S盒的二次方程及一个新的设计准则

Quadratic Equations on S-Boxes and a New S-Box Design Criterion

S盒是许多分组密码算法中唯一的非线性部件,它的密码强度决定了整个密码算法的安全强度.文中从理论上分析了S盒中二次方程的存在条件,证明了高级加密标准AES密码的S盒在有限域GF(28)上存在55个线性无关的二次方程,并给出了GF(28)上的这些二次方程.为了防止利用这些二次方程进行的代数攻击,如XSL攻击,文中提出了一个新的S盒设计准则,通过该准则设计的S盒不存在任何可被代数攻击所利用的二次方程.

As the only nonlinear component in most block ciphers, S-box is responsible for the security of block ciphers. In this paper, the existence of the quadratic equations on S-boxes is theoretically analyzed, and 55 linearly independent quadratic equations on the S-box of the Advanced Encryption Standard （AES） are proved existent in the GF（2^8） region. All these equations are then given in the paper. Moreover, in order to avoid the algebraic attacks using these equations, such as the eXtended Sparse Linearization （XSL） attack, a new S-box design criterion is presented. In the new S-box there exists no quadratic equation that may be used for algebraic attacks.