Score:1

How do AES Substitution box's offer any additional security since it's 1 to 1?

ga flag

If the Substitution box is 1 to 1 (a specific value can only ever be a specific box value), and the contents of Rijndael S-box is public, how does this offer any additional security?

With AES the frequency of a letter isn't a concern so what other reason is there for this substitution? An explanation fitting for a novice would be very much appreciated!

Additionally, why is Rijndael S-box a multiplicative inverse and what purpose does that serve?

fgrieu avatar
ng flag
\[Not a substitute for a full answer\]: Sure, a one-one substitution alone brings no security. However, adding XOR with key(s), it can offer security. For example, one of the simplest secure block cipher (known as Even-Mansour) is built from any large, apparently arbitrary, public, invertible one-one substitution $G$, as $E_{(k_1,k_2)}(b)=G(b\oplus k_1)\oplus k_2$ and $D_{(k_1,k_2)}(b)=G^{-1}(b\oplus k_2)\oplus k_1$. AES extends that in several ways: multiple rounds instead of one, round keys derived from the main key, $G$ built from 16 uses of the S-box and linear algebra.
Score:5
sa flag

Philosophically any invertible cipher (it would be useless if not invertible) is just a one to one map, so no cipher would be secure under your argument.

Specifically, the Sbox has been carefully designed. For example, considering the linear and differential cryptanalysis attacks, having a nonlinear s-box mapping provides security agains linear cryptanalysis while having a low differential uniformity provides security against linear cryptanalysis. The AES Sbox has been optimized with respect to those attacks so it has high nonlinearity and low differential uniformity.

If the Sbox was linear then having 2 input output pairs we could determine what it would give for the sum of those pairs as well which leads to divide and conquer attacks.

$$ S(x_1)=y_1,S(x_2)=y_2 \Rightarrow S(x_1\oplus x_2)=y_1\oplus y_2 $$ where all quantities are 8 bit binary vectors. For AES, the Sbox has been designed to be as far away from linear as possible and it is the only nonlinear part of the AES encryption mapping. So AES would be trivially breakable with only $128$ known plaintext/ciphertext pairs if the Sbox was not nonlinear. See

How can AES-like block cipher without non-linear component be broken?

The link below is about minimizing nonlinearity for a boolean function, so just one output bit of the Sbox. By considering all linear combinations of the outputs of the Sbox we obtain low nonlinearity for the Sbox which has 8 bit outputs, i.e., it is a vectorial boolean function.

how to calculate the non linearity of each element of s box?

For resistance against differential cryptanalysis see this answer:

Searching for a differential characteristic (differential cryptanalysis)

The goal here is to stop attacks using input pairs $(x,x\oplus d)$ which may give output pairs $(S(x),S(x\oplus d):=(y,y\oplus d')$ where the quantity $d'$ occurs much more than the possible minimum, over all pairs.

The tutorial by Heys is a great introduction to these topics.

I sit in a Tesla and translated this thread with Ai:

mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.