Evolving Dynamic S-Boxes Using Fractional-Order Hopfield Neural Network Based Scheme

Static substitution-boxes in fixed structured block ciphers may make the system vulnerable to cryptanalysis. However, key-dependent dynamic substitution-boxes (S-boxes) assume to improve the security and robustness of the whole cryptosystem. This paper proposes to present the construction of key-dependent dynamic S-boxes having high nonlinearity. The proposed scheme involves the evolution of initially generated S-box for improved nonlinearity based on the fractional-order time-delayed Hopfield neural network. The cryptographic performance of the evolved S-box is assessed by using standard security parameters, including nonlinearity, strict avalanche criterion, bits independence criterion, differential uniformity, linear approximation probability, etc. The proposed scheme is able to evolve an S-box having mean nonlinearity of 111.25, strict avalanche criteria value of 0.5007, and differential uniformity of 10. The performance assessments demonstrate that the proposed scheme and S-box have excellent features, and are thus capable of offering high nonlinearity in the cryptosystem. The comparison analysis further confirms the improved security features of anticipated scheme and S-box, as compared to many existing chaos-based and other S-boxes.


Introduction
With the recent advancements in the field of wired/wireless network communication and electronic sharing of confidential data, the need for information security within the organization has undergone major changes. There is heavy reliance on electronic transfer of confidential data in daily life. Examples include different wallets, ecommerce websites purchases use our debit card info, internet banking and emails, etc. Network security is required to protect data while in transit. Cryptography provides the secure exchange of information between two communicating parties [1]. In cryptography, the plain message is converted to cipher text prior to its being transferred over the communication network, so that the observers or the attackers cannot interpret the original information. Thus, in order to successfully encrypt the message, we need to form a secure cipher from the plain text. To form a secure cipher confusion and diffusion are two essential properties needed, as identified by Claude Shannon. In confusion, each bit of the cipher text depends upon several parts of the key hiding the relationship between the two, therefore making it hard to find the key even if someone has a long plain text. In diffusion, the output bits depend upon the input bits in a complex way: If we change a single bit in the plain text, then at least half of the bits in the output cipher text should vary, and, similarly, if we change one of the bits in the cipher text, then more than half of the bits in the input plain text should change. Therefore, this makes the relationship between the plain text and the cipher text complex [2][3][4].
Modern cryptographic applications extensively make use of block encryption algorithms. Strong block encryption algorithms can be designed with the help of substitution-boxes (S-boxes). D q y(t) = A 2 y(t) + B 2 f (x(t)) + C 2 f (y(t)) + D 2 f (x(t − τ)) + E 2 f (y(t − τ)) + I 2 where x(t) and y(t) represent the states of the two neurons at time instance, t; 0 < p and q < 1 are the derivative orders; τ > 0 denotes the delay introduced in time, t; A, B, C, D, E, and I are the associated coefficients corresponding to each state; and f (x) is the piece-wise linear (PWL) function given as f (x) = 0.5 × (|x + 1| − |x − 1|). We followed the procedure as per Grunwald-Letnikov (GL) definition, mentioned in Sections 2.3 and 2.9 in Reference [36], to solve the fractional-order derivative equations of the Hopfield system. The numerical solution of the above two-state time-delayed fractional Hopfield neural network is as follows: where h is the time step, and Now the transmission delay in time terms are computed though the linear interpolation scheme, expression are as follows (assuming τ > h).
where d = ceil(τ/h) when d ≤ j ≤ n + 1, and x(t k − τ) = x 0 for 0 ≤ j < d. After solving the system for pre-specified number of iterations, we get two sequences.

Proposed S-Box Construction Scheme
The two forms of the time delayed fractional Hopfield neural network with different derivative orders and time delays are identified as System (1) and System (2), given below. The coefficients for the two forms are set at A 1 = −0.25, A 2 = −0.2, B 1 = −0.05, B 2 = 0.02, C 1 = 0.01, C 2 = −0.01, D 1 = −0.01, D 2 = 0.02, E 1 = 0.02, E 2 = 0.01, I 1 = −0.1, and I 2 = 0.4. System (1): where x 1 (0) y 1 (0), and/or x 2 (0) y 2 (0), and/or p 1 p 2 , and/or q 1 q 2 , and/or τ 1 τ 2 . The two systems are considered as to extend the possible key space of the proposed method. System (1) is utilized to generate the initial configuration of the S-box. However, System (2) is applied to improvise the nonlinearity strength of the initial S-box. The proposed scheme for the highly nonlinear S-box construction is as follows.
Step I. Initialization of S-Box
Repeat from Step 2 until all distinct 256 elements are recorded in array S.
Step II. Evolving S-Box Scheme

4.
Append arrays U 1 and U 2 to get a single array as
The proposed scheme is also illustrated through the flowchart shown in Figure 1.

Performance Results and Analyses
This section deals with the performance assessment, analyses, and the proposed S-box's comparison with some state-of-the-art S-box schemes which are based on dynamical systems. Without loss of generality, the settings for simulation of proposed scheme are provided in Table 1. The S-box obtained with these settings, using the proposed scheme, is listed in Table 2. The secret key K of proposed security scheme includes the components such as K = (x1(0), x2(0), p1, q1, τ1, y1(0), y2(0), p2, q2, τ2, N, itr_max, step_x, step_y, prime1, prime2, and Δτ). All floating-point computations are performed as per the IEEE 754 standard. Thus, the possible key space is more than 2 500 . This enormously large key space is sufficient enough to withstand the brute-force cryptanalysis. The most popular and standard cryptographic properties of S-boxes are as follows: high nonlinearity, low differential uniformity, the strict avalanche criterion equals to 0.5, the satisfaction of bits independence criterion for high bits independence criterion (BIC) nonlinearity and BIC-strict avalanche criterion (SAC) close to 0.5, and low linear approximation probability. A majority of the existing S-boxes schemes have scrutinized their constructed S-boxes mainly against these security properties [37][38][39][40][41]. The following subsections analyzed the proposed S-boxes under the mentioned properties.

Performance Results and Analyses
This section deals with the performance assessment, analyses, and the proposed S-box's comparison with some state-of-the-art S-box schemes which are based on dynamical systems. Without loss of generality, the settings for simulation of proposed scheme are provided in Table 1. The S-box obtained with these settings, using the proposed scheme, is listed in Table 2. The secret key K of proposed security scheme includes the components such as K = (x 1 (0), x 2 (0), p 1 , q 1 , τ 1 , y 1 (0), y 2 (0), p 2 , q 2 , τ 2 , N, itr_max, step_x, step_y, prime 1 , prime 2 , and ∆τ). All floating-point computations are performed as per the IEEE 754 standard. Thus, the possible key space is more than 2 500 . This enormously large key space is sufficient enough to withstand the brute-force cryptanalysis. The most popular and standard cryptographic properties of S-boxes are as follows: high nonlinearity, low differential uniformity, the strict avalanche criterion equals to 0.5, the satisfaction of bits independence criterion for high bits independence criterion (BIC) nonlinearity and BIC-strict avalanche criterion (SAC) close to 0.5, and low linear approximation probability. A majority of the existing S-boxes schemes have scrutinized their constructed S-boxes mainly against these security properties [37][38][39][40][41]. The following subsections analyzed the proposed S-boxes under the mentioned properties.

Nonlinearity
The nonlinearity measure of a Boolean function, f, is computed by knowing the least distance of f to the set of all affine functions [42]. Thus, the component Boolean functions of the S-box should have standing nonlinearities scores. The nonlinearity NL(f ) of any Boolean function f is computed as follows: is the Walsh-Hadamard transform of Boolean function, f. A Boolean function is deemed frail if it tends to have poor nonlinearity. The higher nonlinearity of balanced Boolean functions is considered one of the prominent measures responsible for providing better robustness to any type of linear attack [43]. We find that the nonlinearity scores of the proposed S-box are 110, 110, 112, 112, 112, 110, 112, and 112, which include the minimum NL of 110 and an average score of 111.25. Thus, it is very evident that the proposed S-box possesses high nonlinearity performance. The reason being, the proposed scheme made to evolve the S-box based on the nonlinearity rating.

Strict Avalanche Criterion
The strict avalanche criterion was described by Tavares and Webster, and it gets its base on the completeness effect's notion and the avalanche [44,45]. This criterion measures that by making a single change in input bits, i.e., how many output bits get altered. The SAC is assumed to be satisfied when all the output bits are changed with a likelihood of 0.5, when only one input bit is flipped. Following the procedure given by Webster and Tavares, we get the SAC matrix shown in Table 3. The average of this matrix, which is 0.5007, indicates the SAC value. We can see that this score is close to ideal value of 0.5 with infinitesimal offset of only 0.0007. Thus, the proposed S-box has good avalanche when any of the single input bit is altered and decently satisfies the SAC criterion.

Bits Independence Criterion
The input bits which remain unchanged are explored under the bits independence criterion. The revamping of the independent performance of pair-wise variables of avalanche vectors and unaltered input bits is the asset of this measure. Under this criterion, the avalanche component Boolean functions pairs should be independent to each. It is an effective criterion in symmetric cryptosystem, because by augmenting independence between bits, the recognition and prediction of patterns of the system is not possible [30,46]. Accordingly, the Boolean functions f = f i ⊕ f j (i j) should behave well for nonlinearity and SAC properties both. The BIC performance of the proposed S-box for nonlinearity is shown in Table 4 and for SAC is provided in Table 5. The BIC-nonlinearity (NL) score is 102.57, and BIC-SAC is 0.5034, which indicates the acceptable performance of our S-box under BIC property.  0  104  100  104  100  98  102  98  104  0  100  104  106  108  104  104  100  100  0  104  104  108  104  98  104  104  104  0  104  100  104  104  100  106  104  104  0  106  102  106  98  108  108  100  106  0  96  102  102  104  104  104  102  96  0  98  98  104  98  104  106  102 98 0

Differential Uniformity
The differential uniformity measures the resistivity of an S-Box against the differential cryptanalysis. The attack procedure of cryptanalysis was given by Biham and Shamir; it is related with developing imbalance on the input/output dissemination to assault block ciphers and S-boxes [47]. Confrontation to this cryptanalysis can be consummate if the Exclusive-OR of each output has identical uniformity with the EX-OR value of each input. If an S-box is uniform in input/output distribution, then it is said to be resistant. It is preferred that the largest value of differential uniformity (DU) in EX-OR table should be as small as possible [48]. The differential uniformity is measured as follows: where set X holds all probable input values, and the cardinality of its elements is 256 for 8x8 S-box. The largest value of EX-OR (differential distribution) table for an S-box should be as small enough to resist the differential cryptanalysis. The differential distribution matrix for the proposed S-box is obtained and is available as Table 6. The highest value of this matrix, i.e., 10, is the differential uniformity for our S-box, and such maximum values are only 7 out of the 256 values in the matrix, thus indicating the good differential uniformity and robustness of the proposed S-box.

Linear Approximation Probability
The method of linear approximation probability (LAP) is helpful in calculating the imbalance of an incident. The largest value of imbalance of an event is measured with the help of the analysis introduced by Matsui [49]. There must be no difference between output and input bits uniformity. Each of the input bits with its results in output bits is examined individually. If all the input elements are 256 for the 8 × 8 S-box, the class of all possible inputs is d, and the masks applied on the equality of output and input bits are respectively m x and m y , then maximum linear approximation is the maximum number of the same results and calculated as follows: A lower value of this measure indicates that S-box is more capable to resist the linear cryptanalysis. The LAP score of proposed S-box is 0.14025.

Comparison
A performance comparison analysis is significant in finding the actual standing of the proposed S-box. Almost all S-box methods were dynamical systems of the following types: (1) high dimensional continuous integer-order systems, (2) time delay system, (3) fractional-order 3D systems, and some other recent S-boxes are opted for the comparison. The performance scores for different security properties of all selected S-boxes are displayed in Table 7. The nonlinearity performance of the proposed S-box comes out to be outstanding, as all three statistics, namely the minimum (110), maximum (112), and average (111.25), are significantly higher than the S-boxes in Table 7. The same comparison is also shown graphically in Figure 2a. Thus, highly nonlinear S-boxes can be constructed by using the proposed novel scheme.
The results of bits independence criterion show that the proposed S-box also exhibits acceptable BIC performance, as the BIC-SAC and BIC-nonlinearity scores are satisfactory, as shown in Figure 2c,d.
The differential uniformity of our S-box is only 10, which is less and better than S-boxes investigated in References [24,25,42,[54][55][56][57], and it is comparable to other S-boxes in terms of robustness to differential cryptanalysis. The DU comparison is also shown graphically in Figure 2e.
A block cipher can withstand the linear cryptanalysis if the employed S-box is dynamic, highly nonlinear, and linear approximation probability is low. The LAP score of 0.14025 is obtained for the proposed S-box, which shows a satisfactory value. Moreover, this probability score is quite lower and better than the LAP score of the S-boxes available in References [25,[27][28][29]33,34,42,52,[54][55][56][57]. The LAP comparison is also shown graphically in Figure 2f. 2c,d.
The differential uniformity of our S-box is only 10, which is less and better than S-boxes investigated in References [24,25,42,[54][55][56][57], and it is comparable to other S-boxes in terms of robustness to differential cryptanalysis. The DU comparison is also shown graphically in Figure 2e.
A block cipher can withstand the linear cryptanalysis if the employed S-box is dynamic, highly nonlinear, and linear approximation probability is low. The LAP score of 0.14025 is obtained for the proposed S-box, which shows a satisfactory value. Moreover, this probability score is quite lower and better than the LAP score of the S-boxes available in References [25,[27][28][29]33,34,42,52,[54][55][56][57]. The LAP comparison is also shown graphically in Figure 2f.

Time Analysis
The computation time is one of the essential features for any security application. In order to have an idea of time consumption of our proposed scheme, we calculated the time taken by the scheme to evolve an S-box. It was found that the scheme takes a very nominal amount of time, (on average) only 3.5459 s. This computational time is considerably nominal compared to many optimization-based evolution of S-boxes available in the literature, such as References [5,8,38,53].

S-Box Validation for Image Encryption Applications
In recent days, the strong S-boxes have been predominantly utilized for image encryption applications. It is prudent to validate the appropriateness of proposed S-box for such security application. Accordingly, we applied the S-box presented in this study, to encrypt the standard 8-bit encoded Baboon plain-image. The encryption involves the forward and reverse substitution using the proposed S-box. The results of encryption along with the distribution of pixels in the respective images are shown in Figure 3. The obtained encrypted image shows high visual distortion and good encryption effect. To quantify the encryption performance exhibited by our S-box, we evaluated the statistical tests, such contrast, correlation, energy, and homogeneity, which are members of the Majority Logic Criteria (MLC) suite. The description and details of these tests are available in author's previous studies [7,40,48]. The statistical scores of encryption performance under MLC analysis are listed in Table 8 and compared with encryption performances of S-boxes investigated in References [48,61]. The obtained results for MLC analysis validate the appropriateness of proposed S-box for image encryption applications.

Conclusions
Highly nonlinear substitution-boxes provide good nonlinear transformation and confusion of input plaintext data to generate ciphertext data in block cryptosystems. Such S-boxes are also potent to offer great resistance to mitigate the linear and other types of attacks which may exploit the existence of linearity in the security system. Moreover, the key-dependent and dynamic S-boxes also tend to provide more strength to the cryptosystem. This paper has proposed a novel scheme of constructing dynamic and highly nonlinear S-boxes. Our scheme is based on the dynamics of two-state time-delayed fractional-order Hopfield neural network system. Firstly, the anticipated scheme generates an initial S-box which is made to evolve for high nonlinearity, using the heuristic. The proposed scheme and constructed S-box possessed high cryptographic strength and large key space. It was found that the proposed scheme is able to evolve an S-box with nonlinearity of 111.25, strict avalanche criteria value of 0.5007, and differential uniformity of 10. The comparison analysis with some available dynamical-systems-based S-box methods and others validated the better performance of our S-box.
As future directions of the presented study, we can also check the effectiveness of proposed scheme in generating large-size nxn S-boxes (n > 8). The large-size S-boxes have better potential to

Conclusions
Highly nonlinear substitution-boxes provide good nonlinear transformation and confusion of input plaintext data to generate ciphertext data in block cryptosystems. Such S-boxes are also potent to offer great resistance to mitigate the linear and other types of attacks which may exploit the existence of linearity in the security system. Moreover, the key-dependent and dynamic S-boxes also tend to provide more strength to the cryptosystem. This paper has proposed a novel scheme of constructing dynamic and highly nonlinear S-boxes. Our scheme is based on the dynamics of two-state time-delayed fractional-order Hopfield neural network system. Firstly, the anticipated scheme generates an initial S-box which is made to evolve for high nonlinearity, using the heuristic. The proposed scheme and constructed S-box possessed high cryptographic strength and large key space. It was found that the proposed scheme is able to evolve an S-box with nonlinearity of 111.25, strict avalanche criteria value of 0.5007, and differential uniformity of 10. The comparison analysis with some available dynamical-systems-based S-box methods and others validated the better performance of our S-box.
As future directions of the presented study, we can also check the effectiveness of proposed scheme in generating large-size nxn S-boxes (n > 8). The large-size S-boxes have better potential to offer resistance to several attacks than small-size S-boxes. The generation of large-size S-boxes is rarely investigated in the literature. Moreover, the evolution is initial S-box is based on only lone criteria of nonlinearity. The evolution process can be executed to satisfy multiple S-box performance parameters.