4 ms·
If you pick a random S-Box you can see that there is an expected value for its nonlinearity. On the other hand, you can also look at the maximum amount of nonli
by blattimwind 8y ago
If you pick a random S-Box you can see that there is an expected value for its nonlinearity. On the other hand, you can also look at the maximum amount of nonlinearity you can have in an S-Box of a given size (and also some other properties). Then you can maximize those. This was done with DES.
The S-Boxes used here on the other hand have a whole lot of structure, i.e. linearity, that has been put there intentionally. This is generally the opposite of what you would want to see in a S-Box. It is of course hypothetically possible that these linearity combine with other parts of the algorithm in a way to result in greater non-linearity or specific hardening against specific unknown attacks, but this does sound a bit far-fetched in my ears (I can't think of precedent for this; e.g. in DES the issue that was worked around was related to differential linearity, and it wasn't solved by adding more linearity into the algorithm).