3 ms·
The NSA quite famously rewrote the S-Boxes of DES to make them resistant to differential cryptanalysis. Later studies indicated that minor changes to the DES S-
by nneonneo 7y ago
The NSA quite famously rewrote the S-Boxes of DES to make them resistant to differential cryptanalysis. Later studies indicated that minor changes to the DES S-Boxes could significantly weaken them (see https://web.archive.org/web/20120520040808if_/http://www.sans.org:80/reading_room/whitepapers/vpns/s-box-modifications-effect-des-like-encryption-systems_768 https://web.archive.org/web/20120520040808if_/http://www.san... for an overview).
Larger S-Boxes might be better; Blowfish for example uses larger key-dependent S-Boxes and yet seems to be reasonably secure. However, they’re also used in conjunction with per-round subkeys; I don’t know how Sarah2 would fare without these per-round keys.