Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
I would like to know how to find multiplicative inverses in $\mathrm{GF}(2^8)$. I know how to multiply two elements of $\mathrm{GF}(2^8)$ (for example, I know that 0x1b*0xaa equals 0x8c).
I follow this explanation, but I still don't understand the process. More specifically: How exactly (step-by-step) are logarithm and antilogarithm tables for AES' finite field formed?
(Note: I'm using hexadecimal numbers to denote AES field elements and decimal numbers to denote integers.)
First of all, you have to fix a generator of the AES field's multiplicative group. There's quite a lot of them:
0x03 0x05 0x06 0x09 0x0b 0x0e 0x11 0x12 0x13 0x14 0x17 0x18 0x19 0x1a 0x1c 0x1e
0x1f 0x21 0x22 0x23 0x27 0x28 0x2a 0x2c 0x30 0x31 0x3c 0x3e 0x3f 0x41 0x45 0x46
0x47 0x48 0x49 0x4b 0x4c 0x4e 0x4f 0x52 0x54 0x56 0x57 0x58 0x59 0x5a 0x5b 0x5f
0x64 0x65 0x68 0x69 0x6d 0x6e 0x70 0x71 0x76 0x77 0x79 0x7a 0x7b 0x7e 0x81 0x84
0x86 0x87 0x88 0x8a 0x8e 0x8f 0x90 0x93 0x95 0x96 0x98 0x99 0x9b 0x9d 0xa0 0xa4
0xa5 0xa6 0xa7 0xa9 0xaa 0xac 0xad 0xb2 0xb4 0xb7 0xb8 0xb9 0xba 0xbe 0xbf 0xc0
0xc1 0xc4 0xc8 0xc9 0xce 0xcf 0xd0 0xd6 0xd7 0xda 0xdc 0xdd 0xde 0xe2 0xe3 0xe5
0xe6 0xe7 0xe9 0xea 0xeb 0xee 0xf0 0xf1 0xf4 0xf5 0xf6 0xf8 0xfb 0xfd 0xfe 0xff
To build exponentiation and logarithm tables, you have to choose and fix one of the generators. Let's call this element $g$. I will use $g=\mathtt{0x03}$ in this answer, but it doesn't really matter.
Now let's build an exponentiation table, that is, an array that maps an index $i\in\{0,\dots,254\}$ to the element $g^i$.
Exp[255] of AES field elements indexed by integers.t := 0x01.i ranging from 0 to 254, do
Exp[i] := t.t := mul(g, t), where mul denotes multiplication in the AES field.i += 1.After this procedure, you can easily find $g^i$ using Exp without using a single multiplication: It is just Exp[i % 255]! (The group is cyclic of order $255$, so the modulo operation takes care of is larger than $254$. This is also the reason for the "missing" 256th spot in the table: It is 0x01 again.)
For example, the table for $g=\mathtt{0x03}$ looks like this:
0x01 0x03 0x05 0x0f 0x11 0x33 0x55 0xff 0x1a 0x2e 0x72 0x96 0xa1 0xf8 0x13 0x35
0x5f 0xe1 0x38 0x48 0xd8 0x73 0x95 0xa4 0xf7 0x02 0x06 0x0a 0x1e 0x22 0x66 0xaa
0xe5 0x34 0x5c 0xe4 0x37 0x59 0xeb 0x26 0x6a 0xbe 0xd9 0x70 0x90 0xab 0xe6 0x31
0x53 0xf5 0x04 0x0c 0x14 0x3c 0x44 0xcc 0x4f 0xd1 0x68 0xb8 0xd3 0x6e 0xb2 0xcd
0x4c 0xd4 0x67 0xa9 0xe0 0x3b 0x4d 0xd7 0x62 0xa6 0xf1 0x08 0x18 0x28 0x78 0x88
0x83 0x9e 0xb9 0xd0 0x6b 0xbd 0xdc 0x7f 0x81 0x98 0xb3 0xce 0x49 0xdb 0x76 0x9a
0xb5 0xc4 0x57 0xf9 0x10 0x30 0x50 0xf0 0x0b 0x1d 0x27 0x69 0xbb 0xd6 0x61 0xa3
0xfe 0x19 0x2b 0x7d 0x87 0x92 0xad 0xec 0x2f 0x71 0x93 0xae 0xe9 0x20 0x60 0xa0
0xfb 0x16 0x3a 0x4e 0xd2 0x6d 0xb7 0xc2 0x5d 0xe7 0x32 0x56 0xfa 0x15 0x3f 0x41
0xc3 0x5e 0xe2 0x3d 0x47 0xc9 0x40 0xc0 0x5b 0xed 0x2c 0x74 0x9c 0xbf 0xda 0x75
0x9f 0xba 0xd5 0x64 0xac 0xef 0x2a 0x7e 0x82 0x9d 0xbc 0xdf 0x7a 0x8e 0x89 0x80
0x9b 0xb6 0xc1 0x58 0xe8 0x23 0x65 0xaf 0xea 0x25 0x6f 0xb1 0xc8 0x43 0xc5 0x54
0xfc 0x1f 0x21 0x63 0xa5 0xf4 0x07 0x09 0x1b 0x2d 0x77 0x99 0xb0 0xcb 0x46 0xca
0x45 0xcf 0x4a 0xde 0x79 0x8b 0x86 0x91 0xa8 0xe3 0x3e 0x42 0xc6 0x51 0xf3 0x0e
0x12 0x36 0x5a 0xee 0x29 0x7b 0x8d 0x8c 0x8f 0x8a 0x85 0x94 0xa7 0xf2 0x0d 0x17
0x39 0x4b 0xdd 0x7c 0x84 0x97 0xa2 0xfd 0x1c 0x24 0x6c 0xb4 0xc7 0x52 0xf6
A logarithm table can be easily derived from this:
Log[0x100] of integers indexed by AES field elements.i ranging from 0 to 254, do
Log[Exp[i]] := i.Note that there is no index i such that Exp[i] = 0x00, so the spot for 0x00 in the table is left empty. There is no logarithm of zero (just like over the reals!).
The result looks like this:
--- 0 25 1 50 2 26 198 75 199 27 104 51 238 223 3
100 4 224 14 52 141 129 239 76 113 8 200 248 105 28 193
125 194 29 181 249 185 39 106 77 228 166 114 154 201 9 120
101 47 138 5 33 15 225 36 18 240 130 69 53 147 218 142
150 143 219 189 54 208 206 148 19 92 210 241 64 70 131 56
102 221 253 48 191 6 139 98 179 37 226 152 34 136 145 16
126 110 72 195 163 182 30 66 58 107 40 84 250 133 61 186
43 121 10 21 155 159 94 202 78 212 172 229 243 115 167 87
175 88 168 80 244 234 214 116 79 174 233 213 231 230 173 232
44 215 117 122 235 22 11 245 89 203 95 176 156 169 81 160
127 12 246 111 23 196 73 236 216 67 31 45 164 118 123 183
204 187 62 90 251 96 177 134 59 82 161 108 170 85 41 157
151 178 135 144 97 190 220 252 188 149 207 205 55 63 91 209
83 57 132 60 65 162 109 71 20 42 158 93 86 242 211 171
68 17 146 217 35 32 46 137 180 124 184 38 119 153 227 165
103 74 237 222 197 49 254 24 13 99 140 128 192 247 112 7
Now, the interesting part is how to use these tables to multiply. Take two AES field elements x and y. If either x or y is 0x00, the result is 0x00 (we have to avoid this special case since Log[0x00] is undefined). Otherwise, we can reduce multiplication in the AES field to modular addition over the integers: One can easily show that
$$\mathtt{mul(x, y) == Exp[(Log[x] + Log[y]) \;\%\; 255]}\text!$$
(This is completely analogous to the well-known rule $b^eb^{e'}=b^{e+e'}$ over the reals.)
Similarly, one can obtain inverses:
$$\mathtt{inv(x) == Exp[255 - Log[x]]}\text,$$
since according to the rule for multiplication and since Log is Exp's inverse by definition,
mul(Exp[255 - Log[x]], x) == Exp[(Log[Exp[255 - Log[x]]] + Log[x]) % 255]
== Exp[(255 - Log[x] + Log[x]) % 255]
== Exp[255 % 255]
== Exp[0]
== 0x01.
(Again, this is analogous to $\frac1{b^e}=b^{-e}$ over the reals, additionally adding the group's order to obtain a positive exponent.)
So, what have we gained? We replaced multiplication in the AES field, which is quite expensive (involving a loop and conditional branches), by table lookups using only very simple and fast arithmetic.
aes.con their GitHub. $\endgroup$