![](bg5.png)
Maximum 16-stages linear feedback shift
register defined over GF(2
n
) generates the sequence
of period length T = 2
16n
– 1 (n = 16 or 32 or 64).
This period length is considerably decreased by the
nonlinear circuit (NL in Fig. 2.5). The processing of
every consecutive block M
i
of the formatted message
modifies initial content of the register and
consequently changes the period (meant as a
sequence of states) of the FSR. The same effect can
be observed when adding H
i
to the result of
processing the input by two rounds to obtain H
i+1
(Fig. 2.2). This implies that collisions exist but
finding them is difficult.
In order to achieve randomized hashing we use
the construction (see Fig. 2.2) in which the random
salt value s is added (mod 2) to each block M
i
(Biham, 2006).
The function defined by the nonlinear circuit is a
nonlinear 8n-argument function, n = 16 or 32 or 64.
For the function with such a number of arguments
(128, 256 and 512, respectively) it is difficult, from
the computational point of view, to perform the best
affine approximation attack (Rueppel, 1986). Time
needed for the attack is equal to time of the birthday
attack, i.e. O(2
8n
).
The sequence produced by the nonlinear circuit
is immune to correlation attack (Rueppel, 1986).
3 S-BOXES
3.1 Involutional S
Let
2
F
be the Galois field GF(2) and
n
2
F
be the n-
dimensional vector space over
2
F
. A substitution
operation or an n×n S-box (or S-box of the size n×n)
is a mapping:
nn
S
22
FF: →
(1)
where n is a fixed positive integer, n ≥ 2. An n-
argument Boolean function is a mapping:
22
FF: →
n
f
(2)
An S-box S can be decomposed into the
sequence S = (f
1
, f
2
, …, f
n
) of Boolean functions such
that S(x
1
, x
2
, …, x
n
) = (f
1
(x
1
, x
2
, …, x
n
), f
2
(x
1
, x
2
, …,
x
n
), …, f
n
(x
1
, x
2
, …, x
n
)). We say that the functions
f
1
, f
2
, …, f
n
are component functions of S.
In case of HaF’s S-box n = 16. HaF’s S-box
therefore is a function that takes 16 input bits and
outputs also 16 bits – it is a 16×16 S-box.
Additionally, it is generated in such a way that it is
its own inverse, i.e., S
−1
= S.
HaF’s S-box has been generated using the
multiplicative inverse procedure similar to AES
[Daemen 1999] with randomly chosen primitive
polynomial defining the Galois field. Nonlinearity of
this S-box is 32510 and its nonlinear degree is 15.
Sixteen Boolean functions that constitute this S-box
have nonlinearities equal to 32510 or 32512. The
degree of each function is equal to 15.
The 16×16 S-box can be stored as a table of
65536 word values. Index for this table is an input of
the S-box function, i.e., x
1
, x
2
, …, x
16
. Values stored
are S-box outputs (16 bits: f
1
(x
1
, x
2
, …, x
16
), f
2
(x
1
, x
2
,
…, x
16
), …, f
16
(x
1
, x
2
, …, x
16
)). To simplify the
description of S-box generation let’s consider a
smaller S-box of size 8×8. For presentation
convenience such S-box can be displayed as a 2-
dimensional table (Table 3.1). The input represented
as a two digit hexadecimal number HL is divided −
the low order digit (L) is on the horizontal axis and
the high order digit (H) is on the vertical axis. For
example, to see what is the S-box output at input 6F
take 6 on the vertical axis and F on the horizontal
axis. The S-box output is DA.
Table 3.1: Sample 8×8 S-box S.
L 0 1 2 3 4 5 6 7 8 9 A B C D E F
H ------------------------------------------------
0 | 9E BC C3 82 A2 7E 41 5A 51 36 3F AC E3 68 2D 2A
1 | EB 9B 1B 35 DC 1E 56 A5 B2 74 34 12 D5 64 15 DD
2 | B6 4B 8E FB CE E9 D9 A1 6E DB 0F 2C 2B 0E 91 F1
3 | 59 D7 3A F4 1A 13 09 50 A9 63 32 F5 C9 CC AD 0A
4 | 5B 06 E6 F7 47 BF BE 44 67 7B B7 21 AF 53 93 FF
5 | 37 08 AE 4D C4 D1 16 A4 D6 30 07 40 8B 9D BB 8C
6 | EF 81 A8 39 1D D4 7A 48 0D E2 CA B0 C7 DE 28 DA
7 | 97 D2 F2 84 19 B3 B9 87 A7 E4 66 49 95 99 05 A3
8 | EE 61 03 C2 73 F3 B8 77 E0 F8 9C 5C 5F BA 22 FA
9 | F0 2E FE 4E 98 7C D3 70 94 7D EA 11 8A 5D 00 EC
A | D8 27 04 7F 57 17 E5 78 62 38 AB AA 0B 3E 52 4C
B | 6B CB 18 75 C0 FD 20 4A 86 76 8D 5E 01 ED 46 45
C | B4 FC 83 02 54 D0 DF 6C CD 3C 6A B1 3D C8 24 E8
D | C5 55 71 96 65 1C 58 31 A0 26 6F 29 14 1F 6D C6
E | 88 F9 69 0C 79 A6 42 F6 CF 25 9A 10 9F BD 80 60
F | 90 2F 72 85 33 3B E7 43 89 E1 8F 23 C1 B5 92 4F
Cryptographically strong S-box should possess
some properties that are universally agreed upon
among researchers. Such S-box should be balanced,
highly nonlinear, have lowest maximum value in its
XOR profile (difference distribution table), have
complex algebraic description (especially it should
be of high degree). The above criteria are dictated by
linear and differential cryptanalysis and algebraic
attacks.
It is a well-known fact, that S-boxes generated
using finite field inversion mapping fulfill these
criteria to a very high extent. However, they are
susceptible to (theoretical) algebraic attacks. To
resist algebraic attacks multiplicative inverse
mapping used to construct an S-box is composed
PECCS 2012 - International Conference on Pervasive and Embedded Computing and Communication Systems
192