# How constant value 0x63 in affine transformation is chosen or generated while AES Substitution Box is formed?

Me and one of my friends are working on AES algorithm. We have understood how multiplicative inverse table is generated. Rijndael AES algorithm shows us how S-Box is generated through the affine transformation process. In the original algorithm they have multiply each byte of the state with an constant matrix and then add the result with another constant byte which is 0x63 to get the substitute value. We have understood how the constant matrix is generated as there is a formula to generate it but couldn't find out why 0x63 constant value is chosen. We have already gone through many resources but could not find any appropriate solution. Can any one help us in this regarding issue?

• 0x63 results in a self inverse mapping at 0x73 and 0x8F, where an input to the s-box and the inverse s-box produce the same result. The optimal constant appears to be 0x15 according to my testing Commented Sep 21, 2016 at 23:56

## 1 Answer

According to the Rijndael AES proposal (emphasis mine):

We have chosen an affine mapping that has a very simple description per se, but a complicated algebraic expression if combined with the ‘inverse’ mapping. It can be seen as modular polynomial multiplication followed by an addition: $$b(x) = (x^7 + x^6 + x^2 + x) + a(x)(x^7 + x^6 + x^5 + x^4 + 1) \mod x^8 + 1$$ The modulus has been chosen as the simplest modulus possible. The multiplication polynomial has been chosen from the set of polynomials coprime to the modulus as the one with the simplest description. The constant has been chosen in such a way that that the S-box has no fixed points (S-box($a$) = $a$) and no ’opposite fixed points' (S-box($a$) = $\bar a$).

I'm not personally aware of any other design considerations in the choice of the additive constant 0x63, although it's worth noting that it does have a fairly nice and simple binary representation (0x63 = 0b0110 0011), which might perhaps simplify some implementations slightly.

• Thanks for your answer. In the original algorithm this constant value is chosen in 2^8 galois field. If we want to work in 2^4 galois field what should be the constant value.It must be reside between 0 to F, I guess. What do you think? Commented Sep 21, 2016 at 19:02
• Once you've picked a multiplicative constant (and checked that the resulting circulant matrix is invertible), you could just iterate over all the possible additive constants (there are only 16) and count how many fixed points (and opposite fixed points) the resulting S-box has. Hopefully you'll find one or more possible constants that yield no such fixed points. (If you don't, you may wish to consider other multiplicative constants.) Commented Sep 21, 2016 at 20:28
• We are very grateful to you. We had successfully accomplished what we were trying for last couple of weeks. Without your help it was not possible. We need to do lots of things ahead. Hope you will help us if we face any problem. Thanks again. Commented Sep 24, 2016 at 21:21