Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It only takes a minute to sign up.
Sign up to join this community
To calculate the values of S-Box in AES, I came across a lot of resources where constant {63} was chosen. It is said that {63} satisfies the condition of S-Box that it should not have any fixed points or opposite fixed points. What are other choices for constants?
eg: will {1},{2},{3},{4} be valid choices for constants? what are other options for constant available?
Out of the 256 possible 8 bit additive constants for the AES S-box, 34 satisfy the requirement of there being no fixed points or opposite fixed points:
0x05, 0x07, 0x08, 0x15, 0x1D, 0x20, 0x30, 0x37, 0x38, 0x3B, 0x3D, 0x49,
0x52, 0x56, 0x5D, 0x63, 0x76, 0x89, 0x9C, 0xA2, 0xA9, 0xAD, 0xB6, 0xC2,
0xC4, 0xC7, 0xC8, 0xCF, 0xDF, 0xE2, 0xEA, 0xF7, 0xF8, 0xFA
To address the obvious follow-up question, no, I do not know why specifically the constant 0x63 was chosen from among these 34 options.
The only immediately apparent property of 0x63 that I could guess might have influenced the choice is that it has exactly four of its eight bits set; but that's still not enough to narrow down the choice completely, since 0x1D, 0x56, 0x9C, 0xA9 and 0xE2 also share this property.
Ps. To obtain the list above, the easiest way is to start with the normal AES S-box (which can be found in many sources, including Wikipedia) as a table of 256 bytes. You can then bitwise XOR each byte in the table with the standard additive constant 0x63 to cancel it out and obtain the S-box as it would look with a zero constant. Then you can just test all the 256 possible constants between 0 and 255 to see if XORing them with each of the table entries will yield any entries matching their index in the table or its bitwise negation.
