What are some design considerations for S-Boxes? My studies in cryptography have been quite detailed so far, however, one area that hasn't been explained to me is how S-Boxes are typically designed. Typically, the S-boxes are provided "as is" by the developers of the algorithm, but I am looking for information on what type of considerations cryptographers evaluate when they design an S-box. Are the numbers in the lookup table chosen at random? Are they generated mathematically? If so, what are some types of maths used and why? Feel free to choose an example cipher or two in your explanation.
The main consideration is to ensure no strong differential or affine properties. 

Random S-Boxes are actually not bad in this regard though not necessarily optimal. 

However Most would not trust "Random" S-boxes and prefer a Nothing-Up-My-Sleeve choice. For fear the designer may have cleverly selected the values to enable some unknown attack. We want some plausible explanation for why the specific values were chosen. 

The AES S-boxes are such, they were selected based on a simple mathematical formula, and yet can be shown to be fairly resilient to differential and linear cryptanalysis.