Security of 256*256 S-box

Hi,

How safe/ or unsafe is it to design an Sbox in this way.

1. Let us assume we have the 256 bit input as W[8], 8x32 bit words
2. S(W) = W ^(Qbox((W >> 24) & 0xFF)) where Qbox is the 8*32
Queensland Sbox. The most significant byte decides which value of the
Queensland S-box to XOR the 32 bit i/p with.

3. We form the large 256*256 Sbox as...


//Layer1
tmp_san = W[0];
W[0] += S(W[1]) + W[5];
W[1] += S(W[2]) + W[6];
W[2] += S(W[3]) + W[7];
W[3] += S(tmp_san) + W[4];

//Layer2
W[4] += S(W[0]);
W[5] += S(W[1]);
W[6] += S(W[2]);
W[7] += S(W[3]);

//Layer3
W[0] ^= S(W[6]);
W[1] ^= S(W[7]);
W[2] ^= S(W[4]);
W[3] ^= S(W[5]);

//Layer5
tmp_san = W[4];
W[4] += W[0] ^= W[5];
W[5] += W[1] ^= W[6];
W[6] += W[2] ^= W[7];
W[7] += W[3] ^= tmp_san;

4. What are the possible problems with such a design?

Thanks.
Ashish Sharma

.

Relevant Pages

  • Re: MC2
    ... AES wasn't the first cipher to use inversion [also known as ... You want a sbox with a good hardware footprint, ... make the design harder to analyze. ... makes the key schedule resistant to related key attacks]. ...
    (sci.crypt)
  • Re: AES: basic question on SBoxes
    ... > If I was to change the contents of the SBox and fill it up with 256 ... > the cipher? ... You can find about the design of AES in the ...
    (sci.crypt)
  • Re: A revised "FFT" hash function.
    ... I use a different mixing network for the sbox. ... The NLO is now 7 not 5. ... I've also lowered the round count to 10 because I strongly disbelieve that a ... Mads has expressed interest in "papering" up the design [I wrote it for him ...
    (sci.crypt)