On the difficulty of constructing cryptographically strong substitution boxes

Xian Mo Zhang*, Yuliang Zheng

*Corresponding author for this work

Research output: Contribution to journalArticlepeer-review

1 Citation (Scopus)


Two significant recent advances in cryptanalysis, namely the differential attack put forward by Biham and Shamir [BS91] and the linear attack by Matsui [Mat94a, Mat94b], have had devastating impact on data encryption algorithms. An eminent problem that researchers are facing is to design S-boxes or substitution boxes so that an encryption algorithm that employs the S-boxes is immune to the attacks. In this paper we present evidence indicating that there are many pitfalls on the road to achieve the goal. In particular, we show that certain types of S-boxes which are seemingly very appealing do not exist. We also show that, contrary to previous perception, techniques such as chopping or repeating permutations do not yield cryptographically strong S-boxes. In addition, we reveal an important combinatorial structure associated with certain quadratic permutations, namely, the difference distribution table of each differentially 2-uniform quadratic permutation embodies a Hadamard matrix. As an application of this result, we show that chopping a differentially 2-uniform quadratic permutation results in an S-box that is very prone to the differential cryptanalytic attack.

Original languageEnglish
Pages (from-to)147-162
Number of pages16
JournalJournal of Universal Computer Science
Issue number3
Publication statusPublished - 1996


  • Cryptography
  • Differential attack
  • Linear attack
  • Permutations
  • Substitution boxes (S-boxes)


Dive into the research topics of 'On the difficulty of constructing cryptographically strong substitution boxes'. Together they form a unique fingerprint.

Cite this