DataTerminology.comNEW
Also known as: Substitution Box
A substitution box providing nonlinearity in block ciphers by mapping input bits to output bits.
DESCRIPTION
An S-box implements a nonlinear substitution that transforms input bits into output bits, typically via lookup tables or algebraic functions. It is central to resisting linear and differential cryptanalysis by disrupting linear correlations. AES uses a byte-oriented S-box built from inversion in GF(2^8) and an affine transformation; DES uses multiple smaller S-boxes. S-box properties include nonlinearity, low differential uniformity, and high algebraic complexity. Implementation must consider side-channel resistance and constant-time access.
ALTERNATIVE DEFINITIONS
Wikipedia
In cryptography, an S-box (substitution-box) is a basic component of symmetric key algorithms which performs substitution.
Defines S-box as a basic substitution component.
NIST
The SubBytes transformation is a non-linear byte substitution that operates independently on each byte of the State using a substitution table (S-box).
Describes the AES S-box’s role and operation precisely.
RELATED TERMS
S-Box Design Substitution Symmetric Block Cipher Algorithms The Feistel Function Rijndael Data Encryption Standard Differential Cryptanalysis Linear Cryptanalysis Nonlinearity
COMPETING TERMS
KNOWLEDGE AREAS
Data Security Mathematics Software Engineering
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Software Developer
EXTERNAL SOURCES
- Wikipedia - S-box
- NIST - AES S-box definition and equations.
- IETF - Terminology for substitution components.
- University of Luxembourg - Lecture on S-box properties and design.
TOP QUESTIONS
Why are S-Boxes critical in block ciphers?
They introduce nonlinearity that breaks linear relationships, thwarting linear and differential attacks when combined with diffusion.
Category: Relevancy
What properties make a strong S-Box?
High nonlinearity, low differential uniformity, balanced outputs, no fixed points, and high algebraic degree are hallmarks.
Category: Requirements
How is the AES S-Box constructed?
By multiplicative inversion in GF(2^8) (with 0 mapped to 0) followed by an affine transformation over GF(2).
Category: Example
What are typical S-Box implementation pitfalls?
Lookup tables may leak through caches; constant-time implementations or bitslicing mitigate side-channel risks.
Category: Mistakes
How do S-Boxes resist differential cryptanalysis?
Low differential uniformity ensures input differences rarely map to predictable output differences.
Category: Concept
Are S-Boxes always lookup tables?
No. They can be computed algebraically or via composite fields to reduce memory and side-channel leakage.
Category: Misunderstanding
How many S-Boxes does DES use?
DES uses eight 6→4-bit S-boxes per round to create nonlinearity.
Category: Example
What is a competing component to an S-Box?
P-Boxes (permutation boxes) provide diffusion rather than nonlinearity, complementing S-boxes in cipher design.
Category: Alternatives
How to evaluate an S-Box design?
Analyze nonlinearity, linear approximation and difference distribution tables, and conduct cryptanalytic tests.
Category: Testing