Hot answers tagged

13 votes

Generate ANF from SBox

This is useful to know in general. Given the Sbox map, generate the truth tables for the bits of the map. From the truth tables, obtain the algebraic normal form, via the Mobius transform. So, given ...
user avatar
  • 16.1k
13 votes

Why don't table lookups run in constant time?

It mostly has to do with the real world influence of memory caches. A cache is a small amount of fast memory; when you read from memory, the contents are placed in this fast memory (possibly along ...
user avatar
  • 131k
12 votes
Accepted

AES s-box representation

The tricky point is that $\mathbb{F}_2^8$ is not a field; it is a degree-8 vector space. Multiplications are not defined on vector spaces. However, the $A$ transform is defined only on the vector ...
user avatar
12 votes

S-box basic question

Good question and yes, it would appear that data is lost. And technically, something clearly must disappear as 6 don't go into 4. But consider the overall architecture of DES: Trace the flow of the ...
user avatar
  • 13.8k
11 votes

Desirable S-box properties

Desirable Properties For simplicity, I’m skipping some of the details here… but the main criteria of a good s-box are: miul It should have balanced component functions, The non-linearity of its ...
user avatar
  • 17.3k
11 votes
Accepted

Why is the DES s-box non-linear? Why does it make the cracking of the cipher more difficult?

It is of course possible to write DES or any block cipher as a system of non-linear equations involving the plaintext bits, the ciphertext bits, and the key bits, which hold with probability 1. In ...
user avatar
  • 4,325
11 votes
Accepted

Generate ANF from SBox

From TRUTH TABLE to ANF First write [6, 4, 7, 8, 0, 5, 2, 10, 14, 3, 13, 1, 12, 15, 9, 11] in that way: the columns of matrix are those numbers in $\mathbb{F_2^4}$. $$ \begin{bmatrix} 0&0&1&...
user avatar
  • 136
11 votes
Accepted

Why do we keep designing new static s boxes?

There are simply a long list of properties for S-boxes that are relevant, see for example these questions: Desirable S-box properties S-box design criteria and random sboxes In addition people have ...
user avatar
  • 4,689
10 votes
Accepted

Is it necessary for the Rijndael polynomial to be primitive?

Is it necessary to choose a primitive polynomial for an S-Box? Actually, it is not necessary (and, as the polynomial they actually use in AES, $x^8 + x^4+ x^3 + x + 1$, is not primitive, and so it's ...
user avatar
  • 131k
10 votes

AES vs DES S-boxes

A good source for this kind of questions is the book The Design of Rijndael by Joan Daemen and Vincent Rijmen. On page 35 they write about their choice for the used S-box $S_{RD}$: Design criteria ...
user avatar
  • 101
10 votes

What is this AES SBOX triplet property?

This is rather pretty if you understand finite fields and rather baffling if you don't. All the arithmetic takes place in $GF(256)$, so if you're not used to $1+1=0$, I apologise. Conversion to pure $...
user avatar
  • 9,576
9 votes

Math to replace s-boxes - Good or bad idea?

The S-boxes in quite many encryption algorithms (for example, in AES) have been already built with math (the AES S-box is an inversion function in $GF(256)$ plus an affine transformation). The lookup ...
user avatar
9 votes

How does one practically calculate the non-linearity of a multi-output boolean function like the AES s-box?

Before we start with vectorial Boolean functions, let's recall the definition of the nonlinearity of a Boolean function: $$\mathcal{NL}(f) = \min_{a \in \mathbb{F}_2^n} d_H(f, \ell_a \oplus b),$$ ...
user avatar
  • 1,776
9 votes

S-box basic question

DES uses a Feistel network. The S-box results gets XOR-ed with the other half so no information is lost. It doesn't need to be invertible.
user avatar
  • 10.4k
8 votes
Accepted

Rijndael S-boxes: Where do the $\mu$ and $\nu$ polynomial ring elements come from?

Finally I've went to the source and I've mailed the Rijndael's authors. They have answered very fast and very nice. I've understood the other way around. The affine transformation is over the vector ...
user avatar
  • 717
8 votes
Accepted

Number of Sbox in a Cipher

Coincidentally I had the Twofish and Camellia design papers open on my computer when you asked this question. S-boxes in the ciphers Both are Feistel ciphers, and the way the s-boxes are used is ...
user avatar
  • 12.6k
8 votes
Accepted

Why is this function bijective?

It is simply a typo in the paper I believe. It should say: $$F(x_1, x_2, \ldots, x_n) = (f(x_1, \ldots, x_k), f(x_2, \ldots, x_{k+1}), \ldots, f(x_n, x_1, \ldots, x_{k-1})).$$ (Note the $x_n$ instead ...
user avatar
  • 1,503
7 votes
Accepted

Active S-boxes for AES with 8x8 MDS matrix

It seems that using an 8x8 MDS will have 27 Active Sboxes after 4 Rounds(There may exist a trail shorter than 27). The image below shows the counting of active Sboxes. The Active and non-Active byte ...
user avatar
  • 1,998
7 votes
Accepted

Converting a 5-bit s-box to its bit-sliced format

A recent paper presented at FSE'2016 [1] addresses this exact question. In fact, it even provides a bitsliced implementation for the S-Box you are interested in Section 4. In summary: you first ...
user avatar
7 votes
Accepted

Do key-dependent S-boxes make efficient constant-time software implementations almost impossible?

The point in the question makes senses, especially if one restricts to portable software implementations. But: Small or moderately large constant-time RAM tables are reasonable, efficient, and (thus) ...
user avatar
  • 122k
7 votes
Accepted

Construction of S-box in AES

In the field $GF(2^8)$, $x^{254} = x^{-1}$ (except for $x=0$, as $0^{-1}$ doesn't exist; for AES, that's treated as 0), and so it's two ways of describing the same thing. When we talk about AES, we ...
user avatar
  • 131k
7 votes

Why do we keep designing new static s boxes?

Why? There are many factors besides basic linear/differential properties. For example, as mentioned by Elias, there are other considerations such as "How does the mapping facilitate masking ...
user avatar
  • 19.2k
7 votes

Why don't table lookups run in constant time?

I just wanted to extend poncho's answer as aspects of this question keep coming up. Generally speaking, you can write constant-time portions of software if you have privileged OS access, but it's not ...
user avatar
  • 4,212
7 votes
Accepted

Security of the AES with a Secret S-box

Are the S-boxes they are considering just random permutations of bytes that fit into an 8×8 table? How might they have chosen all the entries to get the S-box? Yes, they chose a random s-box. Are ...
user avatar
  • 12.6k
7 votes
Accepted

How do the Serpent S-boxes work?

Serpent uses 8 different 4-bit S-boxes (i.e. each S-box contains 16 elements) a total of 32 times. There are no "rows" or "columns" as it is a one-dimensional array containing a ...
user avatar
  • 12.9k
6 votes
Accepted

How constant value 0x63 in affine transformation is chosen or generated while AES Substitution Box is formed?

According to the Rijndael AES proposal (emphasis mine): We have chosen an affine mapping that has a very simple description per se, but a complicated algebraic expression if combined with the ‘...
user avatar
6 votes

S-boxes are not linear

I don't believe you're really asking 'why did they select an SBox with 0 being mapped to something other than 0"; essentially, that's what the designers picked. Instead, it is "why does $S(0) \ne 0$ ...
user avatar
  • 131k
6 votes
Accepted

How can one construct the weakest S-box ever?

Any affine function will do. Let your Sbox be $$S(x)=Mx\oplus c$$ where $M$ is an $n\times n$ binary matrix and $c$ is an $n-$bit constant vector. The output difference for this Sbox is, for any ...
user avatar
  • 16.1k
6 votes
Accepted

AES with linear S-Box

does the cipher become entirely affine and hence trivially weak? Yes; the AES sbox is the only source of nonlinearity (the ShiftRows and MixColumns are linear, and AddRoundKeys for a fixed key is ...
user avatar
  • 131k
6 votes

What's happens if we use the weakest S-BOX for AES?

See: How can one construct the weakest S-box ever? and How do I choose the best 3*3 s-boxes? I believe that user Hend's question is not "how to design the worst possible S-box" but about "having ...
user avatar
  • 270

Only top scored, non community-wiki answers of a minimum length are eligible