# Can the AES encryption and decryption algorithms be described as a polynomial for a specific key?

AES is a block cipher that consists of non-linear and linear parts to provide the Shannon requirements of confusion and diffusion respectively. The linear parts can for sure be described as a polynomial and more specifically the SiftRows,MixColumnds,AddRoundKey parts but what about the non-linear one?

-
The AES sbox is an affine transformation of the inverse if its input, and has a fairly compact algebraic expression –  Richie Frame Sep 12 '13 at 18:37

## 1 Answer

Yes, they can be described as a multivariate polynomial over $GF(2)$ (or over $GF(2^8)$). See algebraic cryptanalysis. This expression does not seem to help cryptanalyze AES, so far as we know, but it can be done.

For an example of how to write AES in this way, see the following paper:

You can also read about the XSL attack, a controversial attack that was claimed by some researchers to work against the AES and which is based upon a representation of AES as multivariate polynomials.

-
Not in practice, but there is some interesting theory around algebraic attacks on AES. –  pg1989 Sep 12 '13 at 17:23
@pg1989, right, that's why I said it does not seem to help cryptanalyze AES. :-) –  D.W. Sep 12 '13 at 17:27
Right. I agree with you, I just think it's an interesting technique. –  pg1989 Sep 12 '13 at 17:39
@D.W.Count you point me in some paper that treats AES as a polynomial for cryptanalysis or any other reason? –  curious Sep 13 '13 at 8:09
@curious don't forget to accept this answer, curious... –  owlstead Sep 18 '13 at 15:39