Seven S-Boxes on Trial: Scoring a Cipher's Power Leak

The computer below hides a secret number from 0 to F. Each “measurement” is a random input passing through the S-box together with the secret, and the chip’s power reading rises with the number of 1s in the S-box’s answer, plus random noise. The attacker tries all 16 possible secrets and asks which one best explains the readings. Press Add 10 a few times: one bar pulls ahead of the rest, and Reveal the secret shows whether it found the right one.

For each guess, the attacker looks up what the S-box would output and counts its 1s (its Hamming weight). The bar shows how closely those predicted counts track the noisy readings, as a correlation from −1 to 1. The right guess predicts the readings well; wrong guesses only partly agree. Slide the noise up and the attacker needs more measurements to see the winner, which is why real attacks collect many traces.

Each measurement is L = HW(S[x ⊕ k]) + N(0, σ²) for a uniform input nibble x and a fixed secret k. For every guess g, the page keeps running sums and computes Pearson’s r between HW(S[x ⊕ g]) and L (Eq. 1). A wrong guess g correlates with the truth through the S-box’s structure, so the S-box changes how far apart the bars sit. This single-nibble view is the inner loop of the paper’s attack, which repeats it for all 16 nibbles of a round key.

The Hamming weight of a uniform nibble has variance 1, so the correlation between one measurement and the correct prediction is at most 1/√(1 + σ²), or 0.55 at the default σ = 1.5. Wrong-key correlations depend on ρ(δ), the correlation between HW(S[x]) and HW(S[x ⊕ δ]); for the seven S-boxes its largest value over δ ≠ 0 ranges from 0.25 (PICCOLO, S1) to 0.50 (PRESENT, S3, S4). The demo’s leakage is simulated; it isolates the S-box from everything else a real device leaks.

GIFT-64 scrambles 64 bits of data in 28 rounds. Each round runs every four-bit piece through the S-box, shuffles the bits, and mixes in part of the key. The first round adds key material only at its end, so the attacker can compute everything before that point. The highlighted row, the S-boxes of round two, is the first place where the secret affects the chip’s work, and that is where the paper listened.

Each row shows the 16 hexadecimal digits of the cipher’s state after one step. Change one digit of the plaintext and watch how many digits change by the end of round two. Then pick another S-box: the steps stay the same, only the lookup table changes, which is exactly how the paper built its seven test ciphers.

GIFT-64 rounds are SubCells (16 parallel 4-bit S-boxes), PermBits (a fixed bit permutation), and AddRoundKey, which XORs 32 key bits into bits 4i and 4i + 1 of each nibble, plus a 6-bit round constant and a fixed 1 in bit 63. The attacker knows x = PermBits(SubCells(plaintext)) and targets HW(S[x ⊕ m]) in round two, where m is the round-1 key-and-constant mask (shown at undergraduate level and up). Guessing all 16 values of each nibble of m recovers the constants along with the key bits, as the paper notes. Since each round key carries only 32 key bits, four consecutive round keys (rounds 2 to 5) are needed to invert the key schedule and recover all 128 bits.

The engine follows the designers’ reference implementation (giftcipher/gift, MIT License) and reproduces every line of their three GIFT-64 test vectors, round by round, and all 158,200 round states from the reference code compiled with each of the seven S-boxes on 200 random inputs. Designers’ test vector loads test vector 3; with the GIFT S-box, every row matches the published file. The paper’s implementation stores nibbles in 8-bit variables, and its round-2 to round-5 points of interest correspond to the highlighted row in rounds two through five.

Each row is one S-box, and each column is one way researchers have tried to predict, with pencil and paper, how easily an S-box leaks. Your device computes them all from the 16-entry tables. Non-linearity measures how far the table is from simple, predictable arithmetic: PICCOLO, GIFT, and PRESENT score 4, the best possible for four bits, while S1, S3, and S4 score 0. Click a row to see its table, or type your own 16 digits.

Try typing 0123456789ABCDEF, the S-box that changes nothing. It scores 0 for non-linearity, because each output bit is simply an input bit. Now look at S4, which adds one to every input (0 becomes 1, F wraps around to 0), and S3, which subtracts every input from 16 (0 stays 0). Both also score 0: a few of their output bits follow a simple rule an attacker can predict exactly. Ciphers need high non-linearity to resist mathematical attacks; the paper asks what that choice does to the power leak.

NL = 2ⁿ⁻¹ − max|W_F(u, v)|/2 over nonzero output masks v (Eq. 6), using the Walsh transform of Eq. 2. TO (Eq. 3) measures how well the derivative of the S-box lets a Hamming-weight model separate keys; higher TO means more exposure, with a maximum of n = 4. RTO (Eq. 4) rebuilds TO from the cross-correlation spectrum of Eq. 5, and DPA-SNR (Eq. 8) estimates the signal a DPA attack sees through the S-box. The values in parentheses are the paper’s Table II; 26 of the 28 deterministic cells match, and the two S2 cells that do not are highlighted.

Differential uniformity (the largest entry of the difference distribution table) is added for context: 4 for PICCOLO and PRESENT, 6 for GIFT, 8 for S2, 10 for S1, and 16 for S3 and S4, whose affine components (output masks v = 1, 2, and 3) make them unusable against classical cryptanalysis, as the paper intends. The Walsh heat map shows where the largest coefficients sit; NL = 8 − (largest |W| outside row 0)/2. S3 and S4 share identical TO, RTO, and DPA-SNR despite different tables, a tie the paper’s Figure 6 then separates experimentally.

This demo repeats the attack 100 times for each S-box, as the paper did, and draws how often it succeeds as the attacker collects more measurements. The curves come from simulated measurements on your device, not from the paper’s chip. In the paper’s real measurements, PICCOLO fell fastest and the low-scoring S3 held out longest. In the simulation the order changes: here the curves follow a different score, DPA-SNR, which suggests the real chip leaked in ways the simple model leaves out.

Each experiment adds one trace at a time from a pool of 2,000, runs the attack after each addition, and counts a success only when all 16 nibbles of the round key come out right. After five successes in a row, the experiment stops and counts the rest as successes. Averaging 100 experiments gives the mean success rate at each trace count. With the default noise and seed, PICCOLO reaches 50 percent at 36 traces and PRESENT at 47.

Algorithm 1 draws traces without replacement from a fixed pool, attacks after each, and stops after five consecutive full-key successes (the remaining counts marked successful) or at the cap of 150. Algorithm 2 averages 100 experiments. The page keeps the protocol and replaces the hardware with L_j = HW(S[x_j ⊕ m_j]) + N(0, σ²) for each nibble j, so the only difference between curves is the S-box. Non-linearity 4 and Non-linearity 0 show the same groupings as the paper’s Figures 5 and 6.

The rank-correlation table asks which metric orders the S-boxes by attack effort. Against the paper’s Figure 4 (traces to 50 percent read from the figure: PICCOLO 35, GIFT 36, PRESENT 37, S2 38, S1 and S4 44, S3 50), NL gives Spearman ρ = −0.93 and TO −0.94, with DPA-SNR near zero (−0.10). Against the simulation the pattern reverses: across seeds 1 to 3, DPA-SNR gives −0.75 to −0.92 and NL 0.00 to 0.32. DPA-SNR is derived for exactly the leakage the simulation assumes, so its success there is expected; its failure on hardware points to leakage beyond the Hamming weight of the targeted nibble. These correlations, over only seven S-boxes, are this page’s analysis, not the paper’s.

• Changing only the S-box changed how many power measurements an attacker needed to recover GIFT-64’s key.
• GIFT-64 with the PICCOLO S-box was the easiest to break of the seven versions tested.
• S-boxes with high non-linearity, the property that protects against mathematical attacks, leaked their key faster.
• Two newer scores, transparency order and its revised form, did not by themselves predict which S-box resisted the attack.

• The attack reached a 50 percent success rate after about 35 traces with PICCOLO and about 50 with S3, reading from the paper’s Figure 4.
• Among the three S-boxes taken from real ciphers (non-linearity 4), PRESENT resisted longest and had the lowest SNR.
• Among the three designed S-boxes with non-linearity 0, S3 resisted longest, and its SNR was the lowest of the three.
• Every experiment reached a 100 percent mean success rate before 150 traces.

• Non-linearity predicts CPA effort. S-boxes with NL = 4 (PICCOLO, GIFT, PRESENT) fell faster than S2 (NL = 2), which fell faster than S1, S3, and S4 (NL = 0).
• SNR breaks ties. Within equal NL, lower SNR went with slower attacks: PRESENT among the NL = 4 S-boxes and S3 among the NL = 0 S-boxes.
• TO and RTO fall short. Variations in TO and RTO were not sufficient to ensure practical CPA resistance, and neither SNR variant was a perfect indicator.
• Scope. First-order CPA on an unprotected software implementation; the authors name template, linear regression, and deep-learning attacks, and hardware implementations, as future work.

Billions of small devices (door locks, medical sensors, factory controllers) run lightweight ciphers, and many sit where an attacker could attach a probe. Designers choose S-boxes for strength against mathematical attacks, and this paper shows that the same choice can make the power leak easier to read. A designer who knows that trade-off can add protection where the S-box alone falls short. Ultimately, a cipher is only as strong as the chip that runs it.

Metrics computed from a 16-entry table cost nothing next to a hardware measurement campaign, so a reliable one would let designers screen S-boxes early. The paper’s result tempers that hope: NL, a classical design target, tracked practical CPA resistance better than the purpose-built TO and RTO on this device. Because the S-boxes chosen for strength against linear cryptanalysis were also the most exposed here, the S-box choice alone cannot protect an unprotected software implementation; countermeasures such as masking still carry that load.

The study is a case study by design: one microcontroller, one implementation, seven S-boxes, and one trial per S-box shown. Its finding that NL and SNR outperform TO and RTO holds for first-order Hamming-weight CPA on that platform; it does not establish a general ranking of the metrics. The simulation on this page sharpens the question: under a pure Hamming-weight model, DPA-SNR orders the S-boxes almost perfectly, so the gap between metric and measurement is a statement about the device’s leakage as much as about the metrics. The same authors’ 2022 NIST Lightweight Cryptography Workshop presentation, whose title adds test vector leakage assessment (TVLA) to these metrics, continues the line of work.

Notes from building this page

• Table II reproduces, with one S-box exception. NL, TO, RTO (Eq. 4 as printed), and DPA-SNR reproduce for six of the seven S-boxes. For S2 as printed in Table I, NL (2) and TO (3.4) match, but DPA-SNR computes to 2.685 against 2.946 and RTO to 3.067 against 3.266. Swapping any one of three adjacent pairs of S2 entries (inputs 2 and 3, 6 and 7, or 12 and 13) reproduces all four printed values (NL 2, TO 3.4, RTO 3.267, DPA-SNR 2.946), so Table I likely carries a one-pair transcription slip. The S2′ row in the scoring table uses the first swap. Which S2 ran on the chip is unknown.
• Rounding. TO and RTO in Table II are truncated to three decimals (3.6667 printed as 3.666); DPA-SNR is rounded (2.1286 printed as 2.129).
• RTO form. The printed Eq. 4 puts one absolute value around the double sum over i and j, and that form reproduces Table II. Taking the absolute value for each output bit j before summing, the form this page reads in Li et al. (2020), gives 1.27 to 2.57 for these S-boxes (the “RTO per bit” column). The paper’s RTO values therefore belong to the printed variant.
• Classical SNR is not recomputed. Eq. 7 defines SNR as Var(signal)/Var(noise), a power ratio, but the dB values are described as 20 log(SNR), the amplitude convention; the paper does not say which trace samples define signal and noise. The 34 to 40 dB values cannot be rebuilt from the text.
• Metrics against attack effort. Reading traces to 50 percent from Figure 4 (approximately, to the nearest trace), Spearman correlations across the seven S-boxes are −0.93 for NL, −0.94 for TO, −0.72 for RTO, and −0.10 for DPA-SNR. TO’s ordering of the measured S-boxes is as strong as NL’s, which qualifies the conclusion that TO variations were not sufficient; the paper’s statement concerns S-boxes with equal NL, where TO differences are small. In the simulation, DPA-SNR leads instead (−0.75 to −0.92 over three seeds). Seven S-boxes give little power for any of these correlations.
• Direction of the NL effect. The paper’s sentence “higher non-linearity results in a cryptographic system being more susceptible to SCA attacks” cites Biryukov et al. (2016). Under pure Hamming-weight leakage the page finds no such trend; the measured trend may come from leakage the simple model omits, such as other intermediate values in the 8-bit implementation.
• Figure 4 axis. The figures stop at 80 traces, where S3 sits near 93 percent; the text states that every experiment reached 100 percent before 150 traces.
• What a success means. The paper defines success as recovering “the key.” The simulation counts success as all 16 nibbles of the round-1 key-and-constant mask; the paper’s full attack needs four round keys, so its per-round success criterion may differ.

Try this in class

1. Write the S-box 0123456789ABCDEF in binary. Show that its lowest output bit always equals the lowest input bit, then explain why an attacker could predict that bit perfectly.
2. In the first demo, set the noise to 0 and count how many measurements it takes for the right guess to lead. Repeat at noise 2 and compare.
3. In the last demo, run the trials and record traces to 50 percent for each S-box. Rank them, then compare your ranking with the non-linearity column of the scoring table.