Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

Filter by
Sorted by
Tagged with
6
votes
1answer
211 views

AES s-box representation

I have seen in various papers like in this one page 4, that the AES s-box equation is: $S=A \circ φ^{-1}(φ(x)^{254})$ where $φ$ is the isomorphism from $\mathbb{F}_2^{8}$ to $\mathbb{F}_{2^{8}}$ with ...
5
votes
1answer
181 views

Can we have Rijndael s-boxes constructed using reducible polynomials?

Is it necessary for the Rijnael polynomial to be irreducible? Can we have s-boxes constructed using reducible polynomials? If not what is the mathematical property that is obstructing to do so?
7
votes
1answer
1k views

Is it necessary for the Rijndael polynomial to be primitive?

I am working on selecting a S-box for my Cipher (Similar to AES). I found out there are 30 irreducible polynomials and over 16 primitive polynomials of degree 8. Is it necessary to choose a primitive ...
3
votes
1answer
1k views

S-boxes are not linear

I am reading about S-boxes. By looking for the reason why the S-boxes are not linear, I found the following: The mappings $B \mapsto S(B)$ are all non-linear, since it holds $S(000000) \neq 0000$ ...
0
votes
1answer
313 views

Alternatives to sbox's for diffusion?

Are there any other alternatives to Sbox's or SP networks to provide diffusion preferably more basic alternatives which still provide a good degree of security?
3
votes
1answer
157 views

Function to polynomial equation in GF(2)

Let F(a,b,c,d,e) be a function that returns the ith bit of 0x3A5C742E, where ...
3
votes
2answers
307 views

How is an AES S-Box cyclically shifted to the left?

I'm trying to an implement an enhanced version of AES which was proposed recently. The link to the paper is here: http://sdiwc.net/digital-library/enhancing-aes-using-novel-block-key-generation-...
3
votes
1answer
560 views

Linear Approximation and Linear Probability of Camellia Sbox

In this article,Analysis of Camellia (para 2. Differential and linear cryptanalysis, page 3), it says The maximum bias of a linear approximation through one S-box is $2^{-4}$ , which gives a ...
1
vote
0answers
127 views

Camellia Sbox - Linear Approximation Probability [duplicate]

One Page 7, of Document Camellia Design and Analysis The author says, In the case of Camellia, the maximum diferential/linear probabilities of s-boxes are $2^{-6}$. Since Camellia S-boxes are ...
3
votes
1answer
232 views

Why Camellia has 4 Sbox

I asked a question about using 16 different Sboxes in AES each for one state byte instead of using same One Sbox for substituting 16 state bytes (See the Question Increase in AES SBox). The answers i ...
5
votes
1answer
126 views

Number of terms in Balanced boolean functions?

I know that balanced boolean functions are required for creating S-boxes. I want to create four balanced Boolean functions for 4X4 Sbox and as far as I’ve understood, the maximum order of the balanced ...
5
votes
1answer
392 views

FEAL-4 Linear Cryptanalysis - Prevention

currently, I prepare for an exam about cryptanalysis. In class, we talked about linear cryptanalysis for FEAL-4. We constructed four linear equations, extended them to equations for three rounds and ...
5
votes
1answer
599 views

How constant value 0x63 in affine transformation is chosen or generated while AES Substitution Box is formed?

Me and one of my friends are working on AES algorithm. We have understood how multiplicative inverse table is generated. Rijndael AES algorithm shows us how S-Box is generated through the affine ...
6
votes
2answers
355 views

Reverse Fixed Points in Kalyna S-Boxes and Reverse Engineering the S-Boxes

I was examining the S-Boxes of the Kalyna Cipher and found that 3 of the 4 S-boxes have reverse fixed points i.e S[x] = (255 - x). Is this an exploitable weakness? I was not able to find any open ...
1
vote
1answer
42 views

Finding Linear Redundancy by counting the number of distinct frequency distributions of absolute walsh transform

I am writing a program to find linear redundancy in 4x4 s boxes. Is the number of distinct frequency distributions of absolute walsh transform a direct measure of linear redundancy in s boxes? byte[] ...
3
votes
1answer
251 views

Is order of Correlation Immunity of AES S_box Zero?

I am working on AES S_box and trying to find out its properties like Correlation Immunity, Balancedness, Algebraic Degree, ANF form etc. These Papers 1, 2 give a nice definitions to above said terms. ...
6
votes
1answer
714 views

How does one practically calculate the non-linearity of a multi-output boolean function like the AES s-box?

I am working on multi-output boolean function i.e. a function that takes an $n$-bit input and gives an $m$-bit output for all possible inputs (i.e. $2^n$ inputs). To be more exact: I am trying to do ...
5
votes
2answers
2k views

Why DES s-box non-linear? Why it makes the cracking of the cypher more difficult?

I know that if we have a cypher which makes only linear transformations (let's say a bunch of $XOR$'s), we break it simply writing a system of equations with $\oplus$ operation starting from the ...
2
votes
2answers
1k views

More suitable Substitution Box

Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more ...
4
votes
2answers
1k views

Is the difference distribution table of AES S-box uniform?

I am studying about various block ciphers and their weaknesses, so I have a doubt about AES S-boxes, Is the difference distribution table of AES uniform ?
1
vote
2answers
958 views

What makes an open source encryption algorithm safe?

Take for example the popular AES algorithm where we have a combination of substitution, shift row, mix column, and add key steps involved in encrypting plain test. All of the mathematical operations ...
3
votes
1answer
288 views

Last Sbox of a block cipher for Linear Cryptanalysis

I figured I should try to learn about linear cryptanalysis with a super simple cipher with only one Sbox. The problem is that with that approach the last subkey bits seem to be involved in the linear ...
5
votes
1answer
327 views

Is this a better involution S-Box for the Anubis cipher?

After swapping random indexes of trivial involution $S[x] = ¬x$, I found the following involution S-Box with a non-linearity of $98$ and a differential uniformity of $6$. Is there an upper limit to ...
6
votes
2answers
747 views

Number of Sbox in a Cipher

Camellia has 4 SBOX and so does the TwoFish(key dependent 4 Sboxes). Where as AES uses only one. Would it have made AES more secure if AES had 4 or more SBOX too? Does using more Sbox with similar ...
5
votes
1answer
301 views

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

It seems to me that algorithms like Blowfish and Twofish with key-dependent S-boxes are almost impossible to implement without table lookups, and thus are almost impossible to implement in software ...
-2
votes
1answer
180 views

What is the security gain of applying Two S-boxes in Different Ways?

In a 128-bits Feistel Cipher: I need suggestions about two variations of the Round Function Variation-1 $64$ bit input is divided into $8$ bytes Byte $0,1,2,3$ are substituted with Sbox1 Byte $4,5,...
4
votes
2answers
433 views

Converting a 5-bit s-box to its bit-sliced format

I'm currently trying to convert a 5-bit sbox (the one from this cipher: http://primates.ae/wp-content/uploads/primatesv1.02.pdf) to its bit-sliced format (i.e. to a boolean network). Most papers ...
0
votes
0answers
146 views

Can we use more than one irreducible polynomial in AES?

I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key ...
1
vote
0answers
1k views

AES - Size of T-Boxes and obtaining T-Box values

In article "A high performance ST-Box based unified AES encryption/decryption architecture on FPGA" (http://www.sciencedirect.com/science/article/pii/S0141933115001945) two 32Kb dual-port BRAMs are ...
1
vote
1answer
3k views

DES: Computing the output of S-Box 1?

If the 48-bit input to the S-box is 0xAAAAAAAAAAAA, what are the first four bits emitted by S-box 1? Answer: 0110 I know that an S-Box takes n inputs and give m outputs and that n != m, but I really ...
3
votes
1answer
168 views

Differential bound of the S-Box in GOST R34.11-2012

In Russian GOST R34.11-2012 LPS-transformation is used. LPS gets all of its non-linearity from the 8-bit S-box S, which apparently has been designed to offer resistance against classical methods of ...
2
votes
1answer
315 views

Why is not there any ideal S-Box?

i read about linear cryptanalysis and about S-Box that there is not any ideal S-Box (ideal S-Box is a random S-Box in another words S-Box that bias of input and output bits is zero) then i read about ...
5
votes
1answer
451 views

Active s-box of 8x8 MDS for AES

one way to enhance the security of AES by increasing the number of active s-boxes .larger MDS matrices are used to increase the number of active s-boxes. using 4x4 MDS matrix generate 25 active s-box ...
2
votes
2answers
648 views

BOOLEAN FUNCTIONS: generate a function $f: \{0, 1\}^n \rightarrow \{0, 1\}$ from a $n \times n$ S-Box

I want to calculate the hamming weight of a S-Box using this formula: $\text{hw}(f) = \sum_{x=0}^{2^n-1} f(x)$. Where $f: \{0, 1\}^n \rightarrow \{0, 1\}$ My problem is that I don't know how to get ...
6
votes
1answer
117 views

Finding differentials and space complexity

Most of article about differential cryptanalysis present the generic method, the way to find sub keys. But I can't find a clear explanation about how to find the differentials used in examples. In ...
0
votes
1answer
192 views

What are the negative consequences for choosing 8 S-boxes for DES vs 1 S-box for AES?

DES has 8 different S-boxes, and AES has only 1. What are the negative consequences of such choices?
-1
votes
1answer
782 views

How does non-linearity (S-box) add security to AES?

I'm trying to understand how AES guarentees security. One of the named points on the web is that AES uses a non-linear step (the SubBytes step). But how exactly does the Rijndael key schedule add ...
7
votes
2answers
3k views

How to build a difference distribution table?

i am studying about differential cryptanalysis, and found one metric to measure the resistance of a sbox to it, but to use it, it is necessary to build a difference distribution table, like the one in ...
1
vote
1answer
2k views

DES and using the S-Box 1

Can someone please check my work and correct me if I am wrong, I am just starting to learn about DES. I am trying to solve the following problem: Show that ...
1
vote
2answers
731 views

AES S-Box Affine Mapping - how to do it?

For the byte substitution layer in AES how do we determine B(i)? I follow how to use the multiplicative inverse table and using that to get B`(i), but how do I actually calculate the affine mapping? ...
2
votes
0answers
252 views

How do we generate AES S-BOX? [closed]

I am new to AES and I am too much confused about the generation of S-box in AES. I don't have any idea of $GF(2)^8$ field and how the things are happening around. Please answer this question with a ...
3
votes
0answers
236 views

How can I design a cryptographically secure, key-dependent s-box?

I would like to design a cryptographically secure, key-dependent s-box, but I am not sure how. Mainly, because I am unsure about the difference in design compared to a random s-box. What is the ...
-2
votes
1answer
145 views

Are more S boxes more secure in a SP-Network?

The classic DES uses 8 different fixed S boxes. If computer memory was not an issue, would say 800 different S boxes be more secure? I'm thinking of a SP-network that would only run on a server like ...
2
votes
1answer
332 views

How to generate the APA SBox?

I am trying to generate the S-Box provided in the Affine Power Affine paper (PDF) but I'm not sure I understand it fully. The essence of the paper is this: ...
0
votes
1answer
202 views

AES inversion operation in sub byes

I was wondering why in the AES sub-bytes operation one can represent the inversion as computing $x^{254}$. What is the reason for this? Moreoever, I was wondering what the text on page 212 of https://...
0
votes
1answer
231 views

What makes this mixer function resistant to differential cryptanalysis?

I recently learned how differential cryptanalysis works, and decided to have a play around with testing various designs for resistance against attack. My testing algorithm is essentially to loop ...
3
votes
0answers
236 views

How to calculate the non-linearity of an s-box? [duplicate]

I am struggling to understand how to calculate non-linearty of an s-box, could someone show me a detailed example? I found “How to calculate non linearity of AES S-box?” which helped a little, but I ...
5
votes
1answer
333 views

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

I've asked some other questions before about Rijndael's S-boxes, and step by step I'm coming to an understanding; but those steps often guide me to new questions. I did some lines of code to ...
3
votes
1answer
359 views

Performing differential cryptanalysis for randomly generated S-boxes

As far as I know, performing differential or linear cryptanalysis always requires a knowledge of the S-boxes' content and order. Yet in Bruce Schneier's Applied Cryptography, it is stated that random ...
11
votes
2answers
822 views

Evaluating Algebraic Complexity of a S-box

While studying the design and the desirable properties of an AES S-box , I came to know that Algebraic Complexity is also an important property of an S-box which is usually considered while evaluating ...