Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I noticed that several hash algorithms, in this case MD5, defines some constants.

MD5 defines 64 constant values (the shift count per round) which also gets expand (via sine) to a summand for a specific round. It is like a lookup table.

But I cannot see anything (no documentation, no implementation,...) that calls this table an substitution box (S-Box). But I saw some implementations that use a variable called "S" for this table. A hint?

So my question is: Is it valid to call this table an S-Box? Or is it only common to call this kind of table an S-Box when it's used into a real encryption/decryption?

share|improve this question
up vote 5 down vote accepted

Is it valid to call this table an S-Box?

Not really; at least, not with the meaning we usually give to "S-box".

The "S" in "S-box" stands for Substitution; we take the data, and replace it with a value from the S-box (using the data as an index into the S-box). The classical (if not the original) example is the S-boxes within AES; at certain points within the cipher, we take each 8 bit value $V$ from the block, and replace it with $SBox[V]$.

We don't do anything like that in MD5; instead, the "S" constants stand for "Shift". They don't replace anything; instead, they modify how much shifting (rotating in more common parlance) we do per round.

share|improve this answer
And what is with the expanded values? I mean the "K" in this: It replaces the round index (data) with some other data. – Bastian Born Apr 22 '14 at 21:20
@BastianBorn: no, that data is added to the current data; it's no more an "sbox" than the "S" constants are. – poncho Apr 22 '14 at 21:23
Technically the rotation could be viewed as a linear substitution, although in cryptography an s-box is generally a nonlinear substitution. – Richie Frame Apr 23 '14 at 3:57
More original than AES was the use of S-boxes in DES. But the term predates even that, I think. – Henno Brandsma Apr 23 '14 at 9:11
@HennoBrandsma: Yes, I know; I did say that the sboxes in AES were not the original. However, it is easier to explain the sboxes there than the sboxes within DES, hence I used that as the example. – poncho Apr 23 '14 at 20:32

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.