2

Can anyone suggest me any fast searching method or algorithm to find best S-Box among a big number of S-boxes? For example; if I have 100 different S-boxes, I want to pick that one which is more secure than the others.

hola
  • 603
  • 6
  • 22
faiz
  • 23
  • 5

2 Answers2

4

There is no such specific algorithm to find the best S-box but you can construct a Diference Distribution Table(DDT) like this and check out the values in it .A DDT is a matrix containing input differences as rows and corresponding output differences in column.

A better S-box has- 1- Lower values in its DDT 2- Less occurence of higher or highest value

Abhinav singh
  • 284
  • 2
  • 13
  • this Differential approximation probability, right?can you elaborate it a little?that how is the first value 64?thanks dear – faiz Jul 12 '16 at 05:32
  • 1
    Yes these are probability, let me explain why first value is 64 The first row show the probability of output differences(which can be between 0000-1111 for input difference 000000. So as you can see column 1 (i.e. 0000) has 64 because if the input differencial will be 000000 then output differential will always be 0000 i.e probability 64/64= 1. – Abhinav singh Jul 12 '16 at 05:34
  • i am alittle weak in mathematics and probability, sorry for asking dumb questions but i am confused about "64" for output, because output should be 4 bits, maximum different values should be 16, for input 2^6=64 , but how 64 for input?and how other all values are zeros?thanks in advance brother – faiz Jul 12 '16 at 07:37
  • 1
    output differences are in 4 bit , 64 in the first row shows the frequency of 0000 as output difference when input difference is 000000. – Abhinav singh Jul 12 '16 at 07:50
  • can we chat here?i mean individual discussion?i don't want to bother other reviewer ...i don't know how to chat personally in this website? – faiz Jul 12 '16 at 08:35
  • I just joined yesterday , don't know if personal chat is available, but i have given enough clues, i hope you can figure out – Abhinav singh Jul 12 '16 at 09:28
  • here's a link to chat if you still need it – Ella Rose Jul 12 '16 at 15:38
-1

AES S-Box is not just a non linear substitution table, it is the result of a precalculation based on two operations. This is, imho, the greatest value of Rijndael, everything rests with maths.

The first operation is a non linear transformation $g: x\rightarrow y = x^{-1} \in \frac{\mathbb{F}_{2}[z]}{m(z)} $ with $m(z) = z^8+z^4+z^3+z+1$ who is irreducible that tells us all the elements are invertible. The second operation is an affine map in $(\mathbb{F}_2)^8$.

Do you like to build a different S-Box but with the same good properties? Lets use a different $m(z)$ (with the same degree) but this will not provide to you any extra feature. Do you like to build table from scratch? Any linearity introduced by mistake will be a weakness. The maths behind the Rijndael helps to avoid mistakes.

srgblnch
  • 737
  • 5
  • 13
  • no i didn't made in this way, i am using chaotic maps to generate s-box by my own algo, i have already 100 different s-boxes , now i want to select best of them through any fast searching method. – faiz Jul 12 '16 at 08:07
  • ok, then I think you are working with a variant of the Rijndael. The subBytes operation provides shannon's "confusion", perhaps a way to evaluate your SBoxes candidates is to measure this confusion. How many bits are changed when the input changes by one bit. – srgblnch Jul 12 '16 at 08:26
  • sometimes 3 sometimes 6, 4, varies – faiz Jul 12 '16 at 08:33
  • So, I think it must change as much as possible as a minimum. I mean, if there is an SBox that has a case that doesn't change any one, discard it. Then I would select the one that provides more confusion. – srgblnch Jul 12 '16 at 08:36
  • all of my sbox have this property. i need any recent research clue about this... – faiz Jul 12 '16 at 08:38