One line of srand48 reproduces two-thirds of the NSA cipher’s lookup table. Here is what that shows, what it doesn’t, and an interactive way to see the difference.
In short. Seeding the POSIX drand48 generator with 48571 and running a simple shuffle produces a table that matches 173 of 256 bytes of Skipjack’s F-table. Neighbouring seeds match 1. The remaining 83 bytes can be fixed with 52 swaps, but those swaps are read off the official table, so they would “fix” any seed. The match is the evidence; the swaps are bookkeeping. One thing the swaps do reveal: they raise nonlinearity from 92 to 100 while differential uniformity gets slightly worse, from 10 to 12.
An interesting Link shows that the CLEFIA S-box and the Rijndael (AES) S-box are affine equivalentâmeaning one can be transformed into the other through invertible affine transformations over the finite field $\mathbb{F}_2^{8}$.
Formally, two functions ( f ) and ( g ) are affine equivalent if there exist invertible affine mappings ( A ), ( B ), and constants ( a ), ( b ) such that:
$$
f(x) = (B \circ g \circ A)(x \oplus a) \oplus b
$$
Pairwise independence may look like a simple probability idea, but it plays an important role in proving the security of block ciphers such as AES.
1. Pairwise Independence and Ideal Permutations
Two random variables are independent if knowing one does not give information about the other. A set of random variables is pairwise independent if every pair is independent, though this does not mean full independence across all of them.
A few years ago, I explored one of my favorite cryptographic building blocks: the substitution box (S-box). Back then, I came across the elegant paper A Very Compact Rijndael S-box, which showed how to eliminate lookup tables by leveraging normal basis representation and logical operations in $F_{2^{8}}$. That approach deeply resonated with meâcompact, efficient, and mathematically sound.
Recently, I decided to revisit that workâbut this time with a new challenge: re-implementing the CLEFIA S-box using the same principles. CLEFIA, Sonyâs lightweight block cipher, uses two $8 \times 8$ S-boxes ($S_0$ and $S_1$), and I focused on reconstructing Sâ using field inversion and affine transformationsâall without tables.