Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
The Affine Transformation for AES Sbox is given by (1)
The straight forward reverse to this transformation is (2)
Where as the inverse of Affine Transformation is given as (3)
where (4)
why did the designers preferred the (3) instead of straight forward reverse (2)?
Those are, of course, two equivalent ways of writing the same function, so it really doesn't matter which one you use. If you're implementing AES, you can use whichever form of the S-box you find more convenient — or even something else entirely, as long as it gives the same results.*
That said, it's often desirable to share as much code and/or circuitry between the encryption and decryption implementations as possible. Thus, it can be convenient to implement the forward and reverse S-boxes so that they have the same mathematical form. Thus, if you're going to implement the forward S-box using formula (1), it can make sense to implement the reverse S-box using formula (3), since the only difference between them is the choice of constants.
*) Of course, however you choose to implement the S-box, you'd typically want to make sure that it runs in constant time and doesn't leak any sensitive data via any other potentially exploitable side channels.
