2
$\begingroup$

I have a problem to calculate the S-box in S-AES. The affine transformation is defined:

Affine transformation of S-AES

I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ is my least significant bit. So I define my inverse $b_0 = 1$, $b_1 = 1$, $b_2 = 0$, $b_3 = 1$.

Then I start to multiply with the first row:

$$(1*b_0) + (0*b_1) + (1*b_2) + (1*b_3) +(1) =\\ (1*1)+(0*1)+(0*0)+(1*1) + (1) =\\ 1+1+1 =\\ 1$$

The second row : $$(1*1)+(1*1)+(0*0)+(1*1) + (0) =\\ 1+1+1 =\\ 1$$ and that is wrong. The result is $0001$.

So where is my mistake?

Improve this question
$\endgroup$
4
  • $\begingroup$ it is s-aes. I didnt knew the right tag so i chose aes $\endgroup$
    – Reazelruss
    Jul 3, 2018 at 12:04
  • $\begingroup$ Here's the solution to the full AES S-Box: github.com/bpdegnan/aes/blob/master/aes-sbox/documentation/… $\endgroup$
    – b degnan
    Jul 3, 2018 at 14:14
  • $\begingroup$ i can see that is the same multiplication like in my question. The only differenz is that the vector begins at a7 and not a0. Therefore are the rows of the matrix are mirrored. But what is wrong with the matrix of s-aes ?? $\endgroup$
    – Reazelruss
    Jul 3, 2018 at 14:57
  • $\begingroup$ btw. ty for your link :) it give me some information but not the solution of my problem... $\endgroup$
    – Reazelruss
    Jul 3, 2018 at 16:06

1 Answer 1

Reset to default
2
$\begingroup$

Endianness strikes again! Quoting the S-AES paper

we associate the nibble $b_0 b_1 b_2 b_3$ with the polynomial $b_0x^3+b_1x^2+b_2x+b_3$.

The nibble $0101$ maps to $b_0=0$, $b_1=1$, $b_2=0$, $b_3=1$ associated to the polynomial $x^2+1$. Its inverse modulo $x^4+x+1$ is $x^3+x+1$, associated to the nibble $1011$ that maps to
$b_0=1$, $b_1=0$, $b_2=1$, $b_3=1$ rather than
$b_0=1$, $b_1=1$, $b_2=0$, $b_3=1$ in the question.

Note: this comment voices puzzlement that coefficients of a polynomial are numbered differently (and in reverse order) than the corresponding powers of $x$. There are two reasons for this convention:

  • Technical: it is common in telecoms to both receive bits sequentially with their number initially unknown (naturally numbering them starting from 0 onward), and perform on-the-fly a Cyclic Redundancy Check by division of the polynomial associated to the message by a shorter fixed-size polynomial. Polynomial division is performed starting from the high-order coefficient of the dividend, hence the convention. Analogy: finding $d\bmod 97$ by performing Euclidean division while given integer $d$ of initially unknown magnitude as a stream of decimal digits in usual reading order.
  • Precedent: the block cipher DES numbered bits from left to right starting from 1 onward in inputs, output, and internal variables including S-box-index (on page marked 14 of FIPS 46-3 the numbering of bits grows as their weight in base 2 decreases, and doing otherwise would have required shuffle of the S-boxes). Time and reason largely shifted practice towards numbering from 0 in fresh cryptographic work, but the numbering direction sticks. Modern practice is to number things according to binary weight up to some size, then the other way around (the threshold is often octet for the external form of large integers as used in RSA and ECC; in FIPS 180 it is 32-bit in SHA-256, 64-bit in SHA-512, with an exception in the padding).
Improve this answer
$\endgroup$
4
  • $\begingroup$ ok maybe i dont understand the galois filed. So lets take the invers 1011. We read the bits from right to left. In this case the first bit on the right side is the least significant bit. In GF(2^4) we can write the Bit in a Polynom. So to compare: dualsystem : 1*2^0+1*2^1+0*2^2+1*2^3 Galois field : 1*x^0+1*x^1+0*x^2+1*x^3. In this case b0 and b1 should be 1. I dont understand your association. Where do u get it ? Are u sure that is correct? $\endgroup$
    – Reazelruss
    Jul 4, 2018 at 20:09
  • $\begingroup$ Sry I saw now your link. I will read it but i hope u can understand why i dont rly understand the association $\endgroup$
    – Reazelruss
    Jul 4, 2018 at 20:18
  • $\begingroup$ sry I am a bit confused. sry for the spam... I propose your association is correct in AES and S-AES but the transformation from binary system to galois field system is correct ? $\endgroup$
    – Reazelruss
    Jul 4, 2018 at 20:40
  • $\begingroup$ ok u are right. ty for help :) $\endgroup$
    – Reazelruss
    Jul 4, 2018 at 21:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.