2

In Cryptanalysis of Block Ciphers with Overdefined Systems of Equations Nicolas Courtois and Josef Pieprzyk state (in Appendix A) that the Rijndael SBox can be written as a "linearized polynomial" $S(x): GF(2^8) \rightarrow GF(2^8)$:

$S(x) = 63+8F\cdot x^{127}+B5\cdot x^{191}+01\cdot x^{123}+F4\cdot x^{239}+25 \cdot x^{247}+F9 \cdot x^{251}+09 \cdot x^{253} + 05 \cdot x^{254}$

I want to understand how this can be derived from the SBox calculation usually described as:

$Sbox(x) = M \cdot x^{-1} + \vec{t}$

I understand that $x^{-1}$ can be written as $x^{254}$, but what are the necessary steps to get to the linearized form?

kelalaka
  • 48,443
  • 11
  • 116
  • 196
ph_0
  • 145
  • 6
  • nearly identical to https://crypto.stackexchange.com/questions/53734/aes-how-to-create-the-s-box-with-sage – Richie Frame Nov 30 '18 at 01:34
  • you can find my answer on : https://crypto.stackexchange.com/questions/22944/evaluating-algebraic-complexity-of-a-s-box – hardyrama Dec 02 '18 at 18:28
  • thank you - I do now understand that it can be done using Lagrange interpolation. I also found this detailed description: https://blogs.msdn.microsoft.com/matthew_van_eerde/2014/04/04/expressing-a-function-f-gf2-gf2-as-a-polynomial-using-a-lagrange-polynomial/ – ph_0 Dec 06 '18 at 14:44

0 Answers0