Recovering S-boxes from the Differential Distribution Table and Aﬃne Equivalence Classes of S-boxes with Respect to Modular Addition

Yershov, StepanYakovliev, Serhii2026-02-262026-02-262025Yershov, S. Recovering S-boxes from the Differential Distribution Table and Aﬃne Equivalence Classes of S-boxes with Respect to Modular Addition / Stepan Yershov, Serhii Yakovliev // Theoretical and Applied Cybersecurity: scientific journal. – 2025. – Vol. 7, No. 2. – P. 44-52. – Bibliogr.: 19 ref.https://ela.kpi.ua/handle/123456789/79067This paper considers the problem of S-box recovery from its differential distribution table (DDT)with respect to modular addition. We describe the structure of DDT for affine S-boxes and affinetransformations of S-boxes. We found some unexpected internal symmetry in DDT w.r.t. modularaddition, which holds for other algebraic operations, but not for bitwise addition (XOR). We describetwo classes of affine transformations (affine shifts) which preserve the structure of DDT. For a recoveryof S-box from its DDT we propose a backtracking-based algorithm, which is moderately effective formedium-size S-boxes. We apply our algorithm for three-bit S-boxes and describe the structure of theirDDT equivalence classes; among other things, it was shown that affine shifts do not cover all DDTequivalence class members.ensymmetric cryptographyS-boxdifferential cryptanalysisdifference distribution tableDDTS-box recoveryaffine equivalencybacktrackingRecovering S-boxes from the Differential Distribution Table and Aﬃne Equivalence Classes of S-boxes with Respect to Modular AdditionArticleP. 44-52https://doi.org/10.20535/tacs.2664-29132025.2.328960003.26:512.5