Let's suppose I want to modify Kuznyechik block cipher by choosing a random S-box (taken from /dev/random for example).

How can I calculate/generate the inverse S-box?

Does anyone know the formula or algorithm used to do this?


2 Answers 2


Sagemath SBox Package is a friend of SBox learners/designers.

For an invertible SBox;

#         0  1  2  3  4  5  6  7       #index
S = SBox([0, 1, 3, 6, 7, 4, 5, 2])     #output
Sinv = S.inverse()


(0, 1, 7, 2, 5, 6, 3, 4)

Actually, the implementation of the inverse is not hard; just reverse the index-output relation. Remember, invertible SBox is just a permutation.

Note that the source code of SageMath SBox is here and as a good library it first controls the SBox is a permutation or not and returns an SBox oject;

        if not self.is_permutation():
            raise TypeError("S-Box must be a permutation")

        cdef Py_ssize_t i
        cdef list L = [self._S_list[i] for i in range(1 << self.m)]

        return SBox([L.index(i) for i in range(1 << self.m)],
  • $\begingroup$ Thanks for the reply. Do you know some similar package/program in C/C++ that does the same of Sagemath SBox package? $\endgroup$ Commented Mar 21, 2022 at 23:58
  • $\begingroup$ @phantomcraft I'm not aware of it, however, you can use it in Python $\endgroup$
    – kelalaka
    Commented Mar 22, 2022 at 6:40
  • $\begingroup$ I got, thank you. $\endgroup$ Commented Mar 23, 2022 at 1:18
  • $\begingroup$ Sorry, I selected the other question as "useful" because I was interested in a C implementation. $\endgroup$ Commented Mar 23, 2022 at 1:22
  • $\begingroup$ @phantomcraft then you are asking on the wrong Stack Overflow site. This is not a programming site and you asked Does anyone know the formula or algorithm used to do this? so I've given you the easiest way, and the simple algorithm reverse the index-output relation.. Without my answer, this question is more to be off-topic side. Have fun. $\endgroup$
    – kelalaka
    Commented Mar 23, 2022 at 8:47

Assuming S-boxes are a permutation.

Here is example in Python:

S = (2, 0, 1)
inverse = [0] * len(S)

for i in range(len(S)):
    inverse[S[i]] = i


Here is example in C:

unsigned int S[256] = {...};
unsigned int inverse[256];

for (int i = 0; i < 256; i++)
    inverse[S[i]] = i;
  • $\begingroup$ Quite simple, I didn't realize that it would be that easy. Thanks! $\endgroup$ Commented Mar 23, 2022 at 1:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.