If the Substitution box is 1 to 1 (a specific value can only ever be a specific box value), and the contents of Rijndael S-box is public, how does this offer any additional security?

With AES the frequency of a letter isn't a concern so what other reason is there for this substitution? An explanation fitting for a novice would be very much appreciated!

Additionally, why is Rijndael S-box a multiplicative inverse and what purpose does that serve?

  • $\begingroup$ [Not a substitute for a full answer]: Sure, a one-one substitution alone brings no security. However, adding XOR with key(s), it can offer security. For example, one of the simplest secure block cipher (known as Even-Mansour) is built from any large, apparently arbitrary, public, invertible one-one substitution $G$, as $E_{(k_1,k_2)}(b)=G(b\oplus k_1)\oplus k_2$ and $D_{(k_1,k_2)}(b)=G^{-1}(b\oplus k_2)\oplus k_1$. AES extends that in several ways: multiple rounds instead of one, round keys derived from the main key, $G$ built from 16 uses of the S-box and linear algebra. $\endgroup$
    – fgrieu
    Commented Nov 30, 2022 at 16:23

1 Answer 1


Philosophically any invertible cipher (it would be useless if not invertible) is just a one to one map, so no cipher would be secure under your argument.

Specifically, the Sbox has been carefully designed. For example, considering the linear and differential cryptanalysis attacks, having a nonlinear s-box mapping provides security agains linear cryptanalysis while having a low differential uniformity provides security against linear cryptanalysis. The AES Sbox has been optimized with respect to those attacks so it has high nonlinearity and low differential uniformity.

If the Sbox was linear then having 2 input output pairs we could determine what it would give for the sum of those pairs as well which leads to divide and conquer attacks.

$$ S(x_1)=y_1,S(x_2)=y_2 \Rightarrow S(x_1\oplus x_2)=y_1\oplus y_2 $$ where all quantities are 8 bit binary vectors. For AES, the Sbox has been designed to be as far away from linear as possible and it is the only nonlinear part of the AES encryption mapping. So AES would be trivially breakable with only $128$ known plaintext/ciphertext pairs if the Sbox was not nonlinear. See

How can AES-like block cipher without non-linear component be broken?

The link below is about minimizing nonlinearity for a boolean function, so just one output bit of the Sbox. By considering all linear combinations of the outputs of the Sbox we obtain low nonlinearity for the Sbox which has 8 bit outputs, i.e., it is a vectorial boolean function.

how to calculate the non linearity of each element of s box?

For resistance against differential cryptanalysis see this answer:

Searching for a differential characteristic (differential cryptanalysis)

The goal here is to stop attacks using input pairs $(x,x\oplus d)$ which may give output pairs $(S(x),S(x\oplus d):=(y,y\oplus d')$ where the quantity $d'$ occurs much more than the possible minimum, over all pairs.

The tutorial by Heys is a great introduction to these topics.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.