An analysis of a class of algorithms for S-box construction

Abstract

We analyze a very general class of algorithms for constructing m-bit invertible S-boxes called bit-by-bit methods. The method builds an S-box one entry at a time, and has been proposed by Adams and Tavares [2] and Forre [11] to construct S-boxes that satisfy certain cryptographic properties such as nonlinearity and the strict avalanche criterion. We prove, both theoretically and empirically, that the bit-by-bit method is infeasible for m>6. © 1994 International Association for Cryptologic Research.