Rijndael S box - Alchetron, The Free Social Encyclopedia

The Rijndael S-box is a matrix (square array of numbers) used in the Rijndael cipher, which the Advanced Encryption Standard (AES) cryptographic algorithm was based on. The S-box (substitution box) serves as a lookup table.

Forward S-box

The S-box is generated by determining the multiplicative inverse for a given number in GF(2⁸) = GF(2)[x]/(x⁸ + x⁴ + x³ + x + 1), Rijndael's finite field. Zero, which has no inverse, is mapped to zero. The multiplicative inverse is then transformed using the following affine transformation:

[ 1 0 0 0 1 1 1 1 1 1 0 0 0 1 1 1 1 1 1 0 0 0 1 1 1 1 1 1 0 0 0 1 1 1 1 1 1 0 0 0 0 1 1 1 1 1 0 0 0 0 1 1 1 1 1 0 0 0 0 1 1 1 1 1 ] [ x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 ] + [ 1 1 0 0 0 1 1 0 ]

where [x₇, ..., x₀] is the multiplicative inverse as a vector.

This affine transformation is the sum of multiple rotations of the byte as a vector, where addition is the XOR operation.

The matrix multiplication can be calculated by the following algorithm:

Let s (an 8-bit unsigned variable) be the input number.
Let result be 0.
For 5 times:
1. XOR result with s.
2. Rotate s one bit to the left.

After the matrix multiplication is done, XOR the value by the decimal number 99 (the hexadecimal number 0x63, the binary number 0b01100011, the bit string 11000110 representing the number in LSb first notation).

This will generate the following S-box, which is represented here with hexadecimal notation:

00 01 02 03 04 05 06 07 08 09 0 a 0 b 0 c 0 d 0 e 0 f 00 63 7 c 77 7 b f 2 6 b 6 f c 5 30 01 67 2 b f e d 7 a b 76 10 c a 82 c 9 7 d f a 59 47 f 0 a d d 4 a 2 a f 9 c a 4 72 c 0 20 b 7 f d 93 26 36 3 f f 7 c c 34 a 5 e 5 f 1 71 d 8 31 15 30 04 c 7 23 c 3 18 96 05 9 a 07 12 80 e 2 e b 27 b 2 75 40 09 83 2 c 1 a 1 b 6 e 5 a a 0 52 3 b d 6 b 3 29 e 3 2 f 84 50 53 d 1 00 e d 20 f c b 1 5 b 6 a c b b e 39 4 a 4 c 58 c f 60 d 0 e f a a f b 43 4 d 33 85 45 f 9 02 7 f 50 3 c 9 f a 8 70 51 a 3 40 8 f 92 9 d 38 f 5 b c b 6 d a 21 10 f f f 3 d 2 80 c d 0 c 13 e c 5 f 97 44 17 c 4 a 7 7 e 3 d 64 5 d 19 73 90 60 81 4 f d c 22 2 a 90 88 46 e e b 8 14 d e 5 e 0 b d b a 0 e 0 32 3 a 0 a 49 06 24 5 c c 2 d 3 a c 62 91 95 e 4 79 b 0 e 7 c 8 37 6 d 8 d d 5 4 e a 9 6 c 56 f 4 e a 65 7 a a e 08 c 0 b a 78 25 2 e 1 c a 6 b 4 c 6 e 8 d d 74 1 f 4 b b d 8 b 8 a d 0 70 3 e b 5 66 48 03 f 6 0 e 61 35 57 b 9 86 c 1 1 d 9 e e 0 e 1 f 8 98 11 69 d 9 8 e 94 9 b 1 e 87 e 9 c e 55 28 d f f 0 8 c a 1 89 0 d b f e 6 42 68 41 99 2 d 0 f b 0 54 b b 16

Here the column is determined by the least significant nibble, and the row is determined by the most significant nibble. For example, the value 0x9a is converted into 0xb8 by Rijndael's S-box.

Inverse S-box

The inverse S-box is simply the S-box run in reverse. For example, the inverse S-box of 0xb8 is 0x9a. It is calculated by first calculating the inverse affine transformation of the input value, followed by the multiplicative inverse. The inverse affine transformation is as follows:

[ 0 0 1 0 0 1 0 1 1 0 0 1 0 0 1 0 0 1 0 0 1 0 0 1 1 0 1 0 0 1 0 0 0 1 0 1 0 0 1 0 0 0 1 0 1 0 0 1 1 0 0 1 0 1 0 0 0 1 0 0 1 0 1 0 ] [ x 0 x 1 x 2 x 3 x 4 x 5 x 6 x 7 ] + [ 1 0 1 0 0 0 0 0 ]

The following table represents Rijndael's inverse S-box:

00 01 02 03 04 05 06 07 08 09 0 a 0 b 0 c 0 d 0 e 0 f 00 52 09 6 a d 5 30 36 a 5 38 b f 40 a 3 9 e 81 f 3 d 7 f b 10 7 c e 3 39 82 9 b 2 f f f 87 34 8 e 43 44 c 4 d e e 9 c b 20 54 7 b 94 32 a 6 c 2 23 3 d e e 4 c 95 0 b 42 f a c 3 4 e 30 08 2 e a 1 66 28 d 9 24 b 2 76 5 b a 2 49 6 d 8 b d 1 25 40 72 f 8 f 6 64 86 68 98 16 d 4 a 4 5 c c c 5 d 65 b 6 92 50 6 c 70 48 50 f d e d b 9 d a 5 e 15 46 57 a 7 8 d 9 d 84 60 90 d 8 a b 00 8 c b c d 3 0 a f 7 e 4 58 05 b 8 b 3 45 06 70 d 0 2 c 1 e 8 f c a 3 f 0 f 02 c 1 a f b d 03 01 13 8 a 6 b 80 3 a 91 11 41 4 f 67 d c e a 97 f 2 c f c e f 0 b 4 e 6 73 90 96 a c 74 22 e 7 a d 35 85 e 2 f 9 37 e 8 1 c 75 d f 6 e a 0 47 f 1 1 a 71 1 d 29 c 5 89 6 f b 7 62 0 e a a 18 b e 1 b b 0 f c 56 3 e 4 b c 6 d 2 79 20 9 a d b c 0 f e 78 c d 5 a f 4 c 0 1 f d d a 8 33 88 07 c 7 31 b 1 12 10 59 27 80 e c 5 f d 0 60 51 7 f a 9 19 b 5 4 a 0 d 2 d e 5 7 a 9 f 93 c 9 9 c e f e 0 a 0 e 0 3 b 4 d a e 2 a f 5 b 0 c 8 e b b b 3 c 83 53 99 61 f 0 17 2 b 04 7 e b a 77 d 6 26 e 1 69 14 63 55 21 0 c 7 d

Design criteria

The Rijndael S-Box was specifically designed to be resistant to linear and differential cryptanalysis. This was done by minimizing the correlation between linear transformations of input/output bits, and at the same time minimizing the difference propagation probability.

The Rijndael S-Box can be edited, which defeats the suspicion of a backdoor built into the cipher that exploits a static S-box. The authors claim that the Rijndael cipher structure should provide enough resistance against differential and linear cryptanalysis if an S-Box with "average" correlation / difference propagation properties is used.

Alternate equation for the affine transformation

An equivalent equation for the affine transformation is

b i ′ = b i ⊕ b ( i + 4 ) mod ⁡ 8 ⊕ b ( i + 5 ) mod ⁡ 8 ⊕ b ( i + 6 ) mod ⁡ 8 ⊕ b ( i + 7 ) mod ⁡ 8 ⊕ c i

where b' b and c are 8 bit arrays and c is 01100011.

Another one is: b o u t = ( b i n × 31 d ) mod ⁡ 257 d ⊕ 99 d

Example implementation

The following C code calculates the S-box:

References

Rijndael S-box Wikipedia

(Text) CC BY-SA