3 ms·
> Good S-boxes are not trivial to come up with; bad ones are vulnerable to attacks like differential cryptanalysis or linear cryptanalysis (where the S-box is m
by clarry 7y ago
> Good S-boxes are not trivial to come up with; bad ones are vulnerable to attacks like differential cryptanalysis or linear cryptanalysis (where the S-box is modeled approximately as a linear function of its inputs).
Last time I looked into this, the consensus seemed to be that even random S-boxes are likely to be good, or at least "good enough." And that it's actually not that hard to filter out boxes that are likely to be bad.
I don't have references handy but google gets me this, for instance: https://kste.dk/assets/slides/secretsbox.pdf https://kste.dk/assets/slides/secretsbox.pdf
- nneonneo 7y agoThe NSA quite famously rewrote the S-Boxes of DES to make them resistant to differential cryptanalysis. Later studies indicated that minor changes to the DES S-Boxes could significantly weaken them (see https://web.archive.org/web/20120520040808if_/http://www.sans.org:80/reading_room/whitepapers/vpns/s-box-modifications-effect-des-like-encryption-systems_768 https://web.archive.org/web/20120520040808if_/http://www.san... for an overview). Larger S-Boxes might be better; Blowfish for example uses larger key-dependent S-Boxes and yet seems to be reasonably secure. However, they’re also used in conjunction with per-round subkeys; I don’t know how Sarah2 would fare without these per-round keys.