Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
7
votes
0answers
144 views

How to implement arbitrary s-box in a side-channel-free way in C?

This could be a question for CodeReview.SE, but I thought it might require non-trivial cryptographic knowledge to merit it on-topic here. The C language is chosen as it's a common language for ...
3
votes
1answer
273 views

DES - Weakness in Sbox

In the book "Introduction to Cryptography with Coding Theory ", in the chapter about the Differential Cryptanalysis for Four Rounds for DES algorithm, the authors say: There is a weakness in the ...
1
vote
1answer
74 views

Is AES S-Box resistant to side-channel attacks?

I know that implemntations with T-tables such as Golang's are prone to side-channel attacks, but is AES's S-Box wihtout any additional table also insecure ?
2
votes
1answer
49 views

Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES

Is ShiftRows(SubtBytes(x)) = SubtBytes(ShiftRows(x)) the same for the same entry : in AES It seems like these two are equal, can someone explain in theoretically?
2
votes
1answer
122 views

Cryptanalysis of a feedback shift reigister with an S-box

I’m just getting started on learning cryptography and here is a problem from exercises about which I'm totally confused: This is a 32-bit feedback shift register to encrypt some message. The register ...
0
votes
0answers
54 views

S-box for byte substitution where the s-box values are multiplicative inverses of 257

The title basically says it. We have a 16 by 16 s-box, $256$ entries total. And the first value is the multiplicative inverse of $257$, so $1 \times k \bmod 257, \space k = 1$. $2 \times k \bmod ...
1
vote
1answer
57 views

What are the standard properties of an S-Box [duplicate]

Apart form the following, what are the other properties of a good cryptographic Substitution box or the S-Box: Changing one input bit should change about half of the output bits. Each output bit ...
0
votes
0answers
34 views

AES S_BOX Generator additive constants

I try to generate other S_BOX for AES but I don't realize how to choose additive constants for S_BOX from decryption if for encryption it is 0x63 why is ...
3
votes
1answer
90 views

Inversion in $GF(2^{10})$ Using Composite Fields

I'm designing a circuit that uses many $GF(2^{10})$ inverters. Normally for this sort of thing I use lookup tables. (Itoh-Tsujii is not efficient for these smaller fields.) This application is for ...
2
votes
1answer
66 views

How to generate a 16 X 8 perfectly nonlinear S-box

I want to generate a 16,8 perfectly nonlinear S-box for an encryption algorithm I am working on. I don't have a background in math, and I'm an undergrad, so a lot of the math involved is very ...
5
votes
1answer
712 views

How constant value 0x63 in affine transformation is chosen or generated while AES Substitution Box is formed?

Me and one of my friends are working on AES algorithm. We have understood how multiplicative inverse table is generated. Rijndael AES algorithm shows us how S-Box is generated through the affine ...
2
votes
0answers
46 views

Design of SIMD-implemented cipher

Design of efficient of block ciphers needs consideration of many factors such as register size. i found that some ciphers can be SIMD implemented such as TWINE , SM4 , chacha20 ,SPIX ,and others. ...
21
votes
5answers
7k views

Desirable S-box properties

What desirable properties should an S-box have? My current standard selection process is to just pick them at random and verify that they fit the following criteria: The probability that any random ...
2
votes
0answers
41 views

what if the S-boxes in DES were “optimal”

if we assume that the s-boxes in DES were optimal. that is for each s-box, every cell in the DDT equals to 4. is there a differential characteristic in a good probability?
4
votes
1answer
87 views

Would using perfect S-boxes in F function of an unbalanced Feistel network produce a simple and secure cipher?

When I read some articles about cryptography on wikipedia, I took note of the following statements (please, correct me, if any of these are wrong): Perfect S-box (based on bent functions) provides ...
0
votes
0answers
38 views

What is degree of state bits and how do i count it?

in the this paper,section 3,autors attack hamsi-256.Also they explain the weakness that are exploited.Im not so good at math,and also not native english speacker, so i dont understand term "degree of ...
1
vote
1answer
59 views

A bit-sliced implementation (or the algebraic normal form) of the two FIDES S-Boxes

I want to see a bit-sliced implementation of 5-bit and 6-bit S-Boxes of FIDES or, at least, a representation of these two functions in algebraic normal form. Where can I find it?
11
votes
2answers
868 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...
2
votes
0answers
64 views

Side-channel vulnerability of AEGIS naive AES implementation

AEGIS, one of the finalists of CAESAR competition, uses a naive implementation of AES encryption round as its reference implementation. By naive I mean it uses secret dependent table lookups, so it is ...
1
vote
0answers
52 views

Do the keys in AES determine the S and P boxes? [closed]

I once read somewhere that the keys determine the S and P boxes. If so, how does that work?
1
vote
1answer
545 views

Explain the fast Walsh–Hadamard transform in simple steps or pseudocode

I've read that the fast Walsh–Hadamard transform is a way to efficiently calculate the linearity/non-linearity of an S-box. Can I get a description of it in simple steps or pseudocode that is ...
5
votes
1answer
500 views

Active s-box of 8x8 MDS for AES

one way to enhance the security of AES by increasing the number of active s-boxes .larger MDS matrices are used to increase the number of active s-boxes. using 4x4 MDS matrix generate 25 active s-box ...
0
votes
1answer
94 views

Can I change the S-box and P-box in DES?

I am a newbie to crypto and just one quick question on the s-box and p-box of DES. I understood that the s-box is where the security comes from and NSA has somehow decided how it should be filled in. ...
6
votes
2answers
381 views

Reverse Fixed Points in Kalyna S-Boxes and Reverse Engineering the S-Boxes

I was examining the S-Boxes of the Kalyna Cipher and found that 3 of the 4 S-boxes have reverse fixed points i.e S[x] = (255 - x). Is this an exploitable weakness? I was not able to find any open ...
1
vote
0answers
61 views

How TAU function of SM4ni cipher is implemented?

I am trying to understand the SIMD implementation of TAU function of SM4 which is as follows: ...
1
vote
2answers
151 views

Is the following s-box more linear or more non-linear?

I am trying to figure out whether the following simple s-box configuration I created is more linear than non-linear or vice versa more non-linear than linear? The parameters for this 16*4 table of ...
0
votes
2answers
221 views

how can I test quality of sbox?

I have 11 sboxes, I want to test them and find the best one. How can I do that, I found several criterions for that but I could not understand.
1
vote
1answer
482 views

how to compute the correlation between two binary vectors?

We find different equations to compute the correlation or correlation coefficient: $\begin{align*} corr &= \frac{a+d}{a+b+c+d}\\ &= \frac{(a+d) - (b+d)}{a+b+c+d}\\ &= \frac{(a+...
0
votes
0answers
51 views

how to compute Bit Independence criterion of SBOX?

I want to compute BIC's of my Sboxes, I found out some theses for that but I could not understand how to do it. Can someone help me?
0
votes
2answers
106 views

$\alpha^{2^{m} + 1}$ is a generator of $\operatorname{GF}(2^m)$?

This is from a paper (Partitions in the S-Box of Streebog and Kuznyechik) about S-Boxes: Let $\operatorname{GF}(2^{2m}) = \mathbb{F}_2[X]/p(X)$ be a finite field of even degree defined by a primitive ...
1
vote
1answer
78 views

Why is DES secure against differential cryptanalysis

I was wondering, why DES is secure against Differential Attacks. Some of the S-Boxes have a very bad Differential Uniformity, only one has a DU of 4, 3 have a DU of 6 and the others are much worse. ...
3
votes
1answer
176 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
2
votes
1answer
107 views

What Is The Number of Active S-boxes over 5 Rounds of Fides AE cipher?

It is mention in the paper " Fides: Lightweight Authenticated Cipher with Side-Channel Resistance for Constrained Hardware" , the number of active S-boxes of Fides cipher is 22 over 5 rounds but my ...
2
votes
1answer
398 views

Simplified AES S-box multiplication - calculation error

I have a problem to calculate the S-box in S-AES. The affine transformation is defined: I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ ...
1
vote
0answers
32 views

Are there any publicly available Serpent s-boxes of a non-linear order 3, optimized for x86_64?

The original serpent paper claims that the s-boxes provided are of non-linear order 3, the maximum. However, this has turned out to be false, as some of them are of order 2. Are there any s-boxes ...
3
votes
1answer
653 views

How do the Serpent S-boxes work?

Warning: The link in the answer explain the S-Box well, but there is an error in the pseudocode. $K_i = K_{i-8} \oplus K_{i-5} \oplus K_{i-3} \oplus K_{i-1} \oplus 0x9e3779b9 \oplus i$; Instead, it ...
3
votes
1answer
281 views

Is order of Correlation Immunity of AES S_box Zero?

I am working on AES S_box and trying to find out its properties like Correlation Immunity, Balancedness, Algebraic Degree, ANF form etc. These Papers 1, 2 give a nice definitions to above said terms. ...
2
votes
1answer
73 views

Generate $4\times 4$ Sboxes with a given branch number

Say, I want to generate a lot of $4\times4$ Sboxes with linear (or differential) branch numbre of $3$. One idea is to take all the $302$ affine classes, expand each of those classes and check if any ...
-1
votes
1answer
135 views
2
votes
2answers
1k views

More suitable Substitution Box

Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more ...
4
votes
2answers
407 views

Choosing the size of an S-box

The most common S-boxes that I've seen are 4-bit and 8-bit (I've seen a 3-bit S-box in PRINTcipher, but I'm pretty sure they only did so due to significant hardware constraints). I understand that ...
5
votes
1answer
618 views

S-box with differential uniformity = 2

I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2. I suppose we cannot compute every possible sbox because there are $64!$ possible s-boxes. Am I right?
9
votes
2answers
959 views

Generate ANF from SBox

Given an SBox, how can I generate its component equations (in ANF)? For example, let's say I have this SBox: 6, 4, 7, 8, 0, 5, 2, 10, 14, 3, 13, 1, 12, 15, 9, 11 Then, the equations are: $y_0 = x_1 ...
1
vote
0answers
177 views

How to find multiplicative inverse of a hexadecimal number in the finite field GF(2^8)? [duplicate]

I am new to cryptography. As I was reading a note regarding S-box construction, I found a step mentioning multiplicative inverse of a number in the finite field GF(2^8). I couldn't understand it!! Can ...
1
vote
2answers
2k views

How we can calculate AES Inverse SBox?

I am trying to find out the inverse of and SBox, but in vain, I have seen multiple questions over StackExchange, But I cant be able to solve my issue. As in this question, How are the AES inverse S-...
2
votes
2answers
70 views

Extract one unique SBox from Canonical Representative

In paper https://eprint.iacr.org/2011/218.pdf, the author has examined 16! different 4 bit SBoxes and at the end of investigation, introduced an optimal class which named "Golden SBoxes". How can I ...
3
votes
1answer
110 views

What does it mean : “Canonical representative of Sbox is 0123468A5BCF79DE”? and How can we calculate this representative for Sbox?

In paper :Cryptographic Analysis of All 4 × 4-Bit S-Boxes Saarinen has classified $4 \times 4$ S-Boxes and defined Canonical representative for each class of S-Boxes. What does "Canonical ...
1
vote
1answer
406 views

What is the inverse function of the finite field GF($2^3$) and GF($2^4$)?

I am currently reading a paper Cryptanalysis of a Theorem Decomposing the Only Known Solution to the Big APN Problem. In this paper, they mention that they used $I$ which is the inverse of the finite ...
1
vote
0answers
200 views

If the S-Box is given. How to calculate the affine transformation matrix?

Example using SAGE sage: sr = mq.SR(1, 1, 1, 8, gf2=True) sage: S = sr.sbox(); S (99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43, 254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71, 240, 173, ...
2
votes
1answer
69 views

What does $x^{1/e}$ mean in cryptography in this open butterfly structure?

I am currently reading a research paper that introduces this thing called a butterfly structure. I am confused about the structure of the open butterfly in this paper which has the equation $H^{\...