Optimizing Hill Climbing Algorithm for S-Boxes Generation

: Nonlinear substitutions or S-boxes are important cryptographic primitives of modern symmetric ciphers. They are designed to complicate the plaintext-ciphertext dependency. According to modern ideas, the S-box should be bijective, have high nonlinearity and algebraic immunity, low delta uniformity, and linear redundancy. These criteria directly affect the cryptographic strength of ciphers, providing resistance to statistical, linear, algebraic, differential, and other cryptanalysis techniques. Many researchers have used various heuristic search algorithms to generate random S-boxes with high nonlinearity; however, the complexity of this task is still high. For example, the best-known algorithm to generate a random 8-bit bijective S-box with nonlinearity 104 requires high computational effort—more than 65,000 intermediate estimates or search iterations. In this article, we explore a hill-climbing algorithm and optimize the heuristic search parameters. We show that the complexity of generating S-boxes can be signiﬁcantly reduced. To search for a random bijective S-box with nonlinearity 104, only about 50,000 intermediate search iterations are required. In addition, we generate cryptographically strong S-Boxes for which additional criteria are provided. We present estimates of the complexity of the search and estimates of the probabilities of generating substitutions with various cryptographic indicators. The extracted results demonstrate a signiﬁcant improvement in our approach compared to the state of the art in terms of providing linear non-redundancy, nonlinearity, algebraic immunity, and delta uniformity.


Introduction
Nonlinear substitutions (S-boxes) have been used for a long time in cryptography.For example, in one of the basic works in cryptography, Claude Shannon pointed out the use of substitutions and permutations [1].Modern cryptographic algorithms make extensive use of this concept.For instance, the AES standard, established by the US National Institute of Standards and Technology (NIST), uses an 8-bit bijective S-box, which is formed by a simple algebraic construction [2].This algebraic simplicity is used to criticize AES.It is assumed that there are effective algebraic attacks on AES [3][4][5], i.e., according to modern ideas, S-boxes in a secure cipher should be random.At the same time, random generation is computationally inefficient.For an 8-bit S-box, the set of possible solutions is huge.It contains 2 8 !> 10 506 values.It is really difficult to find a target S-box (with the required cryptographic indicators) [6][7][8].For example, the nonlinearity of a randomly chosen substitution rarely N(S) > 98 [7].The most difficult task is to generate highly nonlinear random substitutions.Apparently, the value N(S) = 104 is the best-known result for random bijective S-boxes and our main goal is this target result.
We consider the cost function based on Walsh-Hadamard Spectra (WHS heuristic function) [18] as one of the first and most studied heuristic functions f (x) used to generate S-boxes [19][20][21].Various works provide estimates of the efficiency of local search using WHS [10,19,20].Although most sources [10,20] point out more efficient heuristics (in combination with other search algorithms), we demonstrated the low generalizability of these approaches.Several experiments show that with the WHS recommend parameters, it is possible to significantly increase the efficiency of local search.We present the results of the comparison and show that HC with WHS function can be more effective than many current techniques.Actually, we manage to obtain the least number of iterations (intermediate estimates) to generate an S-box with N(S) ≥ 104.We also show that we can generate target S-boxes (with indicators: bijectivity, N(S) ≥ 104, AI(S) ≥ 3, δ ≤ 8, NnonLE(S) = 255) faster (i.e., with less number of search iterations).
The article is structured as follows.Section 2 provides a brief review of the literature sources with the analysis of the obtained results.Section 3 presents the main notation and background of the research.Section 4 describes the proposed heuristic search methodology.Section 5 presents the main results obtained by the proposed approach.Finally, Section 6 provide a discussion about the results and our conclusions.In the list of references, we provide a link to the GitHub repository, where you can find the developed algorithms.The code allows independently reproducing and verifying our results.

Related Works
Many modern works are devoted to the problems of finding new ways to improve the efficiency of modern information protection systems, including new ways to generate Sboxes [22][23][24].Many of them are based on advanced AI techniques, evolutionary algorithms, chaos, heuristic search, etc. [25][26][27][28].
Heuristic algorithms do not use brute force, but select only a subset of solutions (intermediate estimates) [13,29,30].At the same time, intuitively introduced functions (heuristics) are used to rank decision alternatives [31,32].
Usually, heuristic techniques in AI are used to quickly find a local optimum, i.e., they make it possible to find an acceptable (target) solution to the optimization problem in a short time and at reasonable computational costs.For example, the article [7] studies the HC algorithm.The authors have significantly reduced the difficulty of finding target S-boxes; however, the authors did not obtain a nonlinearity value of N(S) ≥ 100.
In [6,18,33], the authors present the simulated annealing method (SA).They have reduced the search time and formed an S-box with a nonlinearity value of N(S) = 102.In addition, the article [18] proposed a new heuristic function based on Walsh-Hadamard Spectra (the WHS cost function), which is used in many other later works.
The works [19,21,34] present the genetic algorithms (GA) and the immune algorithms (IA) for solving this task.In [19], the authors proposed a new method that combines a special version of the genetic method with the tree search, the name of the method is GaT («Genetic and Tree»).The author obtained an S-box with a nonlinearity value of N(S) = 104.The WHS function was also used as a heuristic, for which the author has conducted a large study to select the best parameters.In all subsequent works, the parameters of the WHS heuristic from [21] are mainly used.However, the average number of iterations (intermediate WHS estimates) required to generate a S-box with N(S) = 104 using GaT is still big (more than 3 million) [19,35].
Subsequent works have focused on finding the best heuristics.The work [20] proposes a new heuristic PCF (Picek Cost Function).The authors reviewed several heuristic algorithms (GA, GaT, LSA) and compared their performance in combination with the WHS and PCF functions.In almost all their comparisons, algorithms with the new PCF heuristic turned out to be more efficient (it should be noted that WHS was used with parameters from [19]).The best result achieved in [20] was (on average) 167,451 iterations (intermediate PCF estimates) to create an S-box with N(S) = 104.The GaT algorithm turned out to be the best again.
The recent papers [10,35] propose a new heuristic WCF (Cost Function of the content of the Walsh-Hadamard spectrum).The authors combined WCF with three algorithms (LSA, GaT, HC) and compared the results with respect to [20].It turned out that the new WCF heuristic significantly speeds up the search for a S-box with N(S) = 104.For instance, for GaT, the average number of iterations (intermediate WCF estimates) decreased to 116,266 [10].However, the improvement of the HC algorithm is even more interesting.In combination with the new WCF function, it turned out to be the fastest search algorithm, the average number of iterations (number of evaluations) was reduced to 70,596 [10].In [35], the authors report an even greater improvement.In particular, the average number of iterations (number of estimates) for the HC algorithm is reduced to 65,933.
The logical conclusion is that the choice of the cost function significantly affects the efficiency of the search.This brief analysis of the related works clearly confirms this reasoning.Considered in 1998 [7], the HC algorithm turned out to be more efficient than many modern algorithms [10,35].In this article, we show that the WHS cost function proposed in [18] is also very efficient.
We assumed that heuristic parameter optimization has to be performed for each heuristic algorithm separately.Till now, WHS has been optimized for SA in [6,18] and for GaT in [19].Differently from the other state-of-the-art research in this paper, we present our own interpretation of the HC algorithm.In particular, we optimize the WHS parameters for the HC algorithm and estimate the computational complexity of generating the S-box with N(S) = 104.
Our experiments show that the optimized WHS parameters applied to the HC algorithm enable the obtaining of the smallest average number of iterations (number of estimates).We need to perform an average of 50,265 iterations to generate the S-box with N(S) = 104.For us, this is the best-known result to date.In addition, we show that our technique makes it possible to generate target S-boxes with additionally introduced cryptographic indicators (bijectivity, N(S) ≥ 104, AI(S) ≥ 3, δ ≤ 8, NnonLE(S) = 255).Such cryptographically strong S-boxes are currently integrated and used in modern symmetric ciphers [36][37][38][39].

Background
The main object of research in our work is 8-bit substitution.Schematically, it can be represented as a block (S-box) with 8 binary inputs x 0 , x 1 , x 2 , . . ., x 7 and 8 binary outputs y 0 , y 1 , y 2 , . . ., y 7 (Figure 1).many modern algorithms [10,35].In this article, we show that the WHS cost function proposed in [18] is also very efficient.
We assumed that heuristic parameter optimization has to be performed for each heuristic algorithm separately.Till now, WHS has been optimized for SA in [6,18] and for GaT in [19].Differently from the other state-of-the-art research in this paper, we present our own interpretation of the HC algorithm.In particular, we optimize the WHS parameters for the HC algorithm and estimate the computational complexity of generating the S-box with ( ) 104 N S = .Our experiments show that the optimized WHS parameters applied to the HC algorithm enable the obtaining of the smallest average number of iterations (number of estimates).We need to perform an average of 50,265 iterations to generate the S-box with ( ) 104 N S = .For us, this is the best-known result to date.In addition, we show that our technique makes it possible to generate target S-boxes with additionally introduced cryp- ).Such cryptographically strong S-boxes are currently integrated and used in modern symmetric ciphers [36][37][38][39].

Background
The main object of research in our work is 8-bit substitution.Schematically, it can be represented as a block (S-box) with 8 binary inputs 0 1 2 7 , , ,..., x x х x and 8 binary outputs , , ,..., y y y y (Figure 1).
A bijective substitution (S-box) can be specified as a vector of 256 non-repeating 8-bit integers, where the element's position is given by , and the element's value is given by Thus, an 8-bit S-box implements a Boolean mapping S : {0, 1} 8 → {0, 1} 8 , which is given by a system of algebraic equations (coordinate Boolean functions) over a binary field: (1) For compact notation, we use the definition of (8, 8)-function F(x) = ( f 1 , f 2 , . . ., f 8 ) (Boolean function with several outputs) [40].
A bijective substitution (S-box) can be specified as a vector of 256 non-repeating 8-bit integers, where the element's position is given by x = (x 0 , x 1 , x 2 , . . ., x 7 ), and the element's value is given by y = F(x).
The 8-bit S-boxes are widely used in modern cryptography; for example, they are used in symmetric ciphers to complicate the functional dependence of plaintext and ciphertext [41].Some cryptographic indicators of ciphers are directly determined by indicators of S-boxes [2].
Let us consider the most important S-boxes indicators used in this work.The nonlinearity N(S) of the substitution is calculated as the minimum nonlinearity over the set of nonlinearities of coordinate Boolean functions and all their linear combinations (see, for example, Definition 1 in [40]): The nonlinearity of a Boolean function f (x 0 , x 1 , . . ., x 7 ) is defined in terms of the Hamming distance between its outputs and the outputs of all affine functions.This is equivalent to where W HT max is the maximum absolute value in the Walsh-Hadamard spectrum (see, for example, (5) in [40]): The nonlinearity of S-boxes is the most important performance indicator, because it determines the resistance to linear cryptanalysis [42,43].A safe substitution has to be approximated with equal probability by linear relations of the form: ( In practice, this means that we can count how many times on the entire set u, v ∈ {0, 1} 8 \{0} 8 the equality (3) is true, i.e., make a so-called linear approximation table (LAT) from values Then, for the resistance to linear cryptanalysis the value should be as small as possible for all u, v ∈ {0, 1} 8 \{0} 8 .
Maximum value in LAT is related to the nonlinearity (2) by the formula: The largest known nonlinearity result for a bijective S-box is given by the algebraic construction of the S-box of the AES cipher N(S) = 112 [2].At the same time, such S-boxes can lead to efficient algebraic cryptanalysis [3][4][5].We consider random (non-algebraic) S-boxes, which are formed by heuristic techniques of mathematical optimization.
Most of the works on heuristic methods for generating S-boxes use the indicator N(S) as the main performance criterion.At the same time, many authors proposed different heuristics.For example, the authors of [18] proposes the WHS cost function, where X and R are parameters with real values.Many related works use the WHS feature.For example, the article [19] presents a large study on heuristic search optimization using GaT and WHS.The best results are achieved with parameters X = 21, R = 7.At the same time, the GaT algorithm requires an average of 3.239 million iterations (intermediate WHS estimates) to form an S-box with a nonlinearity value of 104.This result is practically confirmed in a recent paper [35], where the average number of iterations is 3,849,881.
Another example of the PCF heuristic was proposed in [20].Denote the vector of absolute values |W HT(v • F(x), u)| by H(S), and the i-th position of the vector indicates the number of coefficients WHT with the value |4i|, k is the maximum (last) position in this vector with a non-zero value.Then, the cost function PCF is given by where N p is the heuristic parameter (value recommended by the authors is N p = 10).
It is shown in [20] that the PCF function allows a much more efficient implementation of searching target S-boxes.For example, to form an S-box with a nonlinearity of 104, the GaT algorithm needs 167,451 iterations (intermediate PCF estimates), on average.This greatly improves the result from [19] for the WHS function.
Recent papers [10,35] reported significant progress in the fast S-box generation of with N(S) = 104.The best result in [35] is achieved using the new WCF cost function where C = {0, 4, . . . ,32}.
To form an S-box with a nonlinearity value of 104, the GaT algorithm needs 116,266 iterations (intermediate WCF estimates) [10].The HC algorithm requires 65,933 iterations [35] to form such an S-box (the work [10] reported about 70,596 iterations).For us, this is the best known result, which significantly exceeds the previous one from [19,20].
The algebraic immunity of S-box is defined as the minimum degree of a polynomial P from the ideal I(S) [44]: AI(S) = min{deg(P), P ∈ I(S) GF(2)[x 1 , x 2 , . . ., x n , y 1 , y 2 , . . ., y m ]}, (10) and the minimal reduced Gröbner basis of the ideal I(S) under degree reverse lexicographic order (degrevlex) contains a linear basis of polynomials P from I(S), such that AI(S) = deg(P).
To calculate the algebraic immunity (10), it suffices to construct a minimally reduced Gröbner basis of the ideal I(S), given by Equation ( 9) and find a polynomial of the minimum degree among the elements of this basis.The value of minimum degree is the desired value of algebraic immunity AI(S).For an 8-bit S-box, you can also use other calculation algorithms, for example, from [45] or [36,46].
The indicator AI(S) can also be used as a characteristic of S-box randomness.For a randomly generated S-box S : {0, 1} 8 → {0, 1} 8 we almost always have a value AI(S) = 3.The algebraic structure of such an S-box is described by a complex system of equations, and then the cipher will be resistant to algebraic cryptanalysis.For S-boxes with a simple algebraic structure, we have a low value AI(S) = 2 (for example, S-box AES and some other ciphers [36,46]).Such ciphers are potentially vulnerable to algebraic attacks.
It should be noted that some published results on the generation of random S-boxes do not take into account the indicator AI(S).For example, in [21] there are examples of S-boxes with N(S) > 104.A direct check shows that AI(S) = 2.In practice, this means that such S-boxes are described by a simple system of equations, i.e., cannot be random.A simple algebraic structure can potentially lead to the vulnerability to algebraic attack [44].
Another important cryptographic indicator of S-boxes is delta uniformity [47,48].Delta uniformity (the maximum value of the difference table) is used as an indicator of resistance to differential cryptanalysis.It characterizes the maximum probability of the appearance of a difference ∆y = F(x) ⊕ F(x ⊕ α) = β at the output of the S-box (see Figure 1) with an input difference ∆x = x ⊕ α: The value δ has to be as small as possible.For example, the best estimate of deltauniformity for the algebraic S-box cipher AES is δ = 4.In our studies, the target S-boxes must be random and satisfy the condition δ ≤ 8.
The concept of linear redundancy (LR) was introduced in [49,50].An S-box has LR if there are at least two affine equivalent functions on the entire set v • F(x), v ∈ {0, 1} 8 \{0} 8 .For example, for the algebraic S-box cipher AES, all 255 component functions v • F(x) are affinely equivalent to each other.Such an LR is called complete [21].The presence of LR indicates the non-randomness of S-boxes.To quantify the LR S-box, the number of affine non-equivalent component Boolean functions is usually given by NnonLE(S).
To date, there are no cryptographic attacks using the LR property.However, it is assumed that the generated S-boxes does not have to contain affine equivalent Boolean functions v • F(x), i.e., NnonLE(S) = 255.
The presence of a fixed point (FP) in the S-box corresponds to the case F(x) = x [21,51].This case of identity transformation can be supplemented with an inverse fixed point F(x) = x ⊕ {1} 8 .For cryptographic applications, the S-box should not contain such points (this condition can be easily ensured by performing an affine transformation [52]).Thus, it is required that the number of fixed points be NFP(S) = 0.

Methods
We explore the HC algorithm, which is used to solve various mathematical optimization problems [14][15][16][17].For example, in [10] there is the pseudocode of one of the versions of the HC algorithm for generating S-boxes (see Algorithm 1).
The pseudocode uses the nonlinear substitution definition N(S) introduced above.

The value of the cost function (heuristic) is denoted by CF(S).
Random substitution S is used as initial data.The Fisher-Yates method is usually used to form it [53,54].
Our extension and implementation of the HC algorithm formalize three new exit conditions:

•
Reaching the limit number of solutions Ne = 10 6 ; • Formation of the target S-box with the required nonlinearity N(S) ≥ 104; • Achievement of the maximum number of consecutive unsuccessful cycles K = 10 5 .By an unsuccessful cycle we mean the case CF(S ) > CF(S).Thus, the pseudocode of the HC algorithm implemented by us (see Algorithm 2) is different from [10].In fact, we eliminated the nonlinearity estimate at step 3 of the algorithm, i.e., we accept S for all CF(S ) ≤ CF(S).The rationale behind that choice lies to significantly reduce the number of iterations; reduce the computational complexity of generating S-boxes with N(S) ≥ 104.
In our research, we have focused on the WHS cost function, i.e., values CF(S ) and CF(S) were calculated by Formula (6).
The second part of our research consisted in introducing additional requirements for S-boxes cryptographic indicators.In addition to the requirement of nonlinearity N(S) ≥ 104 we also introduce restrictions on other indicators, algebraic immunity AI(S) = 3, delta uniformity δ ≤ 8, linear non-redundancy (NnonLE(S) = 255), and no fixed points (NFP(S) = 0).

Results
We conducted several trial runs of the algorithm with different WHS parameters.In particular, for the entire range of parameters X and R from [18] we have never been able to form the target S-box with N(S) ≥ 104.At the same time, S-boxes with N(S) ≥ 102 are formed fairly quickly.Examples of changes (tracks) of nonlinearity N(S) and values of cost functions CF(S) for different values of the WHS parameters are shown in Figures 2-4:

•
The number of iterations N I is marked along the abscissa;

•
On the y-axis (on the left) the value of the WHS cost function CF(S) is marked;

•
The value N(S) is marked on the y-axis (on the right).The results from Table 1 are graphically reflected in Figure 5.For ease of perception, different ranges of values are shown in color.The results from Table 1 are graphically reflected in Figure 5.For ease of perception, different ranges of values are shown in color.The results from Table 1 are graphically reflected in Figure 5.For ease of perception, different ranges of values are shown in color.We review the operation of the HC algorithm (see Algorithm 2) at each iteration and calculate the values of WHS CF(S) and nonlinearity N(S).Each of the figures shows two examples (marked with a different color) of iterative change (track) of the cost function CF(S) and nonlinearity N(S).The values of CF(S) and N(S) at each iteration correspond to the points on the diagram.For convenience of perception, these points are connected by lines.
As can be seen from the examples, the value of the WHS heuristic gradually decreases (on the graphs, only improving positions are marked, i.e., only cases when the condition CF(S ) ≤ CF(S) is true at step 3 of the algorithm).In this case, the value of the nonlinearity generally increases.Nevertheless, the decrease in the cost function can lead to the nonlinearity decrease in some cases.This is a natural process for local optimization algorithms.
To optimize the parameters X and R in ( 6), we carried out extensive experimental studies, following the example of [19].We used the HC algorithm instead of GaT from [19], as the search algorithm (see Algorithm 2).
The research results are shown in Table 1.For each combination of parameters X and R we give the number of iterations of the HC algorithm that were required to generate an S-box with N(S) = 104.All values were obtained by averaging over 100 runs of the algorithm.The "-" symbol denotes cases where the target S-box was found in less than 50% of launches.
The results from Table 1 are graphically reflected in Figure 5.For ease of perception, different ranges of values are shown in color.The obtained results show that when choosing R = 12 and X = 0 for the heur function (6), the best results are achieved in terms of the average number of iterati (intermediate estimates) for the HC algorithm.Compared to the best result publishe [35], we observe a reduction in the number of iterations by more than 20%.On aver the HC algorithm with optimized parameters WHS ( R = 12 and X = 0) needs to perf 50,265 iterations.
It is worth noting that for our version of the HC algorithm, there is a range of va of parameters X and R , for which close values of computational complexity are served.These values of the X and R parameters are highlighted in Table 1.For e The obtained results show that when choosing R = 12 and X = 0 for the heuristic function (6), the best results are achieved in terms of the average number of iterations (intermediate estimates) for the HC algorithm.Compared to the best result published in [35], we observe a reduction in the number of iterations by more than 20%.On average, the HC algorithm with optimized parameters WHS (R = 12 and X = 0) needs to perform 50,265 iterations.It is worth noting that for our version of the HC algorithm, there is a range of values of parameters X and R, for which close values of computational complexity are observed.These values of the X and R parameters are highlighted in Table 1.For each combination of these parameters, we have the smallest average number of iterations compared to the best result known to date from [31].To compare the computational complexity of different methods for generating 8-bit bijective S-boxes with N(S) = 104 we present Table 2.
For our results, Table 2 also shows the confidence intervals calculated for a statistical significance level of α = 0.05.Practically, this means that in 95% of cases the number of iterations required to generate S-boxes will be in the specified interval.As can be seen from the above results, our optimization of the HC algorithm compared to the best-known result allows us to reduce the average number of iterations by more than 20%.
In the last few years, many papers in the field of S-boxes generation have been published, e.g., [24][25][26][27]55].In these papers, the authors estimate the average value of nonlinearity over all coordinate Boolean functions (1).However, the nonlinearity of Sboxes calculated by formula (2) is usually not high.For example, in [27], the minimum nonlinearity of the two generated S-boxes is 98 and 100.Two examples in [25] are also given, with minimum nonlinearity of 96 and 100.The paper [55] gives an estimate of the linear approximation probability of 0.125.This means that the maximum value in LAT calculated by Formula (4) is 32, whence, by Formula (5) we have a non-linearity of 96.In our comparison in Table 2, we present only the results with minimum (for all component Boolean functions) nonlinearity, i.e., for N(S) = 104.Table 3 shows the results of generating target S-boxes with additionally introduced cryptographic indicators.In addition to the indicator N(S), there are also the results of forming target S-boxes, that correspond to the additionally introduced criteria.All calculations were carried out with R =12 and X = 0. We performed 100 runs for each set of parameters.
Table 3 uses the following notation: • k min is the minimum number of iterations performed by the search algorithm out of all 100 runs, provided that the target S-box is found; • k max is the maximum number of iterations performed by the search algorithm out of all 100 runs, provided that the target S-box is found; • k aver is the average number of iterations performed by the search algorithm, provided that the target S-box is found; • k N=104 is the average number of iterations to find a bijective S-boxes with N(S) = 104; is the average number of additionally performed iterations for the search algorithm after finding the first bijective S-box with N(S) = 104; • k rej is the average number of the rejected iterations with the additional criteria, i.e., after finding the bijective S-box with N(S) = 104, but this S-box does not correspond to the additional criteria.
As we can see from the results shown in Table 3, the probability of finding the target Sbox with the required parameters is high.In our experiments, the probability of generating bijective S-boxes (with parameters N(S) ≥ 104, AI(S) = 3, δ ≤ 8, NnonLE(S) = 255, and NFP(S) = 0) is ≈83%.
The most expensive (in terms of number of iterations) additional parameter is the condition for delta uniformity δ ≤ 8.This criteria increases the average required number of iterations to find the target S-box on average by ≈ 50%.Moreover, the scatter is quite significant, from immediately found to several hundred thousand additional iterations (in this case, up to several hundred found bijective S-boxes with N(S) = 104) are rejected.All found target S-boxes correspond to the criteria AI(S) ≥ 3 and NnonLE(S) = 255.Thus, we can conclude that the introduction of these two additional parameters does not affect the performance of the suggested search algorithm.
As it was mentioned earlier, after finding the target S-box, we perform an affine transformation in order to fulfill the criteria NFP(S) = 0.About 90% of cases were successful in finding an affine transformation of the target S-box that does not contain fixed points.
It should be clarified that a small number of k add with k rej = 0 is formed due to the multi-threading of our software implementation.When calculating the parameters of the target S-box found by one thread, the other thread carries out some more (1-12, depending on the set of checked parameters) iterations, which are also counted in the total number.There are no such anomalies if you run the search algorithm in one thread.
As can be seen from the above results, the proposed optimization of the WHS heuristic allows using the HC algorithm (Algorithm 2) to generate target S-boxes with additionally introduced cryptographic indicators (bijectivity, N(S) ≥ 104, AI(S) ≥ 3, δ ≤ 8, NnonLE(S) = 255, and NFP(S) = 0) for 90 452 iterations, on average.The probability of finding a target S-box with only one run of the algorithm is greater than 80%.

Conclusions
In this paper, we have studied algorithms for heuristic search for nonlinear substitutions of symmetric ciphers.We proposed the integration of the HC algorithm for solving this task and we studied the cost function WHS based on Walsh-Hadamard Spectra.Our goal was to develop computationally efficient techniques for generating cryptographically strong S-boxes (bijective substitutions with high nonlinearity and algebraic immunity, low delta uniformity, and linear redundancy).
Our research consisted of optimizing the WHS objective function (heuristic) in the context of the local optimization algorithm HC.We managed to reduce the computational complexity of generating the S-box with N(S) = 104 more than 20% compared to the best known result from [35].Most interesting in this result is the combination of search

Algorithm 1 :Algorithm 2 :
The Hill Climbing Algorithm[10] Input: a random substitution S, the number of solution evaluations Ne; While Ne > 0 do: S ← S ; Select at random two different positions i and j and swap the outputs on S corresponding to i and j; if N(S ) > N(S) or (N(S ) = N(S) and CF(S ) < CF(S)) then S ← S ; Ne = Ne − 1; Return S. The Implemented Hill Climbing Algorithm Input: a random substitution S; the number of solution evaluations Ne = 10 6 ; the nonlinearity target S-box N(S) ≥ 104; the maximum number of consecutive unsuccessful cycles N f r = 10 5 ; k ← 0 ; While (Ne > 0) and (N(S) < 104) and (k < N f r) do: S ← S ; Select at random two different positions i and j and swap the outputs on S corresponding to i and j

Electronics 2023 ,Figure 5 .
Figure 5. Average number of iterations performed before finding the target S-box, using the W function at different parameters X and R .

Figure 5 .
Figure 5. Average number of iterations performed before finding the target S-box, using the WHS function at different parameters X and R.

Table 1 .
The average number of iterations N I that were performed to find the S-box with N(S) = 104, using the WHS function.

Table 3 .
Results of generating target S-boxes with additionally introduced cryptographic indicators.