# About S-box in AES

I am working on AES. Can we expand $s(a \oplus b)$ in terms of $s(a)$ and $s(b)$ where $a$ and $b$ are two eight bit inputs and $s(a)$ is the S-box value of $a$?

-
No. The sbox are not linear. – ddddavidee Aug 3 '14 at 14:59
Since the sbox is an algebraic construct, yes it can be done, as an expansion of poncho's answer, since $s()$ and $s^{-1}()$ can both be expressed as equations – Richie Frame Aug 4 '14 at 6:33
Acually my question is an we expand S(a xor b) in terms of S(a) and S(b) as we can expand 4(2+3) as 4(2)+4(3) @poncho – user16690 Aug 4 '14 at 16:07

## 1 Answer

If the question is "can we define a function that, given $s(a)$ and $s(b)$, gives us the value $s(a \oplus b)$, the answer is, yes, of course we can; the obvious implementation of such a function is:

$F(x, y) = s( s^{-1}(x) \oplus s^{-1}(y))$

With this function, if $x=s(a)$ and $y=s(b)$, the $F(x,y) = s(a \oplus b)$

However, the real question you need to ask is "is this function interesting? Does us give us any special insight into the sbox?". The answer to that, as far as I can see, is "no".

-
F(x,y) should be F(a,b) in second equation ? – Richie Frame Aug 4 '14 at 6:34
@RichieFrame: nope, it's correct as it stands. – poncho Aug 4 '14 at 12:12