Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am working on AES. Can we expand $s(a \oplus b)$ in terms of $s(a)$ and $s(b)$ where $a$ and $b$ are two eight bit inputs and $s(a)$ is the S-box value of $a$?

share|improve this question
No. The sbox are not linear. – ddddavidee Aug 3 '14 at 14:59
Since the sbox is an algebraic construct, yes it can be done, as an expansion of poncho's answer, since $s()$ and $s^{-1}()$ can both be expressed as equations – Richie Frame Aug 4 '14 at 6:33
Acually my question is an we expand S(a xor b) in terms of S(a) and S(b) as we can expand 4(2+3) as 4(2)+4(3) @poncho – user16690 Aug 4 '14 at 16:07

If the question is "can we define a function that, given $s(a)$ and $s(b)$, gives us the value $s(a \oplus b)$, the answer is, yes, of course we can; the obvious implementation of such a function is:

$F(x, y) = s( s^{-1}(x) \oplus s^{-1}(y))$

With this function, if $x=s(a)$ and $y=s(b)$, the $F(x,y) = s(a \oplus b)$

However, the real question you need to ask is "is this function interesting? Does us give us any special insight into the sbox?". The answer to that, as far as I can see, is "no".

share|improve this answer
F(x,y) should be F(a,b) in second equation ? – Richie Frame Aug 4 '14 at 6:34
@RichieFrame: nope, it's correct as it stands. – poncho Aug 4 '14 at 12:12

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.