4
$\begingroup$

It's rather kind of lame questions, and I can't find good and clear explanation:

  1. In which step of Rijandel is S-box generated?
  2. Is the S-box reused in every round of cipher or is generated in every iteration?
  3. In a course-ware movie where they explained AES (class.coursera.org/crypto-preview/lecture/16) the speaker says that the S-box could be precomputed. Does that mean that the S-box could be constant?
$\endgroup$
7
  • $\begingroup$ I didn't listen to the talk, but perhaps you're confusing round-keys and s-boxes. Round-keys can be computed on the fly or precomputed. In the latter case, they're computed during key setup. $\endgroup$ Sep 23, 2013 at 11:24
  • $\begingroup$ @CodesInChaos I know the difference :) My problem was misunderstanding WHEN S-box is generated and is never generated. Before the moment I looked up AES bouncy castle java implementation on github and "big suprise" S-box is hardcoded as static final table ;-). $\endgroup$
    – Nicramus
    Sep 23, 2013 at 11:33
  • $\begingroup$ When using AES-NI instructions it's not even hardcoded in software, it's hardcoded in hardware :) $\endgroup$ Sep 23, 2013 at 11:35
  • 2
    $\begingroup$ Nicramus is incorrect. There are several different implementations of Rjindael/AES in BouncyCastle, one of which has hardcoded S-boxes. $\endgroup$
    – pg1989
    Sep 23, 2013 at 18:07
  • 1
    $\begingroup$ @AlexandreYamajako: see iacr.org/archive/ches2009/57470001/57470001.pdf for a fast constant time implementation of AES. Yes, their trick won't work for CBC mode; it works just fine for GCM. $\endgroup$
    – poncho
    Sep 23, 2013 at 18:20

1 Answer 1

7
$\begingroup$
  1. The S-Box was generated when Rijndael was designed, not in any step.

  2. It's used in every round in the SubBytes step.

  3. The S-box is constant. You could see it as a function taking a byte and returning a byte. It is used to reduce algebraic properties of Rijndael.

In fact, this is it:

   | 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f
---|--|--|--|--|--|--|--|--|--|--|--|--|--|--|--|--|
00 |63 7c 77 7b f2 6b 6f c5 30 01 67 2b fe d7 ab 76 
10 |ca 82 c9 7d fa 59 47 f0 ad d4 a2 af 9c a4 72 c0 
20 |b7 fd 93 26 36 3f f7 cc 34 a5 e5 f1 71 d8 31 15 
30 |04 c7 23 c3 18 96 05 9a 07 12 80 e2 eb 27 b2 75 
40 |09 83 2c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f 84 
50 |53 d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf 
60 |d0 ef aa fb 43 4d 33 85 45 f9 02 7f 50 3c 9f a8 
70 |51 a3 40 8f 92 9d 38 f5 bc b6 da 21 10 ff f3 d2 
80 |cd 0c 13 ec 5f 97 44 17 c4 a7 7e 3d 64 5d 19 73 
90 |60 81 4f dc 22 2a 90 88 46 ee b8 14 de 5e 0b db 
a0 |e0 32 3a 0a 49 06 24 5c c2 d3 ac 62 91 95 e4 79 
b0 |e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08 
c0 |ba 78 25 2e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a 
d0 |70 3e b5 66 48 03 f6 0e 61 35 57 b9 86 c1 1d 9e 
e0 |e1 f8 98 11 69 d9 8e 94 9b 1e 87 e9 ce 55 28 df 
f0 |8c a1 89 0d bf e6 42 68 41 99 2d 0f b0 54 bb 16 

You can read it by choosing your column by the low nibble of a byte, and the row by the high nibble of a byte.

$\endgroup$
2
  • 5
    $\begingroup$ I'd add as a note for those interested, the two designers of AES (Rijndael), Daemen and Rijmen, wrote a book called The Design of Rijndael which goes into great detail, as you might guess, on the design of Rijndael. It presents all of the essential material from the ground up. So, it would be a great read for anyone wanting to know specifics. $\endgroup$
    – Reid
    Sep 23, 2013 at 19:40
  • $\begingroup$ You should note it is also used in the key schedule $\endgroup$ Sep 24, 2013 at 3:32

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.