### Table 3: Characteristics of the evolved DES S-boxes

"... In PAGE 7: ... In Table 2, we give the characteristics of the S-boxes of the fastest implementation of DES known as bitslice DES [Kwan, 00]. In Table3 , we present the characteristics of the evolved DES S-boxes. area time power S1 167 2.... ..."

### Table 4: S-Boxes of the stream cipher.

2004

"... In PAGE 5: ... Table 1 shows which bits from shift- register A are used as input for the S-Boxes and how the new register values are constructed. The S-Boxes itself are shown in Table4 . Table 6 gives an algebraic description of the S-Boxes, with a being the most significant input bit and e the least significant.... ..."

Cited by 4

### Table 7: The CRYPTON S-boxes

1998

"... In PAGE 12: ... Based on this structure and the above requirements, the nal involution S-box S was searched for over some limited space of good 4-bit P-boxes and linear involutions. The four 8 8 S-boxes constructed as above are presented in Appendix (see Table7 ). Table 3 shows their statistics on the distribution of input-output di erence/linear ap- proximation pairs, where the entry value is the number computed by the numerator of equation (4) (equation (5) in the case of linear approximations).... ..."

Cited by 2

### Table 2: Characteristics of the bitslice DES S-boxes

"... In PAGE 7: ... However, for existing work on designing hardware for DES S-boxes, we could only obtain the size in terms of gate equivalent. In Table2 , we give the characteristics of the S-boxes of the fastest implementation of DES known as bitslice DES [Kwan, 00]. In Table 3, we present the characteristics of the evolved DES S-boxes.... ..."

### Table 2. The hypotheses generated by attacking a compressed S-box.

2006

"... In PAGE 9: ...is found. The number of key hypotheses generated by implementing this attack against a DES using compressed S-boxes is shown in Table2 for di erent numbers of messages used. As can be seen, this is more e cient than modifying 1 S-box value as information on 2 boxes can be gained at once i.... ..."

Cited by 2

### Table 3: LOKI S-box Irreducible Polynomials and Exponents

1993

"... In PAGE 14: ... This is de ned as: Sfnrow(col) = (col + ((row 17) ff16)r amp;ff16)erowmod grow (10) where genrow is an irreducible polynomial in GF(28), and erow is the (constant 31) exponent used in forming Sfnrow(col). The generators and exponents to be used in the 16 S-functions in LOKI91 are speci ed in Table3 . For ease of implementation in hardware, this function can also be written as: Sfnrow(col) = (col + ((row)j(row lt; lt; 4)) amp;ff16)31mod grow (11) The permutation function P provides di usion of the outputs from the four S-boxes across the inputs of all S-boxes in the next round.... ..."

Cited by 36

### Table 3: LOKI S-box Irreducible Polynomials and Exponents

1993

"... In PAGE 14: ... This is de ned as: Sfn row (col)=(col +((row 17) ff 16 )r amp;ff 16 ) e row mod g row (10) where gen row is an irreducible polynomial in GF(2 8 ), and e row is the (constant 31) exponent used in forming Sfn row (col). The generators and exponents to be used in the 16 S-functions in LOKI91 are speci ed in Table3 . For ease of implementation in hardware, this function can also be written as: Sfn row (col)=(col +(( row)j(row lt; lt; 4)) amp;ff 16 ) 31 mod g row (11) The permutation function P provides di usion of the outputs from the four S-boxes across the inputs of all S-boxes in the next round.... ..."

Cited by 8

### Table 1: Number of collision structures found for each S-box

"... In PAGE 4: ... For each S-box we expect to store 255 8n structures which is quite reasonable for the values of n we are interested in. Table1 shows for di erent n how many of these structures we found for the set J = f5; 6; : : : ; n + 4g, which are the values of j used to compute the round keys of the second round on- wards. The exact numbers for di erent choices of J will be slightly di erent, but we expect no major de- viations.... In PAGE 4: ... 3.3 The RS Restriction As Table1 shows, there is no collision on 8 rounds for our chosen set J. For n lt; 8 we can construct two keys, K and K , that generate the same set of round keys.... ..."

### Table 2: the S-box Sub1,1

"... In PAGE 15: ...f1(2, {[ 0 1 0 0 ], [ 0 1 0 1 ], [ 0 1 1 0 ], [ 0 1 1 1 ]}) = {2}, f1(2, {[ 1 0 0 0 ], [ 1 0 0 1 ], [ 1 0 1 0 ], [ 1 0 1 1 ]}) = {1}, f1(2, {[ 1 1 0 0 ], [ 1 1 0 1 ], [ 1 1 1 0 ], [ 1 1 1 1 ]}) = {1}, f2(1, {[ 0 0 0 0 ], [ 0 0 0 1 ], [ 0 0 1 0 ], [ 0 0 1 1 ]}) = {1}, f2(1, {[ 0 1 0 0 ], [ 0 1 0 1 ], [ 0 1 1 0 ], [ 0 1 1 1 ]}) = {2}, f2(1, {[ 1 0 0 0 ], [ 1 0 0 1 ], [ 1 0 1 0 ], [ 1 0 1 1 ]}) = {2}, f2(1, {[ 1 1 0 0 ], [ 1 1 0 1 ], [ 1 1 1 0 ], [ 1 1 1 1 ]}) = {1}, f2(2, {[ 0 0 0 0 ], [ 0 0 0 1 ], [ 0 0 1 0 ], [ 0 0 1 1 ]}) = {1}, f2(2, {[ 0 1 0 0 ], [ 0 1 0 1 ], [ 0 1 1 0 ], [ 0 1 1 1 ]}) = {2}, f2(2, {[ 1 0 0 0 ], [ 1 0 0 1 ], [ 1 0 1 0 ], [ 1 0 1 1 ]}) = {1}, f2(2, {[ 1 1 0 0 ], [ 1 1 0 1 ], [ 1 1 1 0 ], [ 1 1 1 1 ]}) = {1}, MSub1 = (Sub1,1, Sub1,2) = ((0, 3, 1, 2), (2, 3, 0, 1)), Sub1,1 is given in Table2 , Sub1,2 is given in Table 3, and the permutation Per1 = (2, 4, 1, 3) is given in Table 4. It can be seen that each of the S-boxes Sub1,1 and Sub1,2 can be easily implemented with a table lookup of four 2-bit values, indexed by the integer represented by the input block.... ..."

### Table 3: the S-box Sub1,2

"... In PAGE 15: ...f1(2, {[ 0 1 0 0 ], [ 0 1 0 1 ], [ 0 1 1 0 ], [ 0 1 1 1 ]}) = {2}, f1(2, {[ 1 0 0 0 ], [ 1 0 0 1 ], [ 1 0 1 0 ], [ 1 0 1 1 ]}) = {1}, f1(2, {[ 1 1 0 0 ], [ 1 1 0 1 ], [ 1 1 1 0 ], [ 1 1 1 1 ]}) = {1}, f2(1, {[ 0 0 0 0 ], [ 0 0 0 1 ], [ 0 0 1 0 ], [ 0 0 1 1 ]}) = {1}, f2(1, {[ 0 1 0 0 ], [ 0 1 0 1 ], [ 0 1 1 0 ], [ 0 1 1 1 ]}) = {2}, f2(1, {[ 1 0 0 0 ], [ 1 0 0 1 ], [ 1 0 1 0 ], [ 1 0 1 1 ]}) = {2}, f2(1, {[ 1 1 0 0 ], [ 1 1 0 1 ], [ 1 1 1 0 ], [ 1 1 1 1 ]}) = {1}, f2(2, {[ 0 0 0 0 ], [ 0 0 0 1 ], [ 0 0 1 0 ], [ 0 0 1 1 ]}) = {1}, f2(2, {[ 0 1 0 0 ], [ 0 1 0 1 ], [ 0 1 1 0 ], [ 0 1 1 1 ]}) = {2}, f2(2, {[ 1 0 0 0 ], [ 1 0 0 1 ], [ 1 0 1 0 ], [ 1 0 1 1 ]}) = {1}, f2(2, {[ 1 1 0 0 ], [ 1 1 0 1 ], [ 1 1 1 0 ], [ 1 1 1 1 ]}) = {1}, MSub1 = (Sub1,1, Sub1,2) = ((0, 3, 1, 2), (2, 3, 0, 1)), Sub1,1 is given in Table 2, Sub1,2 is given in Table3 , and the permutation Per1 = (2, 4, 1, 3) is given in Table 4. It can be seen that each of the S-boxes Sub1,1 and Sub1,2 can be easily implemented with a table lookup of four 2-bit values, indexed by the integer represented by the input block.... ..."