A New Hyperchaotic System-Based Design for Efficient Bijective Substitution-Boxes

In this paper, we present a novel method to construct cryptographically strong bijective substitution-boxes based on the complicated dynamics of a new hyperchaotic system. The new hyperchaotic system was found to have good characteristics when compared with other systems utilized for S-box construction. The performance assessment of the proposed S-box method was carried out based on criteria, such as high nonlinearity, a good avalanche effect, bit-independent criteria, and low differential uniformity. The proposed method was also analyzed for the batch-generation of 8 × 8 S-boxes. The analyses found that through a proposed purely chaos-based method, an 8 × 8 S-box with a maximum average high nonlinearity of 108.5, or S-boxes with differential uniformity as low as 8, can be retrieved. Moreover, small-sized S-boxes with high nonlinearity and low differential uniformity are also obtainable. A performance comparison of the anticipated method with recent S-box proposals proved its dominance and effectiveness for a strong bijective S-box construction.


Introduction
Recent advancements in cloud computing, smart devices, social media, etc., for communication have substantially raised the amount of users' private data. Consequently, the issue of ensuring and maintaining end to end confidentiality of sensitive data has become more prominent than before. To provide data secrecy for storage and communication, block cryptosystems have been playing a crucial role in the past few decades. In modern block ciphers, cryptographically potent S-boxes are meant to serve this purpose to meet Shannon's requirement of confusion. S-boxes are cornerstone components in many substitution-permutation (S-P) networks or Fiestal networks-based block cryptosystems, such as the famous data encryption standard (DES), Blowfish, advanced encryption standard (AES), Anubis, PRESENT, etc. [1]. According to C.E. Shannon, the confusion establishes a correlation between a secret key and the encrypted text such that it is as complicated and intricate as possible [2]. To achieve a strong confusion, applying complicated and highly nonlinear transformations is demanded. The security of block ciphers directly relies on the strength of the S-boxes employed. Therefore, designing methods that are credible to yield strong S-boxes have drawn the attention of security experts and researchers worldwide [3].
An n × n substitution-box takes a small block of n bits and transforms it to an output that is n bits long. It acts as a nonlinear mapping S: {0, 1} n → {0, 1} n [4], and can be viewed as a Boolean vector that consists of n Boolean functions, each in n-variable as S: g n (x)g n−1 (x) . . . . . . g 1 (x), where each g i (x) is a function from {0, 1} n to {0, 1}, and g i (a) = b i for i = 1, 2, . . . . . . , n [5]. A Boolean function g i is balanced if its outputs have an equal distribution of 0's and 1's. A bijective S-box of size n × n, involving balanced component functions, has distinct pre-images in the range [0, 2 n − 1]. The bijectivity of the S-box is verified through the satisfaction of hwt n ∑ i=1 a i g i = 2 n−1 [5], where, hwt() denotes the hamming weight, a i ∈ {0, 1}, and (a 1 , a 2 , . . . , a 8 ) = (0, 0, . . . , 0). Bijective S-boxes of different sizes have significance in many cryptographic primitives and S-P network based ciphers. They have been utilized in many popular ciphers such as AES, PRESENT, ARIA, KASUMI, hash function KECCAK, etc. [1]. Recently, the application of S-boxes has also been investigated for the design of image encryption, video encryption, watermarking, pseudo-random sequence design, etc.
Chaos is a ubiquitous phenomenon in nature that is being widely utilized for numerous applications in various fields of study, such as engineering, mathematics, physics, biology, and so on [6]. It has deterministic and noise-like behavior, and it is present in nonlinear dynamical systems. The generated sequences from chaotic systems are extremely sensitive to their initial conditions, have a long periodicity, ergodicity, and spread spectrum [7]. These features of chaotic systems have a close correlation with properties of cryptography. Therefore, they have been a preferred choice for designing security primitives and cryptosystems in chaos-based cryptography for long time [8].
A dynamical system is said to have a high sensitivity to initial conditions and parameters provided that it has positive Lyapunov exponent(s). The Lyapunov exponent (LE) of a nonlinear dynamical system refers to the pace of separation of infinitesimally close trajectories. Mathematically, it is defined as: where p i (t) denotes the length of the respective ellipsoidal principal axis. An n-D system has n number of Lyapunov exponents. Presence of only one positive exponent indicates the existence of chaotic behavior in a system. Whereas, if it has at least two positive LEs, then the system is hyperchaotic in nature [9]. Simple-structured and one positive LE dynamical systems tend to possess weak security due to a common correlation that allows it to be cryptanalyzed [10]. Compared to chaotic systems, hyperchaotic systems tend to show more complex dynamics. The minimum dimension for a dynamic system to exhibit hyperchaotic nature should be 4-D. The research has matured in the direction of designing higher dimensional hyperchaotic systems and the present focus is on designing 5-D systems with better dynamics and characteristics [10][11][12][13][14][15]. Hyperchaotic systems have found applications in the area of security for realizing cryptosystems [16], hash functions [17], secure communication [18], S-boxes [19], etc. In the recent past, a number of high-dimensional chaotic systems have been utilized to design methods for S-box generation. Of late, Islam et al. investigated a 4-D hyperchaotic system where two pseudo-random 8-bit integer sequences were produced, which gave rise to an S-box after a two-position swap operation [19]. In Reference [20], Özkaynak adopted a Lorenz chaotic system by sampling the system trajectory after gaps of time steps. A coding table was formed, which resulted in an S-box after some shifting operations. The method of Khan et al. [21] explored multiple systems, namely 3D Lorenz and Rössler chaotic systems, to randomly generate all possible elements of an 8 × 8 S-box. The same author investigated a fractional order Rössler chaotic system and suggested a simple method to synthesise S-boxes in Reference [22]. It was noted that their design is consistent for secure communication. Liu et al. [23] applied a 3-D four-wing chaotic system to generate S-boxes with a good performance. In Reference [24], another simple method was developed for S-boxes based on a fractional-order Chen chaotic system. Cavusoglu et al. [25] scaled the 3-D Zhongtang chaotic system to design a random number generator (RNG) for constructing 8 × 8 S-boxes based on this RNG. In this paper, a new high-dimensional hyperchaotic system is explored for generating strong S-boxes. The proposed hyperchaos-based S-box construction method is capable of synthesizing strong bijective S-boxes, and was found to possess excellent cryptographic strength when compared with some recent S-box proposals. The main contributions of this paper include the following:

•
A 5-D hyperchaotic system is proposed that has twelve terms, seven system parameters, and three cubic nonlinear product terms. • Based on the new hyperchaotic system, an S-boxes construction method is proposed to synthesize efficient 8 × 8 S-boxes, and these are compared with recent methods. • Performance of the same method is also investigated for a generation of small-sized bijective S-boxes ranging from size 4 × 4 to 7 × 7, and is compared with some rare and prominent methods.
The remaining content of the paper is as follows. The model of the newly proposed 5-D hyperchaotic system is discussed and analyzed in Section 2. The proposed method for constructing strong S-boxes is presented in Section 3. Performance assessment of proposed method for S-boxes is performed in Section 4 and compared with some of the most recent S-box methods. This section is subsequently followed by conclusions drawn in Section 5.

5-D Hyperchaotic System
Our novel 5-D nonlinear dynamical system is governed by the following state equations: where, c i (1 ≤ i ≤ 7) are the system's seven constants and x(0), y(0), z(0), u(0), w(0) are the initial conditions that decide its trajectories in phase space. Computation of Lyapunov exponents is performed following the well-known procedure reported in Reference [26]. Interestingly, when parameters are set as c i = {30, 10, 15.7, 5, 2.5, 4.45, 38.5}, the obtained Lyapunov exponents for system (2) are LE 1 = 4.90182, LE 2 = 0.38463, LE 3 = 0, LE 4 = −15.86286, and LE 5 = −31.90952, thereby confirming the existence of hyperchaos as there are two positive exponents. The proposed 5-D hyperchaotic system (2) holds some positive characteristics, which are as follows: • It contains three cubic-order nonlinear product terms, which is rare as the order of nonlinear product terms is usually quadratic; this strengthens the system against some parameter identification attacks [27].

•
It has a large number of systems parameters, namely seven; these are with five initial conditions that heavily enlarge the secret key space of the respective security primitive to make brute-force attack impractical.

•
The value of the largest Lyapunov exponent is 4.90182, which is quite high. This value is substantially higher than 0.9899 [10], 0.0981 [11], 0.0792 [12], 0.4195 [13], and 0.5441 [14] in recent 5-D hyperchaotic systems. A larger positive Lyapunov exponent shows that system trajectories vary more sharply in phase space and this makes the system's dynamics more complicated by establishing stronger sensitivity to initial conditions. • It is invariant under coordinate transformation (x, y, z, u, w) → (−x, −y, −z, −u, −w); that is, the symmetry persists for all system variables.

•
The Kaplan-Yorke (Lyapunov) dimension D KY for any dynamical system is defined as [28]: where, j is the largest integer for which ∑ j i=1 LE i ≥ 0 and ∑ j+1 i=1 LE i < 0. The Lyapunov dimension D KY for the hyperchaotic system (2) is D KY = 3.334, which indicates that the Lyapunov dimension of our system is fractional.

•
The vector field of our system (2) has negative divergence as: This indicates that the system (2) is dissipative in nature, with an exponential contraction rate of dV dt = e −(c 1 −c 2 +c 4 +c 6 )t . Dissipation is needed to attract trajectories in the system's phase space.
The characteristics of the proposed nonlinear system (2) are compared with some high-dimensional chaotic/hyperchaotic systems adopted by researchers to construct S-boxes in Table 1. It is worth noting that unlike our method, in all high dimensional system based S-box methods [19][20][21][22][23][24][25]29], the systems were not modeled by S-box investigators. The comparison table ascertains that system (2) holds excellent characteristics over other adopted systems. Figure 1 displays the phase portraits of the proposed system in various planes and phase spaces. It should be noted that the phase portrait is only an indicative tool for displaying a system's dynamic behavior. Thus, from the phase portraits, we assume the system's (2) complex behavior, which is confirmed by the calculation of the Lyapunov exponents for a chosen set of the system's parameters.  [20,21] Lorenz chaotic 3-D 0.906 2.062 Ref. [22] fractional Rössler chaotic 3-D NR NR Ref. [23] Chaotic 3-D 0.064 2.05 Ref. [24] fractional Chen chaotic 3-D 0.0119 NR Ref. [25] Chaotic 3-D NR NR Ref. [21,29] Rössler  (2) is DKY = 3.334, which indicates that the Lyapunov dimension of our system is fractional.  The vector field of our system (2) has negative divergence as: This indicates that the system (2) is dissipative in nature, with an exponential contraction rate Dissipation is needed to attract trajectories in the system's phase space.
The characteristics of the proposed nonlinear system (2) are compared with some high-dimensional chaotic/hyperchaotic systems adopted by researchers to construct S-boxes in Table 1. It is worth noting that unlike our method, in all high dimensional system based S-box methods [19][20][21][22][23][24][25]29], the systems were not modeled by S-box investigators. The comparison table ascertains that system (2) holds excellent characteristics over other adopted systems. Figure 1 displays the phase portraits of the proposed system in various planes and phase spaces. It should be noted that the phase portrait is only an indicative tool for displaying a system's dynamic behavior. Thus, from the phase portraits, we assume the system's (2) complex behavior, which is confirmed by the calculation of the Lyapunov exponents for a chosen set of the system's parameters. Table 1. Comparison of high dimensional chaotic/hyperchaotic systems adopted for 8 × 8 S-box construction.

Proposed Bijective S-Box Generation Method
The method proposed to efficiently search for S-boxes using the new 5-D hyperchaotic system is provided below. This method performs a random search on the basis of the maximization of nonlinearity to find an optimal configuration of the SG S-box. The proposed method calls the hyperchaos5D() routine, which solves system (2) using Runge-Kutta of order 4 with a step size of 0.001, and takes the initial conditions of five state variables to produce the variable's floating values after t0 or τ iterations. Routine reverse() is intended to reverse the input vector. CreateS() is used to prepare an S-box candidate using a random input vector, and the sort() function performs sorting of the input array in increasing order. The routine nonlinearity() is meant to compute the average of the nonlinearities of all component Boolean functions of the input S-box. The details of the nonlinearity metric is discussed in Section 4. The max() function returns the largest among all inputs and index  [1,5] return the largest value in the input vector.
The proposed method prefers an S-box over previous methods on the basis of nonlinearity of the S-boxes. Since it is considered to be mainly responsible for strong confusion, nonlinear transformation, and the potential to mitigate differential and linear attacks. S-box SG is updated as SP if and only if SP is no worse than SG on the grounds of nonlinearity. The target nonlinearities for the bijective S-box of dimension n = 4, 5, 6, 7, 8 are 4, 12, 24, 56, 112, respectively [30].
Take SP, SG as two empty look-up tables(LUTs) and five empty arrays Xj, each of size numel 3. Iterate system (2) t0 times to die out the transient effect and discard xj except the last:

Proposed Bijective S-Box Generation Method
The method proposed to efficiently search for S-boxes using the new 5-D hyperchaotic system is provided below. This method performs a random search on the basis of the maximization of nonlinearity to find an optimal configuration of the S G S-box. The proposed method calls the hyperchaos5D() routine, which solves system (2) using Runge-Kutta of order 4 with a step size of 0.001, and takes the initial conditions of five state variables to produce the variable's floating values after t 0 or τ iterations. Routine reverse() is intended to reverse the input vector. CreateS() is used to prepare an S-box candidate using a random input vector, and the sort() function performs sorting of the input array in increasing order. The routine nonlinearity() is meant to compute the average of the nonlinearities of all component Boolean functions of the input S-box. The details of the nonlinearity metric are discussed in Section 4. The max() function returns the largest among all inputs and index ∈ [1,5] return the largest value in the input vector.
The proposed method prefers an S-box over previous methods on the basis of nonlinearity of the S-boxes. Since these two are considered to be mainly responsible for strong confusion, nonlinear transformation, and the potential to mitigate differential and linear attacks. S-box S G is updated as S P if and only if S P is no worse than S G on the grounds of nonlinearity. The target nonlinearities for the bijective S-box of dimension n = 4, 5, 6, 7, 8 are 4, 12, 24, 56, 112, respectively [30]. 1. Assign initial values to size n, parameters c i , initial conditions for x, y, z, u, w, t 0 , τ, itr_max Set nl_max = 0, numel = 2 n , len = numel/2, x 1 (0) = x, x 2 (0) = y, x 3 (0) = z, x 4 (0) = u, x 5 (0) = w 2. Take S P , S G as two empty look-up tables(LUTs) and five empty arrays X j , each of size numel 3. Iterate system (2) t 0 times to die out the transient effect and discard x j except the last: Generate the lower halves of the random arrays X j as: Generate new higher halves of the random arrays X j as: Compute nonlinearity of candidates S j : nl j = nonlinearity(S j ) 8. Choose the local best candidate: Update the global best candidate (if required): If (nl P ≥ nl_max) S G = S P nl_max = nl P end 10. Repeat from step 5 for itr_max times. 11. Declare S G as the final S-box and display as LUT.

Bijectiveness
A bijective function is a combination of one-to-one (injective) and onto (surjective) mapping functions. It implies that every element of one set is paired with exactly one element of the other set, and vice versa, with no unpaired elements. This is an important property that is used to test the cryptographic liability of S-boxes. It is verified from S-box LUTs that a proposed S-box satisfies the bijectivity property as it has distinct pre-images in a specified range.

Nonlinearity
In the nonlinearity analysis, the constituent Boolean functions were assessed with reference to the behavior of the input/output bit patterns. The set of all affine functions is used to compare the distance from the given Boolean function. Once the initial distance is determined, the bits in the truth table of the Boolean function were modified to approximate to the closest affine function. The number of modifications required to reach the closest affine functions determined the nonlinearity of the Boolean function. In practice, the nonlinearity of the Boolean function g in n-variable is measured using Equation (3) through Walsh spectrum [32]: where WS g (ω) is the Walsh spectrum of function g, computed as: where, x.ω refers to a bit-by-bit dot product and ω ∈ {0, 1} n . It is also expressed as the least hamming distance between the set of all non-constant linear combinations of function g and set of all affine functions on {0, 1} n [33]. The best affine and linear approximation attacks [34,35] show the significance  Table 3, are found as nl(g 1 ) = 110, nl(g 2 ) = 108, nl(g 3 ) = 110, nl(g 4 ) =106, nl(g 5 ) = 108, nl(g 6 ) = 108, nl(g 7 ) = 110, and nl(g 8 ) = 108, showing that nl min = 106, nl max = 110, and nl avg = 108.5. The nonlinearity values of all component functions were quite high, and larger than or equal to 106. It clearly shows the nonlinearity of the proposed S-box.

Strict Avalanche Criteria
The idea of a strict avalanche criterion (SAC) is a generalization of the avalanche effect, introduced by Webster and Tavares in 1985 [36], is based on Shannon's property of diffusion and implies that a little change in input causes a significant effect in the output. According to Webster and Tavares, if a Boolean function satisfies SAC, it means that if we change any one of the input bits, then all the output bits should change with a probability of a half. The SAC can be evaluated through an 8 × 8 dependency matrix by a procedure suggested in Reference [36]. The average of this matrix is referred to as the SAC value. We calculated the dependency matrix for the proposed S-box and this is shown in Table 4. It can be seen that almost all values are somewhat close to 0.5. The average of the dependency matrix is SAC = 0.5017, which is fairly close to the theoretical SAC with an offset of only 0.0017; this shows that the proposed S-box exhibited a good avalanche effect and satisfied the stated criteria well.

Bits Independence Criteria
The bits independent criterion (BIC) manages testing an individual bit at the input of the cipher by playing out the flip operation. It implies that all the avalanche vectors ought to be match pair-wise independent for a given arrangement of vectors produced by complementing a solitary plaintext bit. The avalanche vectors are created by bit patterns generated because of flipping bit(s) at the inputs. It is an attractive property for any cryptographic primitive. The S-box fulfills BIC if the function g = g i xor g j (i = j, 1 ≤ i, j ≤ 8) is highly nonlinear and also satisfies the SAC [32]. Based on this method, BIC for the proposed S-box was verified by computing the nonlinearity and SAC of g = g i xor g j [37]. The result of BIC for nonlinearity is provided in Table 5 and that of the BIC for the SAC is in Table 6. The average of the BIC-nonlinearity is 104 with a least value of 100 (a commendable score), and the average of the BIC-SAC matrix is 0.5006, which is very close to 0.5. The scores indicate that the proposed S-box is competent enough to satisfy the output bits independence criteria.

Differential Uniformity
The differential uniformity (DU) measure is associated with the change in the output or the differential output observed with respect to a change in input. Its intensity determines the S-box's ability to resist the differential cryptanalysis framed by Biham and Shamir to break the famous DES block cipher [38]. The differential uniformity of an S-box ensures uniform mapping of the input and output differentials. It denotes the maximum likelihood of generating an output differential δb = b i xor b j when the input differential is δa = a i xor a j . Mathematically, it is expressed as [23,38,39]: where, # denotes cardinality, and X is the set of all inputs x. The output exclusive XOR score as explained should have equal likelihood for a corresponding input score. As a good S-box design guideline, the maximum differential uniformity has to be kept as small as possible to resist differential cryptanalysis. Following the approach, an input/output XOR distribution matrix, for differential, is obtained for the proposed S-box and is provided in Table 7. The maximum differential uniformity for our S-box was 10, which is the highest value of the differential matrix in Table 7. The count of this highest value in differential table is only 4. This value of DU is compared with some recent S-boxes in Table 8 to show the effectiveness of proposed S-boxes.

Comparison
The comparison is done in Table 8 based on the criteria discussed in previous subsections. The outcomes of the comparisons are as follows: The nonlinearity strength of the proposed S-box is worth noting as its average value nl avg of 108.5 was the highest among all S-box methods in Table 8. The nl min is similar to three S-boxes in References [40,41,50,52], and better than all other S-boxes. Similarly, the nl max value was comparable to two S-boxes investigated in References [25,33], and larger than the remaining S-boxes. Thus, the proposed S-box provided high nonlinearity, and in turn, strong confusion, and good resistance to linear and affine approximation attacks while transforming input plaintext bits to output bits.
The ideal value for SAC is 0.5, any value closer to this is considered as better than others. According to Table 8, our SAC of 0.5017 is closer to the ideal value and better than the SAC of almost all S-boxes in Table 8. However, all SAC scores in Table 8 were more or less close to 0.5 with almost negligible offsets. The proposed S-box satisfied the SAC criteria very well, and marginally outperformed most of the other S-boxes.
The S-box should have adequacy to thwart differential cryptanalysis as practiced by Biham and Shamir [38]. It is well accepted that an S-box having a lower DU offers more resistance to this cryptanalysis. It is worth noting that the DU of the proposed S-box was only 10, which is similar to the DU of the S-boxes investigated in References [19,20,[23][24][25]39,40,43,49,50,52], and better than the DU of the S-boxes in References [21,22,29,33,[41][42][43][44][45][46][47][48]51]. This means there is an excellent fulfillment of our method on the DU criteria of strong S-boxes.

Analysis of the Batch-Generation of 8 × 8 S-Boxes
This subsection deals with the performance analysis of all intermediate 8 × 8 S P S-boxes obtained while running the proposed method for itr_max = 100,000. The features of these S-box structures, such as average nonlinearity, differential uniformity, SAC, BIC-nonlinearity, and BIC-SAC, are shown graphically in Figure 2. The statistics of these S-boxes for worst, best, average cases, and different conditions are reported in Tables 9 and 10. cryptanalysis. It is worth noting that the DU of the proposed S-box was only 10, which is similar to the DU of the S-boxes investigated in References [19,20,[23][24][25]39,40,43,49,50,52], and better than the DU of the S-boxes in References [21,22,29,33,[41][42][43][44][45][46][47][48]51]. This means there is an excellent fulfillment of our method on the DU criteria of strong S-boxes.

Analysis of the Batch-Generation of 8 × 8 S-Boxes
This subsection deals with the performance analysis of all intermediate 8 × 8 SP S-boxes obtained while running the proposed method for itr_max = 100,000. The features of these S-box structures, such as average nonlinearity, differential uniformity, SAC, BIC-nonlinearity, and BIC-SAC, are shown graphically in Figure 2. The statistics of these S-boxes for worst, best, average cases, and different conditions are reported in Tables 9 and 10.  Performance statistics showed that the batch-generation capability of the proposed method was excellent. Reason being, the worst, best, and average nonlinearities of all intermediate S-boxes are 102, 108.5, and 104.665, respectively, which is far better than the respective statistics of 99.25, 106.75, and 103.55, respectively, of S-box structures by Özkaynak's recent method [40]. This means that all generated 100,000 S-boxes had an average nonlinearity equal to or above 102. The proposed method generated 90.932% S-boxes with average nonlinearity higher than or equal to 104, and 53.467% had a nonlinearity greater than or equal to 105. As far as differential uniformity is concerned, there were 40.871% S-boxes having a DU less of than or equal to 10. The worst DU was 18, and only 16 such S-boxes exists; the best achievable DU with the proposed method was 8, and there are five S-boxes with this lowest DU. By way of comparison, 18 and 10 are the worst and best achievable DU scores in Reference [40]. The features of all five S-boxes having the lowest DU by the proposed method are listed in Table 11. If we change the preference criteria in the proposed method to update the SG S-box from nonlinearity to differential uniformity, then the best obtainable S-box is S3 listed in Table 11. It is worth noting that the features of S-box S3 when compared with existing ones listed in Table 8 are cryptographically better than most of the S-boxes of Table 8. For the SAC criteria, there were 1717 S-boxes which have a SAC equal to the ideal value that is exactly 0.5. Our worst, best, and average SAC was 0.5249, 0.5, and 0.5019, respectively, which was slightly better than respective scores of 0.4832, 0.5264, and 0.5020, respectively, in Reference [40]. The number of S-boxes satisfying 0.495 ≤ SAC ≤ 0.505 is 62677. The worst, best, and average BIC-nonlinearity values were 100.5, 105.57, and 103.53, respectively. There exist more than 56% of all S-boxes whose BIC-Nonlinearity was higher than 103.5, and more than 21% with a BIC-NL above 104. Regarding BIC-SAC, the worst, best, and average scores are 0.5135, 0.5, and 0.5019, respectively, and as much as 85.7% of all S-boxes had a  Performance statistics showed that the batch-generation capability of the proposed method was excellent. Reason being, the worst, best, and average nonlinearities of all intermediate S-boxes are 102, 108.5, and 104.665, respectively, which is far better than the respective statistics of 99.25, 106.75, and 103.55, respectively, of S-box structures by Özkaynak's recent method [40]. This means that all generated 100,000 S-boxes had an average nonlinearity equal to or above 102. The proposed method generated 90.932% S-boxes with average nonlinearity higher than or equal to 104, and 53.467% had a nonlinearity greater than or equal to 105. As far as differential uniformity is concerned, there were 40.871% S-boxes having a DU less of than or equal to 10. The worst DU was 18, and only 16 such S-boxes exists; the best achievable DU with the proposed method was 8, and there are five S-boxes with this lowest DU. By way of comparison, 18 and 10 are the worst and best achievable DU scores in Reference [40]. The features of all five S-boxes having the lowest DU by the proposed method are listed in Table 11. If we change the preference criteria in the proposed method to update the S G S-box from nonlinearity to differential uniformity, then the best obtainable S-box is S3 listed in Table 11. It is worth noting that the features of S-box S3 when compared with existing ones listed in Table 8 are cryptographically better than most of the S-boxes of Table 8. For the SAC criteria, there were 1717 S-boxes which have a SAC equal to the ideal value that is exactly 0.5. Our worst, best, and average SAC was 0.5249, 0.5, and 0.5019, respectively, which was slightly better than respective scores of 0.4832, 0.5264, and 0.5020, respectively, in Reference [40]. The number of S-boxes satisfying 0.495 ≤ SAC ≤ 0.505 is 62677. The worst, best, and average BIC-nonlinearity values were 100.5, 105.57, and 103.53, respectively. There exist more than 56% of all S-boxes whose BIC-Nonlinearity was higher than 103.5, and more than 21% with a BIC-NL above 104. Regarding BIC-SAC, the worst, best, and average scores are 0.5135, 0.5, and 0.5019, respectively, and as much as 85.7% of all S-boxes had a BIC-SAC in [0.495, 0.505]. Thereby, all generated S-boxes showed good satisfaction of the BIC property. Thus, it is evident that the batch-generation capability of the proposed method for bijective S-boxes construction is commendable as it satisfies cryptographic properties reasonably well under different cases and conditions.

Performance of Small-Sized S-Boxes
In addition, we investigated the proposed method for the construction of small-sized bijective S-boxes of sizes 4 × 4, 5 × 5, 6 × 6, and 7 × 7. Different small-sized S-boxes obtained with the proposed method for different n are provided in Table 12. Their nonlinearity scores and differential uniformities are listed in Table 13. The generic methods that can synthesize S-boxes of varied small sizes are rarely investigated. In the literature, there exist optimization-based methods for the synthesis of bijective S-boxes for 5 ≤ n ≤ 8. In 1998, one such approach was suggested by Millan, which was based on a hill climbing technique for the evolution of S-boxes [53]. Fuller et al. applied a heuristic technique to optimize the power mapping-based S-boxes through some iterated mutation operations suggested by him [54]. In Reference [55], Laskari et al. adopted a particle swarm optimization and differential evolution techniques to obtain a number of optimized bijective S-boxes. Tesar designed a special genetic algorithm with a total tree search to evolve small-sized S-boxes in Reference [56]. Of late, Picek et al. has designed a new cost function for evolving S-boxes and different evolutionary techniques, such as genetic algorithm (GA), genetic with tree search (GaT), and local search algorithm (LSA), were analyzed for evolving S-boxes with a new cost function [30]. To justify the improved performance of our method, results were compared with these existing methods in Table 14. We reported the best results for all methods. It is clear from Table 14 that the proposed S-boxes had a significantly higher nonlinearity than existing methods for all sizes. The comparison verified the better performance of our proposed method for the construction of small-sized bijective S-boxes as well.   13  63  23  52  0  37  33  35  17  10  41  1  36  18  51  58  42  8  38  5  40  2  14  59  43  27  28  15  53  32  56  3  50  22  29  34  30 Table 14. Comparison of the average nonlinearities of the small-sized S-boxes.

Conclusions
This paper reports a design procedure for cryptographic substitution-boxes using a hyper-chaotic system. Firstly, a new five-dimensional hyperchaotic system was modeled, which holds some merits over the existing systems. Then, the new hyper-chaotic system was utilized to propose a method for bijective S-box construction. The anticipated method systematically searched the best possible S-box for a given size on the basis of nonlinearity by exploiting the dynamics of new hyperchaotic system. Some standard performance criteria were applied to assess the security strength of the proposed S-box method. The obtained results were compared with some recent S-box proposals to justify the upright performance of the proposed method. The effectiveness of the batch-generation capability of our method was analyzed statistically. It showed that it was possible to obtain 8 × 8 S-boxes with a differential uniformity of 8. Additionally, the same method was also investigated to yield small-sized S-boxes. It has been shown that our method was competent enough to yield better nonlinear small-sized S-boxes. To the best of our knowledge, this is first chaos-based method that attempts to synthesis small-sized S-boxes. The S-box construction method is key-dependent and a large number of strong S-boxes can be obtained with a minute change of any of the key components. The proposed method for S-box generation satisfied all the criteria of a strong S-box very well, and the constructed S-boxes were suited for usage in a strong block cipher design and other security applications.