Posts on

Skipjack's S-box and Seed 48571

Sun, 18 Oct 2026 08:00:00 +0400

One line of srand48 reproduces two-thirds of the NSA cipher’s lookup table. Here is what that shows, what it doesn’t, and an interactive way to see the difference.

In short. Seeding the POSIX drand48 generator with 48571 and running a simple shuffle produces a table that matches 173 of 256 bytes of Skipjack’s F-table. Neighbouring seeds match 1. The remaining 83 bytes can be fixed with 52 swaps, but those swaps are read off the official table, so they would “fix” any seed. The match is the evidence; the swaps are bookkeeping. One thing the swaps do reveal: they raise nonlinearity from 92 to 100 while differential uniformity gets slightly worse, from 10 to 12.

Rediscovered Affine Equivalence Between CLEFIA and Rijndael S-boxes

Wed, 15 Oct 2025 19:30:00 +0400

An interesting Link shows that the CLEFIA S-box and the Rijndael (AES) S-box are affine equivalent—meaning one can be transformed into the other through invertible affine transformations over the finite field $\mathbb{F}_2^{8}$.

Formally, two functions ( f ) and ( g ) are affine equivalent if there exist invertible affine mappings ( A ), ( B ), and constants ( a ), ( b ) such that:

$$ f(x) = (B \circ g \circ A)(x \oplus a) \oplus b $$

Understanding Pairwise Independence in Cryptography

Sun, 07 Sep 2025 16:00:00 +0400

Pairwise independence may look like a simple probability idea, but it plays an important role in proving the security of block ciphers such as AES.

1. Pairwise Independence and Ideal Permutations

Two random variables are independent if knowing one does not give information about the other. A set of random variables is pairwise independent if every pair is independent, though this does not mean full independence across all of them.

Implementation of CLEFIA S-box Using Normal Basis — Inspired by A Very Compact Rijndael S-box

Fri, 18 Apr 2025 14:00:00 +0400

A few years ago, I explored one of my favorite cryptographic building blocks: the substitution box (S-box). Back then, I came across the elegant paper A Very Compact Rijndael S-box, which showed how to eliminate lookup tables by leveraging normal basis representation and logical operations in $F_{2^{8}}$. That approach deeply resonated with me—compact, efficient, and mathematically sound.

Recently, I decided to revisit that work—but this time with a new challenge: re-implementing the CLEFIA S-box using the same principles. CLEFIA, Sony’s lightweight block cipher, uses two $8 \times 8$ S-boxes ($S_0$ and $S_1$), and I focused on reconstructing S₁ using field inversion and affine transformations—all without tables.