# The Effect of the Primitive Irreducible Polynomial on the Quality of Cryptographic Properties of Block Ciphers

Authors: Sajjad Shaukat Jamal; Dawood Shah; Abdulaziz Deajim; Tariq Shah
Journal: Security and Communication Networks
 (2020)

---

## Abstract

Substitution boxes are the only nonlinear component of the symmetric key cryptography and play a key role in the cryptosystem. In block ciphers, the S-boxes create confusion and add valuable strength. The majority of the substitution boxes algorithms focus on bijective Boolean functions and primitive irreducible polynomial that generates the Galois field. For binary field F2, there are exactly 16 primitive irreducible polynomials of degree 8 and it prompts us to construct 16 Galois field extensions of order 256. Conventionally, construction of affine power affine S-box is based on Galois field of order 256, depending on a single degree8 primitive irreducible polynomial over ℤ2. In this manuscript, we study affine power affine S-boxes for all the 16 distinct degree 8 primitive irreducible polynomials over ℤ2 to propose 16 different 8×8 substitution boxes. To perform this idea, we introduce 16 affine power affine transformations and, for fixed parameters, we obtained 16 distinct S-boxes. Here, we thoroughly study S-boxes with all possible primitive irreducible polynomials and their algebraic properties. All of these boxes are evaluated with the help of nonlinearity test, strict avalanche criterion, bit independent criterion, and linear and differential approximation probability analyses to measure the algebraic and statistical strength of the proposed substitution boxes. Majority logic criterion results indicate that the proposed substitution boxes are well suited for the techniques of secure communication.


---

## Body

## 1. Introduction

The exchange of digital data through the Internet has revolutionized the communication parameters over the years. But this rapid communication also provides opportunities to access this digital data illegally. For this reason, the security of this content on the Internet has become a serious challenge for the researchers of different fields. To counter the emerging challenges of security, cryptography and steganography are used to hide the secret information whereas watermarking is used for copyright protection. In this manuscript, we discuss cryptography and relevant aspects of this field. For convenience, cryptography is divided into two types named symmetric key cryptography and asymmetric key cryptography. In symmetric key cryptography, two parties share secret information and keys during encryption and decryption procedures. The private key is shared by both sender and receiver. In addition to this, block ciphers and stream ciphers are two main branches of symmetric key cryptography. In 1949, Shannon gave the idea of block cipher and some examples of block ciphers are Advanced Encryption Standard (AES) [1], Data Encryption Standard (DES), International Data Encryption Algorithm (IDEA), and many more [2, 3]. In AES, there is availability of three different key sizes such as 128, 192, and 256 bits, whereas in DES, the only available key size is 56 bits. The AES has 10, 12, and 14 rounds for key sizes of 128, 192, and 256 bits, respectively. All these rounds have four basic steps, that is, subbyte, shift row, mix column, and add round key. Subbyte is the step which substitutes the plaintext data with substitution box (S-box). This S-box is the only nonlinear part of block cipher used in different well-known cryptosystems. It is used to create confusion to make plaintext data obscure for any attacker and hence S-box is an integral part of any cryptosystem. S-box is a function which has input and output from the Galois field. The Galois field is a finite field having order 256 and denoted by GF28.


### 1.1. Related Work

S-box is used to create confusion as observed in AES, International Data Encryption Algorithm (IDEA), DES, and many more cryptosystems [4]. It is an established fact that the strength of block cipher depends on the standard and quality of S-box. Due to the necessary immersion of S-box to generate nonlinearity, intricacy persuades different researchers to design strong S-boxes to enhance the security level of cryptosystems. Among different available methods, the algebraic structure-based construction of S-boxes has much more attention. These S-boxes have strong cryptographic features and are robust against linear and differential cryptanalysis.In the literature, different structural advancements are viewed to improve the quality of S-boxes. The algebraic complexity of AES S-box has been improved with the extension of this S-box, that is, affine power affine (APA) [5]. Furthermore, the symmetric group S8 has also been applied to AES S-box to improve the quality and numbers of S-boxes [6]. Similarly, the application of transformation using binary gray codes on AES S-box gives Gray S-box [7]. In [8], S-boxes are constructed by using the projective general linear group (PGL). Moreover, the construction scheme of chaotic S-boxes using DNA sequence and chaotic Chen system is given in [9, 10]. Different analytical, algebraic, and chaos-based techniques for the construction of S-boxes are given in [11–16]. Conventionally, AES uses a polynomial of 8 terms which have all the required properties and improves the security for AES. But the Gray S-box has a 255-term polynomial. Moreover, residue prime, Xyi, and Skipjack S-boxes are frequently used for the encryption and decryption schemes [17, 18].It is assumed that the model of Boolean functions and primitive irreducible polynomial has an impact on the strength of S-box. In [19], different primitive irreducible polynomials have been used to identify the effect of primitive irreducible polynomial. To investigate this fact, we want to study all the primitive irreducible polynomials to understand whether there is an impact of irreducible polynomial or not. Archetypally in the synthesis of an S-box, the numbers a,b,c, and d in affine transformation belong to Galois field GF28. As the polynomial ring ℤ2x has 16 primitive irreducible polynomials of degree 8, it shows that only 16 opportunities are available for constructing Galois fields GF28. In this paper, we have constructed 16 different robust 8×8 S-boxes over the elements of these 16 irreducible polynomials. Firstly, we define 16 affine power affine transformations on these different Galois fields which can be given as z⟶az+bocz+d−1; here, for a,b,c,d values, we would be able to get 16 distinct S-boxes.


### 1.2. Motivation

Due to the role of S-boxes in cryptosystems, it is essential to explore all of its aspects. The motivation behind this work is to study all primitive irreducible polynomials and their role in the construction of S-boxes.(1)
The Mobius transformation used in a different construction of S-boxes has certain limitations and restrictions in its structure [7]. For example, the condition on the parameters, i.e., ad−bc≠0∀a,b,c,d∈GF28 squeezes the remaining cases. Hence, there is a need for any other transformation.(2)
There are 16 primitive irreducible polynomials in the principal ideal domainℤ2x whose impact was not studied yet regarding their impression on analyses of S-boxes.(3)
By exploring all primitive irreducible polynomials, we have a better opportunity to obtain the cryptographically strong cryptosystems.


### 1.3. Our Contribution

In this manuscript, we studied all binary degree 8 primitive irreducible polynomials for the construction of S-boxes. The quality of the proposed work can be seen from the different security analyses and resistance against malicious attacks. This whole study can be summarized as follows:(1)
We constructed S-boxes associated with the 16 binary degree 8 primitive irreducible polynomials.(2)
The APA transformation is used in this work, which is bijective and has no restrictions on the parameters.(3)
To evaluate the strength of the proposed S-boxes, we have performed different analyses along with differential cryptanalysis. The outcomes of these analyses are compared with the well-known S-boxes.The remaining part of the paper is planned as follows: Section2 presents the preliminaries and construction scheme of the proposed S-boxes. In Section 3, algebraic and statistical analyses are calculated in detail. Section 4 presents definitions of the balanced Boolean function. Section 5 concludes the paper.


## 1.1. Related Work

S-box is used to create confusion as observed in AES, International Data Encryption Algorithm (IDEA), DES, and many more cryptosystems [4]. It is an established fact that the strength of block cipher depends on the standard and quality of S-box. Due to the necessary immersion of S-box to generate nonlinearity, intricacy persuades different researchers to design strong S-boxes to enhance the security level of cryptosystems. Among different available methods, the algebraic structure-based construction of S-boxes has much more attention. These S-boxes have strong cryptographic features and are robust against linear and differential cryptanalysis.In the literature, different structural advancements are viewed to improve the quality of S-boxes. The algebraic complexity of AES S-box has been improved with the extension of this S-box, that is, affine power affine (APA) [5]. Furthermore, the symmetric group S8 has also been applied to AES S-box to improve the quality and numbers of S-boxes [6]. Similarly, the application of transformation using binary gray codes on AES S-box gives Gray S-box [7]. In [8], S-boxes are constructed by using the projective general linear group (PGL). Moreover, the construction scheme of chaotic S-boxes using DNA sequence and chaotic Chen system is given in [9, 10]. Different analytical, algebraic, and chaos-based techniques for the construction of S-boxes are given in [11–16]. Conventionally, AES uses a polynomial of 8 terms which have all the required properties and improves the security for AES. But the Gray S-box has a 255-term polynomial. Moreover, residue prime, Xyi, and Skipjack S-boxes are frequently used for the encryption and decryption schemes [17, 18].It is assumed that the model of Boolean functions and primitive irreducible polynomial has an impact on the strength of S-box. In [19], different primitive irreducible polynomials have been used to identify the effect of primitive irreducible polynomial. To investigate this fact, we want to study all the primitive irreducible polynomials to understand whether there is an impact of irreducible polynomial or not. Archetypally in the synthesis of an S-box, the numbers a,b,c, and d in affine transformation belong to Galois field GF28. As the polynomial ring ℤ2x has 16 primitive irreducible polynomials of degree 8, it shows that only 16 opportunities are available for constructing Galois fields GF28. In this paper, we have constructed 16 different robust 8×8 S-boxes over the elements of these 16 irreducible polynomials. Firstly, we define 16 affine power affine transformations on these different Galois fields which can be given as z⟶az+bocz+d−1; here, for a,b,c,d values, we would be able to get 16 distinct S-boxes.


## 1.2. Motivation

Due to the role of S-boxes in cryptosystems, it is essential to explore all of its aspects. The motivation behind this work is to study all primitive irreducible polynomials and their role in the construction of S-boxes.(1)
The Mobius transformation used in a different construction of S-boxes has certain limitations and restrictions in its structure [7]. For example, the condition on the parameters, i.e., ad−bc≠0∀a,b,c,d∈GF28 squeezes the remaining cases. Hence, there is a need for any other transformation.(2)
There are 16 primitive irreducible polynomials in the principal ideal domainℤ2x whose impact was not studied yet regarding their impression on analyses of S-boxes.(3)
By exploring all primitive irreducible polynomials, we have a better opportunity to obtain the cryptographically strong cryptosystems.


## 1.3. Our Contribution

In this manuscript, we studied all binary degree 8 primitive irreducible polynomials for the construction of S-boxes. The quality of the proposed work can be seen from the different security analyses and resistance against malicious attacks. This whole study can be summarized as follows:(1)
We constructed S-boxes associated with the 16 binary degree 8 primitive irreducible polynomials.(2)
The APA transformation is used in this work, which is bijective and has no restrictions on the parameters.(3)
To evaluate the strength of the proposed S-boxes, we have performed different analyses along with differential cryptanalysis. The outcomes of these analyses are compared with the well-known S-boxes.The remaining part of the paper is planned as follows: Section2 presents the preliminaries and construction scheme of the proposed S-boxes. In Section 3, algebraic and statistical analyses are calculated in detail. Section 4 presents definitions of the balanced Boolean function. Section 5 concludes the paper.


## 2. Primitive Irreducible Polynomials of Degree 8 and GF (28)

### 2.1. The Galois FieldsGF28

We summarize here some well-known facts from the theory of rings and fields. LetR be a commutative ring with identity. A nonempty subset J of R is called an ideal of R if J is an additive subgroup of R and aJ⊆J for every a∈R, where aJ=ajj∈J. If, furthermore, there does not exist a proper ideal of R properly containing J, then we say that J is a maximal ideal of R Besides; R is said to be a field if each of its nonzero elements has a must inverse in R. If R is a field of prime characteristic p, then R is an extension of the prime field ℤp. A polynomial fx∈ℤpx is said to be irreducible if it cannot be factored in ℤpx into two polynomials of strictly smaller degrees. The principal ideal,(1)fx=hxfx:hx∈ℤpx,generated by a monic irreducible polynomial fx∈ℤpx is a maximal ideal in ℤpx. If fx is of degree m, then the quotient ring,(2)ℤpxfx=gx+fx:gx∈ℤpx,is an extension field of ℤp of degree m consisting of pm elements. This field is called a Galois field and is denoted by GFpm and is said to be the field extension of ℤp defined by the irreducible polynomial fx. A representative gx of each element of GFpm can be chosen to be of degree strictly less than m. If α is a root of fx in an algebraic closure of ℤp, then GFpm is isomorphic to the field:(3)ℤpα=a0+a1α+⋯+am−1αm−1:ai∈ℤp,∀i,and so we can identify the two fields. Furthermore, if α is a generator of the cyclic finite multiplicative group of nonzero elements of ℤpα, then we say that fx is primitive.The Galois fieldGF28 is particularly of specific interest in cryptographic applications, especially in S-boxes constructions. For our cryptographic purposes, we are interested in such a field whose defining irreducible polynomial is “primitive” (of degree 8, of course). It is well known that there are φ28−1/8=16 such polynomials over ℤ2, for example, p1x,…,p16x∈ℤ2x, which we list in Table 1. In the following section, we construct 16 S-boxes out of the Galois fields corresponding to the aforementioned sixteen primitive irreducible polynomials.Table 1
Primitive irreducible polynomials and their corresponding Galois fields.
Primitive polynomialspix& roots αiGalois fieldGF28p1x=x8+x4+x3+x2+1;α1ℤ2x/p1xp2x=x8+x5+x3+x+1;α2ℤ2x/p2xp3x=x8+x5+x3+x2+1;α3ℤ2x/p3xp4x=x8+x6+x3+x2+1;α4ℤ2x/p4xp5x=x8+x6+x4+x3+x2+x+1;α5ℤ2x/p5xp6x=x8+x6+x5+x+1;α6ℤ2x/p6xp7x=x8+x6+x5+x2+1;α7ℤ2x/p7xp8x=x8+x6+x5+x3+1;α8ℤ2x/p8xp9x=x8+x7+x3+x2+1;α9ℤ2x/p9xp10x=x8+x7+x5+x3+1;α10ℤ2x/p10xp11x=x8+x7+x2+x+1;α11ℤ2x/p11xp12x=x8+x7+x6+x+1;α12ℤ2x/p12xp13x=x8+x7+x6+x5+x2+x+1;α13ℤ2x/p13xp14x=x8+x7+x6+x3+x2+x+1;α14ℤ2x/p14xp15x=x8+x7+x6+x5+x4+x2+1;α15ℤ2x/p15xp16x=x8+x6+x5+x4+1;α16ℤ2x/p16x


### 2.2. The Proposed S-Box Construction Method

For eachi=1,…,16, consider the affine power affine map (APA):(4)S=A1∘f∘A2:ℤ2αi⟶ℤ2αi,where A1x=ax+b and A2x=cx+da,b,c,d∈ℤ2αi are two affine maps with a,c≠0, and(5)fx=x−1,ifx≠0,0,ifx=0.Among other things, the mapS, which is obviously bijective, was introduced by [5] to produce confusion in the scheme. For our S-boxes, we choose a=13, b=14 and c=102 and d=210. Figure 1 demonstrates the flow chart of the construction of the 16 different S-boxes. Moreover, the construction of S-boxes in correspondence to polynomial 1 (P1) to polynomial 16 (P16) is shown in Figure 1. All the S-boxes are given in Tables 2–17, corresponding to P1 to P16. These tables are before the conclusion section.Figure 1
Flow chart for the construction of the proposed S-boxes and S-boxes corresponding toP1 and P16.Table 2
S-box corresponding to P2.
Proposed S-box 11761411392497517946948622431974910516725024060189182188230178101236211531103815512720791213295588782442158122115821974201210255119903742431476783962299253144115696322320580140711211251205416818782202107026191611861836523264172419344401373412816424116325872147619613145819897102246277235233515711810011720814330138217661572112451513418012611414289148254218123851541691031656195842241841072032001452290723122658353212191159352425220216247192204136228791159222724873501121321082251625223130185331332376117317127861131811751162511771702341215018146817414939171241993213128162201601111351310412923998222109146721522061902385295166242094647591221561061511949436193Table 3
S-box corresponding to P2.
Proposed S-box 21861702495320810649220147203143207250177133192408415238182158596721915209701504112164255231139182117251004712510977190113110148118197198146391381081617513103200739110520480104130124213221463144481121817219637151313510129221184261114022211127223312987861892052325311489218176193229180201158469221882288524123614023916164577985624102211160142153546821321023071238235822525298337654251321622121921759017245431191784436461661715123419562145452471416817421712215901012376027163202243991161201316224232201233455137206155226811739316910717216719919194136961831492332461791569835095612825488141165126351286676134216972421872443074215121151851947815422725122524892157Table 4
S-box corresponding to P3.
Proposed S-box 31262501621023214312919228200474215513117722124014229491381209446206459911627501676716511713310817596017454582512231641814415488238698919420119322756113712372861691217114418159901618910531512681491763865110481832101962175916323711893132411402081732471193323322866170802221661611601462362241796311581982311509724322917821517614245211199253197854143763621285591401246073134772111072181802041121523024610415113016822022714510318519121828252202341902515213911418718614130122113239211110112239127213871561882161841533724970102262559548420614821417222525445135243511533919592522482033620510024224423520912574232207212158147191095621915717171065723483136791326819878Table 5
S-box corresponding to P4.
Proposed S-box 44910322020858701732382421601541691581101399424020078149155117219131501612261448189114711512021834517104182167150192641789557911763100159205134638524322692361771442102044792068996746614619715010813215251812359319422173182465614010624424714823788232191251234999335925245179222125132109229136774116281881262029767217163988417129422113821311946168511620412975311522391661726810116358321218643105249199255196111328718415624223190195153922301122093952801211319860401381647610172611451221742319861701832142451352313654224811431243022841142653127203141133187901182012718071130171858217513716528216227375547215724823312325414212125312810222519316107250241622076515121Table 6
S-box corresponding to P5.
Proposed S-box 56116310517730219248584179127151118169196240342025177191126233215392541972048931921221289795181217656417323910198439016175877016216892249100245193249205107551391083311114748153156110206137200104247116191821446601151581671301131720442181411761471138216213179226150253318566231187243577123624422545381654017220118811922424229232211214541854222719082159441572502352211712815535521241208478136591233688251831342131431532231021292091111311401441849880178220121481869914921023994234371522306324167189221942382035620711726861121823768472122291661461992281211011801747672321606920810125246732521031648791092527241061421541836296255132156751455013513133222161170519589Table 7
S-box corresponding to P6.
Proposed S-box 61621202051831620137191899512823915910219942401551872481969213922312136182228014013115810053236501927211816713242351901381528249246174221111611912615002549613491811128116310826135216234998514786217710417920718922255271782252122371471142531657517244184199166872087124219517510124779243149442172013836375251631256669218190861033014812321119833482321971059933110714519418541227401462145822877144152573518017224160556861242291691168171154204522332121311924556133113127459811565641341732001022021107418215714176916834224592032061702151537339672913014211618688160471062541931212312107252117250176484431242352091511222302261293223188111156220164238829714370834610925Table 8
S-box corresponding to P7.
Proposed S-box 78610117789199188236165198145112232921647613724024458715198181129117942301083929184206103123561803514224616848366422218711119615541901201041731208105162224251122531725717011431531591852041924512850971402271272144417621811820945324768186249693251502888025411514785154221996945701361303281341711392502432481741912031243332552215227211716110995479226135671431241601252281874926792201792312231482105124114111320016192197239146241832528216712622524258219521072335514923577178157201654021674207133131788312273102662131388011182344619510193172377511911023815621722031752344118915811621520513912021063822930812337631449659426210084166146021716116913216390212194155121Table 9
S-box corresponding to P8.
Proposed S-box 84164728109248100139227141111607125178312402245312391636723771217112052521336122971721822331245119623625517012831861798311929206234210218115122024568132135421430152398958218921248120187219239222202192154246143241311811022720418412913711474122571881999475207976158921303919961341031083322989211755016619587203164461741212534241162112381041122351411625119186253230225521553858177173404514862422011491902502161575924416915315011714210114592072082471601408641801948837162115351565903684106152232159110144738012620016511356161491271216806622614732132146243443138551631671352238193209699910744198105228106577215197193176181724978242857072171183262212542311181361852Table 10
S-box corresponding to P9.
Proposed S-box 91641778216114139985131895824322124915918240641512251202101801355711520472621552271951099512714176229178246121474723516621712221220526271381487017113014021520315614611106233242162620614216119218253169104213102412452311972506586901522372411672544142081827110123268111101345520910318961741162040118186421921312264311363157386986014944255532118222411032944923680160196222185108188154176123238117302478815018114413235371989697136922375121811128312523987214319105201137214155617217913325236220851845023439194739917379124462510016833322819114516516119977126281835917022542022236616321918717417724417551286723079345292115813129904820010734242512481190845219315391207Table 11
S-box corresponding to P10.
Proposed S-box 101092616321377207155873496136401772512811240147166252115158185123146682391491601806111221982082431039724187179228132110188101511306211913160219148245910181205322298203191541786611724610822613520222459236192156141112217283916717210444230542538216823415058107644348201181811021732542007623720914320463193221214148816126223901578546169196191211421199176100216152183893799752337212218452792062351942257115162502102421271532345770165248164567552129124189211712418625115912513432931161225510617573170351398441120182778171821745321583247942273113729611131452122381381053047121927478014223295197220195231491613686991651324421851025014422911419045249133140383318620156Table 12
S-box corresponding to P11.
Proposed S-box 111281911321671111201592182568173217323999239240941579575112190213152202401012207140641923835151154197199606118744201723712611824801241411641193160710716312924866189221101097615011025517170171843174153131132062442193203121344824516413023041445318278155227253158268618662792117516222221524720898137210635767138961392422543892188975221110669228521219823422542223119136903346121249184341422512021421650209135877417616157736229831497316818119611519411568822315111486519517223177228013125288170220276971123232492262365810414317816611720554169108912041271164516589305531842461515612222419210314524311418510220018025081233475912513310014714183146235237292810593179241Table 13
S-box corresponding to P12.
Proposed S-box 121402491103253619160102247235219171661843424019822115921219918814827052731761549312832214195238216242299224136209207129252451399710941225371051067110020616512959171702081261112421811192152218323314222204150226144821214087672281162348113180596237425195169979216931301255589143123178122158806610133462523311221015713120312743211541322175815515219253128844488236194168170239231218232205103151217326145202511361171464983352029024316478108201167175191681636585185255104182271777539161182187579818664246179196174381181351011937722394248722501076218915384875616960231114914129156147120154254134130244200172213197162190113458611423047138611152205013722476631421249174Table 14
S-box corresponding to P13.
Proposed S-box 132417715125771226153127137209732542139623724023410213120114211864162491766518222955236821602242251447467129113105143186248181113231108582164311415637168917060324640122217247223851634651523118970121732102072331971078311516499665623111120612514620515425516719881871092013559681003922017214511132185106531621122535418033116175104134211123204261909089215110119291882302191997679174130147166632152414124414112403598218245242722123947942082381016517191141927724314815880203454219414615923521416132169931011403097508412622919620048551395744691284915519622322522361362502715719512520634179783819322728184133881871787521213811719120214922228891501212211718286511831032Table 15
S-box corresponding to P14.
Proposed S-box 149313118253482101401631003418128119053114240227242106112138147922502061415615257942125014923521233254102131156142173194314524419523743183168121959713712020462119174122186123291051361911969140229864411252222416215530223161391691463521331993624112459651901272198821411512696382395571977324223144474668726185109176198201234222203211175157113110217853249255116104258217997158135447811716416022166236145103602302321341826717718815810779216122465121318058171892522152456921819210225745483846116619316139811321910176208231151181491879920222820522015419811116720262006416524724820920714822602818433159271532417217175238243778735170321371432511291781461508089108130570Table 16
S-box corresponding to P15.
Proposed S-box 151222018271422399625136246211622231033540240132322191161602432812816815920619395501543823447661261925416965175254894512323339171941112022422261782101856477218108127147222191214237110184155302086212156125511916714110525217663205139151533318917021318322420475691002301961883143104839114560113117152941571291022351354915181163195582491341711073721134242386722236882531092072211642031381948229122717693120143811062613721520018721711872244245150209121144199141862770115845541173801797914618173617285613678614252851661334122825999015812557292248102319252011806817717423161208986223214051165216024110199713114819824713011425011244462251315331682190124591971492277487Table 17
S-box corresponding to P15.
Proposed S-box 166136682181661184811421733039204811441342404611583912021203106314548911221317478176149117181381335687162201997860157254141922920017814069241211601481582526722811110310219433122442056110022921580187217189281241479231764517113723995154426451551192367724201275216841512204910115012953155198174146902338822554179574246138110230211153208214401841325571163621301752322311281561413415215212165411069716772177169234107170120247104245195717219658536701082092221971322445720118296521252101831272411262352658227143112388613519166168237359123322710520722122248251243502316186988225018016419321993793519624918813925316199372232242261312110925731164320694113190142185159918In the proposed work, we present an APA S-box corresponding to eachi=1,…,16 where the APA map S gives the16×16 lookup tables. We, then, show that these S-boxes have strong cryptographic properties certified with the help of analyses such as nonlinearity, strict avalanche criterion (SAC), bit independent criterion (BIC), linear approximation probability (LP), and differential approximation probability (DP) [20].


## 2.1. The Galois FieldsGF28

We summarize here some well-known facts from the theory of rings and fields. LetR be a commutative ring with identity. A nonempty subset J of R is called an ideal of R if J is an additive subgroup of R and aJ⊆J for every a∈R, where aJ=ajj∈J. If, furthermore, there does not exist a proper ideal of R properly containing J, then we say that J is a maximal ideal of R Besides; R is said to be a field if each of its nonzero elements has a must inverse in R. If R is a field of prime characteristic p, then R is an extension of the prime field ℤp. A polynomial fx∈ℤpx is said to be irreducible if it cannot be factored in ℤpx into two polynomials of strictly smaller degrees. The principal ideal,(1)fx=hxfx:hx∈ℤpx,generated by a monic irreducible polynomial fx∈ℤpx is a maximal ideal in ℤpx. If fx is of degree m, then the quotient ring,(2)ℤpxfx=gx+fx:gx∈ℤpx,is an extension field of ℤp of degree m consisting of pm elements. This field is called a Galois field and is denoted by GFpm and is said to be the field extension of ℤp defined by the irreducible polynomial fx. A representative gx of each element of GFpm can be chosen to be of degree strictly less than m. If α is a root of fx in an algebraic closure of ℤp, then GFpm is isomorphic to the field:(3)ℤpα=a0+a1α+⋯+am−1αm−1:ai∈ℤp,∀i,and so we can identify the two fields. Furthermore, if α is a generator of the cyclic finite multiplicative group of nonzero elements of ℤpα, then we say that fx is primitive.The Galois fieldGF28 is particularly of specific interest in cryptographic applications, especially in S-boxes constructions. For our cryptographic purposes, we are interested in such a field whose defining irreducible polynomial is “primitive” (of degree 8, of course). It is well known that there are φ28−1/8=16 such polynomials over ℤ2, for example, p1x,…,p16x∈ℤ2x, which we list in Table 1. In the following section, we construct 16 S-boxes out of the Galois fields corresponding to the aforementioned sixteen primitive irreducible polynomials.Table 1
Primitive irreducible polynomials and their corresponding Galois fields.
Primitive polynomialspix& roots αiGalois fieldGF28p1x=x8+x4+x3+x2+1;α1ℤ2x/p1xp2x=x8+x5+x3+x+1;α2ℤ2x/p2xp3x=x8+x5+x3+x2+1;α3ℤ2x/p3xp4x=x8+x6+x3+x2+1;α4ℤ2x/p4xp5x=x8+x6+x4+x3+x2+x+1;α5ℤ2x/p5xp6x=x8+x6+x5+x+1;α6ℤ2x/p6xp7x=x8+x6+x5+x2+1;α7ℤ2x/p7xp8x=x8+x6+x5+x3+1;α8ℤ2x/p8xp9x=x8+x7+x3+x2+1;α9ℤ2x/p9xp10x=x8+x7+x5+x3+1;α10ℤ2x/p10xp11x=x8+x7+x2+x+1;α11ℤ2x/p11xp12x=x8+x7+x6+x+1;α12ℤ2x/p12xp13x=x8+x7+x6+x5+x2+x+1;α13ℤ2x/p13xp14x=x8+x7+x6+x3+x2+x+1;α14ℤ2x/p14xp15x=x8+x7+x6+x5+x4+x2+1;α15ℤ2x/p15xp16x=x8+x6+x5+x4+1;α16ℤ2x/p16x


## 2.2. The Proposed S-Box Construction Method

For eachi=1,…,16, consider the affine power affine map (APA):(4)S=A1∘f∘A2:ℤ2αi⟶ℤ2αi,where A1x=ax+b and A2x=cx+da,b,c,d∈ℤ2αi are two affine maps with a,c≠0, and(5)fx=x−1,ifx≠0,0,ifx=0.Among other things, the mapS, which is obviously bijective, was introduced by [5] to produce confusion in the scheme. For our S-boxes, we choose a=13, b=14 and c=102 and d=210. Figure 1 demonstrates the flow chart of the construction of the 16 different S-boxes. Moreover, the construction of S-boxes in correspondence to polynomial 1 (P1) to polynomial 16 (P16) is shown in Figure 1. All the S-boxes are given in Tables 2–17, corresponding to P1 to P16. These tables are before the conclusion section.Figure 1
Flow chart for the construction of the proposed S-boxes and S-boxes corresponding toP1 and P16.Table 2
S-box corresponding to P2.
Proposed S-box 11761411392497517946948622431974910516725024060189182188230178101236211531103815512720791213295588782442158122115821974201210255119903742431476783962299253144115696322320580140711211251205416818782202107026191611861836523264172419344401373412816424116325872147619613145819897102246277235233515711810011720814330138217661572112451513418012611414289148254218123851541691031656195842241841072032001452290723122658353212191159352425220216247192204136228791159222724873501121321082251625223130185331332376117317127861131811751162511771702341215018146817414939171241993213128162201601111351310412923998222109146721522061902385295166242094647591221561061511949436193Table 3
S-box corresponding to P2.
Proposed S-box 21861702495320810649220147203143207250177133192408415238182158596721915209701504112164255231139182117251004712510977190113110148118197198146391381081617513103200739110520480104130124213221463144481121817219637151313510129221184261114022211127223312987861892052325311489218176193229180201158469221882288524123614023916164577985624102211160142153546821321023071238235822525298337654251321622121921759017245431191784436461661715123419562145452471416817421712215901012376027163202243991161201316224232201233455137206155226811739316910717216719919194136961831492332461791569835095612825488141165126351286676134216972421872443074215121151851947815422725122524892157Table 4
S-box corresponding to P3.
Proposed S-box 31262501621023214312919228200474215513117722124014229491381209446206459911627501676716511713310817596017454582512231641814415488238698919420119322756113712372861691217114418159901618910531512681491763865110481832101962175916323711893132411402081732471193323322866170802221661611601462362241796311581982311509724322917821517614245211199253197854143763621285591401246073134772111072181802041121523024610415113016822022714510318519121828252202341902515213911418718614130122113239211110112239127213871561882161841533724970102262559548420614821417222525445135243511533919592522482033620510024224423520912574232207212158147191095621915717171065723483136791326819878Table 5
S-box corresponding to P4.
Proposed S-box 44910322020858701732382421601541691581101399424020078149155117219131501612261448189114711512021834517104182167150192641789557911763100159205134638524322692361771442102044792068996746614619715010813215251812359319422173182465614010624424714823788232191251234999335925245179222125132109229136774116281881262029767217163988417129422113821311946168511620412975311522391661726810116358321218643105249199255196111328718415624223190195153922301122093952801211319860401381647610172611451221742319861701832142451352313654224811431243022841142653127203141133187901182012718071130171858217513716528216227375547215724823312325414212125312810222519316107250241622076515121Table 6
S-box corresponding to P5.
Proposed S-box 56116310517730219248584179127151118169196240342025177191126233215392541972048931921221289795181217656417323910198439016175877016216892249100245193249205107551391083311114748153156110206137200104247116191821446601151581671301131720442181411761471138216213179226150253318566231187243577123624422545381654017220118811922424229232211214541854222719082159441572502352211712815535521241208478136591233688251831342131431532231021292091111311401441849880178220121481869914921023994234371522306324167189221942382035620711726861121823768472122291661461992281211011801747672321606920810125246732521031648791092527241061421541836296255132156751455013513133222161170519589Table 7
S-box corresponding to P6.
Proposed S-box 61621202051831620137191899512823915910219942401551872481969213922312136182228014013115810053236501927211816713242351901381528249246174221111611912615002549613491811128116310826135216234998514786217710417920718922255271782252122371471142531657517244184199166872087124219517510124779243149442172013836375251631256669218190861033014812321119833482321971059933110714519418541227401462145822877144152573518017224160556861242291691168171154204522332121311924556133113127459811565641341732001022021107418215714176916834224592032061702151537339672913014211618688160471062541931212312107252117250176484431242352091511222302261293223188111156220164238829714370834610925Table 8
S-box corresponding to P7.
Proposed S-box 78610117789199188236165198145112232921647613724024458715198181129117942301083929184206103123561803514224616848366422218711119615541901201041731208105162224251122531725717011431531591852041924512850971402271272144417621811820945324768186249693251502888025411514785154221996945701361303281341711392502432481741912031243332552215227211716110995479226135671431241601252281874926792201792312231482105124114111320016192197239146241832528216712622524258219521072335514923577178157201654021674207133131788312273102662131388011182344619510193172377511911023815621722031752344118915811621520513912021063822930812337631449659426210084166146021716116913216390212194155121Table 9
S-box corresponding to P8.
Proposed S-box 84164728109248100139227141111607125178312402245312391636723771217112052521336122971721822331245119623625517012831861798311929206234210218115122024568132135421430152398958218921248120187219239222202192154246143241311811022720418412913711474122571881999475207976158921303919961341031083322989211755016619587203164461741212534241162112381041122351411625119186253230225521553858177173404514862422011491902502161575924416915315011714210114592072082471601408641801948837162115351565903684106152232159110144738012620016511356161491271216806622614732132146243443138551631671352238193209699910744198105228106577215197193176181724978242857072171183262212542311181361852Table 10
S-box corresponding to P9.
Proposed S-box 91641778216114139985131895824322124915918240641512251202101801355711520472621552271951099512714176229178246121474723516621712221220526271381487017113014021520315614611106233242162620614216119218253169104213102412452311972506586901522372411672544142081827110123268111101345520910318961741162040118186421921312264311363157386986014944255532118222411032944923680160196222185108188154176123238117302478815018114413235371989697136922375121811128312523987214319105201137214155617217913325236220851845023439194739917379124462510016833322819114516516119977126281835917022542022236616321918717417724417551286723079345292115813129904820010734242512481190845219315391207Table 11
S-box corresponding to P10.
Proposed S-box 101092616321377207155873496136401772512811240147166252115158185123146682391491601806111221982082431039724187179228132110188101511306211913160219148245910181205322298203191541786611724610822613520222459236192156141112217283916717210444230542538216823415058107644348201181811021732542007623720914320463193221214148816126223901578546169196191211421199176100216152183893799752337212218452792062351942257115162502102421271532345770165248164567552129124189211712418625115912513432931161225510617573170351398441120182778171821745321583247942273113729611131452122381381053047121927478014223295197220195231491613686991651324421851025014422911419045249133140383318620156Table 12
S-box corresponding to P11.
Proposed S-box 111281911321671111201592182568173217323999239240941579575112190213152202401012207140641923835151154197199606118744201723712611824801241411641193160710716312924866189221101097615011025517170171843174153131132062442193203121344824516413023041445318278155227253158268618662792117516222221524720898137210635767138961392422543892188975221110669228521219823422542223119136903346121249184341422512021421650209135877417616157736229831497316818119611519411568822315111486519517223177228013125288170220276971123232492262365810414317816611720554169108912041271164516589305531842461515612222419210314524311418510220018025081233475912513310014714183146235237292810593179241Table 13
S-box corresponding to P12.
Proposed S-box 121402491103253619160102247235219171661843424019822115921219918814827052731761549312832214195238216242299224136209207129252451399710941225371051067110020616512959171702081261112421811192152218323314222204150226144821214087672281162348113180596237425195169979216931301255589143123178122158806610133462523311221015713120312743211541322175815515219253128844488236194168170239231218232205103151217326145202511361171464983352029024316478108201167175191681636585185255104182271777539161182187579818664246179196174381181351011937722394248722501076218915384875616960231114914129156147120154254134130244200172213197162190113458611423047138611152205013722476631421249174Table 14
S-box corresponding to P13.
Proposed S-box 132417715125771226153127137209732542139623724023410213120114211864162491766518222955236821602242251447467129113105143186248181113231108582164311415637168917060324640122217247223851634651523118970121732102072331971078311516499665623111120612514620515425516719881871092013559681003922017214511132185106531621122535418033116175104134211123204261909089215110119291882302191997679174130147166632152414124414112403598218245242722123947942082381016517191141927724314815880203454219414615923521416132169931011403097508412622919620048551395744691284915519622322522361362502715719512520634179783819322728184133881871787521213811719120214922228891501212211718286511831032Table 15
S-box corresponding to P14.
Proposed S-box 149313118253482101401631003418128119053114240227242106112138147922502061415615257942125014923521233254102131156142173194314524419523743183168121959713712020462119174122186123291051361911969140229864411252222416215530223161391691463521331993624112459651901272198821411512696382395571977324223144474668726185109176198201234222203211175157113110217853249255116104258217997158135447811716416022166236145103602302321341826717718815810779216122465121318058171892522152456921819210225745483846116619316139811321910176208231151181491879920222820522015419811116720262006416524724820920714822602818433159271532417217175238243778735170321371432511291781461508089108130570Table 16
S-box corresponding to P15.
Proposed S-box 151222018271422399625136246211622231033540240132322191161602432812816815920619395501543823447661261925416965175254894512323339171941112022422261782101856477218108127147222191214237110184155302086212156125511916714110525217663205139151533318917021318322420475691002301961883143104839114560113117152941571291022351354915181163195582491341711073721134242386722236882531092072211642031381948229122717693120143811062613721520018721711872244245150209121144199141862770115845541173801797914618173617285613678614252851661334122825999015812557292248102319252011806817717423161208986223214051165216024110199713114819824713011425011244462251315331682190124591971492277487Table 17
S-box corresponding to P15.
Proposed S-box 166136682181661184811421733039204811441342404611583912021203106314548911221317478176149117181381335687162201997860157254141922920017814069241211601481582526722811110310219433122442056110022921580187217189281241479231764517113723995154426451551192367724201275216841512204910115012953155198174146902338822554179574246138110230211153208214401841325571163621301752322311281561413415215212165411069716772177169234107170120247104245195717219658536701082092221971322445720118296521252101831272411262352658227143112388613519166168237359123322710520722122248251243502316186988225018016419321993793519624918813925316199372232242261312110925731164320694113190142185159918In the proposed work, we present an APA S-box corresponding to eachi=1,…,16 where the APA map S gives the16×16 lookup tables. We, then, show that these S-boxes have strong cryptographic properties certified with the help of analyses such as nonlinearity, strict avalanche criterion (SAC), bit independent criterion (BIC), linear approximation probability (LP), and differential approximation probability (DP) [20].


## 3. Security Analysis

In this section, we present some algebraic and statistical analyses of S-box followed [21]. Such analyses indicate the strength of all the proposed S-boxes and give an idea for their application in image encryption and other modes of secure communication.


### 3.1. Nonlinearity

Nonlinearity analysis of a functionf is the minimum hamming distance between the Boolean function f:f:0,1n⟶0,1 and its all n-bit affine functions. In the truth table of Boolean function f, the nonlinearity of f represents the degree of dissimilarity between f and all affine function. If the function has high minimum hamming distance, it indicates it has high nonlinearity. It is an established fact that high nonlinearity provides resistance to any kind of linear approximation attacks [22, 23]. The calculated upper bound of nonlinearity is M=2m−1−2m/2−1 so that, form=8, the optimal value of nonlinearity is120. Table 18 shows the nonlinearity of 16 S-boxes corresponding to all primitive irreducible polynomials. From this table, it can be seen that the value of nonlinearity has not been affected due to background irreducible polynomial.Table 18
Nonlinearity of the proposed S-box.
S-boxesf1f2f3f4f5f6f7f8AverageS-box 1112112112112112112112112112S-box 2112112112112112112112112112S-box 3112112112112112112112112112S-box 4112112112112112112112112112S-box 5112112112112112112112112112S-box 6112112112112112112112112112S-box 7112112112112112112112112112S-box 8112112112112112112112112112S-box 9112112112112112112112112112S-box 10112112112112112112112112112S-box 11112112112112112112112112112S-box 12112112112112112112112112112S-box 13112112112112112112112112112S-box 14112112112112112112112112112S-box 15112112112112112112112112112S-box 16112112112112112112112112112


### 3.2. Strict Avalanche Criteria

In [24], Webster and Tavares introduced the strict avalanche criteria (SAC) on the concepts of completeness and avalanche. If a single input bit changes, the output bits change with almost 0.5 probability. It helps to show that the resulting output vector is highly random, and no single pattern can be predictable by minor variation in the input vector [25]. By seeing the performance indexes of S-boxes, the proposed S-boxes successfully satisfy SAC. Table 19 depicts the value of SAC for all the proposed 16 S-boxes. It shows that the maximum value of SAC is 0.562500 for the first 9 S-boxes including 11th, 14th, and 16th S-boxes. Similarly, the minimum value of SAC is 0.453125 for the first 10 S-boxes including 12th and 14th S-boxes. The average value of SAC lies in the interval [0.4856, 0.509766].Table 19
Strict avalanche criterion.
S-boxMaxMinAverageSquare deviationS-box 10.5625000.4375000.4960940.0172495S-box 20.5468750.4531250.4951170.0128725S-box 30.5625000.4531250.4941410.0152856S-box 40.5625000.4531250.507080.0118748S-box 50.5468750.4531250.5031740.0153901S-box 60.5625000.4531250.5017090.016637S-box 70.5625000.4531250.5024410.0170951S-box 80.5625000.4531250.5039060.0165152S-box 90.5625000.4531250.4855960.0153978S-box 100.5468750.4531250.5097660.0123912S-box 110.5625000.43750.504150.0191487S-box 120.56250.4531250.5012210.016475S-box 130.5468750.43750.5009770.0127235S-box 140.56250.4531250.5083010.0158654S-box 150.5468750.4375000.4987790.0143727S-box 160.56250.4375000.4965820.0143171


### 3.3. Bit Independent Criterion

Another algebraic criterion (BIC) is used to evaluate the strength of S-box, which is presented by Detombe and Tavares in [26]. In Table 14, the outcomes of BIC to SAC and BIC for the proposed S-boxes are given. The minimum BIC to SAC value is 0.47070 for 12th S-box and the highest minimum value is 0.49219 for 2nd S-box. The average BIC to SAC lies between 0.49679 and 0.50739. Similarly, the square deviation values for all the proposed S-boxes are given in Table 20. The maximum and average value of BIC is 112 for all S-boxes. It is depicted that the proposed S-boxes give the nearest best value of BIC analyses.Table 20
Bit independent criterion.
BIC-SACBICS-boxMinAverageSquare deviationMaxAverageSquare deviationS-box 10.474610.501190.011321121120S-box 20.492190.506000.008451121120S-box 30.480470.502020.010151121120S-box 40.478520.506560.012011121120S-box 50.484380.501050.009241121120S-box 60.476560.498190.007841121120S-box 70.486330.505930.009251121120S-box 80.488280.502510.008351121120S-box 90.488280.502580.006441121120S-box 100.484380.507390.009811121120S-box 110.476560.497840.009501121120S-box 120.470700.496790.010261121120S-box 130.482420.500210.010851121120S-box 140.490230.507180.009011121120S-box 150.484380.502650.008831121120S-box 160.486330.505440.008611121120


### 3.4. Linear Approximation Probability

Matsui defines the extreme value of the imbalance of an event as the linear approximation probability. It is notable that the parity of the input bits that is, the maskGl, is equal to the parity of the output bits, i.e., the mask Gm. The linear approximation probability of a given S-box is defined in the following equation:(6)LP=maxGl,Gm≠0#l∈Xl⋅Gl=Sl⋅Gm2n−12,where Gl and Gm are input and output masks, respectively, and the set “X” represents the set of all possible inputs; 2n is the number of elements ofX. The value of linear approximation indicates the strength of S-box against various linear attacks. In Table 21, the maximum count and the LP value for all proposed S-boxes is 144 and 0.0625. These values of LP of the proposed S-boxes are appropriate against linear attacks.Table 21
Linear and differential approximation probability analysis.
S-boxLinear approximation probabilityDifferential approximation probabilityMax countLPMax valueDPS-box 11440.062540.015625S-box 11440.062540.015625S-box 21440.062540.015625S-box 31440.062540.015625S-box 41440.062540.015625S-box 51440.062540.015625S-box 61440.062540.015625S-box 71450.066440.015625S-box 81440.062540.015625S-box 91440.062540.015625S-box 101440.062540.015625S-box 111440.062540.015625S-box 121440.062540.015625S-box 131440.062540.015625S-box 141440.062540.015625S-box 151440.062540.015625S-box 161440.062540.015625


### 3.5. Differential Approximation Probability

The degree of differential uniformity is known as differential approximation probability (DPs) of S-box. Mathematically, it can be given as(7)DPsΔl⟶Δm=#l∈XSl±Sl±Δl=Δm2m.Briefly, it can be explained as follows: an input differentialΔli must be mapped to an output differentialΔmi uniquely for each i. Here, X represents all the possible input values and the number of its elements is given by 2m. Table 21 depicts the results of DP, which include the maximum and DP value.Moreover, Table22 represents the values of proposed S-boxes along with AES, Skipjack, Xyi, APA, Gray, and residue prime S-boxes.Table 22
Comparison of the performance indexes of the proposed S-boxes with some standard S-boxes.
8×8S-boxesNonlinearitySACBICBIC-SACDPLPAES S-box1120.50581120.5040.01560.062APA S-box1120.49871120.4990.01560.062Gray S-box1120.50581120.5020.01560.062Skipjack S-box105.70.4980104.10.4990.04680.109Xyi S-box1050.5048103.70.5030.04680.156Residue prime99.50.5012101.70.5020.28100.132Reference [27]1060.4978103.92———Reference [28]0.505————Reference [29]1040.52411030.501810.16250.0486S-box 11120.4960941120.501190.0156250.0625S-box 21120.4951171120.506000.0156250.0625S-box 31120.4941411120.502020.0156250.0625S-box 41120.507081120.506560.0156250.0625S-box 51120.5031741120.501050.0156250.0625S-box 61120.5017091120.498190.0156250.0625S-box 71120.5024411120.505930.0156250.0625S-box 81120.5039061120.502510.0156250.0664S-box 91120.4855961120.502580.0156250.0625S-box 101120.5097661120.507390.0156250.0625S-box 111120.504151120.497840.0156250.0625S-box 121120.5012211120.496790.0156250.0625S-box 131120.5009771120.500210.0156250.0625S-box 141120.5083011120.507180.0156250.0625S-box 151120.4987791120.502650.0156250.0625S-box 161120.4965821120.505440.0156250.0625


### 3.6. Statistical Analyses

To evaluate the visual strength of the substitution with the help of the proposed S-boxes, various statistical analyses are made on the host and substituted images. In this proposed work, statistical analyses like homogeneity, entropy, contrast, energy, and correlation are used to evaluate the substitution ability of the 16 proposed S-boxes. These analyses are given as(8)correlation=∑k,lk−μkl−μlσkσlpk,l,(9)contrast=∑k,lk−l2pk,l,(10)entropy=−∑k,lprpk,llogPrpk,l,(11)homogeneity=∑k,lpk,l1+k−l,(12)energy=−∑k,lpk,l2,where k,l give the row and column locations of an image. The pixel value at kth row and lth column is represented by pk,l and Prpk,l is the probability of the image pixel. In equation (8), μandσ are mean and standard deviation, respectively.Correlation analysis helps to find the similarity between the host and substituted image. The correlation analysis provides the range which indicates the perfect, negative, and positive correlation. This is−1,1 interval for correlation and value of 1 indicates the perfect correlation.The randomness of the digital image can be calculated with the help of entropy. The higher value of entropy from the interval0,8 represents the higher amount of randomness in a digital image. For any viewer, it is only possible with the help of contrast analysis to intensely recognize the objects in the texture of an image. With the help of contrast analyses, one can observe the maximum distinction in image pixels. The range of the contrast can be given bysizeImage−12. For constant image, the value of contrast is zero. The goal of finding close distribution between the matrix and its diagonal is obtained in homogeneity analysis. The matrix used in this analysis is named gray level cooccurrence matrix (GLCM) and the range of homogeneity lies between 0 and 1. The range for energy analysis also lies in the interval [0, 1]. The results of Table 23 are obtained by applying these analyses on the original and encrypted images. For all the proposed 16 S-boxes, we calculated the values of the statistical analyses.Table 23
MLC analyses for the proposed S-boxes.
S-boxesEntropyCorrelationContrastEnergyHomogeneityS-box 17.27630.10328.85050.01750.4499S-box 27.27630.12469.15170.01740.4530S-box 37.27630.08959.57480.01750.4532S-box 47.27630.14868.91320.01840.4579S-box 57.27630.12779.20770.01950.4714S-box 67.27630.13269.81300.01780.4532S-box 77.26420.090410.05990.01770.4438S-box 87.27630.12569.66350.01820.4509S-box 97.27630.10998.96530.01790.4609S-box 107.27630.07479.71060.01770.4453S-box 117.27630.09279.79050.01820.4529S-box 127.27630.08799.87200.01820.4531S-box 137.27630.08688.55690.01880.4606S-box 147.27630.08628.63080.01790.4510S-box 157.27630.12459.38290.01840.4522S-box 167.27630.08439.58980.01790.4533A 256 × 256 JPEG image of Lena is considered for MLC analysis. Figure2 shows the results of image encryption with 16 proposed S-boxes.Figure 2
Original Lena image and the encrypted images using all 16 primitive irreducible polynomials S-boxes. (a) Lena image, (b) S-box 1, (c) S-box 2, (d) S-box 3, (e) S-box 4, (f) S-box 5, (g) S-box 6, (h) S-box 7, (i) S-box 8, (j) S-box 9, (k) S-box 10, (l) S-box 11, (m) S-box 12, (n) S-box 13, (o) S-box 14, (p) S-box 15, and (q) S-box 16.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)


## 3.1. Nonlinearity

Nonlinearity analysis of a functionf is the minimum hamming distance between the Boolean function f:f:0,1n⟶0,1 and its all n-bit affine functions. In the truth table of Boolean function f, the nonlinearity of f represents the degree of dissimilarity between f and all affine function. If the function has high minimum hamming distance, it indicates it has high nonlinearity. It is an established fact that high nonlinearity provides resistance to any kind of linear approximation attacks [22, 23]. The calculated upper bound of nonlinearity is M=2m−1−2m/2−1 so that, form=8, the optimal value of nonlinearity is120. Table 18 shows the nonlinearity of 16 S-boxes corresponding to all primitive irreducible polynomials. From this table, it can be seen that the value of nonlinearity has not been affected due to background irreducible polynomial.Table 18
Nonlinearity of the proposed S-box.
S-boxesf1f2f3f4f5f6f7f8AverageS-box 1112112112112112112112112112S-box 2112112112112112112112112112S-box 3112112112112112112112112112S-box 4112112112112112112112112112S-box 5112112112112112112112112112S-box 6112112112112112112112112112S-box 7112112112112112112112112112S-box 8112112112112112112112112112S-box 9112112112112112112112112112S-box 10112112112112112112112112112S-box 11112112112112112112112112112S-box 12112112112112112112112112112S-box 13112112112112112112112112112S-box 14112112112112112112112112112S-box 15112112112112112112112112112S-box 16112112112112112112112112112


## 3.2. Strict Avalanche Criteria

In [24], Webster and Tavares introduced the strict avalanche criteria (SAC) on the concepts of completeness and avalanche. If a single input bit changes, the output bits change with almost 0.5 probability. It helps to show that the resulting output vector is highly random, and no single pattern can be predictable by minor variation in the input vector [25]. By seeing the performance indexes of S-boxes, the proposed S-boxes successfully satisfy SAC. Table 19 depicts the value of SAC for all the proposed 16 S-boxes. It shows that the maximum value of SAC is 0.562500 for the first 9 S-boxes including 11th, 14th, and 16th S-boxes. Similarly, the minimum value of SAC is 0.453125 for the first 10 S-boxes including 12th and 14th S-boxes. The average value of SAC lies in the interval [0.4856, 0.509766].Table 19
Strict avalanche criterion.
S-boxMaxMinAverageSquare deviationS-box 10.5625000.4375000.4960940.0172495S-box 20.5468750.4531250.4951170.0128725S-box 30.5625000.4531250.4941410.0152856S-box 40.5625000.4531250.507080.0118748S-box 50.5468750.4531250.5031740.0153901S-box 60.5625000.4531250.5017090.016637S-box 70.5625000.4531250.5024410.0170951S-box 80.5625000.4531250.5039060.0165152S-box 90.5625000.4531250.4855960.0153978S-box 100.5468750.4531250.5097660.0123912S-box 110.5625000.43750.504150.0191487S-box 120.56250.4531250.5012210.016475S-box 130.5468750.43750.5009770.0127235S-box 140.56250.4531250.5083010.0158654S-box 150.5468750.4375000.4987790.0143727S-box 160.56250.4375000.4965820.0143171


## 3.3. Bit Independent Criterion

Another algebraic criterion (BIC) is used to evaluate the strength of S-box, which is presented by Detombe and Tavares in [26]. In Table 14, the outcomes of BIC to SAC and BIC for the proposed S-boxes are given. The minimum BIC to SAC value is 0.47070 for 12th S-box and the highest minimum value is 0.49219 for 2nd S-box. The average BIC to SAC lies between 0.49679 and 0.50739. Similarly, the square deviation values for all the proposed S-boxes are given in Table 20. The maximum and average value of BIC is 112 for all S-boxes. It is depicted that the proposed S-boxes give the nearest best value of BIC analyses.Table 20
Bit independent criterion.
BIC-SACBICS-boxMinAverageSquare deviationMaxAverageSquare deviationS-box 10.474610.501190.011321121120S-box 20.492190.506000.008451121120S-box 30.480470.502020.010151121120S-box 40.478520.506560.012011121120S-box 50.484380.501050.009241121120S-box 60.476560.498190.007841121120S-box 70.486330.505930.009251121120S-box 80.488280.502510.008351121120S-box 90.488280.502580.006441121120S-box 100.484380.507390.009811121120S-box 110.476560.497840.009501121120S-box 120.470700.496790.010261121120S-box 130.482420.500210.010851121120S-box 140.490230.507180.009011121120S-box 150.484380.502650.008831121120S-box 160.486330.505440.008611121120


## 3.4. Linear Approximation Probability

Matsui defines the extreme value of the imbalance of an event as the linear approximation probability. It is notable that the parity of the input bits that is, the maskGl, is equal to the parity of the output bits, i.e., the mask Gm. The linear approximation probability of a given S-box is defined in the following equation:(6)LP=maxGl,Gm≠0#l∈Xl⋅Gl=Sl⋅Gm2n−12,where Gl and Gm are input and output masks, respectively, and the set “X” represents the set of all possible inputs; 2n is the number of elements ofX. The value of linear approximation indicates the strength of S-box against various linear attacks. In Table 21, the maximum count and the LP value for all proposed S-boxes is 144 and 0.0625. These values of LP of the proposed S-boxes are appropriate against linear attacks.Table 21
Linear and differential approximation probability analysis.
S-boxLinear approximation probabilityDifferential approximation probabilityMax countLPMax valueDPS-box 11440.062540.015625S-box 11440.062540.015625S-box 21440.062540.015625S-box 31440.062540.015625S-box 41440.062540.015625S-box 51440.062540.015625S-box 61440.062540.015625S-box 71450.066440.015625S-box 81440.062540.015625S-box 91440.062540.015625S-box 101440.062540.015625S-box 111440.062540.015625S-box 121440.062540.015625S-box 131440.062540.015625S-box 141440.062540.015625S-box 151440.062540.015625S-box 161440.062540.015625


## 3.5. Differential Approximation Probability

The degree of differential uniformity is known as differential approximation probability (DPs) of S-box. Mathematically, it can be given as(7)DPsΔl⟶Δm=#l∈XSl±Sl±Δl=Δm2m.Briefly, it can be explained as follows: an input differentialΔli must be mapped to an output differentialΔmi uniquely for each i. Here, X represents all the possible input values and the number of its elements is given by 2m. Table 21 depicts the results of DP, which include the maximum and DP value.Moreover, Table22 represents the values of proposed S-boxes along with AES, Skipjack, Xyi, APA, Gray, and residue prime S-boxes.Table 22
Comparison of the performance indexes of the proposed S-boxes with some standard S-boxes.
8×8S-boxesNonlinearitySACBICBIC-SACDPLPAES S-box1120.50581120.5040.01560.062APA S-box1120.49871120.4990.01560.062Gray S-box1120.50581120.5020.01560.062Skipjack S-box105.70.4980104.10.4990.04680.109Xyi S-box1050.5048103.70.5030.04680.156Residue prime99.50.5012101.70.5020.28100.132Reference [27]1060.4978103.92———Reference [28]0.505————Reference [29]1040.52411030.501810.16250.0486S-box 11120.4960941120.501190.0156250.0625S-box 21120.4951171120.506000.0156250.0625S-box 31120.4941411120.502020.0156250.0625S-box 41120.507081120.506560.0156250.0625S-box 51120.5031741120.501050.0156250.0625S-box 61120.5017091120.498190.0156250.0625S-box 71120.5024411120.505930.0156250.0625S-box 81120.5039061120.502510.0156250.0664S-box 91120.4855961120.502580.0156250.0625S-box 101120.5097661120.507390.0156250.0625S-box 111120.504151120.497840.0156250.0625S-box 121120.5012211120.496790.0156250.0625S-box 131120.5009771120.500210.0156250.0625S-box 141120.5083011120.507180.0156250.0625S-box 151120.4987791120.502650.0156250.0625S-box 161120.4965821120.505440.0156250.0625


## 3.6. Statistical Analyses

To evaluate the visual strength of the substitution with the help of the proposed S-boxes, various statistical analyses are made on the host and substituted images. In this proposed work, statistical analyses like homogeneity, entropy, contrast, energy, and correlation are used to evaluate the substitution ability of the 16 proposed S-boxes. These analyses are given as(8)correlation=∑k,lk−μkl−μlσkσlpk,l,(9)contrast=∑k,lk−l2pk,l,(10)entropy=−∑k,lprpk,llogPrpk,l,(11)homogeneity=∑k,lpk,l1+k−l,(12)energy=−∑k,lpk,l2,where k,l give the row and column locations of an image. The pixel value at kth row and lth column is represented by pk,l and Prpk,l is the probability of the image pixel. In equation (8), μandσ are mean and standard deviation, respectively.Correlation analysis helps to find the similarity between the host and substituted image. The correlation analysis provides the range which indicates the perfect, negative, and positive correlation. This is−1,1 interval for correlation and value of 1 indicates the perfect correlation.The randomness of the digital image can be calculated with the help of entropy. The higher value of entropy from the interval0,8 represents the higher amount of randomness in a digital image. For any viewer, it is only possible with the help of contrast analysis to intensely recognize the objects in the texture of an image. With the help of contrast analyses, one can observe the maximum distinction in image pixels. The range of the contrast can be given bysizeImage−12. For constant image, the value of contrast is zero. The goal of finding close distribution between the matrix and its diagonal is obtained in homogeneity analysis. The matrix used in this analysis is named gray level cooccurrence matrix (GLCM) and the range of homogeneity lies between 0 and 1. The range for energy analysis also lies in the interval [0, 1]. The results of Table 23 are obtained by applying these analyses on the original and encrypted images. For all the proposed 16 S-boxes, we calculated the values of the statistical analyses.Table 23
MLC analyses for the proposed S-boxes.
S-boxesEntropyCorrelationContrastEnergyHomogeneityS-box 17.27630.10328.85050.01750.4499S-box 27.27630.12469.15170.01740.4530S-box 37.27630.08959.57480.01750.4532S-box 47.27630.14868.91320.01840.4579S-box 57.27630.12779.20770.01950.4714S-box 67.27630.13269.81300.01780.4532S-box 77.26420.090410.05990.01770.4438S-box 87.27630.12569.66350.01820.4509S-box 97.27630.10998.96530.01790.4609S-box 107.27630.07479.71060.01770.4453S-box 117.27630.09279.79050.01820.4529S-box 127.27630.08799.87200.01820.4531S-box 137.27630.08688.55690.01880.4606S-box 147.27630.08628.63080.01790.4510S-box 157.27630.12459.38290.01840.4522S-box 167.27630.08439.58980.01790.4533A 256 × 256 JPEG image of Lena is considered for MLC analysis. Figure2 shows the results of image encryption with 16 proposed S-boxes.Figure 2
Original Lena image and the encrypted images using all 16 primitive irreducible polynomials S-boxes. (a) Lena image, (b) S-box 1, (c) S-box 2, (d) S-box 3, (e) S-box 4, (f) S-box 5, (g) S-box 6, (h) S-box 7, (i) S-box 8, (j) S-box 9, (k) S-box 10, (l) S-box 11, (m) S-box 12, (n) S-box 13, (o) S-box 14, (p) S-box 15, and (q) S-box 16.
(a)(b)(c)(d)(e)(f)(g)(h)(i)(j)(k)(l)(m)(n)(o)(p)(q)


## 4. Balanced Boolean Function

### 4.1. Balance Property

The imbalance of a Boolean function weak system against linear cryptanalysis highlights the importance of balance property. The balance property indicates that the higher the magnitude of a function’s imbalance, the more the chances of a high probability linear approximation. A Boolean functionf:ℤ2n⟶ℤ2 is balanced. If the cardinality or Hamming weight of these two functions, that is, x:fx=0andx:fx=1 is the same, then it is named the balance function.


### 4.2. Balance Property of the Proposed S-Box

All the Boolean functionsfi,i=1,2,3,…,8 involved in proposed S-boxes are balanced just like the Boolean functions of AES, S8, AES and other well-known S-boxes. The nonlinearity of the proposed S-boxes is equal to 112.


## 4.1. Balance Property

The imbalance of a Boolean function weak system against linear cryptanalysis highlights the importance of balance property. The balance property indicates that the higher the magnitude of a function’s imbalance, the more the chances of a high probability linear approximation. A Boolean functionf:ℤ2n⟶ℤ2 is balanced. If the cardinality or Hamming weight of these two functions, that is, x:fx=0andx:fx=1 is the same, then it is named the balance function.


## 4.2. Balance Property of the Proposed S-Box

All the Boolean functionsfi,i=1,2,3,…,8 involved in proposed S-boxes are balanced just like the Boolean functions of AES, S8, AES and other well-known S-boxes. The nonlinearity of the proposed S-boxes is equal to 112.


## 5. Conclusion

In this paper, a scheme for the synthesis of8×8 S-boxes over 16 isomorphic Galois fields is presented. Here, we fixed all the parameters of affine power affine transformation, that is, a,b,c,dfor 16 S-boxes. We have 16 primitive irreducible polynomials of degree 8 and they prompt us to construct 16 Galois field extensions of order 256. By using elements of the Galois field, corresponding to each different pair of the parameters, one can construct different S-boxes. These S-boxes obtained as a result of APA transformation which is bijective, pass nonlinearity test, and out bit independent criterion (BIC) which demonstrates that the existing S-boxes have high confusion producing capability. The evaluation of constructed S-boxes is done with some algebraic and statistical analyses. The results of these analyses highlight the characteristics of all the proposed S-boxes and later these S-boxes are equated with some of the existing S-boxes. In addition to this, we also ensured that all these constructed S-boxes are balanced that guarantee the strength of our S-boxes. Hence, we have concluded that a large class of S-boxes can be obtained by varying parameters of affine power affine transformations. These S-boxes can be used for secure communication.



---

*Source: 8883884-2020-09-24.xml*