Generation of Dynamical S-Boxes for Block Ciphers via Extended Logistic Map

. In this work, we present a simple algorithm to design n × n -bits substitution boxes (S-boxes) based on chaotic time series of the logistic map for diﬀerent carrying capacities. The use of diﬀerent carrying capacities in the chaotic map leads to low computational complexity, which is desirable to get high-speed communication systems. We generate a main sequence by means of two auxiliary sequences with uniform distribution via the logistic map for diﬀerent carrying capacities. The elements of the main sequence are useful for generating the elements of an S-box. The auxiliary sequences are generated by considering lag time chaotic series; this helps to hide the chaotic map used. The U-shape distribution of logistic chaotic map is also avoided, in contrast with common chaos-based schemes without considering lag time chaotic series, and uncorrelated S-box elements are obtained. The proposed algorithm guarantees the generation of strong S-boxes that fulﬁll the following criteria: bijection, nonlinearity, strict avalanche criterion, output bits independence criterion, criterion of equiprobable input/output XOR distribution, and maximum expected linear probability. Finally, an application premised on polyalphabetic ciphers principle is developed to obtain a uniform distribution of the plaintext via dynamical S-boxes.


Introduction
Nowadays, we are in the era of informatics, and due to a large number of attacks, it is important to adequately protect the information to be transmitted and avoid the possible misuse of it. e aforementioned comment motivates the generation of different approaches to have secure cryptographic systems. In general, cryptosystems can be divided into two classes: stream cipher and block cipher. A stream cipher takes one bit and transforms it into one output bit. Meanwhile, a block cipher takes m input bits and transforms them into m output bits. e core of this transformation in block ciphers is static S-boxes. e S-boxes give cryptosystems the confusion property described by Shannon [1] and are used in conventional block ciphers such as the Data Encryption Standard (DES) and the Advanced Encryption Standard (AES). e security in these cryptographic systems depends mainly on the properties of S-boxes used. A strong S-box fulfills the following criteria: bijection, nonlinearity, strict avalanche criterion (SAC), and the output bit independence criterion (BIC) [2]. If an S-box fulfills the above criteria, then it is called "good S-box." Other desirable characteristics are being resistant to linear and differential cryptanalysis attacks. e construction of cryptographically secure dynamic S-boxes is a field of interest in the area of cryptography.
In recent years, many papers have been reported and focus on studying cryptosystems based on chaos, see ref. [3][4][5][6][7][8][9][10][11][12][13][14][15][16], this is, because of the relationships that exists between the chaotic system properties and the cryptosystem properties. In ref. [17] the relationship between these properties are given; for instance, confusion is related to ergodicity, the diffusion property with sensitivity to initial conditions and the deterministic dynamic with the deterministic pseudorandomness. Taking advantage of the chaotic system's properties, a strong and dynamic S-Box is proposed that fulfills the criteria of a good S-box.
Regarding the generation of S-box based on chaos, some algorithms have been developed using discrete dynamical systems. For example, in ref. [3,5,[8][9][10]16], the generation of substitution boxes was introduced through using only a time series of a map or by combining two time series of different maps. In the same way, there are algorithms that use continuous chaotic dynamical systems [4,6,11,12]. Nevertheless, these algorithms do not guarantee that the series used have a uniform distribution, in contrast with the approach used in this work. ere are also algorithms that consider the mixing of time series of continuous and discrete dynamical systems [7,13], and in ref. [18] the algorithm is built via time-delay series. Other types of encryption algorithms consider so-called hidden attractors [15]. e advantage of using discrete chaotic dynamical systems is that from one iteration to another, the elements of the time series are uncorrelated. However, this does not happen if a continuous chaotic dynamical system is used, and the elements of the time series are strongly correlated. erefore, many iterations are needed, and the calculation of the mutual information between elements of the time series is necessary to be able to say when they are uncorrelated, which implies a higher computational cost.
In chaos-based encryption schemes, pseudorandom sequences via chaotic maps are generally used as one-time pad for encrypting messages. Since encryption schemes, based on low dimensional chaotic map, have low computational complexity, they can be analyzed with low computational cost using iteration and correlation functions [19]. Time-delay chaotic series have complex behavior and erase the trace of the mapping that generates them. In ref. [20], the generation of pseudorandom series with good statistical properties was proposed using lag time series from the logistic map. Using this kind of lag time series, it is possible to hide the map used to build them. Usually, the chaotic maps used for cryptography have been normalized to map the interval [0, 1] to itself, i.e., f: is simple maneuver of using the extended logistic map allows the generation algorithm to calculate dynamic S-boxes faster than its standardized version.
In this paper, we present an algorithm to design n × nbits S-boxes based on a main sequence generated by mixing two auxiliary sequences using lag time chaotic series. ese chaotic time series are computed with the logistic map considering different carrying capacities. Because of the logistic map considers a carrying capacity parameter, it is easy to adjust this parameter to map the interval [0, 2 8 ] to itself, so each iteration generates a byte instead of a bit. e generation of a byte with each iteration helps with the computational time to produce S-boxes because fewer iterations are needed. Notice that the generation of bytes can be realized in a different way, for example, by partitioning the interval [0, 1] into 256 subintervals. So each subinterval corresponds to a byte. e difference between both approaches of byte generation is the computing program; then we implement the approach based on the extended logistic map. Two lag time chaotic series are mixed to favor a uniform distribution in the main sequence that generates S-boxes. In addition, the logistic map is hidden if the first return map is plotted with the main sequence. Several statistical tests are carried out to evaluate the performance of these proposed S-boxes. e results show that all the criteria are met for a good S-box and with high immunity to resist differential cryptanalysis and linear cryptanalysis. e rest of the work is organized as follows: in Section 2, an algorithm for generating substitution boxes based on binary sequences of the logistic map is presented. In Section 3, a dynamic analysis of the extended logistic map and the proposed scheme to generate a dynamic S-box based on the map are presented. In Section 4, the criteria for a "good" n × n-bits S-box are described. In Section 5, the performance analysis of the proposed algorithms are provided and compared with other S-boxes reported in the literature. In Section 6, an application to obtain a uniform distribution of the plaintext via dynamical S-boxes is presented. Finally, conclusions are drawn in Section 7.

Dynamical S-Boxes Based on CSPRNG
First, we consider an algorithm to generate dynamic S-boxes based on a Cryptographically Secure Pseudo-Random Number Generator (CSPRNG), which was proposed by García-Martínez and Campos-Cantón [20] and tested with the suite of NIST. e CSPRNG is based on two lag time series generated with the logistic map, f L : I ⟶ I, which is defined as where x is the state variable of the logistic map, and α is the parameter of the system.

e First Algorithm for S-Box
Design via CSPRNG. e steps of the algorithm are simple as shown below: Step 1. Select initial conditions x 01 and x 02 for CSPRNG in order to generate the stream of bits s 0 , s 1 , s 2 , . . .
Step 4. Discard the repeated elements D's to select 2 n different values. e rule to discard an element is as follows: if D i � D j with i < j then discard D j .
Step 5. Create the S-Box with the 2 n different elements of D's.
Once the procedure is over, the proposed algorithm returns a n × n-bits S-box with distinct 2 n values. Note that D 0 is the first element of the S-box, but the second element could be not D 1 if D 0 � D 1 . However, enough 2 n elements have been generated to build the S-box. Each block C's is comprised by n-bits, s j , s j+1 , . . ., s j+n− 1 , which are related with the functions f i , with i � 1, . . ., n.
To exemplify the generation of dynamic S-boxes, consider n � 8, this allows us to build a 8 × 8 bits S-Box. e other parameters are set as follows: α 1 � 4, α 2 � − 2 and two arbitrary initial conditions x 01 and x 02 , then the S-Box obtained is shown in Table 1 for x 01 � 0.8147, and x 02 � 0.9058.
is proposed substitution box has the properties of confusion and diffusion, which are of vital importance for the block ciphers. In this case, the time needed to calculate an S-box was 1.096 seconds.

Analysis of the Extended Logistic Map
In the context of mathematics, it is possible to consider the logistic map at different intervals, [0, κ], with 0 < κ ∈ R, and the parameter α positive and restricted to an interval such that the orbit of an initial condition x 0 ∈ [0, κ] does not escape to infinity. In this context, the logistic map for 1 < κ is called extended logistic map. For our interest, we consider the extended logistic map as f LE (α, x): [0, 2 n ] ⟶ [0, 2 n ], so that it is defined as follows: for the bifurcation parameter α ∈ [0, (4/2 n )] and x 0 ∈ [0, 2 n ]. Nevertheless, as it is explained in [21], mathematically, it is possible to consider negative values. As mentioned above, the extended logistic map is now studied with α in the interval [− (2/2 n ), 0). e dynamical system (2) has one or two fixed points located at x * 1 � 0 and at x * 2 � 2 n α − 1/α, for α ≠ 0.
For cryptographic purposes, the value of n � 8 is chosen because a pixel, specifically, is represented by 8 bits (2 8 colors), and 1 byte � 8 bits. For α ∈ [− (2/2 8 ), (4/2 8 )], the orbits do not escape to infinity for any initial conditions in an appropriate interval determined by the value and sign of the α parameter. Figure 1 shows the shape of the extended logistic map for α � − 2/2 8 in blue triangles and for α � 4/2 8 in black crosses. It can be seen that the system has one or two fixed points depending on the value of α which are located at x * 1 � 0 and x * 2 � (2 8 α − 1)/α for α ≠ 0. e stability of the fixed points is displayed in Figure 2 where a circle denotes a stable or attractive fixed point, while a cross denotes that the fixed point is unstable or repulsive. e stability of these fixed points change according to the parameter α, i.e., when |f LE ′ (x * 1 )| < 1 and |f LE ′ (x * 2 )| < 1; then the fixed points x * 1 and x * 2 are stable, respectively, and they are unstable when |f LE ′ (x * 1 )| > 1 and |f LE ′ (x * 2 )| > 1. e case of interest is the last, because the system presents complex behavior; this is, both fixed points are repulsive, |f LE 8 . On the other hand, the x * 2 fixed point is repulsive for − 2/2 8 ≤ α < 1/ 2 8 but α ≠ 0, or 3/2 8 < α ≤ 4/2 8 . So the interesting values are α ∈ [− 2/2 8 , − 1/2 8 ] ∪ [3/2 8 , 4/2 8 ]; this is the condition to have both repulsive fixed points.
e dynamical system (2) bifurcates when |f LE ′ (x * 1 )| � 1 and |f LE ′ (x * 2 )| � 1, this happens for x * 1 when α � ±1/2 8 , and for x * 2 the bifurcation values are given by α � 1/2 8 and 3/2 8 . It is possible to analyze the behavior of the system by means of a bifurcation diagram, which is shown in Figure 3. is diagram shows orbit's values as a function of α parameter and the route to chaos are period-doubling bifurcations at α � 3/2 8 and period-halving bifurcations at α � − 1/2 8 . ere are intervals for the parameter α near to − 2/2 8 and 4/2 8 where the extended logistic map f LE (α, x) behaves chaotically. ere are several approaches to demonstrate that a system is chaotic; one of them is to prove that the dynamical system fulfills the definition given by Devaney [22] and another approach is based on the Lyapunov exponent [23,24]. We use this last concept to prove chaos and the Lyapunov exponent of Equation (2) is shown in Figure 4. e graph of Lyapunov exponents is symmetric with respect to α � 1/2 8 ≈ 0.0039, the chaotic behavior of the extended logistic map appears for values of the parameter α near − 2/2 8 ≈ − 0.0078 and 4/2 8 ≈ 0.0156. e local stability of the fixed points are in accordance with the Lyapunov exponent values, for example, when α ∈ (− 1/ 2 8 ≈ − 0.0039, 3/2 8 ≈ 0.0117), the orbits of the system converge at a fixed point, and when the bifurcations occur, the orbits converge at periodic orbits up to chaos appears. e aim is to use the extended logistic map to generate a time series with uniform distribution and without evidencing the mapping used. To achieve this, there is an approach based on two chaotic time series of the extended logistic map given in [20]. Following Lyapunov exponent analysis, the values of α are arbitrarily selected within the chaos region, so it is considered α � − 2/2 8 and 4/2 8 . e extended logistic map for these parameter values is invariant in different intervals as follows: It is worth mentioning that the time series generated with both parameter values have a U-shape distribution.

S-Box Construction via Integer Chaotic Lag Time Series.
e main idea of the proposed algorithm for the generation of dynamic S-boxes is to mix two lag time series based on the extended logistic map f LE : I ⟶ I. e interval I is determined by the parameter α. Let M1 and M2 be two time series generated with the extended logistic map by means of the following considerations: (i) given two arbitrary initial conditions x 01 , x 02 , such that, x 01 ≠ x 02 ; (ii) two different bifurcation parameter values α 1 and α 2 ; and (iii) l-units of memory for each time series . So the orbits have uniform distribution independent of the U-shape distribution of the extended logistic map. In order to illustrate the algorithm, we have chosen the bifurcation parameter values at α 1 � − 2/2 8 and α 2 � 4/2 8 for the time series M1 and M2, respectively. ese parameter values ensure that system (2) has chaotic behavior in both cases; see Figure 4.
For instance, the plot of the time series x n onto the plane (x n− 1 , x n ) reveals the map used; see Figure 7(a), i.e., the extended logistic map is shown. In contrast, the time series z n does not reveal the extended logistic map onto the plane (z n− 1 , z n ); see Figure 7(c). In addition, the delayed map has a uniform probability distribution instead of a "U-shaped" probability distribution [25] that the extended logistic map has. Figures 7(b) and 7(d) show the probability distribution of the time series x n and z n , respectively. is is an important characteristic that makes easier the construction of S-box since all values have the same probability of occurrence in contrast to the use of a single time series.
Because the elements of the time series Z i are real numbers, they are discretized to obtain a time series that is useful for cryptosystems. e symbolic dynamics of Z i time series is given by using the floor function to obtain the series s i . So the elements of s are integer numbers, s i (Z i ) ∈ {0, 1, 2, . . ., 2 8 }; thus, the process for getting the integer number series is as follows:

Mathematical Problems in Engineering 5
A CSPRNG based on a discrete dynamical system is given from equations (2) to (9).

e Second Algorithm for S-Box Design via Extended
Logistic Map. In this subsection, we introduce an algorithm to generate n × n S-boxes based on the extended logistic map. e algorithm steps are simple as shown below.
Step 2. Discard the repeated elements D's to select 2 n different values. e rule to discard an element is as follows: if s i � s j with i < j then discard s j .
Step 3. Create the S-Box with the 2 n different elements of s i 's.
Once the procedure is finished, the proposed algorithm returns a n × n S-box with 2 n different values. Note that s 0 is the first element of the S-box, but the second element could be not s 1 if s 0 � s 1 . However, enough 2 n elements have been generated to build the S-box.
For example, if n � 8, x 01 � 191, x 02 � 209, α 1 � 4/2 8 , and α 2 � − 2/2 8 , then the 8 × 8 S-Box is obtained and shown in Table 2. is proposed substitution box has the confusion and diffusion properties, which are vital for the block ciphers. In this case, the time needed to calculate an S-box is 0.014 seconds.

Criteria for a Good n × n S-Box
A compilation of six important and well-known criteria reported in the literature to generate cryptographically good S-boxes is presented. ese criteria are bijection; nonlinearity, strict avalanche criterion, independence criterion of output bits, XOR distribution of equiprobable input/output, and maximum expected linear probability.

Nonlinearity Criterion
Definition 1 (see [27]). e nonlinearity of a Boolean function f: F n ⟶ F is denoted by where A w,c (x) is an affine function set and d H (f, l) is the Hamming distance between f and l. e minimum distance between two Boolean functions can be described by means of the Walsh spectrum [28]: where the Walsh spectrum of f(x) is defined as follows: with ω ∈ F n , and x • ω is the dot product between x and ω as

Strict Avalanche Criterion (SAC).
is criterion was first introduced by Webster and Tavares [29]. A Boolean function f satisfies SAC if complementing any single input bit changes the output bit with the probability of half. So, a Boolean function f satisfies SAC, if and only if where e i ∈ F n such that wt(e i ) � 1.

Output Bits Independence Criterion (BIC). Output Bit
Independence Criterion was also introduced by Webster and Tavares [29]. It means that all the avalanche variables should be pairwise independent for a given set of avalanche vectors generated by complementing a single plaintext bit. Adam and Tavares introduced another method to measure the BIC, for Boolean functions, f i and f j (i ≠ j) of two output bits in a S-box, if f i ⊕ f j is highly nonlinear and comes as close as possible to satisfy SAC [2]. Additionally, f i ⊕ f j can be tested with a Dynamic Distance (DD). e DD of a function f can be defined as If the value of DD is a small integer and close to zero, the function f satisfies the SAC. [30] introduced differential cryptanalysis which attacks S-boxes faster than brute-force attack. It is desirable for an S-box to have differential uniformity. is can be measured by the maximum expected differential probability (MEDP). Differential probability for a given map S can be calculated by measuring differential resistance and is defined as follows:

Criterion of Equiprobable Input/Output XOR Distribution. Biham and Shamir
where 2 n is the cardinality of all the possible input values (x), Δx and Δy are called input and output differences, respectively, for the S. us, the smaller value of DP f gives better cryptographic property, i.e., better resistance to differential cryptanalysis.

Performance Analysis of the Generated S-Box
In this section, we analyze the proposed S-boxes based on the second algorithm with the six important cryptographic criteria. Furthermore, our results are compared with results reported in the literature using other approaches.

Bijective Criterion.
e computed value of proposed S-box is the desired value of 2 n− 1 � 128, with n � 8, according to formula (10), the bijective criterion is satisfied. So, the proposed S-box is one-to-one, surjective, and balanced.

Nonlinearity Criterion. Nonlinearity criterion ensures that an S-box is not a linear function between input vectors and output vectors.
e nonlinearity gives the degree of dissimilarity between the Boolean function f and n-bit linear function l. If the function has high minimum Hamming distance is said to have high nonlinearity, i.e., by reducing the Walsh spectrum in (12). An S-box contains n Boolean functions and the nonlinearity of each Boolean function must be calculated. e nonlinearities of the proposed S-box are 96, 104, 106, 102, 104, 102, 108, and 96. High nonlinearity ensures the strongest ability to resist powerful modern attacks such as linear cryptanalysis.

Strict Avalanche Criterion (SAC).
e avalanche effect indicates the randomness of an S-box when an input has a change. e generated S-box is given in Table 3. We obtain a maximum SAC equal to 0.6094, the minimum is 0.4219, and its average value 0.5059 is close to the desired value 0.5. With these results, we conclude that the S-box generated by the proposed method fulfills the property of SAC.

Output Bits Independence Criterion (BIC).
e BIC criterion guarantees that there is no statistic pattern or dependency between output vectors. e obtained BIC results are shown in Tables 4, 5, and 6. e mean value of BIC-nonlinearity is 103.50, the mean value of BIC-SAC is 0.5050, and maximum value of DD is 12 which indicates that S-box satisfies the BIC criterion.

Criterion of Equiprobable Input/Output XOR Distribution.
e equiprobable input/output XOR Distribution analyzes the effect in particular differences of input pairs of the resultant output pairs to discover the key bits. e idea is to find the high probability difference pairs for an S-Box under attack. In Table 7, the maximal value of the   Table 4: BIC-nonlinearity criterion result of the generated S-box. 0 Table 5    Mathematical Problems in Engineering generated S-box is 12, which indicates that the S-box is resistant to differential cryptanalysis.

MELP Criterion.
is criterion is computed according to equation (18) and the average value for the proposed S-Box is 0.0625, which indicates resistance against linear cryptanalysis.

Performance Comparation.
A performance comparison of our S-box and others' good S-boxes that were reported in the literature is presented in Table 8. e proposed S-box fulfills the most important condition and bijection and accomplishes good results to the rest of the test values expected [3, 4, 6, 8-11, 14, 31-42].
Comparing these S-boxes, we find that (i) e proposal fulfills the expected value 128.
(ii) e nonlinearity is 102.25, and our proposal has similar value or above that approaches reported in references [6,9,39]. (iii) e mean value of SAC of our proposed algorithm is 0.5059. is value is close to the ideal value, 0.5. (iv) e BIC-nonlinearity average is 103.42, and the BIC-SAC average is 0.5066. Table 8 shows that all the S-boxes have a good BIC property. (v) e value of the XOR distribution of equiprobable input/output is 0.0469 which indicates resistance against to differential attack. (vi) e maximum MELP is 0.0625 which is a good value in comparison with that the S-boxes reported in the literature.
e computational time depends on the algorithm and the computer used to simulate the algorithm. For example, algorithms based on chaos need more steps for generating one iteration if the chaotic systems are based on ordinary differential equations (ODEs) instead of mappings. References [4,6,15,36,39] are based on ODEs which imply more computational operations to solve the systems than references [2,3,9,10,35,38,40] based on iterated maps. It would be unfair to compare the computational time between these algorithms that all of them generate good S-boxes.
Our two proposals are based on iterated logistic maps, the first proposal maps the interval [0, 1] and second proposal maps [0, 2 8 ]. One of the characteristics of the second proposal (extended logistic map) is the use of fewer iterations to generate S-boxes than the first proposal (logistic map). Fewer iterations are possible because the extended logistic map employs the interval [0, 2 8 ] instead of the logistic map [0, 1]. e use of the interval [0, 2 8 ] allows to generate S-boxes with less iteration that the original logistic map. To scale the interval allows us to glimpse that the algorithms reported in the literature can be scaled to operate in the interval [0, 2 8 ] to generate less iterations to build good S-boxes.

Dynamical Generation of S-Boxes and its Application
"polyalphabetic ciphers," we present an application of dynamical S-boxes, where a particular intensity of a pixel is substituted by different intensities in the same round. Usually, an S-box is used to substitute all the pixels of an image of size p × q in the same way. e idea of "polyalphabetic ciphers" is to use a dynamical S-box to achieve uniform distribution in the encoded image.
Our encoded approach, to get a uniform distribution, is given by applying dynamical S-box which changes in each pixel row. e codification input is the grayscale Lenna image (Figure 8(a)), and the process is to substitute pixels of a row according to an S-box, but different rows use different S-boxes. e codification output is shown in Figure 8 Furthermore, in cryptography, a uniform distribution is always desired; since this property was achieved by simple substitution with the S-boxes, a good result is expected for a full cryptographic algorithm based on these S-boxes.
It is well known that many ciphers have been successfully analyzed with the help of statistical analysis and several statistical attacks have been devised on them. erefore, an effective cipher should be robust against any statistical attack, for instance, the information entropy, the correlation of two adjacent pixels, Peak Signal to Noise Ratio (PSNR), Unified Average Changing Intensity (UACI), and others, which it is not the purpose of this article.
It is important to point out that this substitution is a simple and useful approach intended to catch a glimpse of possible applications of dynamical S-boxes presented in this assignment.

Concluding Remarks
In this work, simple algorithms to design n × n-bits substitution boxes are presented. e algorithms are based on two lag time chaotic series of the logistic map and the extended logistic map. In both approaches, two lag time series are generated by considering different carrying capacity parameter values. e mixing of these lag time series favors two things: a uniform distribution, and the concealment of the chaotic map used.
Two proposals were presented, the former generates bits and the latter generates bytes. e generation of bytes instead of bits helps to generate S-boxes with less iterations. Although, for this work, we use the extended logistic map, it is possible to employ the logistic map or different chaotic maps to generate bytes.
To evaluate the performance of the proposed S-boxes, several statistical tests were carried out. e numerical analysis results for both proposed algorithms show that all good S-box criteria were fulfilled with high immunity to resist differential cryptanalysis and linear cryptanalysis. e number of operations is considerably reduced when we generate bytes instead of bits. e Lyapunov exponent, the bifurcations, and the local stability of logistic map are preserved in the extended logistic map. We contrast the performance of our S-boxes with other S-boxes reported in the literature and our results are in the average of good S-boxes. Finally, a simple and useful S-box application approach for coding that provides a uniform distribution was presented.

Data Availability
e data used to support the findings of this study are available from the corresponding author upon request.

Conflicts of Interest
e authors declare that they have no conflicts of interest.