# Search-Space Reduction for S-Boxes Resilient to Power Attacks
## Appendix C  
* Construction, by columns, of the 36 equivalent S-boxes from the HW class \(<F_{Print}>\) of the PRINT cipher's S-box \(F_{Print}\). All of them have \(CCV=0.275510\). Let the S-box be \(F_{Print}\) of the PRINT cipher's (Example 3).  
\begin{tabular}{c c c c c c c c c} \hline \hline
**Column** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** \\ \hline Input x to the & 0 & 1 & 2 & 3 & 4 & 5 & 6 & 7 \\ S-box \(F-Print\) & & & & & & & & & \\ \hline Output & 0 & 1 & 3 & 6 & 7 & 4 & 5 & 2 \\ \(F_{Print}(x)\) & & & & & & & & & \\ \hline Hamming weight & 0 & 1 & 2 & 2 & 3 & 1 & 2 & 1 \\ of the output & & & & & & & & & \\ \hline \hline \end{tabular}  
The \(<F_{Print}>\) class can be represented directly by the output weight vector: \(<F_{Print}>=(HW(F_{Print}(0)),\ldots,HW(F_{Print}(7))=(0,1,2,2,3,1,2,1)\), of the last row; however, for the construction of the class, it is more convenient to use the representation through the sets \(\{C(F_{Print})_{k}:k=0,1,2,3\}=\{Inputs\ x\ whose\ outputF_{Print}(x)\ has;\ weightHW(F_{Print}(x))=k\}\).  
Class construction:  
* Column 1: \(C(F_{Print})_{0}=\{0\}\) Input 0 with output 0 of weight 0. Taking into account that, for the weight \(k=0\), the set \(C(F_{Print})_{0}=\{0\}\) has cardinal one, its elements cannot be permuted with each other, therefore all the S-boxes \(F_{b}\) of the \(<F_{Print}>\) class satisfy that \(F_{b}(0)=0\) (Proposition 4).
* Column 5: \(C(F_{Print})_{3}=\{4\}\). Input 4, with output 7 of weight 3. Analogously for the weight \(k=3\), the set \(C(F_{Print})_{3}=\{4\}\) has cardinal one and its elements cannot be permuted with each other; therefore, all S-boxes \(F_{b}\) of the \(<F_{Print}>\) class satisfy that \(F_{b}(4)=7\) (Proposition 4).
* Columns 2, 6, and 8: \(C(F_{Print})_{1}=\{1,5,7\}\). \(1,5,7\) inputs with \(1,4,2\) outputs of weight 1. The three outputs \(1,4,2\) can be interchanged \(\{(1,2,4),(1,4,2),(2,1,4),\)\((2,4,1),\)\((2,4,1),\)\((4,1,2),\)\((4,2,1)\}\) in Columns 2, 6,8, without altering the weight of the outputs, and therefore the hypothetical leakage of the S-box is not altered according to the Hamming weight leakage model.
* Columns 3, 4, and 7: \(C(F_{Print})_{2}=\{2,3,6\}\). Inputs \(2,3,6\) with outputs \(3,6,5\) of weight 2. The three outputs \(3,6,5\) can be interchanged \(\{(3,5,6),(3,6,5),(5,3,6),(5,6,3),\)\((6,3,5),(6,5,3)\}\) in Columns 3, 4,7 without altering the weight of the outputs and therefore the hypothetical leakage of the S-box according to the Hamming weight leak model is not altered.  
Cartesian product of the two sets of permutations: By making the Cartesian product of the two sets of six permutations each \(\{(1,4,2),(1,2,4),(4,1,2),(4,2,1),(2,1,4),\)\((2,4,1)\}\) in Columns 2, 6, 8 and \(\{(3,6,5),(3,5,6),(5,3,6),(5,6,3),(6,3,5),(6,5,3)\}\) in Columns 3, 4, 7, keeping Columns 1 and 5 fixed, the 36 S-boxes of the \(<F_{Print}>\) class are obtained. Due to their construction, the 36 S-boxes have the same hypothetical leakage according to the. \"Hamming weight\" leakage model.  
The 36 S-boxes of this class are shown below (some rows are left blank to visualize the Cartesian product better).