AES S-Box: Possible options for constant to calculate S-Box values

Question

To calculate the values of S-Box in AES, I came across a lot of resources where constant {63} was chosen. It is said that {63} satisfies the condition of S-Box that it should not have any fixed points or opposite fixed points. What are other choices for constants?

eg: will {1},{2},{3},{4} be valid choices for constants? what are other options for constant available?

Answer 1

Out of the 256 possible 8 bit additive constants for the AES S-box, 34 satisfy the requirement of there being no fixed points or opposite fixed points:

0x05, 0x07, 0x08, 0x15, 0x1D, 0x20, 0x30, 0x37, 0x38, 0x3B, 0x3D, 0x49,
0x52, 0x56, 0x5D, 0x63, 0x76, 0x89, 0x9C, 0xA2, 0xA9, 0xAD, 0xB6, 0xC2,
0xC4, 0xC7, 0xC8, 0xCF, 0xDF, 0xE2, 0xEA, 0xF7, 0xF8, 0xFA

To address the obvious follow-up question, no, I do not know why specifically the constant 0x63 was chosen from among these 34 options.

The only immediately apparent property of 0x63 that I could guess might have influenced the choice is that it has exactly four of its eight bits set; but that's still not enough to narrow down the choice completely, since 0x1D, 0x56, 0x9C, 0xA9 and 0xE2 also share this property.

---

Ps. To obtain the list above, the easiest way is to start with the normal AES S-box (which can be found in many sources, including Wikipedia) as a table of 256 bytes. You can then bitwise XOR each byte in the table with the standard additive constant 0x63 to cancel it out and obtain the S-box as it would look with a zero constant. Then you can just test all the 256 possible constants between 0 and 255 to see if XORing them with each of the table entries will yield any entries matching their index in the table or its bitwise negation.