Multiplicative complexity of bijective 4×4 S-boxes

Abstract

Multiplicative complexity of S-box is the minimum number of 2-input AND-gates required to implement the S-box in AND, XOR, NOT logic. We show that under an affine equivalence there is only a single class of bijective n×n S-boxes with multiplicative complexity 1. Furthermore, we show that each bijective 4×4 S-box has multiplicative complexity at most 5. Finally, we refine the bounds on the multiplicative complexity of each affine class of bijective 4×4 S-boxes.

Appendix

1.1 List of S-boxes

For each class of S-box we list its number according to [1] (we only list class number), its representative in hexadecimal notation (first normalized S-box in lexicographic order, prefix 01234 was removed to compress space), (upper bound on) multiplicative complexity, and the constructive proof of MC. The proof is either by composition of two S-boxes with lower MC, or by writing down coefficients of expansion-compression construction for an S-box in the given class (we do not provide a proof of affine equivalence with the representative). The expansion-compression proof was required for 2 S-boxes with M C(S)=2, 5 S-boxes with M C(S)=3, and 25 S-boxes with M C(S)=4.

The format of expansion-compression proof:

• 1. Four (single-digit) hex numbers encode vectors c ⁿ⁺¹⋯c ⁿ⁺⁴,

• 2. Eight (two-digit) hex numbers encode vectors b ₁,b ₂ for E ₄,E ₅,E ₆,E ₇.

Table 3

The format of composition proof S ₂∘A∘S ₁:

• 1. S ₁ is representative of the first listed class;

• 2. A is always linear transformation, encoded by 4 hexadecimal numbers, the images of 1,2,4,8 in this order (1 encodes e ⁽¹⁾).

• 3. S ₂ is representative of the second listed class;

Table 4