Wikipedia: Rijndael's Forward S-box

I'm writing C Code to generate S-boxes but I'm stuck.

Would you mind explaining one entry of the S-box? (say for x = 0x2). Here is what I got.

The inverse of $2$ in $GF(2^8)$ for polynomial $x^8 + x^4 + x^3 + x + 1 = 142$ (in decimal). Now if I apply the affine equation, it results in $86$ (0x56). What's wrong with my approach?

The additive constant for S-Box = 0x63.

In case it helps and/or makes sense, here's my C code.

  • 4
    $\begingroup$ The multiplicative inverse is wrong: $2$ translates to the polynomial $p_1 = X$. The number $142$ would be $10001110$ in binary, which translates to the polynomial $p_2 = X^7+X^3+X^2+X$. And the product $p_1p_2$ is: $p_1p_2 = X (X^7+X^3+X^2+X) = X^8+X^4+X^3+X^2$. Reducing this modulo the polynomial $q=X^8+X^4+X^3+X+1$, this is $p_1p_2 = X^2+X+1 \mod q$, which is not the neutral element. $\endgroup$
    – tylo
    Apr 4, 2017 at 15:27
  • $\begingroup$ Thanks but one thing what is the inverse of 2? I need it for a reference. $\endgroup$
    – Mithil
    Apr 4, 2017 at 17:15
  • 1
    $\begingroup$ Related: How are the AES S-Boxes calculated? and How can I calculate the Rijndael SBox? $\endgroup$
    – e-sushi
    Apr 4, 2017 at 18:57
  • 1
    $\begingroup$ Also related: Multiplicative inverse in $GF(2^8)$ ? and (more generally) Galois fields in cryptography. In fact, I might almost suggest the former as a possible duplicate. $\endgroup$ Apr 4, 2017 at 22:35

1 Answer 1


In your code you use the modular inverse with the respect to the modulus 0x11b, which is an operation quite different from taking the inverse in the field GF(2^8).

For getting an idea what you have to do instead, take a look at finite field arithmetic in the wikipedia.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.