If you look at the AES Linear Approximation Table (computed for example with Sage) you will see there are many entries with what looks like a high bias of -16 ("absolute bias" scale).
I know AES is designed to be resistant to Linear cryptanalysis. If you agree that -16 is a high bias, then there are 2 (3) options:
- either the AES Sbox is weak to linear cryptanalysis, but the overall cipher is not thanks to the properties of ShiftRow and MixColumn
- or it is difficult/impossible to concatenate these entries with high bias to form a linear characteristic with high bias for more than 1 round (imagine we ignore the ShiftRow and MixColum and try to concatenate the linear approximation for more than one consecutive Sbox)
- or both
Which one is it? I read that AES Sbox is based on multiplicative inverse in Galois Field which is supposed to be "highly nonlinear", but I'm not sure this applies here.