I'm trying to an implement an enhanced version of AES which was proposed recently. The link to the paper is here: http://sdiwc.net/digital-library/enhancing-aes-using-novel-block-key-generation-algorithm-and-key-dependent-sboxes

In their proposed algorithm, a unique S-box is created for each round by XOR'ing all 16 bytes of the round key, and cyclically shifting the original static S-Box to the left by that value. I'm new to cryptography in general, and I understand the original AES algorithm well, but I don't understand what the authors mean by cyclically shifting the S-Box. Obviously, each individual byte can't be shifted, since the shift values produced are as high as 127. Is it each row of the S-Box that has to be shifted, or are all 256 bytes lined up somehow and shifted?

  • 1
    $\begingroup$ The paper lists like 19 earlier modifications of AES, and proposes yet another one. But is there any serious motivation for some of these modifications? $\endgroup$
    – fgrieu
    Jan 26, 2017 at 14:00

2 Answers 2


Yes they are talking about shifting each individual byte.

In the example in the paper, s-box input 00 becomes input A4 (output 63), 01 becomes A5 (7C), and so on. This is a 92 byte left rotation of the s-box elements, which is equivalent to a 164 byte right rotation, all done mod 256.

Without going into extreme detail, I would strongly recommend against using this... ever, it is not a good idea, and actually makes the cipher weaker. There are only 255 new s-boxes generated using this method, and they are all weaker than the original.

The example s-box given shows the following properties:

Differential Uniformity: 8 (lower is better)
Non-linearity: 94 (higher is better)
AutoCorrelation: 88 (lower is better)
SSI: 260608 (lower is better)

The AES standard s-box has these values for the same properties:

Differential Uniformity: 4 (lower is better)
Non-linearity: 112 (higher is better)
AutoCorrelation: 32 (lower is better)
SSI: 133120 (lower is better)

The new s-box also inherits the undesirable properties of the original, such as simple algebraic representation and CCZ equivalence.

  • $\begingroup$ Additionally, the new s-box will slow the algorithm down (as it takes time to generate), and will imply difficulty for a constant time implementation . $\endgroup$
    – Ella Rose
    Jan 26, 2017 at 17:55
  • $\begingroup$ @EllaRose yes, but that is likely done during key scheduling and only once. The resultant s-boxes would mainly take up additional memory, and not slow down a standard implementation, but they do make any hardware acceleration that may be available unusable $\endgroup$ Jan 27, 2017 at 4:08

The following illustration explains the concept fantastically. It's taken from A Stick Figure Guide to the Advanced Encryption Standard (AES).

Cyclically shifting refers to the fact that the byte values wrap round like a cyclical buffer and are pushed back on the other side as shown.

The paper you have linked applies this type of shifting in a key-dependent fashion to generate 10 'round-sboxes' from one static key independent cipher sbox.

AES Shift Rows operation taken from A Stick Figure Guide to the AES


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.