# Search-Space Reduction for S-Boxes Resilient to Power Attacks
## 3 Our Contributions: Reduction of the S-Boxes Search-Space into a Hamming Weight Class SEARCH-Space
### New Search Strategy for S-Boxes Resistant to Power Attacks Based on HW Classes  
This section proposes a new search strategy for S-boxes resistant to power attacks based on the HW classes. It reduces the search space avoiding unnecessary operations. We suggest moving between HW classes and avoiding analyzing all S-boxes in the same class because they have the same DPA resistance. This new partition in classes allows us to define a new approach to search S-boxes with high CCV, and that also satisfies other desirable properties such as high nonlinearity. The proposed new strategy consists of two steps:Step 1. As long as the S-box evaluated has a CCV value less than the desired one, the HW class must be changed. Step 2. When a high CCV value is reached, it is necessary to search within that class the S-boxes that meet the other cryptographic properties, such as high nonlinearity. The practical application of this strategy supports two aspects. First, changing classes is enough to swap at least two elements of the input whose outputs have different weights, and, second, the generation algorithm of S-boxes within the class (ESboxG algorithm) is easy to use and not complicated to implement. It is enough to permute two elements within one of the subsets \(C(F)_{k}\) defined in Section 3.2. Different meta-heuristics can be used to perform movement between classes and within classes. The objective function used for the search within the classes will depend on the remaining cryptographic properties of the S-box to be optimized. Comparison between the Partition of the Space of S-Boxes in Related Classes and Hamming Weight Classes  
Properties of the Partition of the space of S-boxes in Affine Classes. 1. Constant cryptographic properties within classes. * The nonlinearity is constant within each class: the classes, by way of construction, fulfill the property that all the S-boxes of a class have the same nonlinearity value. This ensures that all S-boxes in a class have the same resistance against linear attacks. * Other cryptographic properties are not constant within each class since they were not taken into account for the definition of these classes. For example, the resistance to power attacks is not constant within the class; if measured with the theoretical metric of the confusion coefficient variance (CCV), this metric can take different values for S-boxes that belong to the same class. 2. Movement between classes and within classes. * Movement within each class: Given an S-box \(F_{a}\), to obtain another S-box \(F_{b}\) of the same class, transformations related to \(F_{a}\) are performed. * Movement between different classes: Given an S-box \(F_{a}\), to obtain another S-box \(F_{b}\) belonging to a different class, it is enough that affine transformations do not relate the two S-boxes. 3. Number of classes. * The number of affine classes is approximately \((2^{n})!/|G|^{2}\), where \(|G|\) is the linear or affine group size, as estimated in [27]. Properties of the S-box Space Partition in Hamming Weight Classes (HW) Based on the Theoretical Resistance to Power Attacks According to the Metric of the Confusion Coefficient Variance (CCV). 1. Constant cryptographic properties within classes. * The variance of the confusion coefficient variance (CCV) is constant within each class: the \"theoretical\" resistance to power attacks is constant within the class. The HW classes, by the way of construction, fulfill the property that all the S-boxes of a class have the same value of the confusion coefficient variance (CCV). This ensures that all S-boxes in a class have the same \"theoretical\" resistance against power attacks, based on this metric. * None of the known theoretical metrics of resistance against Power Attacks is exact, nor is the confusion coefficient variance (CCV), therefore, the actual resistance against these attacks is \"approximately\" constant within the class. * Other cryptographic properties are not constant within each class, since they were not taken into account for the definition of these classes.