{"id":"7f9203d5-7f91-4d05-a4ea-979bfbba6f5e","arxiv_id":"1908.09168","paper_version":2,"verdict":"CONDITIONAL","confidence":"MODERATE","novelty_score":3.0,"correctness_risk":"medium","formal_verification":"none","parameter_count":0,"one_line_summary":"Scrambling an S-box's input and output coordinates yields (n!)^2 key-dependent clone S-boxes that retain the seed's bijection, nonlinearity, SAC, and BIC properties.","lead":"This paper gives an algorithm that starts from one S-box and creates many key-dependent S-boxes by scrambling the input and output positions, while keeping four standard cryptographic properties unchanged. It is relevant to cipher designers who want dynamic S-boxes with a larger key space but no loss in known security metrics.","discovery_kind":"extension","skeptic_critique":{"model":"deepseek-v4-flash","headline":"Distinctness of the claimed (n!)^2 clone S-boxes is asserted, not proved, and is false in general because seeds with coordinate-permutation symmetries produce collisions.","rationale":"I read the paper in good faith and checked the central preservation claim first. Theorem 3.3 is correct: the row permutation Q1 is uniquely determined by the column permutation P1 through the identity table, and Q1YP2 is precisely a coordinate permutation on the input bits followed by a coordinate permutation on the output bits of Y. Such a transformation preserves bijection, nonlinearity, SAC, and BIC; the cited lemmas are applied correctly. The paper's principal mathematical result therefore stands. The genuinely load-bearing defect is the distinctness count. The abstract promises (n!)^2 clone copies, and the practical value of a key-dependent S-box depends on how many distinct S-boxes the key can actually select. Distinctness requires that the map from permutation pairs to transformed S-boxes be injective, i.e., that the seed has no nontrivial coordinate-permutation stabilizer. No such proof is given, and the identity S-box is a clean counterexample: because Q1X=XP1, all pairs with the same product P1P2 produce the same output, so the number of distinct clones is n!, not (n!)^2. For arbitrary seeds, collisions are not excluded. The authors' verification for one n=4 seed is evidence only for that seed; the n=8 claim is presented without an equivalent verification. The reader's weakest assumption identified exactly this injectivity problem, and I agree it is the most important issue. The fixed-point-removal claim and Maple code errors are real but secondary; they do not touch the core theorem. For these reasons I would keep the verdict conditional: the preservation theorem can be accepted, but the announcement of the effective key space must be corrected to include, or be derived from, the stabilizer of the seed, and the fixed-point-removal step needs an existence proof or at least a clearly stated heuristic.","tokens_in":13485,"tokens_out":8535,"duration_ms":95861,"concrete_test":"Exhaustively enumerate all 576 pairs (σ1,σ2) in S_4×S_4 for the 4×4 seed in Eq. 4.3 and count distinct S-boxes Q1YP2; if fewer than 576, the paper's own example contradicts the (4!)^2 claim. Repeat for the identity seed X, which should give only 24 distinct outputs. For the n=8 AES seed, compute the coordinate-permutation stabilizer size by backtracking search over S_8×S_8; a nontrivial stabilizer or any detected collision invalidates the claimed 8! distinct copies per fixed column permutation.","verdict_should_be":"UNCHANGED","load_bearing_attack":"The preservation theorem (Theorem 3.3) is sound: Q1 is exactly the row permutation induced by the input coordinate permutation P1, so Q1YP2 applies a coordinate permutation to input bits and to output bits, and Lemmas 2.4 and 2.5 transfer nonlinearity and SAC while bijection and BIC are immediate. The load-bearing weakness is the paper's key-space claim that every pair (σ1,σ2) yields a distinct clone, giving (n!)^2 S-boxes. This is asserted in the abstract, in Remark 4.2, and in the discussion before Example 4.3, but it is never proved. The map (P1,P2) ↦ P2∘Y∘P1 is injective only if the coordinate-permutation stabilizer of Y is trivial. For the identity seed Y=X, the construction gives Q1XP2 = XP1P2, so the result depends only on the product P1P2; there are only n! distinct S-boxes, not (n!)^2. Thus the claimed count cannot hold for arbitrary initial S-boxes as Theorem 3.3 states. For the particular 4×4 seed in Eq. 4.3 the authors report having verified 576 distinct outputs, but no such verification is reported for the AES seed, and no general stabilizer argument is given. Since the dynamic key space is the practical motivation of the paper, the unsupported distinctness claim is the central concern; the secondary fixed-point-removal claim in steps 10–11 is also unproved, but the count is the more load-bearing issue.","agreement_with_reader":"agree"},"referee_report":{"model":"deepseek-v4-flash","summary":"The paper proposes a method for generating key-dependent S-boxes, called clone S-boxes, by applying two permutations to an initial seed S-box: one permutation acts on the input-coordinate bits and is realized as a row permutation Q1 through the identity S-box X, and the second permutation P2 permutes the output columns. The central claim, Theorem 3.3, is that Q1 Y P2 is a new S-box with the same algebraic properties as the seed Y: bijection, nonlinearity, the strict avalanche criterion (SAC), and the bits independence criterion (BIC). The proof argues that row permutation by Q1 is equivalent to an input coordinate permutation and that the cited invariance lemmas transfer nonlinearity and SAC, while bijection and BIC are preserved. The paper includes a Maple implementation, worked examples for n=4 and n=8, and tables comparing the four metrics of the seed and clone S-boxes. The abstract and Section 4 further claim that the method generates (4!)^2 distinct clones for the n=4 seed and, for n=8, 8! clones per column permutation, and that fixed points and reverse fixed points can be removed while preserving the algebraic properties.","tokens_in":13848,"tokens_out":5350,"duration_ms":61103,"significance":"If the main claims hold, the paper offers a simple and computationally cheap method for producing dynamic key-dependent S-boxes whose nonlinearity, SAC, and BIC exactly match a strong seed such as the AES S-box, directly addressing the concern in [2] that key-dependent variations degrade nonlinearity. The invariance proof in Theorem 3.3 is mathematically sound and rests on standard, correctly cited lemmas; there is no parameter fitting or circularity. The reproduction of the reported metric tables for the two examples is a useful sanity check. However, two load-bearing claims are not established: the claimed count of (n!)^2 distinct clone S-boxes, and the guaranteed removal of fixed points by the loop in steps 10-11. Since the practical motivation is a large key-dependent space of distinct S-boxes, the unproved distinctness assertion limits the paper's significance as it stands.","major_comments":[{"comment":"The claim that the method generates (4!)^2 = 576 distinct S-boxes for the n=4 seed, and by extension (n!)^2 clones for n=8, requires injectivity of the map (P1,P2) → Q1 Y P2. Injectivity is asserted but never proved, and it is false in general. For the identity seed Y = X, Q1 X P2 = X P1 P2, so the output depends only on the product P1P2; there are n! distinct clones, not (n!)^2. The authors verified 576 outputs for the particular 4×4 seed, but no such verification is reported for the AES seed, and no stabilizer argument is given to rule out collisions for arbitrary seeds. Because the size of the effective key space is the main practical selling point, this gap must be fixed, either by proving the count under explicit conditions on Y or by revising the claims to state the actual number of distinct clones for the presented seeds.","section":"Abstract and Remark 4.2"},{"comment":"The fixed-point and reverse-fixed-point removal loop is not justified. The paper asserts that if the initial S-box has fixed points, 'the algorithm can be applied to obtain improved clone versions where all the fixed points and reverse fixed points are removed,' but no proof is given that for an arbitrary bijective S-box Y there exist permutations σ̄1, σ̄2 such that the resulting clone has no fixed points, nor is there a termination argument for the loop. The set of allowed row permutations is restricted to bit-coordinate permutations, not all permutations of {0,1}^n, so the existence of a derangement in the full symmetric group does not by itself imply the existence of a fixed-point-free clone in this restricted class. The authors should either prove the existence, provide a concrete termination bound, or state the condition under which the loop is guaranteed to succeed.","section":"Algorithm steps 10-11 and Section 4 opening paragraph"}],"minor_comments":[{"comment":"There are several wording and typographical issues: 'To generated (4!)^2 clone copies' should read 'To generate', and the phrase 'initial n×n s-box' should be 'initial n-bit s-box' or '2^n×n s-box' to avoid confusing the S-box size with the permutation size.","section":"Abstract and page 2"},{"comment":"The Maple procedure FIXP hardcodes the reverse fixed-point condition as 'S[i]=255-(i-1)', which is specific to n=8; for general n this should be 2^n-1-(i-1) or should be parameterized by n. The main text also never defines 'reverse fixed point' before using it in step 10.","section":"Appendix, Listing 5"},{"comment":"The phrase 'Simillarly' in Example 4.3 is a typo, and the text would benefit from a statement of whether the AES-seed clone was checked for distinctness against all other generated clones, since Remark 4.2 reports such a check only for the n=4 seed.","section":"Section 4 and Example 4.3"}],"recommendation":"major_revision","confidential_remarks":"The core invariance result is correct, and the paper is not circular or dishonest; the problem is that the advertised key-space size and the fixed-point-removal guarantee are unsupported. These are fixable in revision: the authors can either prove the distinctness count for seeds with trivial stabilizer and report a computational check for the AES seed, or scale back the claims to what is actually proved. I would not reject the paper, but I would require the distinctness issue to be resolved before acceptance, because the (n!)^2 count appears in the abstract and in the motivation for the method."},"author_rebuttal":null,"desk_editor":{"model":"deepseek-v4-flash","letter":"The core of this paper is a correct and pleasantly simple observation: if you permute the input bits and output bits of an S-box in the specific way they define, the four classical metrics—bijection, nonlinearity, SAC, and BIC—are preserved. The proof via the identity-sbox relation Q1X = XP1 is tidy, and the lemmas from Pieprzyk et al. transfer cleanly. For someone who wants key-dependent S-boxes without degrading these properties, this gives a cheap way to generate many candidates from a trusted seed. The examples for n=4 and n=8 check out, and the tables match.\n\nThe soft spot is the headline count. The abstract and Remark 4.2 claim (n!)^2 distinct clones, but the paper never proves injectivity of the map (σ1,σ2) → Q1YP2. That map has collisions whenever the seed has a nontrivial coordinate-permutation stabilizer. The identity seed is a concrete counterexample: Q1XP2 = XP1P2, so you only get n! distinct outputs, not (n!)^2. The authors verify 576 distinct outputs for the 4×4 Adams–Tavares seed, but that is a check, not a proof, and for the AES seed no such check is reported. Since the effective key space is the main selling point, this is a real flaw, not a minor omission. They should either prove a stabilizer bound or lower the claim to \"at most (n!)^2, typically much fewer.\"\n\nThe fixed-point-removal steps (10–11) are also asserted without proof. I don't doubt they can be made to work, but as written there is no termination argument and no proof that the updated permutations preserve the claimed properties. That section needs a rewrite or a clear statement of scope.\n\nThe Maple code has minor issues (the BLmatrix procedure uses convert base 10 to 2, which is not correct for all inputs), but that is cosmetic.\n\nOverall: the central preservation theorem is sound and useful as a practical recipe, but the paper overstates the key space. With a corrected count and a proper treatment of the fixed-point loop, it would be publishable. I'd send it to a referee; the referee should ask for these changes, not for a rejection.","headline":"Sound preservation theorem, but the claimed (n!)^2 distinct clone S-boxes is unproved and false in general; the paper needs a corrected key-space bound before it is publishable.","tokens_in":14336,"tokens_out":2447,"would_cite":false,"duration_ms":24363,"reading_group":"maybe","serious_thinker":"yes","would_accept_peer_review":true},"rs_alignment":null,"lean_confirmation":null,"pith_extraction":{"msc":["94A60","06E30","20B35"],"pacs":[],"model":"deepseek-v4-flash","headline":"Two key-derived permutations applied to an S-box's rows and columns produce clone S-boxes whose bijection, nonlinearity, SAC, and BIC are identical to the seed.","keywords":["Cryptography","Key-Dependent s-boxes","Permutation","Bijection","Nonlinearity","Strict avalanche criterion","Bits independence criterion","Invariant"],"falsifier":"Enumerate all (n!)^2 pairs for the n=4 seed S-box from Example 4.1 and compare the resulting vectors; if two different pairs produce the same S-box, the claimed clone count is false. The same enumeration on a randomly chosen n=5 or n=6 seed would also test whether the metric-preservation theorem holds outside the two examples.","tokens_in":13318,"feed_emoji":"🔐","tokens_out":9072,"duration_ms":84198,"temperature":0.7,"pith_summary":"Dynamic S-boxes improve a cipher's resistance to linear and differential attacks, but earlier key-dependent designs do not keep nonlinearity invariant. This paper claims to close that gap: apply one permutation to the columns and another to the rows of an S-box's bit matrix, and the result is a new S-box whose bijection, nonlinearity, strict avalanche criterion (SAC), and bit independence criterion (BIC) are identical to the seed. The construction is algorithmic, with the two permutations extracted from the key, and a proof of invariance is given for all four metrics. If the claim is correct, a designer can take one strong S-box, such as the AES S-box, and generate many key-dependent variants without re-running expensive metric evaluations.","feed_headline":"Cloning S-boxes: row and column swaps keep all four strength metrics","feed_subtitle":"Key-derived copies preserve bijection, nonlinearity, SAC, and BIC of the seed S-box.","key_machinery":"The load-bearing object is the transformation Q1 Y P2, assembled from the identity S-box X and two key-derived permutation matrices P1 and P2, with Q1 the 2^n×2^n row-permutation matrix that satisfies Q1 X = X P1. This identity is what turns an abstract row permutation of the S-box's bit matrix into a concrete permutation of the input coordinates, x ↦ x P1, so the known invariance of nonlinearity and SAC under nonsingular affine input changes transfers directly to the clone. The group action is S_n on the columns and the induced image of S_n inside S_{2^n} on the rows, which is why the paper counts (n!)^2 candidate clones.","core_discovery":"The central claim, Theorem 3.3, is that for any n×n S-box Y and any two n×n permutation matrices P1,P2, the 2^n×n bit matrix Q1 Y P2 is an S-box with the same bijection, nonlinearity, SAC, and BIC as Y, where Q1 is the 2^n×2^n permutation matrix determined by the identity S-box X through the identity Q1 X = X P1. The column factor P2 simply relabels the output bits, so it plainly preserves all four metrics; the row factor Q1 is the subtle part. Because Q1 X = X P1, permuting the rows of the truth-table matrix is the same as permuting the coordinates of the input x to x P1, and the standard lemmas on affine input changes carry the nonlinearity and SAC invariance, while applying the same lemmas to fj⊕fk carries BIC. The paper verifies the construction on the n=4 seed S-box used in Example 4.1 for all 576 permutation pairs and on the n=8 AES S-box for one pair, reporting metric tables that match the seeds exactly.","pith_inferences":["The row permutation Q1 is not an arbitrary member of S_{2^n}: it is the image of S_n acting on input coordinates through the identity S-box. The family generated is therefore an orbit of the seed under a group isomorphic to S_n × S_n, a subgroup of the affine group, not under all input/output permutations.","The claimed (n!)^2 distinct clones presupposes that different pairs (P1,P2) give different S-boxes; the paper reports checking this for the n=4 example, but a general injectivity proof is not given, so the effective key space could be smaller for symmetric seeds.","Because the clone is related to the seed by an input coordinate permutation and an output bit permutation, the construction is metric-preserving but not metric-improving: it cannot raise nonlinearity above the seed's value, only produce many equally strong variants.","A natural stress test is to apply the construction to random S-boxes of size n=5 or n=6 and compare full nonlinearity, SAC, and BIC tables; if invariance ever fails outside the two worked examples, the theorem's scope would need qualification."],"forward_implications":["A single strong static S-box can be expanded into a large family of key-dependent S-boxes whose four standard metrics are exactly those of the seed, so designers do not need to regenerate and re-test S-boxes for each key.","For an n×n S-box the construction yields (n!)^2 clones in the paper's count; for n=8 this is (8!)^2 ≈ 1.6×10^9 candidates from one AES seed.","If the seed has fixed points or reverse fixed points, the algorithm's update step produces clone S-boxes without those points while preserving the four metrics, addressing the exploitable weakness discussed in the paper's Sec. 4.","The method directly answers the earlier finding that key-dependent Rijndael variants do not keep nonlinearity invariant: the generated clones preserve nonlinearity exactly."],"supporting_citations":[{"why":"Supplies the Hamming-weight criterion for bijectivity and the n=4 seed S-box used in the worked example.","marker":"[7]"},{"why":"Supplies the lemmas that nonlinearity and SAC are invariant under nonsingular affine input transformations, the core of the row-permutation proof.","marker":"[36]"},{"why":"Defines the strict avalanche criterion and bit independence criterion whose preservation is the paper's main result.","marker":"[37]"},{"why":"Supplies the AES S-box used as the n=8 seed in the second worked example.","marker":"[38]"},{"why":"Records the motivating problem that key-dependent Rijndael variants do not keep nonlinearity invariant.","marker":"[2]"},{"why":"Presents the earlier S8-permutation-plus-XOR cloning method that this paper extends by adding row permutations.","marker":"[6]"},{"why":"Establishes the earlier S8 column-permutation construction whose count is the column factor in (n!)^2.","marker":"[3]"},{"why":"Extends the S8 column-permutation method to affine-power-affine S-boxes, providing the prior template for clone generation.","marker":"[4]"}],"fun_headline_variants":["S-box cloning: row-column swaps preserve all key metrics","Key-dependent S-boxes: identical properties via row/column permutations","Row-column swaps replicate S-box strength metrics","S-box clones keep all four strength metrics","New method: clone S-boxes with unchanged algebraic properties"],"cache_read_input_tokens":3200,"weakest_assumption_plain":"The paper's advertised key space of (n!)^2 distinct clones assumes that different key-derived permutation pairs always produce different S-boxes; this injectivity is stated but not proven, and a collision would shrink the effective key space.","fun_headline_variants_meta":{"raw":{"variants":["S-box cloning: row-column swaps preserve all key metrics","Key-dependent S-boxes: identical properties via row/column permutations","Row-column swaps replicate S-box strength metrics","S-box clones keep all four strength metrics","New method: clone S-boxes with unchanged algebraic properties"]},"model":"deepseek-v4-flash","effort":"low","cost_usd":0.001543,"raw_usage":{"total_tokens":6283,"prompt_tokens":1168,"completion_tokens":5115,"prompt_tokens_details":{"cached_tokens":384},"prompt_cache_hit_tokens":384,"prompt_cache_miss_tokens":784,"completion_tokens_details":{"reasoning_tokens":5038}},"tokens_in":784,"tokens_out":5115,"duration_ms":31088,"temperature":1.0,"reasoning_tokens":5038,"cache_read_input_tokens":384,"cache_creation_input_tokens":0},"cache_creation_input_tokens":0},"created_at":"2026-08-14T11:20:13.166445+00:00","model_set":{"reader":"deepseek-v4-flash"},"falsifier":"Enumerate all (n!)^2 pairs for the n=4 seed S-box from Example 4.1 and compare the resulting vectors; if two different pairs produce the same S-box, the claimed clone count is false. The same enumeration on a randomly chosen n=5 or n=6 seed would also test whether the metric-preservation theorem holds outside the two examples.","supporting_citations":[{"cited_title":"The Structured Design of Crypto- graphically Good S-Boxes, Journal of Cryptology, 3 (1), pp","cited_arxiv_id":null,"evidence_quote":"Supplies the Hamming-weight criterion for bijectivity and the n=4 seed S-box used in the worked example."},{"cited_title":"and Seberry, J., 2013","cited_arxiv_id":null,"evidence_quote":"Supplies the lemmas that nonlinearity and SAC are invariant under nonsingular affine input transformations, the core of the row-permutation proof."},{"cited_title":"F., Tavares, S","cited_arxiv_id":null,"evidence_quote":"Defines the strict avalanche criterion and bit independence criterion whose preservation is the paper's main result."},{"cited_title":"Daemen, V","cited_arxiv_id":null,"evidence_quote":"Supplies the AES S-box used as the n=8 seed in the second worked example."},{"cited_title":"An Examination of Inefficiencies in Key Dependent Vari- ations of the Rijndael S-Box","cited_arxiv_id":null,"evidence_quote":"Records the motivating problem that key-dependent Rijndael variants do not keep nonlinearity invariant."},{"cited_title":"Neural Computing and Applications","cited_arxiv_id":null,"evidence_quote":"Presents the earlier S8-permutation-plus-XOR cloning method that this paper extends by adding row permutations."},{"cited_title":"Construction of S8 Liu J S-boxes and their applications","cited_arxiv_id":null,"evidence_quote":"Establishes the earlier S8 column-permutation construction whose count is the column factor in (n!)^2."},{"cited_title":"S8 affine-power-affine S-boxes and their applications","cited_arxiv_id":null,"evidence_quote":"Extends the S8 column-permutation method to affine-power-affine S-boxes, providing the prior template for clone generation."}],"review_version":1}