Low AND Depth and efficient inverses: A guide on S-boxes for low-latency masking

Begül Bilgin, Lauren De Meyer, Sébastien Duval, Itamar Levi, François Xavier Standaert

Research output: Contribution to journalArticlepeer-review

22 Scopus citations


In this work, we perform an extensive investigation and construct a portfolio of S-boxes suitable for secure lightweight implementations, which aligns well with the ongoing NIST Lightweight Cryptography competition. In particular, we target good functional properties on the one hand and efficient implementations in terms of AND depth and AND gate complexity on the other. Moreover, we also consider the implementation of the inverse S-box and the possibility for it to share resources with the forward S-box. We take our exploration beyond the conventional small (and even) S-box sizes. Our investigation is twofold: (1) we note that implementations of existing S-boxes are not optimized for the criteria which define masking complexity (AND depth and AND gate complexity) and improve a tool published at FSE 2016 by Stoffelen in order to fill this gap. (2) We search for new S-box designs which take these implementation properties into account from the start. We perform a systematic search based on the properties of not only the S-box but also its inverse as well as an exploration of larger S-box sizes using length-doubling structures. The result of our investigation is not only a wide selection of very good S-boxes, but we also provide complete descriptions of their circuits, enabling their integration into future work.

Original languageEnglish
Pages (from-to)144-184
Number of pages41
JournalIACR Transactions on Symmetric Cryptology
Issue number1
StatePublished - 2020

Bibliographical note

Publisher Copyright:
© 2020, Ruhr-Universitat Bochum. All rights reserved.


  • AND depth
  • Lightweight cryptography
  • Masking
  • Multiplicative complexity
  • S-box


Dive into the research topics of 'Low AND Depth and efficient inverses: A guide on S-boxes for low-latency masking'. Together they form a unique fingerprint.

Cite this