In my introductory cryptography class. There is a line describe the construction of S-box in AES "The S-box of AES is constructed by combining a function $h(x)=x^{254}$ defined on $GF(256)$ with an invertible affine transformation." However, when I look into the Advanced Encryption Standard (AES) document , I can not find where the $h(x)=x^{254}$ is used. I understand that S-box is constructed by $a_{i,j}\to a_{i,j}^{-1}(mod\,x^8+x^4+x^3+x+1)$ and subsequent affine transformation. Does $h(x)=x^{254}=x^{-1}$ is used during the inverse proccess?


1 Answer 1


In the field $GF(2^8)$, $x^{254} = x^{-1}$ (except for $x=0$, as $0^{-1}$ doesn't exist; for AES, that's treated as 0), and so it's two ways of describing the same thing.

When we talk about AES, we typically use the $x^{-1}$ nomenclature; for whatever reason, your class decided to go with the $x^{254}$ one.

  • $\begingroup$ Probably a silly question, but don't we require a modulus for the field multiplication? $\endgroup$
    – hola
    Feb 19, 2020 at 18:55
  • $\begingroup$ @yyyy0000: one way to implement $GF(2^8)$ field multiplication using the representation that AES uses is, in fact, treat the values are polynomials on $GF(2)$, and to multiply two values, you would multiply the two polynomials, and then reduce the product modulo $x^8+x^4+x^3+x+1$. However, when we're working the field (or ring or group), we typically just use the $\times$ or $+$ operations as the field operations, and don't explicitly write out how it could be implemented every time. $\endgroup$
    – poncho
    Feb 19, 2020 at 19:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.