# Questions tagged [s-boxes]

(or substitution boxes), components in many block ciphers used to substitute parts of the data in a non-linear way. While often fixed by the algorithm (like in DES and AES), sometimes they are key-dependent (like in Blowfish).

225 questions
Filter by
Sorted by
Tagged with
542 views

### Math to replace s-boxes - Good or bad idea?

The following was going through my brain for the past week. If my thoughts are generally known to the cryptographic community would someone provide a link or two. Even if I’m making a classic newbie ...
2k views

### Choice of multiplication polynomial in Rijndael s-box affine mapping

The Rijndael specification details the design choices for the s-box in section 7.2. They describe the choice of affine mapping as follows: We have chosen an affine mapping that has a very simple ...
1k views

In FIPS-197 §5.1.1, it says the first transformation in the SubBytes() transformation is: Take the multiplicative inverse in the finite field $\text{GF}(2^8)$ described in Sec. 4.2; the element $... 1answer 2k views ### How to calculate inverse affine transform in AES from forward affine transform? In AES the forward affine tranformation matrix is defined as: $$\begin{bmatrix} 1& 0& 0& 0& 1& 1& 1& 1 \\ 1& 1& 0& 0& 0& 1& 1& 1 \\ 1& 1&... 2answers 912 views ### About the Rijndael/AES sbox polynomial (subBytes) I've recently read a question about the irreducible polynomial behind the subBytes() operation in the Rijndael that has awakened and old curiosity I have: Why \,m(x) was chosen as \,x^8+x^4+x^3+x+... 1answer 776 views ### Are the MD5 constants an S-Box? I noticed that several hash algorithms, in this case MD5, defines some constants. MD5 defines 64 constant values (the shift count per round) which also gets expand (via sine) to a summand for a ... 2answers 9k views ### Reason why “XOR” is a linear operation, but ordinary “addition” isn’t? I'm new in cryptography and try to read some articles in this field. Many of these articles talk about non-linear S-boxes, and nothing more on what they mean by their non-linearity. I have a simple ... 2answers 1k views ### Two-dimensional S-Box Consider the following simple cipher:$$c_1 = S(m_1 \oplus k_1) \oplus k_2$$Where$S$is S-box,$m_1$- 16-bit plain text,$k_1$and$k_2$is two parts of 16-bit key. If S-box is standard then this ... 1answer 269 views ### How would using only one s-box affect security of Blowfish? Schneier says: Fewer and smaller S-boxes. It may be possible to reduce the number of S-boxes from four to one. Additionally, it may be possible to overlap entries in a single S-box: entry 0 ... 3answers 2k views ### AES column mixing and S-Box confusion I am trying to understand the AES encryption algorithm. I know that we process 128 bits at a time for a 128 bit key in a 4x4 octet form, but am confused by the following: How does the substitution ... 1answer 1k views ### Serpent cipher : Osvik S-Boxes confusion and test vectors I'm having hard time with the implementation of the S-Boxes by Osvik found in this paper: Speeding up Serpent. At the end of the paper, all the s-boxes are given and then, I just implement them. Here'... 1answer 1k views ### Serpent block cipher : S0 to S7 functions unclear I am presently implementing the serpent block cipher in C++ following the specifications. It's important to mention that I'm implementing the cipher in bitslice mode. You'll need the The full ... 1answer 43k views ### How are the AES S-Boxes calculated? I'm trying to understand how the AES S-Boxes are calculated. I understand how the multiplicative inverse is calculated over$GF(2^8)$, but I'm confused by the description of the affine transformation. ... 1answer 2k views ### Where is the S-Box generated in Rijandel/AES? It's rather kind of lame questions, and I can't find good and clear explanation: In which step of Rijandel is S-box generated? Is the S-box reused in every round of cipher or is generated in every ... 1answer 43k views ### How does DES decryption work? Is it the same as encryption or the reverse? [duplicate] If DES decryption is the same as encryption done in reverse order, then how can the reversed S-Box convert 4 bits into 6 bits? 2answers 885 views ### How do I choose the best 3*3 s-boxes? I've read about 20 papers about the criteria for choosing best$n \times n$s-boxes. Now, I've got two problems: How to generate$2^{24}$s-boxes, and how to test them considering the criteria. ... 1answer 7k views ### How can an S-Box be reversed? So, as an exercise to greater understand some things about cryptography, I decided to try and implement GOST 28147-89, which uses eight 4x4 S-Boxes. I can grasp the concept of putting 4 bits through ... 1answer 701 views ### S-box with differential uniformity = 2 I read that we do not know if there exists an 8x8 sbox with differential uniformity = 2. I suppose we cannot compute every possible sbox because there are$64!$possible s-boxes. Am I right? 1answer 4k views ### S-box design criteria and random sboxes What are the disadvantages of using random s-boxes? In AES, the s-boxes had to obey certain mathematical rules, which? And why? What security does using hidden s-boxes (GOST) or generating them from ... 3answers 10k views ### Why do block ciphers need a non-linear component (like an S-box)? Why is there a requirement of "Non-Linear functions" as a component of many popular block ciphers (e.g. the S-box in DES or 3DES)? How does it make the cipher more secure? The only intuition I have ... 1answer 537 views ### S-box Cryptanalytic Resistance In DES, different S-boxes were tested for cryptanalytic resistance and the most secure one was chosen for the algorithm itself. How do different S-boxes offer different levels of security against ... 5answers 8k views ### Desirable S-box properties What desirable properties should an S-box have? My current standard selection process is to just pick them at random and verify that they fit the following criteria: The probability that any random ... 3answers 4k views ### Security of simple xor and s-box cipher? What weaknesses (or strengths) do block ciphers based on only key xor and s-box have when operating in CBC mode? A cipher's internal primitive might be a simple as this:$C = S[M \oplus k]$, where$...
The Rijndael S-Box design generates a permutation cycle of type $2+27+59+81+87$. What effect would replacing that permutation with a cycle of type $256$ have on the security of AES?