## 2 Security Requirement and S-Box Design Methods
### S-Box Design Methods
#### 2.2.1 S-Boxes in Block Ciphers  
The block ciphers SQUARE [16], BKSQ [17] and Rijndael [18; 19] were developed by the same designer in the late 1990s. All S-boxes in these three block ciphers were constructed using similar transformations which take the multiplicative inverse over finite field \(\mathbb{F}_{28}\), as suggested in [20]; then, an affine transformation over \(\mathbb{F}_{2}\) is applied to the output bits. Rijndael block cipher was then promoted as the Advanced Encryption Standard (AES) by the National Institute of Standards and Technology (NIST) in 2001 [8]. Following the same construction and transformations are the S-boxes used in block cipher Camellia [21], Mercy [22], ARIA [23], SMS4 [24] and BC2 [25]. The S-box in HyRAL [26] block cipher was also constructed based on multiplicative inverse over \(\mathbb{F}_{28}\) using the irreducible polynomial of \(2^{8}+z^{4}+z^{3}+z+1\) with two transformations performed beforehand, namely affine transformation (i.e., \(y=x\oplus 64\)) and Gray code transformation (i.e., \(z=y\oplus(y<<1)\)). Therefore, HyRAL S-box is classified as a mathematical function approach.  
Another block cipher proposed in 2010 is called PP-1 [27]. The S-box construction is classified as a mathematical function approach since they use a multiplicative inverse procedure over finite field, similar to AES but with a randomly chosen primitive polynomial (i.e., \(z^{7}+z^{2}+z+1\)). In the studies of [PERSON] et al. [28] for removing linear redundancy in S-boxes, they select several random pairs of S-box elements and rearrange four corresponding S-box entries in such a way that the S-box produced is an involution S-box.  
Heuristic  
CS-Cipher [29] and CRYPTON [30] block cipher use a 3-round Feistel cipher to generate \(8\times 8\) S-box. In general, their S-box is constructed with concatenation of elements generated in \(\mathbb{F}_{2^{4}}\) and pre-determined parameters to produce \(8\times 8\) S-box. Using the same construction is the S-box used in PICARO [15] block cipher. However, the S-box generated in PICARO is a non-bijective S-box. The ZORRO [31] block cipher proposed an improvement to PICARO's S-box construction. They instantiate a 4-round Feistel network with a monomial \(x^{3}\) generated in \(\mathbb{F}_{24}\). Then, they add an 8-bit linear transformation at theend of each round and lastly, an affine transformation to remove the fixed point. Unlike PICARO, the final S-box of ZORRO is bijective but the construction classification technique is the same, i.e., a heuristic approach.  
S-box used in Skipjack [32] and FOX [33] block ciphers are also classified as a heuristic approach. Although the real S-box construction in Skipjack is unknown, the research of [PERSON] and [PERSON] [34] on the reverse-engineering of S-boxes, concludes that the Skipjack's S-box construction is not the result of random generation. The method of S-box construction used in the FOX block cipher consists of a three-round Lai-Massey scheme to avoid a purely algebraic construction. The three rounds of the Lai-Massey scheme take three different small S-boxes as the round function \(F\).