Classification of 4-bit S-Boxes for BOGI Permutation

Bad Output must go to Good Input (BOGI) is the primary design strategy of GIFT, a lightweight block cipher that was presented at CHES 2017. Because this strategy obviates the need to adhere to the required conditions of S-boxes when adopting bit-permutation, cryptographic designers have more S-box choices. In this paper, we classify all 4-bit S-boxes that support BOGI, called 'BOGI-applicable S-boxes,' and evaluate them in terms of the cryptographic strength and efficiency. First, we exhaustively show that only 2413 Permutation- XOR-Equivalence (PXE) classes over 4-bit S-boxes are BOGI-applicable. After refining the PXE classes with respect to the differential uniformity ( $\mathcal {U}$ ) and linearity ( $\mathcal {L}$ ), we suggest 20 'Optimal BOGI-applicable' PXE classes that provide the best ( $\mathcal {U}$ , $\mathcal {L}$ ). Our security evaluations revealed that all optimal BOGI-applicable S-boxes fulfill the security properties considered by the designers of GIFT and that the differences between them exist in the other properties. Moreover, we explore the resistance of GIFT variants against differential and linear cryptanalysis by replacing the existing S-box with other optimal BOGI-applicable S-boxes. Based on the results, we identify the best attainable resistance with the bit-permutation of GIFT-64. Lastly, we suggest notable S-boxes that support competitive performance, jointly considering the cryptographic strength and efficiency for GIFT-64 and GIFT-128 structures, respectively.