## 3 S-Box Construction
### Our Proposed Construction
This includes (N\({}_{\rm EL}\), R\({}_{\rm EL}\)) pairs of (15, 1), (17, 1), (51, 1) and (85, 1) from Table 5.  
In total, there are 1540 candidates that can be used for our initial S-box. However, this number of candidates can be minimized to 200 using the squaring method [94] because of its linearly non-equivalent properties, as shown in Table 6. The complete list of linearly non-equivalent binomial power functions that produces one repeated element from these four groups is included in Appendix A. In this study, we select and limit the selection of the initial S-box to only one repeated element to preserve the cryptographic properties of the newly generated function such that it is not compromised significantly. \begin{table}
\begin{tabular}{r r r r r r r r r r r r r r r r r r} \hline  & \multicolumn{1}{c}{\(\mathbf{N_{\rm EL}}\)} & \multicolumn{1}{c}{\(\mathbf{R_{\rm EL}}\)} & \multicolumn{1}{c}{**Total**  
The construction continues with the addition of an S-box candidate with another power function (i.e., \(F=F+F_{3}\)), where the selection of a new power function must not include the previously selected power function. After a new function \(F\) is generated, we extract the information of \(D_{\text{EL}}\), \(R_{\text{EL}}\) and \(N_{\text{EL}}\) on the function, as described in Section 3.1. If \(N_{\text{EL}}\) contains no element, that means the function is already bijective. Then, we measure its cryptographic properties and store it as the proposed S-box if it exhibits the desired strong properties. Otherwise, if \(N_{\text{EL}}\) contains any element, we construct a redundancy analysis table by determining all the elements in \(N_{\text{EL}}\) and \(R_{\text{EL}}\) groups of \(F\). Then, the bit errors rate between all elements in \(N_{\text{EL}}\) and all elements in \(R_{\text{EL}}\) are produced to complete the redundancy analysis table. The bit error rate is the number of bit errors per unit time. In this study, the bit errors range from a minimum of one (1) bit, up to the maximum of eight (8) bits since we construct an \(8\times 8\) S-box. From the redundancy analysis table, we identify one current'smallest' bit error. If there are several choices obtained from the table, the selection will be made randomly. Then, we determine the actual element of \(N_{\text{EL}}\) and \(R_{\text{EL}}\) that correspond with the selected smallest bit error. Next, the exact location of the selected \(R_{\text{EL}}\) is identified in function \(F\) and lastly we swap the element with the previously selected \(N_{\text{EL}}\) (i.e., \(F(R_{\text{EL}})=N_{\text{EL}}\)). Similarly, the selection will be made randomly if more than one option of the identified \(R_{\text{EL}}\) is located. By selecting the smallest bit errors, we expect that the cryptographic properties of the newly generated function will not be compromised significantly. After the swapping process, we measure the cryptographic properties of this newly generated function. We store it as the proposed S-box if it exhibits the desired strong properties. Otherwise, the function will be denoted as \(F_{p}\) and rotated by \(n\) places. This rotation step that we proposed is operated based on circular rotation either column-wise (i.e., rotation of component function) or row-wise (i.e., rotation of elements in the function). The purpose of this step is to increase the algebraic expression (i.e., no. of terms (#term)) of the function \(F_{p}\) while preserving its cryptographic properties. Current construction, which \begin{table}
\begin{tabular}{c c c c} \hline \hline  & \(N_{\text{EL}}\) & \(R_{\text{EL}}\) & Distinct Total & Linearly Non-Equivalent Total \\ \hline
1 & 15 & 1 & 1024 & 136 \\
2 & 17 & 1 & 128 & 16 \\
3 & 51 & 1 & 256 & 32 \\
4 & 85 & 1 & 128 & 16 \\  & **Overall Total** & **1540** & **200** \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Linearly Non-Equivalent Functions for \(R_{\text{EL}}=1\). Figure 2: S-box Optimization Algorithm.