## 3 S-Box Construction
### Our Proposed Construction  
Let \(x^{d}\) denote a power function in \(\mathbb{F}_{2^{8}}\) using the irreducible polynomial \(x^{8}+x^{4}+x^{3}+x^{2}+1\), where \(d=\{1,2,\ldots,2^{8}-2\}\) and \(x\in\mathbb{F}_{2^{8}}\). All power functions (i.e., \(x^{d}\)) can be classified into linearly non-equivalent functions using the squaring method [94], as shown in Table 4. The first column of Table 4 represents the powers \(d\) that are non-equivalent to each other. The second column lists all the equivalent power functions for each power \(d\). For instance, the power function \(x^{253}\) is equivalent to \(x^{127}\), as is the case with \(x^{191}\). Four more columns in Table 4 denote the values of NL, DU, AD and LA produced by the underlying power function. The \(\mathrm{N_{EL}}\) column lists the number of non-existent elements, while the \(\mathrm{R_{EL}}\) column lists the number of repeated elements in each of the involved power functions. The last column denotes whether the power function is a permutation or otherwise, based on the number given in columns \(\mathrm{N_{EL}}\) and \(\mathrm{R_{EL}}\) (i.e., label \(\mathrm{\Upsilon^{\prime}}\) is given when \(\mathrm{N_{EL}}=\mathrm{R_{EL}}=0\), otherwise label 'N' will be given). \begin{table}
\begin{tabular}{c c c c c c c c c c c c c c} \hline \hline \(x\) & 0 & 1 & 2 & 3 & 4 & 5 & 6 & 7 & 8 & 9 & A & B & C & D & E & F \\ \(x^{3}\) & 0 & 1 & 8 & F & C & A & 1 & 1 & A & F & F & C & S & A & S & C \\ \hline \hline \end{tabular}
\end{table} 
Table 2: \(x^{3}\) over \(\mathbb{F}_{2^{4}}\). \begin{table}
\begin{tabular}{c c c c c c c c c c c c} \hline \hline \(\mathrm{R_{EL}}\)\(\mathrm{N_{EL}}\) & **2** & **3** & **4** & **5** & **6** & **7** & **9** & **B** & **D** & **E** \\ \hline
1 & 2 & 1 & 2 & 1 & 3 & 2 & 1 & 2 & 3 & 2 \\ B & 2 & 3 & 2 & 3 & 3 & 4 & 1 & 2 & 1 & 2 \\ A & 1 & 2 & 3 & 4 & 2 & 3 & 2 & 1 & 2 & 3 \\ C & 3 & 4 & 1 & 2 & 2 & 3 & 2 & 3 & 0 & 1 \\ F & 3 & 2 & 3 & 2 & 2 & 1 & 2 &
Our construction starts with the generation of binomial power functions. \(\mathtt{F}_{1}\) and \(\mathtt{F}_{2}\) which are two different power functions selected over finite field \(\mathbb{F}_{28}\) is added to produce a new function \(\mathtt{F}\) (i.e., \(\mathtt{F}=\mathtt{F}_{1}+\mathtt{F}_{2}\)). In total, there are \(\mathtt{c}_{2}^{28-2}=32,\!131\) possible combination of binomial power functions produced from this operation and none of them are permutation function. We analyzed its repeated elements (\(\mathtt{R}_{\mathrm{EL}}\)) and non-existent elements (\(\mathtt{N}_{\mathrm{EL}}\)), then summarized the findings in Table 5. \begin{table}
\begin{tabular}{c c c c c c c c c} \hline \hline \(d\) & \(\{d\times 2\ (\mathrm{mod}2^{8}-1\,)\}\) & **NL** & **DU** & **AD** & **LA** & \(\mathbf{N}_{\mathrm{EL}}\) & \(\mathbf{R}_{\mathrm{EL}}\) & **PERM** \\ \hline  
4, 8, 16, 32, 64, 128 & 0 & 256 & 1 & 128 & 0 & 0 & Y \\ \hline \hline \end{tabular}
\end{table} 
Table 4: Classification of linearly non-equivalent power function, \(x^{d}\) based on maximum NL in \(\mathbb{F}_{28}\). Figure 1: Bits Error Representation. Table 5 lists the number of binomial power functions according to (N\({}_{\rm EL}\), R\({}_{\rm EL}\)) pairs. As an example, there are a total of 1024 binomial power functions that produce 15 non-existent elements over only one repeated element. In addition, there are a total of 576 generated binomial power functions that produce the same number of N\({}_{\rm EL}\) and R\({}_{\rm EL}\), which are equal to 128. Other than that, we can categorize the generated binomial power functions into 130 groups based on (N\({}_{\rm EL}\), R\({}_{\rm EL}\)) pairs. Overall, our proposed algorithm in constructing cryptographically strong S-boxes is illustrated in Figure 2, which is inspired by the S-box construction of [PERSON] et al. [12]. Our initial S-box is selected from the groups of binomial power functions that produce only one (1) repeated element.