A Novel S-Box Design Algorithm Based on a New Compound Chaotic System

Substitution-boxes (S-Boxes) are important non-linear components in block cryptosystem, which play an important role in the security of cryptosystems. Constructing S-Boxes with a strong cryptographic feature is an important step in designing block cipher systems. In this paper, a novel algorithm for constructing S-Boxes based on a new compound chaotic system is presented. Firstly, the new chaotic system, tent–logistic system, is proposed, which has better chaotic performance and wider chaotic range than the tent and logistic system, and can not only increase the randomness of the chaotic sequences but also expand the key space of cryptosystems. Secondly, a novel linear mapping is employed to construct the initial S-Box. Then, the permutation operation on the initial S-Box is performed by using chaotic sequence generated with the tent–logistic system, which improves the cryptographic features of the S-Box. The idea behind the proposed work is to make supplementary safe S-box. Detail tests for cryptographic strength of the proposed S-Box are performed by using different standard benchmarks. The test results and performance analysis show that our proposed S-Box has very smaller values of linear probability (LP) and differential probability (DP) and a satisfactory average value of nonlinearity compared with other S-Boxes, showing its excellent application potential in block cipher system.


Introduction
With the rapid development of network communication and big data applications, information security has become a more and more popular topic. Scholars have proposed a variety of information security technologies, including information encryption [1][2][3][4][5], watermarking [6,7], privacy protection [8][9][10], and so on. Among them, cryptography is the most basic technology in information security. In symmetric cryptographic systems, block encryption algorithms are widely used, such as in the data encryption standard (DES), advanced encryption standard (AES), and other systems. In a block cipher system, there is an important non-linear component called the substitution box (abbreviated as S-Box). S-Boxes play an important role in the security of symmetric cryptosystems. AES is considered to be an effective cryptosystem to a large extent. One of the important components of AES is its S-Box, which is based on the inversion and affine transformation of GF (2 8 ) elements. Due to the popularity of AES in communication systems, S-Box has attracted more and more attention. However, the S-Box component that is used in AES is fixed. If we construct this component dynamically, the encryption strength of the cryptosystem would be greater than before.
In view of the importance of S-Box in block cipher system, the design of S-Box with strong cryptographic performance has always been the goal of cryptosystem designers. Many S-Box construction methods have been proposed [11][12][13][14][15]. In order to obtain a ciphertext block corresponding generator (PRNG) based on three chaotic maps: the Bernoulli shift map, tent, and zigzag maps. It was found that some chaotic maps are more suitable for cryptographic applications, like the Bernoulli shift map that requires low field-programmable gate array (FPGA) resources, and provides high throughput. In [35], the authors show an application in the encryption of very high-resolution digital images based on the design of a digital chaos generator by using arbitrary precision arithmetic.
To improve the shortcomings of existing chaos based S-Box construction methods, this paper presents a novel and efficient S-Box construction method by using a new compound chaotic system. It can improve the linear probability (LP) and differential probability (DP) properties of the S-Box, and enhance the robustness of cryptosystem against linear analysis attack and differential attack. The innovations of this work are as follows: (1) A new compound chaotic system, tent-logistic system (TLS), is proposed, which has a wider chaotic range and better chaotic performance than the old ones, so it is more suitable for cryptographic applications.
(2) A simple and effective S-Box construction method by using a novel linear mapping and the tent-logistic chaotic system is proposed, which can improve the efficiency of S-Boxes construction.  (3) The proposed S-Box has a higher score of LP and DP than some old S-Boxes, showing that our proposed S-Box has obvious advantages in resisting the attacks of differential cryptanalysis and linear cryptanalysis.
The rest of this paper is organized as follows. Section 2 proposes the new tent-logistic system (TLS) model. Section 3 describes the simple and effective S-Box construction method based on the tent-logistic system. Section 4 shows cryptographic performance analysis of the proposed S-Box, and makes a comparison with some recently designed S-Boxes. Section 5 completes the research paper with conclusions.

The Proposed New Chaotic System
One-dimensional (1D) discrete chaotic systems have many advantages in applications to cryptography because of their simple structures. The general mathematical model of 1D discrete mapping system can be expressed as: where f[x] denotes functions with regard to x. x(0) is the initial state value of the system and {x(1), x(2), ...} is the output sequence of state values. For 1D discrete maps, the definition of Lyapunov exponent is as: where, f [x] denotes the derivative of function f[x] to x. If λ > 0, then the chaotic behaviors exist in the system. In this section, we firstly reviewed two famous 1D chaotic maps: the logistic and tent chaotic maps. Then, we proposed a new discrete compound chaotic system, which has better chaotic performance and wider chaotic range than logistic and tent maps.

Logistic Chaotic Map
The logistic map is one of famous 1D chaotic maps, which has a simple mathematical structure yet complex chaotic behavior. The mathematical model of Logistic map is [36]: where µ is the system parameter in the range of [0,4]. In order to determine the range of parameters corresponding to its chaotic phenomena, we calculated Lyapunov exponents under different parameters µ and found the chaotic rang of logistic map was µ ∈ [3.57, 4]. The bifurcation diagram of logistic map is shown in Figure 1a and the state distribution under µ = 3.78 is shown in Figure 1b. (3) The proposed S-Box has a higher score of LP and DP than some old S-Boxes, showing that our proposed S-Box has obvious advantages in resisting the attacks of differential cryptanalysis and linear cryptanalysis.
The rest of this paper is organized as follows. Section 2 proposes the new tent-logistic system (TLS) model. Section 3 describes the simple and effective S-Box construction method based on the tent-logistic system. Section 4 shows cryptographic performance analysis of the proposed S-Box, and makes a comparison with some recently designed S-Boxes. Section 5 completes the research paper with conclusions.

The Proposed New Chaotic System
One-dimensional (1D) discrete chaotic systems have many advantages in applications to cryptography because of their simple structures. The general mathematical model of 1D discrete mapping system can be expressed as: where f[x] denotes functions with regard to x. x(0) is the initial state value of the system and {x(1), x(2), ...} is the output sequence of state values. For 1D discrete maps, the definition of Lyapunov exponent is as: where, f'[x] denotes the derivative of function f[x] to x. If λ > 0, then the chaotic behaviors exist in the system. In this section, we firstly reviewed two famous 1D chaotic maps: the logistic and tent chaotic maps. Then, we proposed a new discrete compound chaotic system, which has better chaotic performance and wider chaotic range than logistic and tent maps.

Logistic Chaotic Map
The logistic map is one of famous 1D chaotic maps, which has a simple mathematical structure yet complex chaotic behavior. The mathematical model of Logistic map is [36]: where μ is the system parameter in the range of [0,4]. In order to determine the range of parameters corresponding to its chaotic phenomena, we calculated Lyapunov exponents under different parameters μ and found the chaotic rang of logistic map was μ ∈ [3.57, 4]. The bifurcation diagram of logistic map is shown in Figure 1a and the state distribution under μ = 3.78 is shown in Figure 1b.  There are three drawbacks in the logistic map. One is the chaotic range of the system is limited to µ ∈ [3.57, 4]. Even within this range, there are some parameters that make the logistic map to have no chaotic behaviors. Another drawback is the non-uniform distribution of state values in the range of [0, 1]. In [37], authors point out that the logistic map for µ = 3.9 has aperiodic behavior. Instead of using the range of 3.57 ≤ µ ≤ 4, one can fix the value of µ, however, which results in a lower key space. These drawbacks reduce the application value of the logistic map.

Tent Chaotic Map
Tent map is another discrete 1D chaotic system, which has the tent-like shape in its bifurcation diagram. The mathematical model of the tent map is as follows [38] x where µ is the system parameter in the range of [0, 4]. By Equation (4), we could get the Lyapunov exponent of the tent map as λ= log(µ/2), so when µ > 2, λ > 0, and when µ = 4, λ = λ max = log(2) = 0.6931. Its chaotic property is shown in the bifurcation analysis in Figure 2a. Both analysis results indicate that its chaotic range was µ ∈ [2,4]. The state distribution under µ = 3.78 is shown in Figure 2b. The tent map had the same problems as the logistic map: the small chaotic range and the no uniform distribution of the output state values. There are three drawbacks in the logistic map. One is the chaotic range of the system is limited to μ ∈ [3.57, 4]. Even within this range, there are some parameters that make the logistic map to have no chaotic behaviors. Another drawback is the non-uniform distribution of state values in the range of [0, 1]. In [37], authors point out that the logistic map for μ = 3.9 has aperiodic behavior. Instead of using the range of 3.57 ≤ μ ≤ 4, one can fix the value of μ, however, which results in a lower key space. These drawbacks reduce the application value of the logistic map.

Tent Chaotic Map
Tent map is another discrete 1D chaotic system, which has the tent-like shape in its bifurcation diagram. The mathematical model of the tent map is as follows [38]  x n x n x n x n x n x n x n μ μ where μ is the system parameter in the range of [0, 4]. By Equation (4), we could get the Lyapunov exponent of the tent map as λ= log(μ/2), so when μ > 2, λ > 0, and when μ = 4, λ = λmax = log(2) = 0.6931. Its chaotic property is shown in the bifurcation analysis in Figure 2a. Both analysis results indicate that its chaotic range was μ ∈ [2,4]. The state distribution under μ = 3.78 is shown in Figure 2b. The tent map had the same problems as the logistic map: the small chaotic range and the no uniform distribution of the output state values.

The Tent-Logistic System
To solve the problems existing in logistic and tent maps, we proposed a new compound system by combining the logistic and tent maps, and called the new system the tent-logistic system (TLS). Its mathematical model is as follows: where μ is the system parameter in the range of [0,9]. When μ = 0, Equation (5) degenerates to the best chaotic logistic map, while μ = 9, Equation (5) degenerates to the best chaotic tent map. Therefore, both the best chaotic logistic and tent maps can be regarded as special cases of Equation (5).

The Tent-Logistic System
To solve the problems existing in logistic and tent maps, we proposed a new compound system by combining the logistic and tent maps, and called the new system the tent-logistic system (TLS). Its mathematical model is as follows: where µ is the system parameter in the range of [0,9]. When µ = 0, Equation (5) degenerates to the best chaotic logistic map, while µ = 9, Equation (5) degenerates to the best chaotic tent map. Therefore, both the best chaotic logistic and tent maps can be regarded as special cases of Equation (5).
(2) When µ = 9, Equation (5) degenerates to the chaotic tent map f T : The bifurcation diagram and the state distribution diagram of the TLS are shown in Figure 3. From Figure 3a, one can see that the chaotic range was the whole range µ∈[0, 9], which was much larger than those of the logistic or tent maps. Its output sequences uniformly distributed within [0, 1] (see Figure 3b). Hence, the TLS had better chaotic performance than the logistic and tent maps. (1) When μ = 0, Equation (5) degenerates to the chaotic logistic map fL: xi∈(0, 1)→xi+1∈(0, 1).
(4) When 0 < μ < 9 and The bifurcation diagram and the state distribution diagram of the TLS are shown in Figure 3.
From Figure 3a, one can see that the chaotic range was the whole range μ∈ [0,9], which was much larger than those of the logistic or tent maps. Its output sequences uniformly distributed within [0, 1] (see Figure 3b). Hence, the TLS had better chaotic performance than the logistic and tent maps.  The new tent-logistic system has two advantages compared with logistic and tent maps. First, the chaotic range of the tent-logistic system was far wider than those of the logistic and tent map. If the system parameter μ was used as the secret key of a cryptosystem, the key space of the cryptosystem with the new system would be much larger. Second, the output sequences of the tent-logistic system distributed evenly throughout the entire value range between 0 and 1. These advantages guarantee that the proposed tent-logistic system was more suitable for cryptographic applications.

Entropy Analysis of the New Chaotic System
There are many techniques to evaluate the system complexity from time sequence [39][40][41]. One of the most famous methods is approximate entropy [41]. The greater the approximate entropy, the higher the complexity of the time sequence. To measure the complexity of sequences generated by different chaotic systems, the approximate entropy values of the sequence generated by the three chaotic maps are calculated and shown in Figure 4. From Figure 4, one can see that the approximate entropy values of sequence generated by the tent-logistic map were the largest ones among the three chaotic maps in the cases of most μ values. It verified that the sequence generated by the tent-logistic map had larger complexity than tent and logistic maps. The new tent-logistic system has two advantages compared with logistic and tent maps. First, the chaotic range of the tent-logistic system was far wider than those of the logistic and tent map. If the system parameter µ was used as the secret key of a cryptosystem, the key space of the cryptosystem with the new system would be much larger. Second, the output sequences of the tent-logistic system distributed evenly throughout the entire value range between 0 and 1. These advantages guarantee that the proposed tent-logistic system was more suitable for cryptographic applications.

Entropy Analysis of the New Chaotic System
There are many techniques to evaluate the system complexity from time sequence [39][40][41]. One of the most famous methods is approximate entropy [41]. The greater the approximate entropy, the higher the complexity of the time sequence. To measure the complexity of sequences generated by different chaotic systems, the approximate entropy values of the sequence generated by the three chaotic maps are calculated and shown in Figure 4. From Figure 4, one can see that the approximate entropy values of sequence generated by the tent-logistic map were the largest ones among the three chaotic maps in the cases of most µ values. It verified that the sequence generated by the tent-logistic map had larger complexity than tent and logistic maps.

NIST Randomness Test of PRNG with the New System
In this section, a pseudo-random number generator (PRNG) was designed by using the tent-logistic map. The specific steps of generating random number are as follows: 1) Set the initial state value x0, the system parameter μ, and the positive integer N0 and L.
2) Iterate the chaotic tent-logistic map (5) N0 times to eliminate harmful effects of transient processes.
3) Continue to iterate the chaotic tent-logistic map ( where, floor(x) returns a maximum integer less than or equal to x and mod(x, 256) returns the remainder of x divided by 256. Therefore, each element in Y is an integer with the size of one byte and in the range of [0, 255], which is especially suitable for image encryption. NIST test software mainly uses two performance indicators: pass rate and p-value to determine the random performance of the sequence. The number of sequences to be tested is m, the significant level is α. If the p-values of N sequences are greater than α, then the pass rate is N/m. The default value of α is 0.01. To test the random performance of the bit sequences generated by our PRNG, we set the parameters as: x0 = 0.66, μ = 4.5, L = 12.5 × 10 6 , and N0 = 500. Then, a bit sequence was generated, which had the length of 100 × 10 6 bits. The bit sequence was divided into 100 sub-sequences of equal length, each of which was 10 6 bits in length. By this way, 100 sequences of Table 1 was 0.045675, which was larger than 0.01. The minimum pass rate for each statistical test was 98 for 100 binary sequences. Therefore, the sequence generated with the new tent-logistic

NIST Randomness Test of PRNG with the New System
In this section, a pseudo-random number generator (PRNG) was designed by using the tent-logistic map. The specific steps of generating random number are as follows: (1) Set the initial state value x 0 , the system parameter µ, and the positive integer N 0 and L.
(2) Iterate the chaotic tent-logistic map (5) N 0 times to eliminate harmful effects of transient processes.
(3) Continue to iterate the chaotic tent-logistic map (5) L times and generate a random sequence (4) Through the nonlinear transformation of Equation (6), the random sequence X is transformed into the random sequence Y = [y 1 , y 2 , ..., y L ].
where, floor(x) returns a maximum integer less than or equal to x and mod(x, 256) returns the remainder of x divided by 256. Therefore, each element in Y is an integer with the size of one byte and in the range of [0, 255], which is especially suitable for image encryption. (5) Transform each y i to a 8-bit binary number, then we could obtain a bit sequence B = {b 1 , b 2 , ..., b 8L }, which is especially suitable for stream cipher application.
The random number generator test standard is the Federal Information Processing Standard issued by the National Institute of Standards and Technology (NIST). The NIST test suite includes 17 tests, which focus on a sort of different types of non-randomness that could exist in a sequence. NIST test software mainly uses two performance indicators: pass rate and p-value to determine the random performance of the sequence. The number of sequences to be tested is m, the significant level is α. If the p-values of N sequences are greater than α, then the pass rate is N/m. The default value of α is 0.01. To test the random performance of the bit sequences generated by our PRNG, we set the parameters as: x 0 = 0.66, µ = 4.5, L = 12.5 × 10 6 , and N 0 = 500. Then, a bit sequence was generated, which had the length of 100 × 10 6 bits. The bit sequence was divided into 100 sub-sequences of equal length, each of which was 10 6 bits in length. By this way, 100 sequences of 10 6 bits were produced. The results from all statistical tests are given in Table 1. The min p-value in Table 1 was 0.045675, which was larger than 0.01. The minimum pass rate for each statistical test was 98 for 100 binary sequences. Therefore, the sequence generated with the new tent-logistic system and the generation algorithm could be considered to have high randomness. It is worth noting that the smaller number of sequences was used for random excursions tests in the Table 1. It was due to the fact that random excursions and random excursions variant tests were not applicable to binary sequences with insufficient number of cycles. Therefore, only samples with the number of cycles exceeding 500 were evaluated for these tests. In our test, there were 57 samples with the number of cycles exceeding 500.

Introduction of S-Boxes
An S-Box is the only non-linear component in a block cipher system. It plays an important role in symmetric block cipher cryptosystems. An S-Box is like a black box. It transforms any input plaintext block into a ciphertext block, which can confuse the relationship between ciphertext and plaintext. A general m × n S-Box is a map: {0, 1} m →{0, 1} n . When n = m, it means that data are neither compressed nor expanded during encryption transformation. In this case of n = m, the S-Box can realize completely reversible transformation. Most S-Boxes commonly used in cryptography are m = n. The function and basic principle of an n × n S-Box can be shown in Figure 5.
applicable to binary sequences with insufficient number of cycles. Therefore, only samples with the number of cycles exceeding 500 were evaluated for these tests. In our test, there were 57 samples with the number of cycles exceeding 500.

Introduction of S-Boxes
An S-Box is the only non-linear component in a block cipher system. It plays an important role in symmetric block cipher cryptosystems. An S-Box is like a black box. It transforms any input plaintext block into a ciphertext block, which can confuse the relationship between ciphertext and plaintext. A general m × n S-Box is a map: {0, 1} m →{0, 1} n . When n = m, it means that data are neither compressed nor expanded during encryption transformation. In this case of n = m, the S-Box can realize completely reversible transformation. Most S-Boxes commonly used in cryptography are m = n. The function and basic principle of an n × n S-Box can be shown in Figure 5. An n × n S-Box is a number set of {0, 1, 2, ..., 2 n − 1}, which is represented by a 2 n/2 × 2 n/2 matrix Sb. S boxes that are 8 × 8 are the most commonly used type of S-Box, especially widely used in An n × n S-Box is a number set of {0, 1, 2, ..., 2 n − 1}, which is represented by a 2 n/2 × 2 n/2 matrix Sb. S boxes that are 8 × 8 are the most commonly used type of S-Box, especially widely used in digital image encryption system [42]. In this paper, we focused on the design algorithm of an 8 × 8 S-Box. An 8 × 8 S-Box is a number set of {0, 1, 2, ..., 255}, which is represented by a 16 × 16 matrix Sb = {Sb(i, j)|i = 1, 2,..., 16; j = 1, 2, ..., 16} shown in Table 2. For 8 × 8 S-Boxes, there are a total of (2 8 !) different forms of variation. Among (2 8 !) different forms of variation, the simplest 8 × 8 S-Box arranges elements in an orderly manner from small to large values. As the result, elements in the simplest 8 × 8 S-Box has the form: Sb(i, j) = (i-1) × 16 + j-1. The process of converting plaintext byte x into ciphertext byte y through an S-Box with matrix Sb can be expressed by the function S[x] as: where, floor(a) rounds a to the nearest integer less than or equal to a. mod(a, m) returns the remainder after division of a by m, where a is the dividend and m is the divisor. Equation

The Proposed Algorithm for Generating S-Box
Many researchers have done extensive research on the design methods of S-Boxes with different cryptographic strength. However, most of these methods are complex and inefficient, so the time cost of generating S-Boxes is large. Here, we proposed a very simple and efficient design methods to construct strong S-Boxes based on the new chaotic map and a nonlinear mapping. The new method takes advantage of the excellent chaotic characteristics of the tent-logistic map. The detailed steps of generating new S-Boxes are given below.
Step 3: Based on T and A to obtain a new array R by the following linear mapping: where T(i)∈{0, 1, ...,255}, A is a positive integer satisfying A k × 257, and k is a positive integer.
Step 5: Transform the 1D array R into a 2D matrix Rb, and then Rb could be considered as the initial S-Box.
Step 6: Set the parameters µ, initial state value x 0 of the tent-logistic map, and an integer L that was far larger than 256. Then iterate the tent-logistic map L times to generate a chaotic sequence of length L. In order to improve the sensitivity of output chaotic sequence to its initial state value, we discarded the first (L-256) elements of the original chaotic sequence, and then we could obtain a new chaotic sequence of length 256, which is represented by X.
Step 9: Transform the 1D array S1 into a 2D matrix Sb, and this was the proposed S-Box. By the proposed method, the length of chaotic sequences to be used in constructing a 16 × 16 sized S-Box matrix was 256. The purpose of taking L far larger than 256 is to execute (L-256) times pre-iterations, which could enhance the sensitivity of S-Box to the initial value x 0 of the chaotic system. In the process of concrete realization, the proposed new S-Box was generated by the above S-Box generation algorithm with parameters were set as {x 0 = 0.66, µ = 4.5, A = 56, L = 65536}, which is shown in Table 3. The number in the first row of Table 3 represents the column number of the S-Box matrix, while the number in the first column of Table 3 represents the row number of the S-Box matrix.

Performance Tests
In this section, we tested the cryptographic strength of our proposed new S-Box given in Table 3 with widely used standard S-Box performance evaluation criteria.

Bijectiveness
A function S: x∈N → y∈N is bijective if and only if it is one-to-one map. From Equation (7a) and Table 3, it is obvious that one can obtain a distinct value y∈N corresponding to a certain x∈N. Conversely, from a certain y∈N, one can find a distinct value in the matrix SB that equal to y and obtain a distinct value pair (i, j). By the inverse transformation S −1 [y] defined by Equation (7b), one can obtain a distinct value x. Therefore, function S corresponding to S-Box of Table 3 is bijective.

Strict Avalanche Criterion (SAC)
The strict avalanche criterion (SAC) [11,12] is a crucial feature for any cryptographic S-Box. SAC requires that if a single j-th bit in the input value x is changed, the probability of causing the change of the i-th bit in the output cipher text value y should be 0.5. Namely, the probability p(i, j) should be 0.5 for all i = 1, 2, ..., n, and j = 1. 2, ..., n. An S-Box having p(i, j) values of SAC closer to 0.5 has satisfactory uncertainty. Dependency matrix providing the SAC values of an S-Box. Table 4 listed the dependency matrix of the proposed S-Box for strict avalanche criterion (SAC). The values corresponding to the positions of i-th row and j-th column in the table are p(i, j) values. It is evident from Table 4 that p(i, j) values of the S-Box was very close to 0.5 (an average value of p(i, j) was 0.505), showing that the proposed S-Box satisfied the SAC criterion.

Nonlinearity
The nonlinear mapping of an S-Box can also be expressed as: where, y i = S i [x] ∈ {0, 1} and S i [x] is an n-bit Boolean function, i = 1, 2, ..., n. In order to effectively resist linear cryptanalysis attack, an S-Box must have high nonlinear relationship between its input and output values. The nonlinearity of an n-bit Boolean function S i [x] is used to measure the nonlinear strength of an n × n S-Box, which can be calculated by: where, WS_S i [x] is the Walsh spectrum of function S i [x], and it is calculated as: where, x·z denotes the dot product of x and z, which is calculated as: where ⊕ denotes the modulo 2 addition. NL i is the nonlinearity value of the i-th constituent Boolean functions in an S-Box. The larger the nonlinearity, the better the performance of an S-Box against linear cryptanalysis attack. The nonlinearity values of all eight constituent Boolean functions in the proposed S-Box are listed in Table 5. The minimum of nonlinearity was 104, the maximum of nonlinearity was 110, and the average value of nonlinearity was 106.3. Table 5 also lists the nonlinearity values of the initial S-Box, the nonlinearity values of which were much less than those of the final S-Box. The results show that the nonlinearity of the final S-Box was greatly improved by introducing chaotic sequence to scramble the initial S-Box.

Bit Independence Criterion (BIC)
According to the criterion of BIC [11,12], when the k-th bit of the input data block changes (flips), the i-th bit and j-th bit of the output data block changes independently (or without any dependence on each other). Then it means that the response of the output bit values of the S-Box to the change of an input bit is independent. To measure this feature of an S-Box, the bit independence criterion for strict avalanche criterion (BIC-SAC) was introduced. To determine the BIC-SAC results, we could calculate the sum of (S ) for all input x∈{0, 1, ..., 255}, where z and x were only one bit different every time. If the average BIC-SAC values for all input x∈{0, 1, ..., 255} were close to 0.5, and then the S-Box met BIC-SAC very well. For our proposed S-Box, the BIC-SAC results are listed in Table 6, which had the average value 0.49937. The results show that our proposed S-Box met BIC-SAC very well. Another indicator of bit independence criterion was the BIC results for nonlinearity. To determine the BIC results for nonlinearity, we could calculate the nonlinearity values for each output bit value of (y i ⊕ y j ) for all input x∈{0, 1, ..., 255}, where i = 1, 2, ..., n and j = 1, 2, ..., n. For our proposed S-Box, the BIC results for nonlinearity are listed in Table 7, which had the average value 103.8. The experimental results show that our proposed S-Box met BIC for nonlinearity very well.  [12], if an S-Box exhibits SAC and nonlinearity, it fulfills BIC. The obtained scores of 0.499 and 103.8 for our proposed S-Box clearly manifested an exceedingly strong nonlinearity interrelation among the output bits. These test results fully validated BIC of our proposed S-Box.

Linear Probability
A secure cryptosystem should have strong confusion and diffusion effects. Strong S-Boxes help cryptosystems to achieve strong confusion and diffusion effects through nonlinear mapping between input and output data. The lower linear probability (LP) of an S-Box, the higher the nonlinear mapping feature and the stronger the performance resistance against the linear cryptanalysis. Therefore, linear probability (LP) was used to measure the resistance of an S-Box to linear cryptanalysis, which was calculated by: where, N = {0, 1, ... , 255}, α x and β x are the corresponding input and output masks (α x ∈N, β x ∈N), "." denotes the dot product operation mentioned above, and #{x∈N|X} denotes the number of x satisfying the condition X. The maximal value of LP of our proposed S-Box was only 0.125, and thus provides good resistance against linear cryptanalysis.

Differential Probability
Differential cryptanalysis [43] is another effective method to decipher ciphertext. This method is to find the plaintext pairs and corresponding ciphertext pairs having the same differentials. By these plaintext pairs and corresponding ciphertext pairs, the attackers can gain some part of the key. In order to measure the performance of S-Box against differential cryptanalysis, the differential probability (DP) is introduced, which is calculated by: where, ∆x = x ⊕ x and ∆y = y ⊕ y are differentials corresponding to input pair (x, x') and output pair (y, y'), respectively. An S-Box with smaller differential probability (DP) has a stronger ability to resist differential cryptanalysis. The maximal value of DP of our proposed S-Box was only 0.039. This small value indicates that the proposed S-Box had strong resistance to differential cryptanalysis attacks.

Performance Comparison
In order to compare the cryptographic performance of S-Boxes proposed in this paper with some recently proposed S-Boxes, the performance index values of these S-Boxes are listed in Table 8. From Table 8, it can be seen that our S-Box had the smaller values of LP and DP than most of the other S-Boxes in Table 8. The results show that our S-Box had obvious advantages in resisting the attacks of differential cryptanalysis and linear cryptanalysis. Our S-Box had an average value of nonlinearity greater than most of the other S-Boxes in Table 8. The results also indicate that the SAC value (0.505) of our proposed S-Box was very near to the ideal value of SAC (0.5). The BIC value of the proposed S-Box was also quite good ensuing gratification of the BIC test. It is worth noting that the initial S-Box obtained by this algorithm has poor nonlinearity (see the penultimate row of Table 8). By introducing the chaotic sequence to disturb the initial S-Box, the final S-Box obviously enhanced the nonlinearity. In our opinion, it is very important for randomly generated S-boxes to obtain similar quality as good S-boxes. In addition to these quality evaluation indicators, the novelty, time, and space overhead of the algorithm are also very important evaluation criteria.