I am trying to design the s-box for AES. Quoting from Wikipedia, the algorithm for applying affine transformation in AES s-box calculation is

Let s (an 8-bit unsigned variable) be the input number.
Let result be 0.
For 5 times: 
   XOR result with s.
   Rotate s one bit to the left.

My question is why the multiplication is done this way? Why only 5 steps?

  • 1
    $\begingroup$ look at the affine matrix, each column and row only has 5 bits set $\endgroup$ Mar 14, 2018 at 21:04

1 Answer 1


This is first half of the calculation presented on the Wiki page.

Notice that every bit of the result is actually a XOR of just five bits:

affine matrix multiplication with result

Now we slightly modify the algorithm you wrote to create five numbers by rotating the original number to the left and only then XOR them together:

five numbers  xored together give the same result as above

As you can see the result is exactly the same.

  • $\begingroup$ Thanks for the answer. So for any S-box , I'll just compute the no. of set bits and do that much shifting and xor-ing? $\endgroup$
    – user56952
    Mar 17, 2018 at 7:05

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.