# How is an AES S-Box cyclically shifted to the left?

I'm trying to an implement an enhanced version of AES which was proposed recently. The link to the paper is here: http://sdiwc.net/digital-library/enhancing-aes-using-novel-block-key-generation-algorithm-and-key-dependent-sboxes

In their proposed algorithm, a unique S-box is created for each round by XOR'ing all 16 bytes of the round key, and cyclically shifting the original static S-Box to the left by that value. I'm new to cryptography in general, and I understand the original AES algorithm well, but I don't understand what the authors mean by cyclically shifting the S-Box. Obviously, each individual byte can't be shifted, since the shift values produced are as high as 127. Is it each row of the S-Box that has to be shifted, or are all 256 bytes lined up somehow and shifted?

• The paper lists like 19 earlier modifications of AES, and proposes yet another one. But is there any serious motivation for some of these modifications?
– fgrieu
Commented Jan 26, 2017 at 14:00

Yes they are talking about shifting each individual byte.

In the example in the paper, s-box input 00 becomes input A4 (output 63), 01 becomes A5 (7C), and so on. This is a 92 byte left rotation of the s-box elements, which is equivalent to a 164 byte right rotation, all done mod 256.

Without going into extreme detail, I would strongly recommend against using this... ever, it is not a good idea, and actually makes the cipher weaker. There are only 255 new s-boxes generated using this method, and they are all weaker than the original.

The example s-box given shows the following properties:

Differential Uniformity: 8 (lower is better)
Non-linearity: 94 (higher is better)
AutoCorrelation: 88 (lower is better)
SSI: 260608 (lower is better)


The AES standard s-box has these values for the same properties:

Differential Uniformity: 4 (lower is better)
Non-linearity: 112 (higher is better)
AutoCorrelation: 32 (lower is better)
SSI: 133120 (lower is better)


The new s-box also inherits the undesirable properties of the original, such as simple algebraic representation and CCZ equivalence.

• Additionally, the new s-box will slow the algorithm down (as it takes time to generate), and will imply difficulty for a constant time implementation . Commented Jan 26, 2017 at 17:55
• @EllaRose yes, but that is likely done during key scheduling and only once. The resultant s-boxes would mainly take up additional memory, and not slow down a standard implementation, but they do make any hardware acceleration that may be available unusable Commented Jan 27, 2017 at 4:08

The following illustration explains the concept fantastically. It's taken from A Stick Figure Guide to the Advanced Encryption Standard (AES).

Cyclically shifting refers to the fact that the byte values wrap round like a cyclical buffer and are pushed back on the other side as shown.

The paper you have linked applies this type of shifting in a key-dependent fashion to generate 10 'round-sboxes' from one static key independent cipher sbox.