Recently it was observed that for a particular nonzero in- put dierence to an S-Box, some bits in all the corresponding output dierences may remain invariant. These specic invariant bits are called undisturbed bits. Undisturbed bits can also be seen as truncated dier- entials with probability 1 for an S-Box. The existence of undisturbed bits was found in the S-Box of Present and its inverse. A 13-round improbable dierential attack on Present was provided by Tezcan and without using the undisturbed bits in the S-Box an attack of this type can only reach 7 rounds. Although the observation and the cryptanalytic application of undisturbed bits are given, their relation with other prop- erties of an S-Box remain unknown. This paper presents some results on mathematical properties of S-Boxes having undisturbed bits. We show that an S-Box has undisturbed bits if any of its coordinate functions has a nontrivial linear structure. The relation of undisturbed bits with other cryptanalytic tools such as dierence distribution table (DDT) and linear approximation table (LAT) are also given. We show that autocorrelation table is proven to be a more useful tool, compared to DDT, to obtain all nonzero input dierences that yield undisturbed bits. Autocorrelation table can then be viewed as a counterpart of DDT for truncated dier- ential cryptanalysis. Given an n m balanced S-Box, we state that the S-Box has undisturbed bits whenever the degree of any of its coordinate function is quadratic.
['Rusydi H. Makarim', 'Cihangir Tezcan']
Relating Undisturbed Bits to Other Properties of Substitution Boxes