Possible cooked S-boxes in Kuznyechik & Streebog..Russian cipher & hash

[Cfrg] Structure in the S-box of the Russian algorithms (RFC 6986, RFC 7801)

Dear CFRG Participants,

My name is Léo Perrin, I am a post-doc in symmetric cryptography at Inria, and I would like to bring recent results of mine to your attention. Thus, at least in the case of Streebog, both the linear layer and the S-box interact in a highly structured way with two partitions of GF(2^8) and one of those is its partition into additive cosets of the subfield (this will be important later). On the other hand, Arnaud Bannier proved in his PhD (see also [3]) that an S-box preserving a partition of the space into additive cosets in such a way that it interacts with the linear layer was necessary to build some specific backdoors.

Source: mailarchive.ietf.org