2022年2月9日 · I have performed the XOR and the result comes as 1001. Now my confusion is that in standard S-Box (DES) the input is 6 bit where the first and last bit together specifies row and 4-middle bits column. Even if I append two zeros on the left making the XOR result 001001, then row 01 does not exist in the problem.

2014年9月7日 · Two of the properties that lead to the design of DES S-Boxes are: For any non-zero 6-bit difference between inputs, no more than 8 of the 32 pairs of inputs exhibiting that difference may result in the same output difference. This is a criterion similar to the previous one, but for the case of three S-boxes.

2011年8月16日 · There is a good article from Coppersmith which explains it. Basically, the designers of DES had envisioned differential cryptanalysis (a good 15 years before differential cryptanalysis was rediscovered by Biham and Shamir, and published); they could measure how well DES could resist differential cryptanalysis for a given set of S-boxes.

It is of course possible to write DES or any block cipher as a system of non-linear equations involving the plaintext bits, the ciphertext bits, and the key bits, which hold with probability 1. In principle, cracking the cipher would then merely involve collecting enough linearly independent equations (e.g. from a couple different known ...

2017年4月4日 · $\begingroup$ "The S-boxes of DES, OTOH, had to be crafted in such an elaborate way that no attacks other than brute force are possible given the current state-of-the-art." This is not true; DES can be broken by linear cryptanalysis because of the s-box; AES resists this attack better because of the s-box. $\endgroup$ –

2017年7月3日 · You're actually referring to the internals of the DES cipher function which looks like:-and you can identify the s boxes. They indeed accept 6 bits and output 4, so something is lost due to the pigeon principle. But look at the expansion box above the s boxes. Additional bits are created due the permutation, P.

2018年3月19日 · Yes, in DES, S-boxes are the main contributors to diffusion and hence to the avalanche effect, because changing 1 input bit from an S-box has the potential to change up to 4 output bits. Another contributor is the expansion E, because 16 out of its 32 inputs have effect on 2 outputs (the 16 others provide no diffusion).

$\begingroup$ That schematic does not directly apply to DES: it is missing the final swap, IP, FP; and shows decryption with L and R reversed; whereas in DES, thanks to the final swap, encryption and decryption are identical except for the order of subkeys. $\endgroup$

2016年3月28日 · If the 48-bit input to the S-box is 0xAAAAAAAAAAAA, what are the first four bits emitted by S-box 1? Answer: 0110. I know that an S-Box takes n inputs and give m outputs and that n != m, but I really don't see how they got that answer. Since a S-Box takes 3 bits and maps it to 2 bits how can you predict what AAA will be?

$\begingroup$ Compact representation of DES S-boxes indeed has been studied, starting (AFAIK) with Eli Biham's A fast new DES implementation in software (1997, in proceedings of the fourth FSE conference). See also Matthew Kwan's website and paper Reducing the Gate Count of Bitslice DES (2000, IACR eprint archive).