Sboxes

S-boxes, or substitution boxes, are nonlinear components used in symmetric-key cryptography to transform input bits into output bits. They implement a fixed mapping from an n-bit input to an m-bit output, typically realized as a look-up table. S-boxes are placed in substitution layers to introduce nonlinearity and diffusion, contributing to the overall confusion of the cipher and helping to protect against linear and differential cryptanalysis.

Sizes and formats vary by algorithm. DES uses eight 6‑to‑4 S-boxes, one for each round portion of the data path. AES uses a single 8‑to‑8 S-box derived from a mathematical construction: the multiplicative inverse in GF(2^8) followed by an affine transformation. Many lightweight and modern ciphers employ 4‑to‑4 or 4‑to‑2 S-boxes, such as the 4×4 S-boxes in the PRESENT cipher, or other fixed-size S-boxes designed for efficiency on constrained hardware.

Implementation is commonly through fixed tables, though some designs use algebraic or combinational constructions. Important design goals include high nonlinearity, balanced output (each output value appears with equal probability), and good diffusion properties. Differential uniformity and resistance to linear cryptanalysis are key considerations when selecting or constructing S-boxes.

S-boxes appear in many cryptographic primitives beyond block ciphers, including stream ciphers and hash-like compression functions, where they serve as the primary source of nonlinearity. They are typically complemented by permutation layers or mix columns/rows to achieve full diffusion across multiple rounds.