# Where is the S-Box generated in Rijandel/AES?

It's rather kind of lame questions, and I can't find good and clear explanation:

1. In which step of Rijandel is S-box generated?
2. Is the S-box reused in every round of cipher or is generated in every iteration?
3. In a course-ware movie where they explained AES (class.coursera.org/crypto-preview/lecture/16) the speaker says that the S-box could be precomputed. Does that mean that the S-box could be constant?
-
I didn't listen to the talk, but perhaps you're confusing round-keys and s-boxes. Round-keys can be computed on the fly or precomputed. In the latter case, they're computed during key setup. –  CodesInChaos Sep 23 '13 at 11:24
@CodesInChaos I know the difference :) My problem was misunderstanding WHEN S-box is generated and is never generated. Before the moment I looked up AES bouncy castle java implementation on github and "big suprise" S-box is hardcoded as static final table ;-). –  Nicramus Sep 23 '13 at 11:33
When using AES-NI instructions it's not even hardcoded in software, it's hardcoded in hardware :) –  CodesInChaos Sep 23 '13 at 11:35
Nicramus is incorrect. There are several different implementations of Rjindael/AES in BouncyCastle, one of which has hardcoded S-boxes. –  pg1989 Sep 23 '13 at 18:07
@AlexandreYamajako: see iacr.org/archive/ches2009/57470001/57470001.pdf for a fast constant time implementation of AES. Yes, their trick won't work for CBC mode; it works just fine for GCM. –  poncho Sep 23 '13 at 18:20

## 1 Answer

1. The S-Box was generated when Rijndael was designed, not in any step.

2. It's used in every round in the SubBytes step.

3. The S-box is constant. You could see it as a function taking a byte and returning a byte. It is used to reduce algebraic properties of Rijndael.

In fact, this is it:

   | 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
---|--|--|--|--|--|--|--|--|--|--|--|--|--|--|--|--|
00 |63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76
10 |ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0
20 |b7 fd 93 26 36 3f f7 cc 34 a5 e5 f1 71 d8 31 15
30 |04 c7 23 c3 18 96 05 9a 07 12 80 e2 eb 27 b2 75
40 |09 83 2c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f 84
50 |53 d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf
60 |d0 ef aa fb 43 4d 33 85 45 f9 02 7f 50 3c 9f a8
70 |51 a3 40 8f 92 9d 38 f5 bc b6 da 21 10 ff f3 d2
80 |cd 0c 13 ec 5f 97 44 17 c4 a7 7e 3d 64 5d 19 73
90 |60 81 4f dc 22 2a 90 88 46 ee b8 14 de 5e 0b db
a0 |e0 32 3a 0a 49 06 24 5c c2 d3 ac 62 91 95 e4 79
b0 |e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08
c0 |ba 78 25 2e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a
d0 |70 3e b5 66 48 03 f6 0e 61 35 57 b9 86 c1 1d 9e
e0 |e1 f8 98 11 69 d9 8e 94 9b 1e 87 e9 ce 55 28 df
f0 |8c a1 89 0d bf e6 42 68 41 99 2d 0f b0 54 bb 16


You can read it by choosing your column by the low nibble of a byte, and the row by the high nibble of a byte.

-
I'd add as a note for those interested, the two designers of AES (Rijndael), Daemen and Rijmen, wrote a book called The Design of Rijndael which goes into great detail, as you might guess, on the design of Rijndael. It presents all of the essential material from the ground up. So, it would be a great read for anyone wanting to know specifics. –  Reid Sep 23 '13 at 19:40
You should note it is also used in the key schedule –  Richie Frame Sep 24 '13 at 3:32