Cryptography Reference
In-Depth Information
The entries with the largest biases (in magnitude) are bold. Ignore the upper-left entry, which represents 0 = 0.
LargetablesaregoodforseeingthecharacteristicsofanS-box,althoughorderedlistingsofindividualentries
spelled out (as above) are still useful for building larger linear expressions. For example, a graphical represent-
ation of AES's S-box is shown in
Figure 6-2
, where there would be too much information for a large table, and
a listing of top entries would be more useful.
Figure 6-2
Linear correlation between the input and output of AES's S-box (with darker values meaning high-
er correlation, since the table would be too large to show individual numbers). This shows a great deal of diffu-
sion between the input and input, since the color is spread all over.
In S-box analysis tables, we are looking for entries with large biases, either negative or positive. If all of the
entries are small, then the S-box does not have a very linear structure, and it may make linear cryptanalysis on
the cipher difficult.
Notice that when we are analyzing these potential linear expressions, we don't have to worry about key bits,
or collecting plaintext-ciphertext pairs, as we will for the full technique. This analysis is nonrandom and fairly
straightforward. Granted, we do have to try every possible input possible for the S-boxes, but usually this is a
fairly small number (in the grand scheme of things).
Search WWH ::
Custom Search