Computer Security and Cryptography

9.18 WHEN IS A PRODUCT BLOCK-CIPHER SECURE?

In LUCIFER, DES, and Rijndael, the substitution (S-box) provides the only nonlinear element in the encipherment transformation. In the 16 years various authors have studied the general design principles of strong product block-ciphers, which have been investigated since the beginning of the 1980s. Susan Landau's paper [Landau, 2004] is a very fine summary of the concepts.

will continue to denote the set of all binary n-vectors. The Hamming distance d(x, y) between two n-vectors x = (x₀, x₁, …, x_n−1) and y = (y₀, y₁, …, y_n−1) is the number of coordinates in which they differ.

If

where, indicates complementation, then

An S-box is Boolean function; that is, a mapping

We use the notations

• _n for the set of all Boolean functions on with values in ,
• _n for the set of all linear Boolean functions f(x) = a₀x₀ + a₁x₁ + ··· + a_n−1x_n−1 where the coefficient ...