A multiple-input multiple-output s-box receives a contiguously numbered input bits (101, 102, 103, 104, 105) I1, I2 to Ia, where a is at least 4, and outputs b contiguously numbered output bits (131, 132, 133, 134, 135) O1, O2, to Ob. The s-box comprises c primitive s-boxes (121, 122, 123) sb1 sb2 to sbc. Each primitive s-box (121, 122, 123) has a multiple-input single-output
Boolean function ƒ1, ƒ2, to ƒo defining the relationship between the multiple inputs and the single output. Each primitive s-box (121, 122, 123) receives a set of input bits s1, s2, to sc, respectively, each such set is chosen from the a input bits (101, 102, 103, 104, 105) to the s-box and containing sl1, sl2, to slc bits respectively. Each of the numbers sl1, sl2, to slc, is in the range of 3 to (a−1), and the sum of the numbers sl1, sl2, to slc is larger than a. The b output bits of the s-box (131, 132, 133, 134, 135) are the outputs of the c Boolean functions.