(Igor Sikorsky Kyiv Polytechnic Institute, 2025) Yershov, Stepan; Yakovliev, Serhii
This paper considers the problem of S-box recovery from its differential distribution table (DDT)with respect to modular addition. We describe the structure of DDT for affine S-boxes and affinetransformations of S-boxes. We found some unexpected internal symmetry in DDT w.r.t. modularaddition, which holds for other algebraic operations, but not for bitwise addition (XOR). We describetwo classes of affine transformations (affine shifts) which preserve the structure of DDT. For a recoveryof S-box from its DDT we propose a backtracking-based algorithm, which is moderately effective formedium-size S-boxes. We apply our algorithm for three-bit S-boxes and describe the structure of theirDDT equivalence classes; among other things, it was shown that affine shifts do not cover all DDTequivalence class members.