Physics Letters A 374 (2010) 3733–3738

Contents lists available at ScienceDirect

Physics Letters A

www.elsevier.com/locate/pla

A method for designing strong S-Boxes based on chaotic Lorenz system

Fatih Özkaynak a, Ahmet Bedri Özer b,∗a Tunceli University, Department of Computer Engineering, Tunceli, Turkeyb Firat University, Department of Computer Engineering, 23119 Elazig, Turkey

a r t i c l e i n f o a b s t r a c t

Article history:Received 17 February 2010Received in revised form 21 June 2010Accepted 7 July 2010Available online 13 July 2010Communicated by A.R. Bishop

Keywords:ChaosCryptologyS-BoxesLorenz system

It is important to design cryptographically strong S-Boxes in order to design secure systems. In thisstudy, a strong, chaos-based S-Box design is proposed. Continuous-time Lorenz system is chosen as thechaotic system. Proposed methodology is analyzed and tested for the following criteria: Bijective property,nonlinearity, strict avalanche criterion, output bits independence criterion and equiprobable input/outputXOR distribution. The results of the analysis show that the proposed cryptosystem is a highly reliablesystem suitable for secure communication.

© 2010 Elsevier B.V. All rights reserved.

1. Introduction

Some researchers emphasize on a strong relationship betweenthe science of chaos and cryptology. The first study on this rela-tionship is based on the article written by Shannon in 1949 [1].The ergodic, mixing and random-like behavior and basic charac-teristics of chaos, such as sensitivity to initial conditions, overlapswith the basic characteristics of cryptology such as confusion anddiffusion. This relationship is used in the design of new cryp-tosystems. In the literature, it is possible to come across manycryptosystems designed based on chaotic systems. Design of sub-stitution boxes (S-Box) — one of the basic components in blockcryptosystems — based on chaotic systems (functions) is an appli-cation field of chaos in the science of cryptology [2–14].

S-Box is the only nonlinear component among the block cryp-tosystems possessing the mixing ability of the traditional systemslike DES, IDEA and AES. Therefore, S-Boxes with good crypto-graphic properties are required to be designed for strong cryp-tosystems. Mathematically an S-Box of size n × n is a nonlinearmap defined as S : {0,1}n → {0,1}n . There are many methodolo-gies and design criteria proposed for the design of S-Box. Adamand Tavares proposed a methodology to design an S-Box of sizen×n [15]. Proposed methodology makes exhaustive search difficultfor large n values. Following the presentation of differential crypt-

* Corresponding author. Tel.: +90 532 4979227; fax: +90 424 2415526.E-mail addresses: ozkaynak_fatih@hotmail.com (F. Özkaynak),

bedriozer@firat.edu.tr (A.B. Özer).

0375-9601/$ – see front matter © 2010 Elsevier B.V. All rights reserved.doi:10.1016/j.physleta.2010.07.019

analysis methodology [16] Detombe and Tavares designed an S-Boxof size 5 × 5 resistant against differential cryptanalysis [17]. Eventhough the designed S-Box is resistant against differential crypt-analysis, it yields acceptable results only for those S-Boxes hav-ing odd-numbered dimensions. Jakimoski and Kocarev proposeda four-step method employing chaotic maps in order to gener-ate S-Boxes [14]. The proposed method had good cryptographicproperties. Tang et al. proposed an 8 × 8 S-Box based on two-dimensional chaotic Baker map [13]. It is shown that the proposedmethod has better performance characteristics than the S-Box pro-posed by Jakimoski and Kocarev. Although the proposed methodis an effective method, there are still some implementation errors.Chen et al. improved the method by employing three-dimensionalBaker map in order to overcome these errors [12]. Wang et al. pro-posed an S-Box based on Tent map [11].

In this Letter, it is preferred to use continuous-time chaoticLorenz system instead of chaotic maps in the S-Box design. Thesystem is discretized by sampling the system trajectory for cer-tain time steps. After the discretization process the outputs arecoded by an algorithm to generate an 8 × 8 S-Box. It is demon-strated by the performance analyses that the proposed system hasstrong cryptographic properties compared to the other chaos-basedS-Boxes. In conclusion, the designed S-Box can be used to improvesecurity of cryptosystem in most of the traditional block cipher al-gorithms.

The rest of the study is organized as follows. In Section 2 themathematical structure of chaotic Lorenz system is established andthe change in system trajectory resulting from small initial con-dition disturbances is demonstrated. In Section 3 the algorithm

3734 F. Özkaynak, A.B. Özer / Physics Letters A 374 (2010) 3733–3738

Fig. 1. x–z plot for a = 10, b = 21 and c = 8/3 (periodic).

Fig. 2. x–z plot for a = 10, b = 28 and c = 8/3 (chaotic).

which generates S-Box employing chaotic system is explained. Cri-teria used in the performance analyses of the designed S-Box aredefined and comparison with the other chaos-based S-Boxes isconducted in Section 4. The last section includes a summary ofthe study and recommendations for advanced studies.

2. Chaotic Lorenz system

Lorenz system is the first numerical study on chaos. It is de-veloped by Edward Lorenz towards the end of 1950s in order tomodel the air flow in the atmosphere. Equations of system dynam-ics are given in (1).

dx

dt= a(y − x)

dy

dt= (bx − y − xz)

dz

dt= (xy − cz) (1)

States of the system lie in the following intervals: −20 �x � 20, −50 � y � 50, −50 � z � 50. The system has periodic be-havior for parameter values a = 10, b = 21 and c = 8/3 and chaoticbehavior for parameter values a = 10, b = 28 and c = 8/3. State-

space plots of x–z states when the system has periodic and chaoticbehavior are shown in Figs. 1 and 2 respectively.

3. Algorithm proposed for S-Box design

The algorithm that will be followed to generate chaos-basedS-Box mainly consists of two phases. In the first phase (steps 1and 2) diffusion operation is performed whereas in the secondphase (steps 3 to 6) substitution operation is realized. The algo-rithm is explained in detail below.

Step 1: System trajectories are obtained by solving the Lorenz sys-tem with selected initial conditions and chaotic parametervalues employing four-step Runge–Kutta method.

Step 2: Selected trajectory is sampled at every (number ofdata/256) step.

Step 3: Outputs corresponding to each sample are coded startingfrom 0 to 255.

Step 4: S-Box is generated using the codes corresponding to out-puts with the code corresponding to the smallest outputbeing the first cell of the S-Box.

Step 5: After the S-Box is generated, the rows are shifted to theleft except for the first row. Cells of the remaining rows areshifted to the left such that at each row number of cells

F. Özkaynak, A.B. Özer / Physics Letters A 374 (2010) 3733–3738 3735

Table 1Output values of the samples taken from system orbit and the appointed code values.

Sampling order 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16

Output value 30.2 8.9 1.7 3.4 14.2 0.01 5.6 19.6 28.2 16.9 23.7 32.4 25.2 6.01 9.6 7Code given 0 1 2 3 4 5 6 7 8 9 10 11 12 13 14 15

Table 2Table formed at the end of fourth step.

0 1 2 3

0 5 2 3 61 13 15 1 142 4 9 7 103 12 8 0 11

Table 3Table formed as a result of row-based shifting.

0 1 2 3

0 5 2 3 61 15 1 14 132 7 10 4 93 11 12 8 0

Table 4Table formed as a result of column-based shifting.

0 1 2 3

0 11 10 14 61 5 12 4 132 15 2 8 93 7 1 3 0

being shifted to the left is incremented by one comparedto the previous row.

Step 6: Once the rows are shifted, columnwise rotation is per-formed starting from the last column leaving it unrotated.Cells of the remaining columns are rotated such that ateach column the number of cells being rotated is incre-mented by one compared to the previous column.

In the first step of the algorithm given above system orbits areobtained by solving Lorenz chaotic system. There are as many or-bits as the dimension of the chaotic system. In the second step 256samples are taken on an orbit that is selected among system orbits.In the third step according to sampling order the samples taken arecoded from 0 to 255, increasing by 1. In fourth step coding tableis formed in a fashion such that the value of the code given to thesample which has the minimum output value among the samplesis placed in the first cell.

In order to illustrate how S-Box is generated with an examplea simple system orbit is given in Fig. 3. By taking 16 samples onthe orbit a 4 × 4 S-Box is generated. Output values and the corre-sponding code value for each sample taken on the orbit are givenin Table 1. The formed S-Box is shown in Table 2.

As it can be observed on the tables that the code 5 given to thesample 0.01 which has the minimum value among outputs valuesis placed in the first cell of the coding table. Other cells of thetable are also formed with a similar reasoning.

In fifth and sixth steps in order to facilitate a better replace-ment some shifting operations on the columns and the rows takeplace. Test results indicate that S-Boxes formed with shifting op-erations have better cryptographic results. The S-Box formed afterthe implementation of the fourth step is given in Table 3. The fi-nal form of the S-Box generated as a result of the implementationof the fifth step is shown in Table 4.

In this Letter, initial conditions for S-Box design are selected asx = 0.1, y = 0 and z = 0. System trajectory is generated for 100000data points. First 10000 data points are ignored for the transientsof the system to die out. In order to obtain the samples to be usedin the design of S-Box data along y-axis is used. Change of sys-tem trajectory along y-axis with respect to time is given in Fig. 4.Chaotic S-Box — generating 8 bit output for 8 bit input — obtainedfrom the algorithm is seen in Table 5.

4. Performance analysis of chaotic S-Box

Jakimoski and Kocarev demonstrated how to select the im-portant properties required for the design of a cryptographicallystrong n × n S-Box [15]. Biham and Shamir developed differentialcryptanalysis for DES-like cryptosystems [18]. After the introduc-tion of differential cryptanalysis, Dawson and Tavares developedS-Box design criteria based on information theory [19]. Generallyfive properties are selected in order to design cryptographicallystrong S-Boxes. These are bijective property, nonlinearity, strictavalanche criterion (SAC), outputs bit independence criterion (BIC)and equiprobable input/output XOR distribution.

4.1. Bijective property

A method is developed in order to check the bijective property[14]. A boolean function f i is bijective if it satisfies wt(

∑ni=1 ai f i) =

2n−1, where ai ∈ {0,1}, (a1,a2, . . . ,an) �= (0,0, . . . ,0) and wt( ) isthe hamming weight. The proposed S-Box satisfies the bijectiveproperty.

4.2. Nonlinearity criterion

Nonlinearity of f (x) can be shown by Walsh spectrum.

N f = 2n−1(

1 − 2−n maxω∈GF(2n)

∣∣S( f )(ω)∣∣) (2)

Walsh spectrum can be described as follows.

S( f )(ω) =∑

ω∈GF(2n)

(−1) f (x)⊕x·ω (3)

where ω ∈ GF(2n) and x · ω is the dot product of x and ω.

x · ω = x1 · ω1 ⊕ · · · ⊕ xnωn (4)

Nonlinearity of 8 output bits of the proposed S-Box can beshown as 104, 100, 106, 102, 104, 102, 104, 104. In Table 6 thenonlinearity criteria of the proposed method and the other chaos-based S-Boxes are given comparatively. It is seen that the averagevalue obtained from the proposed method is close to Wang, Chenand Tang’s and same as Jakimoski’s.

4.3. Strict avalanche criterion

Strict avalanche criterion is firstly published by Webster andTavares [16]. If the function satisfies the strict avalanche criterion,it means that it is possible that half of each output bit mightchange if there is a change in a single input bit. An effectivemethod is given in [20] in order to check whether a completeS-Box satisfies the strict avalanche criterion.

3736 F. Özkaynak, A.B. Özer / Physics Letters A 374 (2010) 3733–3738

Fig. 3. A sample system orbit.

Fig. 4. Change of y data obtained from Eq. (1) with respect to time.

Table 5Proposed chaotic substitution box.⎡

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎣

60 215 166 47 119 212 85 136 117 65 238 242 182 39 229 14331 129 128 218 8 27 99 45 241 179 187 73 237 138 15 203

227 205 216 144 202 49 130 254 131 81 148 178 127 121 221 13313 230 92 48 188 199 58 116 44 43 137 153 34 112 231 10367 204 211 206 152 118 96 57 77 126 74 50 244 253 164 2266 10 36 38 94 98 59 184 115 170 232 7 162 68 150 248

72 167 159 177 105 142 56 93 114 192 249 90 84 102 154 222134 125 141 183 185 169 87 189 156 155 217 197 201 89 2 9228 186 240 173 195 104 100 101 29 33 252 236 18 193 26 213250 55 176 95 20 146 17 1 219 139 79 132 194 61 14 20753 62 180 255 63 174 69 35 32 42 28 4 124 19 75 23

147 80 54 200 158 165 120 140 190 11 220 157 210 106 145 107239 40 246 91 243 5 151 111 214 37 25 233 82 86 21 24576 172 22 78 122 198 30 224 168 209 225 110 64 181 251 20888 71 235 109 51 108 161 0 191 223 247 171 149 196 66 113

123 41 3 70 163 175 135 16 12 234 97 83 160 24 52 46

⎤⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎦

A dependence matrix and average values for the proposedS-Box and the other S-Boxes are calculated using this method. Theaverage value of the proposed S-Box is 0.5048. There are morethan one S-Boxes proposed in Wang’s article. The average values ofthese lie between 0.4850 and 0.5150. The average value for Chenis calculated as 0.4999 while it is calculated as 0.4993 for Tangand 0.4972 for Jakimoski. It is obvious that the calculated average

values are very close to the ideal average value 0.5000. The depen-dence matrix for the proposed S-Box is given in Table 7.

4.4. Output bits independence criterion

This criterion is firstly demonstrated by Webster and Tavares[16]. It is another essential property required for the security of the

F. Özkaynak, A.B. Özer / Physics Letters A 374 (2010) 3733–3738 3737

Table 6Performance comparison of the proposed S-Box.

S-Box 0 1 2 3 4 5 6 7 Average

Wang 104 106 106 102 102 104 104 102 103.7Chen 100 102 103 104 106 106 106 108 104.3Tang 100 103 104 104 105 105 106 109 104.5Jakimoski 98 100 100 104 104 106 106 108 103.2The proposed method 104 100 106 102 104 102 104 104 103.2

Table 7Dependence matrix for the proposed S-Box.⎡

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎣

0.4531 0.5625 0.4687 0.5312 0.5000 0.4687 0.5468 0.45310.4843 0.5468 0.5000 0.4843 0.4843 0.4531 0.4843 0.46870.4531 0.5312 0.5312 0.5468 0.4843 0.5312 0.5312 0.45310.5312 0.4843 0.5000 0.4687 0.5156 0.5781 0.5156 0.54680.4375 0.5781 0.5312 0.4687 0.5156 0.5468 0.4687 0.54680.5000 0.4687 0.5000 0.5156 0.5312 0.5156 0.5468 0.51560.5937 0.5312 0.4687 0.5156 0.4531 0.5312 0.5000 0.50000.4218 0.4843 0.4843 0.4531 0.5312 0.5625 0.5000 0.5000

⎤⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎦

Table 8BIC-nonlinearity criterion for the proposed S-Box.⎡

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎣

– 106 104 104 102 102 104 102106 – 104 106 104 104 108 108104 104 – 102 100 102 102 106104 106 102 – 100 104 104 104102 104 100 100 – 106 100 102102 104 102 104 106 – 104 104104 108 102 104 100 104 – 106102 108 106 104 102 104 106 –

⎤⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎦

Table 9BIC-SAC criterion for the proposed S-Box.⎡

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎣

– 0.4980 0.5097 0.4863 0.5000 0.5000 0.5157 0.50580.4980 – 0.5019 0.4921 0.5000 0.4980 0.5000 0.48630.5097 0.5019 – 0.5058 0.5156 0.4882 0.4980 0.50970.4863 0.4921 0.5058 – 0.5039 0.5136 0.4687 0.53710.5000 0.5000 0.5156 0.5039 – 0.5312 0.5234 0.49800.5000 0.4980 0.4882 0.5136 0.5312 – 0.4785 0.47070.5117 0.5000 0.4980 0.4687 0.5234 0.4785 – 0.49410.5058 0.4863 0.5097 0.5371 0.4980 0.4707 0.4941 –

⎤⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎦

cryptosystem. It means that all avalanche variable couples mustbe independent for the set of avalanche vectors generated by theinverse of the bits of a single plaintext. In order to measure thedegree of independence between the avalanche variable couples,the correlation coefficient between the couples is calculated. It isindicated in the study of Webster and Tavares that if the booleanfunctions of two output bits f j and fk satisfy BIC, f j ⊕ fk ( j �= k,1 � j,k � n) should also satisfy nonlinearity and strict avalanchecriterion.

Results obtained for the proposed S-Box are given in Tables 8and 9. It is seen in Table 4 that all elements are greater than 100.Wang gives the average values for their proposed S-Boxes. Thesmallest is around 102. Chen obtains 100 as the smallest value fortheir proposed S-Box. The smallest value in Tang and Jakimoski’swork is 98. Considering these results, the nonlinearity criterion ofthe proposed S-Box is higher than those of Tang and Jakimoski.

4.5. The equiprobable input/output XOR distribution

Biham and Shamir demonstrated differential cryptanalysis foran S-Box based on the imbalance on the input/output XOR distri-bution table [18]. Output variations can be obtained from inputvariations and XOR value of each output must have equal proba-bility with the XOR value of each input. It means that if an S-Boxis closed in the input/output probability distribution, it is resistantagainst differential cryptanalysis. Differential approach probabilityfor a given map f can be calculated by measuring differential re-

Table 10Differential approach table for the proposed S-Box.⎡

⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎢⎣

8 6 6 6 8 6 10 6 6 6 8 6 6 6 6 68 6 10 6 6 6 8 8 6 6 6 6 8 6 8 106 6 6 6 6 6 6 8 6 6 8 6 6 6 6 68 8 8 8 6 10 8 8 6 8 6 6 6 8 6 106 8 6 6 6 6 10 6 6 8 8 8 6 6 6 66 6 6 6 6 6 6 6 6 8 8 6 8 6 8 86 6 8 8 10 10 6 6 8 8 6 6 6 8 8 66 6 8 8 6 6 6 8 6 8 6 8 6 8 8 66 8 6 6 8 6 6 8 6 8 8 8 6 8 6 86 6 6 6 6 6 6 8 6 8 10 4 8 8 6 66 6 10 8 8 8 6 8 6 6 8 6 6 6 8 86 8 6 6 8 6 6 6 6 6 6 6 8 8 6 66 6 8 6 8 8 6 10 6 6 6 8 6 6 6 66 6 8 8 6 6 6 6 6 6 8 8 6 6 6 66 6 8 6 6 8 6 6 6 8 8 6 8 8 6 66 8 6 6 6 8 6 8 6 6 6 6 6 6 6 –

⎤⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎥⎦

sistance as follows:

DP f = max�x�=0,�y

(#{x ∈ X | f (x) ⊕ f (x ⊕ �x) = �y}

2m

)(5)

where X is the set of all possible input values and 2m is the num-ber of its elements. Differential approach table for the proposedS-Box is given in Table 10. It can be seen in Table 6 that the largestof its elements is 10 which is also the largest value in Wang andTang’s articles. The largest value in Chen and Jakimoski’s articlesis 12. This proves that the proposed approach is stronger than thatof Chen and Jakimoski against differential attacks.

5. Conclusion and recommendations

In this study, a new design methodology for one of the ba-sic components of block cipher algorithms, S-Boxes, is proposed.A method is developed making use of random-like behavior ofchaotic systems in the generation of S-Boxes and the generatedS-Boxes are tested for whether they satisfy the required crypto-graphic properties for system safety.

There are many chaos-based S-Box generating algorithms pres-ent in the literature. The common feature of these algorithms isthe fact that they generate strong S-Boxes by making use of ran-dom distribution of the chaotic maps. That is to say, generatorsare dependent on chaotic systems. Unlike the methods used inthe past the proposed method does not generate an S-Box by us-ing chaotic systems only. Chaotic systems are used as a source ofrandomness and the strong diffusion features provided by chaoticsystems are used in the formation of coding table. Following theformation of the coding table S-Box is formed by the algorithmthat uses the coding table. In the last phase algorithm is fortifiedwith shifting operations made on columns and rows. Consequently,the reliability of the generated S-Box no longer depends only onthe chaotic system. This is one of the most important advantagesof the proposed method.

In literature, generally chaotic maps are used as chaotic systemin generators. However since the proposed algorithm uses chaoticsystems merely as a source of randomness discrete time chaoticsystems can be used as well as continuous time chaotic systems.For example, Lorenz system present in the proposed algorithm is

3738 F. Özkaynak, A.B. Özer / Physics Letters A 374 (2010) 3733–3738

replaced and tested with Duffing oscillator, Chua circuit and VanDer Pol system, which are frequently encountered in sources de-scribing chaos, and successful results are obtained.

Shifting method used in the algorithm is another method usedto design a stronger S-Box generator. In the light of the observa-tions made after the formation of the coding table it is seen thatdepending on the selected chaotic system some arrays affect theperformance of S-Box unfavorably. With shifting operations thesebad arrays are removed, the dependence on the chaotic system isprevented and the complexity of the algorithm is increased.

In the proposed method coding table is formed by using anorbit that is selected among system orbits. If the system is n di-mensional there will be n different system orbits; therefore differ-ent coding tables can easily be formed. For analysis, not only thechaotic system but also the selected orbit needs to be known. This,in return, enhances the complexity of the algorithm.

As future work, it is aimed to design stronger S-Box generatorsby developing algorithms in the light of lessons learned from thecomparative analysis of S-Boxes which are generated with differentchaotic systems.

References

[1] C.E. Shannon, Bell Syst. Tech. J. 28 (1949) 656.

[2] M.S. Baptista, Phys. Lett. A 240 (1998) 50.[3] G. Alvarez, F. Montoya, M. Romera, G. Pastor, Phys. Lett. A 276 (2000) 191.[4] G. Alvarez, F. Montoya, M. Romera, G. Pastor, Phys. Lett. A 311 (2003) 172.[5] G. Alvarez, F. Montoya, M. Romera, G. Pastor, Phys. Lett. A 306 (2003) 200.[6] G. Alvarez, F. Montoya, M. Romera, G. Pastor, Phys. Lett. A 319 (2003) 334.[7] G. Alvarez, F. Montoya, M. Romera, G. Pastor, Phys. Lett. A 326 (2004) 211.[8] S. Li, X. Mou, Z. Ji, J. Zhang, Y. Cai, Phys. Lett. A 290 (2001) 127.[9] S. Li, X. Mou, Z. Ji, J. Zhang, Y. Cai, Phys. Lett. A 307 (2003) 22.

[10] K.W. Wong, Phys. Lett. A 298 (2002) 238.[11] Y. Wang, K.W. Wong, X. Liao, T. Xiang, Commun. Nonlinear Sci. Numer.

Simul. 14 (2009) 3089.[12] G. Chen, Y. Chen, X. Liao, Chaos Solitons Fractals 31 (2007) 571.[13] T. Guoping, L. Xiaofeng, C. Yong, Chaos Solitons Fractals 23 (2005) 413.[14] G. Jakimoski, L. Kocarev, IEEE Trans. Circuits Syst.-I 48 (2) (2001) 163.[15] C. Adams, S. Tavares, in: Advances in Cryptology: Proceedings of CRYPTO_89,

Lecture Notes in Computer Science, 1989, pp. 612–615.[16] A.F. Webster, S. Tavares, in: Advances in Cryptology: Proceedings of CRYPTO_85,

Lecture Notes in Computer Science, 1986, pp. 523–534.[17] J. Detombe, S. Tavares, in: Advances in Cryptology: Proceedings of CRYPTO_92,

Lecture Notes in Computer Science, 1992.[18] E. Biham, A. Shamir, J. Cryptol. 4 (1) (1991) 3.[19] M. Dawson, S. Tavares, in: Advances in Cryptology: Proceedings of EURO-

CRYPT_91, Lecture Notes in Computer Science, 1991, pp. 352–367.[20] J. Pieprzyk, G. Finkelsten, Towards effective nonlinear cryptosystem design, in:

IEE Proc. Part E: Computers Digital Techn., vol. 135, 1988, pp. 325–335.