Bijective S-boxes Research Articles

On the Pentanomial Power Mapping Classification of 8-bit to 8-bit S-Boxes

Substitution boxes, or S-boxes, are one of the most important mathematical primitives in modern symmetric cryptographic algorithms. Given their importance, in the past decades, they have been thoroughly analyzed and evaluated by the academic world. Thus, a lot of desirable characteristics a given S-box should possess have been found. This includes, as much as possible, higher nonlinearity and algebraic degrees as well as, as much as possible, lower values of differential uniformity, autocorrelation and sum of squares indicator values. In this work, we use power mappings over GF(28) to generate, enumerate and evaluate all bijective S-boxes yielded by pentanomials of the form f(x)=xa+xb+xc+xd+xe given 0<a<b<c<d<e<256. We find a total of 152,320 different bijective S-boxes, which are further classified into 41,458 different groups in terms of the aforementioned characteristics as well as the number of their fixed points. Having this data, an S-box designer can easily generate a bijective substitution S-box with parameters of their choice. By using pentanomials, we show how we can easily construct S-boxes with cryptographic properties similar to those found in some popular S-boxes like the Kuznyechik S-box proposed by the Russian Federation’s standardization agency as well as the Skipjack S-box proposed by the National Security Agency of the USA.

Enhancing Cryptographic Primitives through Dynamic Cost Function Optimization in Heuristic Search

The efficiency of heuristic search algorithms is a critical factor in the realm of cryptographic primitive construction, particularly in the generation of highly nonlinear bijective permutations, known as substitution boxes (S-boxes). The vast search space of 256! (256 factorial) permutations for 8-bit sequences poses a significant challenge in isolating S-boxes with optimal nonlinearity, a crucial property for enhancing the resilience of symmetric ciphers against cryptanalytic attacks. Existing approaches to this problem suffer from high computational costs and limited success rates, necessitating the development of more efficient and effective methods. This study introduces a novel approach that addresses these limitations by dynamically adjusting the cost function parameters within the hill-climbing heuristic search algorithm. By incorporating principles from dynamic programming, our methodology leverages feedback from previous iterations to adaptively refine the search trajectory, leading to a significant reduction in the number of iterations required to converge on optimal solutions. Through extensive comparative analyses with state-of-the-art techniques, we demonstrate that our approach achieves a remarkable 100% success rate in locating 8-bit bijective S-boxes with maximal nonlinearity, while requiring only 50,000 iterations on average—a substantial improvement over existing methods. The proposed dynamic parameter adaptation mechanism not only enhances the computational efficiency of the search process, but also showcases the potential for interdisciplinary collaboration between the fields of heuristic optimization and cryptography. The practical implications of our findings are significant, as the ability to efficiently generate highly nonlinear S-boxes directly contributes to the development of more secure and robust symmetric encryption systems. Furthermore, the dynamic parameter adaptation concept introduced in this study opens up new avenues for future research in the broader context of heuristic optimization and its applications across various domains.

A lower bound for differential uniformity by multiplicative complexity & bijective functions of multiplicative complexity 1 over finite fields

The multiplicative complexity of an S-box over a finite field is the minimum number of multiplications needed to implement the S-box as an arithmetic circuit. In this paper we fully characterize bijective S-boxes with multiplicative complexity 1 up to affine equivalence over any finite field. We show that under affine equivalence in odd characteristic there are two classes of bijective functions and in even characteristic there are three classes of bijective functions with multiplicative complexity 1. Moreover, in (Jeon et al., Cryptogr. Commun., 14(4), 849-874 (2022)) A-boxes where introduced to lower bound the differential uniformity of an S-box over F2n\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{2}^{n}$$\\end{document} via its multiplicative complexity. We generalize this concept to arbitrary finite fields. In particular, we show that the differential uniformity of a (n, m)-S-box over Fq\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\mathbb {F}_{q}$$\\end{document} is at least qn-l\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$q^{n - l}$$\\end{document}, where ⌊n-12⌋+l\\documentclass[12pt]{minimal} \\usepackage{amsmath} \\usepackage{wasysym} \\usepackage{amsfonts} \\usepackage{amssymb} \\usepackage{amsbsy} \\usepackage{mathrsfs} \\usepackage{upgreek} \\setlength{\\oddsidemargin}{-69pt} \\begin{document}$$\\lfloor \\frac{n - 1}{2} \\rfloor + l$$\\end{document} is the multiplicative complexity of the S-box.

A further study on bridge structures and constructing bijective S-boxes for low-latency masking

A further study on bridge structures and constructing bijective S-boxes for low-latency masking

Optimizing Hill Climbing Algorithm for S-Boxes Generation

Nonlinear substitutions or S-boxes are important cryptographic primitives of modern symmetric ciphers. They are designed to complicate the plaintext-ciphertext dependency. According to modern ideas, the S-box should be bijective, have high nonlinearity and algebraic immunity, low delta uniformity, and linear redundancy. These criteria directly affect the cryptographic strength of ciphers, providing resistance to statistical, linear, algebraic, differential, and other cryptanalysis techniques. Many researchers have used various heuristic search algorithms to generate random S-boxes with high nonlinearity; however, the complexity of this task is still high. For example, the best-known algorithm to generate a random 8-bit bijective S-box with nonlinearity 104 requires high computational effort—more than 65,000 intermediate estimates or search iterations. In this article, we explore a hill-climbing algorithm and optimize the heuristic search parameters. We show that the complexity of generating S-boxes can be significantly reduced. To search for a random bijective S-box with nonlinearity 104, only about 50,000 intermediate search iterations are required. In addition, we generate cryptographically strong S-Boxes for which additional criteria are provided. We present estimates of the complexity of the search and estimates of the probabilities of generating substitutions with various cryptographic indicators. The extracted results demonstrate a significant improvement in our approach compared to the state of the art in terms of providing linear non-redundancy, nonlinearity, algebraic immunity, and delta uniformity.

Generation of Nonlinear Substitutions by Simulated Annealing Algorithm

The problem of nonlinear substitution generation (S-boxes) is investigated in many related works in symmetric key cryptography. In particular, the strength of symmetric ciphers to linear cryptanalysis is directly related to the nonlinearity of substitution. In addition to being highly nonlinear, S-boxes must be random, i.e., must not contain hidden mathematical constructs that facilitate algebraic cryptanalysis. The generation of such substitutions is a complex combinatorial optimization problem. Probabilistic algorithms are used to solve it, for instance the simulated annealing algorithm, which is well-fitted to a discrete search space. We propose a new cost function based on Walsh–Hadamard spectrum computation, and investigate the search efficiency of S-boxes using a simulated annealing algorithm. For this purpose, we conduct numerous experiments with different input parameters: initial temperature, cooling coefficient, number of internal and external loops. As the results of the research show, applying the new cost function allows for the rapid generation of nonlinear substitutions. To find 8-bit bijective S-boxes with nonlinearity 104, we need about 83,000 iterations. At the same time, the probability of finding the target result is 100%.

Modifications of bijective S-Boxes with linear structures

Various systematic modifications of vectorial Boolean functions have been used for finding new previously unknown classes of S-boxes with good or even optimal differential uniformity and nonlinearity. In this paper, a new general modification method is given that preserves the bijectivity property of the function in case the inverse of the function admits a linear structure. A previously known construction of such a modification based on bijective Gold functions in odd dimension is a special case of the new method.

Enhancement of Non-Permutation Binomial Power Functions to Construct Cryptographically Strong S-Boxes

A Substitution box (S-box) is an important component used in symmetric key cryptosystems to satisfy Shannon’s property on confusion. As the only nonlinear operation, the S-box must be cryptographically strong to thwart any cryptanalysis tools on cryptosystems. Generally, the S-boxes can be constructed using any of the following approaches: the random search approach, heuristic/evolutionary approach or mathematical approach. However, the current S-box construction has some drawbacks, such as low cryptographic properties for the random search approach and the fact that it is hard to develop mathematical functions that can be used to construct a cryptographically strong S-box. In this paper, we explore the non-permutation function that was generated from the binomial operation of the power function to construct a cryptographically strong S-box. By adopting the method called the Redundancy Removal Algorithm, we propose some enhancement in the algorithm such that the desired result can be obtained. The analytical results of our experiment indicate that all criteria such as bijective, nonlinearity, differential uniformity, algebraic degree and linear approximation are found to hold in the obtained S-boxes. Our proposed S-box also surpassed several bijective S-boxes available in the literature in terms of cryptographic properties.

Метод синтезу s-блоків на основі матриць gf-перетворення

Cryptographic methods today are a crucial tool for constructing information security systems. At the same time, to solve the problem of encrypting large amounts of information, block or stream symmetric ciphers are mainly preferred because of their efficiency and proven cryptographic strength, including against perspective quantum cryptanalysis. The effectiveness of modern symmetric ciphers largely depends on the cryptographic S-boxes applied in their construction, the quality of which largely determines the degree of implementation of the concepts of diffusion and confusion by the cryptographic algorithm, while the presence of large sets of cryptographically high-quality S-boxes is also important, in the terms of their application as a long-term key. Today, the Nyberg construction is well-known and widely applied in ciphers, including widespread AES block symmetric cipher. This construction allows you to synthesize high-quality S-boxes that harmoniously satisfy the main criteria for cryptographic quality, however, the set of S-boxes synthesized using this construction is small, which makes the task of developing new methods for synthesizing large sets of cryptographically high-quality S-boxes highly relevant. At the same time, as research shows, the constructions of extended Galois fields are a promising raw material for solving this problem. In this paper, the Galois field transform matrices of order N=256 are constructed for all isomorphic representations of the extended Galois field GF(256) which are analogous to the Reed-Muller transform but for the case of many-valued logic functions. As part of the research, the isomorphism invariant row numbers of the Galois field transform matrices are identified, which allows to obtain bijective S-boxes, as well as bijective S-boxes that correspond to the main criteria for cryptographic quality of component Boolean functions such as algebraic degree of nonlinearity, distance of nonlinearity, error propagation criterion, and criterion of minimization of correlation of output and input vectors of the S-box. At the same time, the cardinality of the set of synthesized S-boxes is ~23 times higher than the cardinality of the set of S-boxes of the Nyberg construction, which allows them to be used as a long-term key. The proposed S-boxes can become the basis for improving the effectiveness of existing symmetric cryptographic algorithms and developing new ciphers.

An Optimal Universal Construction for the Threshold Implementation of Bijective S-boxes

Threshold implementation is a method based on secret sharing to secure cryptographic ciphers (and in particular S-boxes) against differential power analysis side-channel attacks which was proposed by Nikova, Rechberger, and Rijmen in 2006. Until now, threshold implementations were only constructed for specific types of functions and some small S-boxes, but no generic construction was ever presented. In this paper, we present the first universal threshold implementation with <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> +2 shares that is applicable to any bijective S-box, where <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> is its algebraic degree (or is larger than the algebraic degree). While being universal, our construction is also optimal with respect to the number of shares, since the theoretically smallest possible number, <italic xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">t</i> + 1, is not attainable for some bijective S-boxes. Our results enable low latency secure hardware implementations without the need for additional randomness. In particular, we apply this result to find two uniform sharings of the AES S-box. The first sharing is obtained by using the threshold implementation of the inversion in F <sub xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink">2⁸</sub> and the second by using two threshold implementations of two cubic power permutations that decompose the inversion. Area and performance figures for hardware implementations are provided.

A theoretical analysis of generalized invariants of bijective S-boxes

A theoretical analysis of generalized invariants of bijective S-boxes

Low-Latency Boolean Functions and Bijective S-boxes

In this paper, we study the gate depth complexity of (vectorial) Boolean functions in the basis of {NAND, NOR, INV} as a new metric, called latency complexity, to mathematically measure the latency of Boolean functions. We present efficient algorithms to find all Boolean functions with low-latency complexity, or to determine the latency complexity of the (vectorial) Boolean functions, and to find all the circuits with the minimum latency complexity for a given Boolean function. Then, we present another algorithm to build bijective S-boxes with low-latency complexity which with respect to the computation cost, this algorithm overcomes the previous methods of building S-boxes.As a result, for latency complexity 3, we present n-bit S-boxes of 3 ≤ n ≤ 8 with linearity 2n−1 and uniformity 2n−2 (except for 5-bit S-boxes for whose the minimum achievable uniformity is 6). Besides, for latency complexity 4, we present several n-bit S-boxes of 5 ≤ n &lt; 8 with linearity 2n−2 and uniformity 2n−4.

Optimization of a Simulated Annealing Algorithm for S-Boxes Generating.

Cryptographic algorithms are used to ensure confidentiality, integrity and authenticity of data in information systems. One of the important areas of modern cryptography is that of symmetric key ciphers. They convert the input plaintext into ciphertext, representing it as a random sequence of characters. S-boxes are designed to complicate the input–output relationship of the cipher. In other words, S-boxes introduce nonlinearity into the encryption process, complicating the use of different methods of cryptanalysis (linear, differential, statistical, correlation, etc.). In addition, S-boxes must be random. This property means that nonlinear substitution cannot be represented as simple algebraic constructions. Random S-boxes are designed to protect against algebraic methods of cryptanalysis. Thus, generation of random S-boxes is an important area of research directly related to the design of modern cryptographically strong symmetric ciphers. This problem has been solved in many related works, including some using the simulated annealing (SA) algorithm. Some works managed to generate 8-bit bijective S-boxes with a nonlinearity index of 104. However, this required enormous computational resources. This paper presents the results of our optimization of SA via various parameters. We were able to significantly reduce the computational complexity of substitution generation with SA. In addition, we also significantly increased the probability of generating the target S-boxes with a nonlinearity score of 104.

Study of a new cost function for generating random substitutions of symmetric ciphers

Cryptographic transformations with a secret key play an essential role in providing information and cyber security. Block and stream symmetric ciphers are used in various applications both as a separate cryptographic protection mechanism and as part of other applications (pseudo-random sequence generators, hashing algorithms, electronic signature protocols, etc.). Therefore, the design and study of individual components of symmetric ciphers is a relevant and important scientific task. In this paper we consider and investigates iterative algorithms for generating non-linear substitutions (substitutions, S-boxes), which are used in modern block and stream encryption algorithms with a symmetric key. Cryptographic resistance of symmetric ciphers to statistical, differential, linear and other methods of cryptanalysis is provided by the properties of substitutions. In addition, S-boxes must be random from the point of view of the possibility to use algebraic cryptanalysis. Therefore, the task of quickly generating random S-boxes with the desired cryptographic properties is an urgent, but extremely difficult task. For example, the best known generation algorithm requires more than 65 thousand iterations to find a random bijective 8-bit substitution with a non-linearity of 104. In this paper, we study an iterative algorithm for generating substitutions for hill climbing with different cost functions and propose a new cost function, the use of which can significantly reduce the number of search iterations. In particular, the search for a bijective S-box with nonlinearity 104 requires less than 50 thousand iterations.

A novel systematic byte substitution method to design strong bijective substitution box (S-box) using piece-wise-linear chaotic map

Cryptography deals with designing practical mathematical algorithms having the two primitive elements of confusion and diffusion. The security of encrypted data is highly dependent on these two primitive elements and a key. S-box is the nonlinear component present in a symmetric encryption algorithm that provides confusion. A cryptographically strong bijective S-box structure in cryptosystem ensures near-optimal resistance against cryptanalytic attacks. It provides uncertainty and nonlinearity that ensures high confidentiality and security against cryptanalysis attacks. The nonlinearity of an S-box is highly dependent on the dispersal of input data using an S-box. Cryptographic performance criteria of chaos-based S-boxes are worse than algebraic S-box design methods, especially differential probability. This article reports a novel approach to design an 8 × 8 S-box using chaos and randomization using dispersion property to S-box cryptographic properties, especially differential probability. The randomization using dispersion property is introduced within the design loop to achieve low differential uniformity possibly. Two steps are involved in generating the proposed S-box. In the first step, a piecewise linear chaotic map (PWLCM) is utilized to generate initial S-box positions. Generally, the dispersion property is a post-processing technique that measures maximum nonlinearity in a given random sequence. However, in the second step, the concept is carefully reverse engineered, and the dispersion property is used within the design loop for systematic dispersal of input substituting sequence. The proposed controlled randomization changes the probability distribution statistics of S-box’s differentials. The proposed methodology systematically substitutes the S-box positions that cause output differences to recur for a given input difference. The proposed S-box is analyzed using well-established and well-known statistical cryptographic criteria of nonlinearity, strict avalanche criteria (SAC), bit independence criteria (BIC), differential probability, and linear probability. Further, the S-box’s boomerang connectivity table (BCT) is generated to analyze its strength against boomerang attack. Boomerang is a relatively new attacking framework for cryptosystem. The proposed S-box is compared with the state-of-the-art latest related publications. Results show that the proposed S-box achieves an upper bound of cryptographic properties, especially differential probability. This work hypothesizes that highly dispersive hamming distances at output difference, generated a systematic S-box. The mixing property of chaos generated trajectories utilized for decimal mapping. To test the randomness of generated chaotic trajectories, a cryptographically secure pseudo-random sequence was generated using a chaotic map that was tested using the National Institute of Standards and Technology (NIST) NIST-800-22 test suit.

Design of key-dependent bijective S-Boxes for color image cryptosystem

The S-Boxes with high nonlinearity and low differential uniformity are highly desirable for designing a secure image encryption scheme to ensure secure communication of digital images over the Internet. This paper presents a novel image cryptosystem using key-dependent bijective S-Boxes based on the Henon map. In this paper, the 2D Henon-map is used to generate key-dependent bijective S-Boxes (for confusion) and pseudo-random sequence (for diffusion) to design a color image cryptosystem with high confusion and diffusion capability. We perform the security analysis of the proposed encryption scheme and the experimental results shows that the proposed image encryption scheme is able to resist the statistical attack (entropy and NIST randomness test), differential attack (NPCR and UACI), correlation and chosen-plaintext attack.

The SPN Network for Digital Audio Data Based on Elliptic Curve Over a Finite Field

The mathematical operation of the Elliptic Curve over the prime finite field is wildly used for secure data communication as it provides high security while utilizing the same size as the secret key. This manuscript presents a novel approach the SPN (Substitution Permutation Network) for a new digital audio encryption scheme based on Mordell elliptic curve (MEC) over a finite prime field. The proposed scheme consists of a confusion and diffusion module. For the confusion module, the scheme initially generates 5×5 bijective S-boxes, which have never been applied in the present literature with good cryptographic properties. The generated S-box is then used parallel in the substitution module, which provides optimum confusion in the cipher data. For the diffusion property, the scheme generates pseudo-random number sequences used for block permutation and achieves the property of diffusion. The scheme has been thoroughly securitized against various attacks. The result shows the efficiency of the proposed algorithm over the existing schemes. In addition, the framework that is used to generate MEC points is based on the searching technique. Consequently, it significantly reduces the computational cost and enhances the scheme’s performance compared to the schemes presented in the literature.

New Genetic Operators for Developing S-Boxes With Low Boomerang Uniformity

The boomerang uniformity measures the resistance of block ciphers to boomerang attacks and has become an essential criterion of the substitution box (S-box). However, the S-box es created by the Feistel structure have a poor property of boomerang uniformity. The genetic algorithm is introduced to improve the properties of the S-box es created by the Feistel structure. New genetic operators are designed for the genetic algorithm to improve its searchability. The new genetic algorithm generates some 8 <inline-formula xmlns:mml="http://www.w3.org/1998/Math/MathML" xmlns:xlink="http://www.w3.org/1999/xlink"> <tex-math notation="LaTeX">$\times $ </tex-math></inline-formula> 8 bijective S-boxes with differential uniformity 6, nonlinearity 108, and boomerang uniformity 10, which has dramatically improved the properties of the S-boxes created by the Feistel structure. Furthermore, the new genetic algorithm also improves the properties of the S-box population created by the Feistel structure as a whole. We compare the S-boxes generated by the new genetic algorithm with those generated by the traditional one. The comparison results show that the S-boxes generated by the new genetic algorithm have better properties than the S-boxes generated by the traditional genetic algorithm, demonstrating the new genetic algorithm’s effectiveness and superiority in developing S-boxes.

Improved Objective Functions to Search for 8 × 8 Bijective S-Boxes With Theoretical Resistance Against Power Attacks Under Hamming Leakage Models

Many research focuses on finding S-boxes with good cryptographic properties applying a heuristic method and a balanced, objective function. The design of S-boxes with theoretical resistance against Side-Channel Attacks by power consumption is addressed with properties defined under one of these two models: the Hamming Distance leakage model and the Hamming Weight leakage model. As far as we know, a balanced search criterion that considers properties under both, at the same time, remains an open problem. We define two new optimal objective functions that can be used to obtain S-boxes with good cryptographic properties values, keeping high theoretical resistance for the two leakage models; we encourage using at least one of our objective functions. We apply a Hill Climbing heuristic method over the S-box’s space to measure which objective function is better and to compare the obtained S-boxes with the S-boxes in the actual literature. We also confirm some key relationships between the properties and which property is more suitable to be used.

Probabilistic Evaluation of the Exploration–Exploitation Balance during the Search, Using the Swap Operator, for Nonlinear Bijective S-Boxes, Resistant to Power Attacks

During the search for S-boxes resistant to Power Attacks, the S-box space has recently been divided into Hamming Weight classes, according to its theoretical resistance to these attacks using the metric variance of the confusion coefficient. This partition allows for reducing the size of the search space. The swap operator is frequently used when searching with a random selection of items to be exchanged. In this work, the theoretical probability of changing Hamming Weight class of the S-box is calculated when the swap operator is applied randomly in a permutation. The precision of these probabilities is confirmed experimentally. Its limit and a recursive formula are theoretically proved. It is shown that this operator changes classes with high probability, which favors the exploration of the Hamming Weight class of S-boxes space but dramatically reduces the exploitation within classes. These results are generalized, showing that the probability of moving within the same class is substantially reduced by applying two swaps. Based on these results, it is proposed to modify/improve the use of the swap operator, replacing its random application with the appropriate selection of the elements to be exchanged, which allows taking control of the balance between exploration and exploitation. The calculated probabilities show that the random application of the swap operator is inappropriate during the search for nonlinear S-boxes resistant to Power Attacks since the exploration may be inappropriate when the class is resistant to Differential Power Attack. It would be more convenient to search for nonlinear S-boxes within the class. This result provides new knowledge about the influence of this operator in the balance exploration–exploitation. It constitutes a valuable tool to improve the design of future algorithms for searching S-boxes with good cryptography properties. In a probabilistic way, our main theoretical result characterizes the influence of the swap operator in the exploration–exploitation balance during the search for S-boxes resistant to Power Attacks in the Hamming Weight class space. The main practical contribution consists of proposing modifications to the swap operator to control this balance better.