AES Inverse SBox?

I am trying to find out the inverse of and SBox, but in vain, I have seen multiple questions over StackExchange, But I cant be able to solve my issue. As in this question, How are the AES inverse S-...
2
votes
2answers
62 views

Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
3
votes
1answer
68 views

What does it mean : “Canonical representative of Sbox is 0123468A5BCF79DE”? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
1
vote
1answer
70 views

What is the inverse function of the finite field GF($2^3$) and GF($2^4$)?

I am currently reading a paper Cryptanalysis of a Theorem Decomposing the Only Known Solution to the Big APN Problem. In this paper, they mention that they used $I$ which is the inverse of the finite ...
1
vote
0answers
110 views

If the S-Box is given. How to calculate the affine transformation matrix?

Example using SAGE sage: sr = mq.SR(1, 1, 1, 8, gf2=True) sage: S = sr.sbox(); S (99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, ...
2
votes
1answer
61 views

What does $x^{1/e}$ mean in cryptography in this open butterfly structure?

I am currently reading a research paper that introduces this thing called a butterfly structure. I am confused about the structure of the open butterfly in this paper which has the equation $H^{\...
0
votes
1answer
55 views

Can multiple Pearson permutation tables be reduced or merged?

There was a recent question answered where the accepted solution was a double Pearson hash. It consisted of the following pseudo code:- h = T1[h ^ x[i]] followed ...
13
votes
1answer
36k views

How are the AES S-Boxes calculated?

I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over $GF(2^8)$, but I'm confused by the description of the affine transformation. ...
1
vote
1answer
62 views

Getting the s-box input from its output in differential cryptanalysis on DES

If we try to get K4 using differential cryptanalysis on 4-variant DES, how can we get the input of a certain S-box if we know it's output? This seems hard to do since the substitution operation is ...
0
votes
0answers
60 views

Calculating the inverse for a Rijndael s-box [duplicate]

I want to calculate a Rijndael S-box but something went wrong. How can I calculate the inverse? In the following is my approach: given: $f(x)=x^8+x^4+x^3+x+1 \rightarrow$ binary: 100011011 0x12 = ...
6
votes
1answer
159 views

Does a masked look-up table prevent cache timing attacks?

When applying the boolean masking countermeasure to a cipher which uses an S-box $S$, a way to handle this nonlinear operation is to recompute a new S-box $S'$ such that $S'(x \oplus r_{in}) = S(x) \...
1
vote
1answer
144 views

AES oracle with bad S-box

Say you run in to a messed up AES (128) implementation which has the s-box configured as [0x0, 0x1, ..., 0xFE, 0xFF] and where you can query a few plaintexts to get the corresponding ciphertexts. How ...
6
votes
1answer
156 views

How does Twofish avoid weak keys if it uses key-dependent S-boxes?

From section 7.2.2 of the Twofish paper, the four S-boxes for the 128-bit cipher are generated with: $$\begin{align} s_0(x) &= q_1[q_0[q_0[x] \oplus s_{0,0}] \oplus s_{1,0}]\\ s_1(x) &= q_0[...
1
vote
1answer
41 views

What is the link between the parity check matrix, double-error-correcting codes and APN permutations?

I am currently reading a research paper (linked below) which mentions that a map $f:V:=GF(2^{m}) \rightarrow V$ which vanishes at 0 is APN if it satisfies the condition that it is a binary code $C_{f}$...
0
votes
0answers
23 views

What are dual codes and the codewords denoted by these dual codes in terms of trace?

I am currently reading a research paper (linked below) that mentions "Consider only maps that vanish at 0, their short codes $C_f$ and their duals $C_f^\perp$. The duals can be written as $C_f^\perp = ...
3
votes
1answer
51 views

What does 2-flat mean when discussing APN permutations?

I am currently reading a research paper that uses the term 2-flat. However, I don't understand what this term means. For example, the paper mentions in its definition of APN that for all distinct $a$,...
11
votes
1answer
777 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
2
votes
1answer
4k views

How are the AES inverse S-Boxes calculated?

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value ...
4
votes
1answer
1k views

Serpent block cipher : S0 to S7 functions unclear

I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ...
1
vote
1answer
243 views

Inversion in $GF(2^8)$ AES [duplicate]

I was wondering how you would calculate the S-box in AES. I found that you have to calculate the inverse of the polynomials in $GF(2^8)$. I found out that to calculate the inverse, you have to use the ...
2
votes
0answers
85 views

How can the Rijndael SBox be written as a linearized polynomial?

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk state (in Appendix A) that the Rijndael SBox can be written as a "linearized polynomial" $S(...
3
votes
1answer
91 views

Countermeasures to prevent integral cryptanalysis against 4-rounds AES

Integral cryptanalysis against 4-rounds AES is practical (Security of the AES with a Secret S-box). I did two experiments in order to find the impact and remove the integral distinguisher of 4 rounds:...
19
votes
5answers
6k views

Desirable S-box properties

What desirable properties should an S-box have? My current standard selection process is to just pick them at random and verify that they fit the following criteria: The probability that any random ...
1
vote
1answer
199 views

how to compute the correlation between two binary vectors?

We find different equations to compute the correlation or correlation coefficient: $\begin{align*} corr &= \frac{a+d}{a+b+c+d}\\ &= \frac{(a+d) - (b+d)}{a+b+c+d}\\ &= \frac{(a+...
0
votes
1answer
229 views

S-Box and it's linearity

I am trying to figure out why it is necessary S-box's to be nonlinear. I have been searching for some materials but was not able to find out clear proof why it means that if we use S-box in DES, it ...
1
vote
3answers
248 views

What is the time complexity of the basic components of a symmetric cipher?

I have a very basic knowledge on time complexity and even less on programming, so please bear with me. I am interested to know the time complexity in big-O notation of some of the basic operations in ...
6
votes
3answers
671 views

Why don't table lookups run in constant time?

The Wikipedia article on big O notation says that performing a lookup is a constant time operation. So why are lookup tables susceptible to timing attacks?
1
vote
0answers
84 views

Perfect Nonlinearity of AES S Boxes

Can someone give a clear definition of what a perfectly nonlinear function is? Can we say that AES s-boxes are perfectly nonlinear and why?
-1
votes
1answer
120 views

Question about DES S-boxes from Encryption to Decryption [duplicate]

While working on a homework assignment, I came across an interesting dilemma that I want to delve more into. The question essentially said to flip the first bit in the key string and then see what S ...
5
votes
1answer
245 views

Security Implications of Fixed & Opposite Fixed Points of Sbox

Fixed point means when Sbox Input is equal to Sbox Output whereas Opposite Fixed Point means when Sbox Input is complement of Sbox Output. How does Fixed and Opposite Fixed Point affect the strength/ ...
4
votes
3answers
626 views

What's happens if we use the weakest S-BOX for AES?

I'm in research of generating Dynamic Secret S-BOX for AES based on 2 Keys (Encryption Key and *I Called S-BOX key). If (worst scenario) I randomly generate the worst S-BOX in an encryption. What ...
1
vote
0answers
216 views

how to compute Bit Independent Criteria on a 4-bit S-box?

The idea of Bit Independence Criterion (BIC ) was introduced by Webster and Tavares . For a given set of avalanche vectors generated by complementing a single plaintext bit, all avalanche variables ...