Skip to main content
8 votes
Accepted

Linear Approximation Table of S-Box for SPN

In Howard Heys' tutorial, the S-box $S$ maps 4 bits to 4 bits. It is defined by the following lookup table: ...
Bla Blaat's user avatar
  • 136
8 votes

Why is AES not a Feistel cipher?

The simple answer is "Because its an SPN cipher". What is difference between Feistel and SPN? SPN operates on whole data in one round, where as Feistel divides data into N parts where N>=2 , then ...
crypt's user avatar
  • 2,449
6 votes
Accepted

What is the diffrence between Feistel networks and SPN?

In a Feistel networks (from the German IBM cryptographer Horst Feistel), the input is divided into two blocks ($L_0$ and $R_0$) which interact with each other. Main example is DES. basic construction:...
Biv's user avatar
  • 10k
6 votes

modified substitution permutation networks

Your construction is completely insecure: a single known plaintext / ciphertext block pair is sufficient to decrypt all blocks encrypted with the same key. Specifically, let me write your block ...
Ilmari Karonen's user avatar
5 votes
Accepted

Substitution-permutation network visualizer

You might be interested in TikZ for Cryptographers: PGF/TikZ is a tandem of languages for producing vector graphics from a geometric/algebraic description. PGF is a lower-level language, while TikZ ...
Ella Rose's user avatar
  • 19.7k
4 votes
Accepted

modified substitution permutation networks

So, the mixing of the $n$ keys is at most as secure as having a uniformly distributed single key. If your key randomness is not strong, doing this kind of mixing can make the key distribution nearer ...
kodlu's user avatar
  • 22.8k
4 votes

DES/AES invertibility

DES is a Feistel cipher where the round function doesn't need to be invertible. Therefore, when designing a Feistel cipher you will have invertible and non-invertible S-box options. In contrast, AES ...
kelalaka's user avatar
  • 49k
4 votes

Substitution-permutation network visualizer

I know of no software that lets you visualize an arbitrary SPN network; however, many of us on the semiconductor side of things have their verification tools output visualizations based on the bit ...
b degnan's user avatar
  • 4,880
4 votes
Accepted

What does this notation means $\mathbb{F}_{2^{-}}$?

You've been confused by the placement of the "-". It's not $\mathbb F_{2^-}$ (Latex: $\mathbb F_{2^-}$), this does not exist. What was actually meant is $\mathbb ...
SEJPM's user avatar
  • 46.1k
3 votes

Midori block cipher design: importance of $S_b$ as the S-box

The lightweight Midori block cipher is a subtitution-permutation network where a round of cipher has a substitution phase where chunks of state are used as inputs to the $S$-box and the outputs ...
Daniel S's user avatar
  • 24.1k
3 votes
Accepted

Attacking a one-round SPN

If we're talking about Katz and Lindell, it might be worth investing in a newer edition. My (third) edition section 7.2.1 on page 225 reads: A better attack is possible by noting that individual bits ...
Daniel S's user avatar
  • 24.1k
3 votes

Using a round function intended for an SP network in a Feistel network?

There is only one requirement for a Feistel round function and that is a good diffusion and confusion. It is not required for the round function to be invertible in a Feistel network. You can use (as ...
Biv's user avatar
  • 10k
3 votes

16-bit entry in a S-Box of a SPN block cipher: Would it have the same speed/performance than a 8-bit entry?

Firstly note that a $2^{16}$-long look up table of 16-bit=2-byte entries takes up 131,072 bytes of space. Your question is very architecture dependent. For speedy encryption you would want the S-...
Daniel S's user avatar
  • 24.1k
3 votes
Accepted

Is it possible to use words of bits as entries in S-Boxes bigger than 4/8 bits and achive similar security/speed in SPN block ciphers?

There's an ambiguity in the term S-box as to whether it means a general look-up table or specifically a bijective substitution function. I've seen both uses. If we mean a general look-up table, then ...
Daniel S's user avatar
  • 24.1k
2 votes

Differential analysis of SPN

I would disagree with the answer by @kodlu. In classic differential cryptanalysis, we don't pay "probability" for the last rounds, but rather we pay for the enumeration of the involved key ...
Fractalice's user avatar
  • 3,097
2 votes

Definition Problem for toy SPN

Definition 3.1 : Let $\pi_S:\{0,1\}^m\rightarrow \{0,1\}^n$ be a S-box. Consider an (ordered) pair of bitstrings of length $m$, say $(x,x^*)$. We say that input XOR of the S-box is $x\oplus x^*$ and ...
kodlu's user avatar
  • 22.8k
1 vote

Heys Differential Cryptanalysis Question

So to attack those keys you need to create high probability input differences confined to $S_{41}$ and $S_{43}$. Taking the same input differences as in Heys for $S_{42}$ and $S_{43}$ and working ...
kodlu's user avatar
  • 22.8k
1 vote
Accepted

How round constants are chosen in a block cipher?

The constants used in block cipher, much like ones used in many other symmetric cryptographic algorithms, depend on what the algorithm needs in terms of security. For block ciphers, the most common ...
bk2204's user avatar
  • 3,476
1 vote

Substitution-Permutation Network (SPN) Example

The question is read as; We have Substitution–Permutation Network (SPN) a block cipher with block size $lm$ Round key addition with $K^r$ $\pi_s$ is the diffusion part and it is S-box of input-output ...
kelalaka's user avatar
  • 49k
1 vote

Is the order of applying transformations in SP cryptosystems significant?

It depends on the cryptosystem if the order of transformations matters to security. In the example of DES, we can't quite exchange S and P as considered in the question. That's because the input of S ...
fgrieu's user avatar
  • 142k
1 vote

Is the order of applying transformations in SP cryptosystems significant?

Let call the Substitution by $S$ and Permutation by $P$ in the Substitution Permutation Network (SPN). Let consider an SPN block cipher with $4$ rounds where $K$ represents the $\oplus$ round key. ...
kelalaka's user avatar
  • 49k
1 vote

Differential analysis of SPN

The reason $R=n-1$ (or $R=1,$ applied to the decryption mapping) is used is the following. All the individual differential approximations as well as the differential trail which is chosen over the $R$ ...
kodlu's user avatar
  • 22.8k
1 vote

Construction of key recovery attack in O(2^(n/2))

Well, you said that this was a "practice problem"; hence you're supposed to learn from it, so I won't give you the answer. I will give you a hint: you have $E_k(M) = \Pi(M \oplus K) \oplus K$...
poncho's user avatar
  • 148k
1 vote

Can we design a block cipher based on SP-network without loss of E/D similarity theoretically?

Actually, to deal with the conflict between the inverse SBOX and E/D similarity, we can just expand the original SP network into something like "$S$->$P$->(entangled with key)->$P^{-1}$-&...
Max1z's user avatar
  • 145
1 vote

substitution-permutation network construction

Assuming your key mixing layer uses XOR: $M \oplus K_0 \oplus K_1 \oplus ... K_r$ $K_0 \oplus K_1 \oplus ... K_r$ effectively compresses into one, single key Equivalent to $M ^ K$ in terms of ...
Ella Rose's user avatar
  • 19.7k

Only top scored, non community-wiki answers of a minimum length are eligible