2
$\begingroup$

I would like to know, how to calculate the inverse S-box. I followed this link (with affine transformation first, then multiplicative inverse), but the result is wrong. For example, if I use the value 0x52 (01010010 in binary), reverse of this value would be 01001010. The inverse matrix (for inverse S-Box) is:

Input = 0  1  0  0  1  0  1  0 (LSB First)
Row 0 = 0  0  1  0  0  1  0  1
Bit 0 = 0  0  0  0  0  0  0  0 = 0

Row 1 = 1  0  0  1  0  0  1  0
Bit 1 = 0  0  0  0  0  0  1  0 = 1

Row 2 = 0  1  0  0  1  0  0  1
Bit 2 = 0  1  0  0  1  0  0  0 = 0

Row 3 = 1  0  1  0  0  1  0  0
Bit 3 = 0  0  0  0  0  0  0  0 = 0

Row 4 = 0  1  0  1  0  0  1  0
Bit 4 = 0  1  0  0  0  0  1  0 = 0

Row 5 = 0  0  1  0  1  0  0  1
Bit 5 = 0  0  0  0  1  0  0  0 = 1

Row 6 = 1  0  0  1  0  1  0  0
Bit 6 = 0  0  0  0  0  0  0  0 = 0

Row 7 = 0  1  0  0  1  0  1  0
Bit 7 = 0  1  0  0  1  0  1  0 = 1

The result is 01000101, MSB first that would be 10100010, XOR-ed with final vector 0x52 is 0xf0. The inverse of 0xf0 is 0x5b, which is wrong. It should be 0x48. Where did I make a mistake?

$\endgroup$
  • $\begingroup$ It is not clear how your inverse S-box is calculated exactly. It must be: 1) XOR 0x63; 2) Apply the matrix that is the inverse to the 0x1F matrix; 3) Compute the inverse in GF(256). $\endgroup$ – Dmitry Khovratovich Jan 28 '15 at 9:57
  • $\begingroup$ how did you get the reverse of 0x52 is 0x4A? would you like to explain this? I've been looking for this in two days $\endgroup$ – Pandu Hutagalung Jan 24 at 23:11
  • $\begingroup$ @PanduHutagalung Check this: github.com/bpdegnan/aes/blob/master/aes-sbox/documentation/… $\endgroup$ – b degnan Jan 25 at 14:55
3
$\begingroup$

You performed the matrix component of the affine tranformation correctly, what you did wrong was the addition of the vector prior to field inversion.

The value 10100010 (0xA2) is the correct result of the inverse affine matrix. The final vector of the inverse affine transform however is 00000101 (0x05).

The resultant 0xA7 is then inverted, which is 0x48, the correct inverse s-box value.

$\endgroup$

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.