How are Rijndael's S-Boxes generated?

Question

I'm writing C Code to generate S-boxes but I'm stuck.

Would you mind explaining one entry of the S-box? (say for x = 0x2). Here is what I got.

The inverse of $2$ in $GF(2^8)$ for polynomial $x^8 + x^4 + x^3 + x + 1 = 142$ (in decimal). Now if I apply the affine equation, it results in $86$ (0x56). What's wrong with my approach?

The additive constant for S-Box = 0x63.

In case it helps and/or makes sense, here's my C code.

The multiplicative inverse is wrong: $2$ translates to the polynomial $p_1 = X$. The number $142$ would be $10001110$ in binary, which translates to the polynomial $p_2 = X^7+X^3+X^2+X$. And the product $p_1p_2$ is: $p_1p_2 = X (X^7+X^3+X^2+X) = X^8+X^4+X^3+X^2$. Reducing this modulo the polynomial $q=X^8+X^4+X^3+X+1$, this is $p_1p_2 = X^2+X+1 \mod q$, which is not the neutral element. — tylo, Apr 04 '17 at 15:27
Thanks but one thing what is the inverse of 2? I need it for a reference. — Mithil, Apr 04 '17 at 17:15
Related: *How are the AES S-Boxes calculated?* and *How can I calculate the Rijndael SBox?* — e-sushi, Apr 04 '17 at 18:57
Also related: Multiplicative inverse in $GF(2^8)$ ? and (more generally) Galois fields in cryptography. In fact, I might almost suggest the former as a possible duplicate. — Ilmari Karonen, Apr 04 '17 at 22:35

score 2 · Accepted Answer · answered Apr 04 '17 at 15:12

In your code you use the modular inverse with the respect to the modulus 0x11b, which is an operation quite different from taking the inverse in the field GF(2^8).

For getting an idea what you have to do instead, take a look at finite field arithmetic in the wikipedia.

How are Rijndael's S-Boxes generated?

1 Answers1