Most of the approaches published in the literature to construct S-boxes via Cellular Automata (CA) work by either iterating a finite CA for several time steps, or by a one-shot application of the global rule. The main characteristic that brings together these works is that they employ a single CA rule to define the vectorial Boolean function of the S-box. In this work, we explore a different direction for the design of S-boxes that leverages on Orthogonal CA (OCA), i.e. pairs of CA rules giving rise to orthogonal Latin squares. The motivation stands on the facts that an OCA pair already defines a bijective transformation, and moreover the orthogonality property of the resulting Latin squares ensures a minimum amount of diffusion. We exhaustively enumerate all S-boxes generated by OCA pairs of diameter $4 \le d \le 6$, and measure their nonlinearity. Interestingly, we observe that for $d=4$ and $d=5$ all S-boxes are linear, despite the underlying CA local rules being nonlinear. The smallest nonlinear S-boxes emerges for $d=6$, but their nonlinearity is still too low to be used in practice. Nonetheless, we unearth an interesting structure of linear OCA S-boxes, proving that their Linear Components Space (LCS) is itself the image of a linear CA, or equivalently a polynomial code. We finally classify all linear OCA S-boxes in terms of their generator polynomials.

翻译：文献中公布的大多数通过元胞自动机构建S盒的方法，要么通过迭代有限CA多个时间步长，要么通过一次性应用全局规则来实现。将这些工作联系在一起的主要特征在于，它们使用单一CA规则来定义S盒的向量布尔函数。在本工作中，我们探索了利用正交元胞自动机设计S盒的不同方向，即产生正交拉丁方的CA规则对。其动机基于以下事实：OCA对本身定义了双射变换，且所得拉丁方的正交性确保了最低程度的扩散性。我们穷举枚举了所有由直径$4 \le d \le 6$的OCA对生成的S盒，并测量了它们的非线性度。有趣的是，我们观察到当$d=4$和$d=5$时，所有S盒均为线性的，尽管底层CA局部规则是非线性的。最小非线性S盒出现在$d=6$时，但其非线性度仍过低而无法实际应用。不过，我们揭示了线性OCA S盒的有趣结构，证明了其线性分量空间本身就是一个线性CA的像，或等价于多项式码。最后，我们根据生成多项式对所有线性OCA S盒进行了分类。