# How does an S-box introduce confusion

I'm trying to find the logic for introducing the S-box, but having trouble understanding why. In a simple cipher, e.g.

c = pt xor key


I understand that I can easially find the key when choosing the plaintext myself

key = pt xor C


But I don't see why an S-box can help in this at all, given that the S-box is public.

C = S[pt xor key]


Because then I could just do

key = S^-1[pt xor C]


I understand by adding multiple rounds and keys, this gets harder, but what is the S-box giving, when we can just reverse it?

• Hint: think multiple rounds. – kelalaka Feb 16 at 18:55

Another need for the Sbox (or Sboxes) is to make a cipher non-linear. AES, for example, consists of affine transformation only apart from the SubBytes step (which is a reversible Sbox). If this step was omitted, the cipher would become affine, so it can be represnted as C = Lx+v, and is easily breakable with polynomial time and data by solving linear equations (By knowing L and v you can encrypt/decrypt any ciphertext).