Introduction
Want to see how the AES S-box is constructed from a multiplicative inverse in GF(2^8) and an affine transformation, or how ShiftRows and MixColumns shuffle bytes? This tool takes a single hex byte, computes its GF(2^8) inverse, applies the affine transformation, and verifies the result matches the AES S-box table. In P-box mode, it shows ShiftRows (byte permutation) and MixColumns (GF(2^8) matrix multiplication) on a 4-byte input with full arithmetic details. Everything runs in your browser.
What this tool does
- Compute the AES S-box output for any input byte (00 to FF) by performing the two-step construction: multiplicative inverse in GF(2^8) followed by an affine transformation over GF(2)
- Verify that the computed S-box output matches the known AES S-box table entry, with a match confirmation indicator
- Display the full 256-entry AES S-box table with the input cell and output cell highlighted, so you can see where any byte maps
- Compute the inverse S-box lookup for the same input byte, showing the reverse mapping
- In P-box mode, apply ShiftRows (left rotation of a 4-byte row by 1 position) to a 4-byte input and visualize the byte permutation with an SVG diagram
- In P-box mode, apply MixColumns (GF(2^8) matrix multiplication with the fixed matrix 02 03 01 01) to a 4-byte input and show the full arithmetic for each output byte
How this tool works
The tool has two modes: S-box and P-box. In S-box mode, you enter a single hex byte (00 to FF). The tool computes the multiplicative inverse in GF(2^8) using the AES irreducible polynomial x^8 + x^4 + x^3 + x + 1 (represented as 0x11B). The inverse is found by brute force: for input a, it searches for the value b such that gfMul(a, b) = 1 in GF(2^8). The special case 0x00 maps to 0x00 (0 has no inverse, so the S-box defines it as mapping to itself).
Next, the tool applies the affine transformation over GF(2). For each output bit i, it computes b_i XOR b_{i+4} XOR b_{i+5} XOR b_{i+6} XOR b_{i+7} XOR c_i, where b is the inverse byte and c is the constant 0x63. This is a matrix multiplication over GF(2) followed by XOR with 0x63. The result should match the AES S-box entry for the input byte, and the tool shows a verification indicator.
The tool also displays the full 256-entry S-box table as a 16x16 grid, with the input cell highlighted in bold and the output cell highlighted in a lighter shade. The inverse S-box lookup is shown as well, so you can see the reverse mapping.
In P-box mode, you enter 4 bytes in hex (32 bits). The tool applies ShiftRows (a left rotation by 1 position on the 4-byte row) and shows the result with an SVG diagram that draws arrows from input positions to output positions. Then it applies MixColumns, which multiplies the 4-byte column by the fixed matrix [02, 03, 01, 01] (circularly shifted per row) in GF(2^8). The tool shows the full arithmetic for each output byte: out[r] = gfMul(02, in[0]) XOR gfMul(03, in[1]) XOR gfMul(01, in[2]) XOR gfMul(01, in[3]), with each gfMul result displayed.
The GF(2^8) multiplication uses the standard AES reduction polynomial. When a product exceeds 8 bits (the high bit of the intermediate value is set), it is reduced by XOR with 0x1B (the low 8 bits of 0x11B). This keeps all values within a single byte.
How the AES S-box and P-box work (FIPS 197)
The AES S-box is the only non-linear component in AES. Without it, AES would be a linear cipher, trivially breakable by linear algebra. The S-box is specified in FIPS 197 and was designed by Joan Daemen and Vincent Rijmen, who describe its construction in The Design of Rijndael.
The S-box is built in two steps. First, compute the multiplicative inverse of the input byte in the Galois field GF(2^8) with the irreducible polynomial m(x) = x^8 + x^4 + x^3 + x + 1. The inverse of a is the element b such that a * b = 1 in this field. The element 0x00 is special: it has no inverse, so it is mapped to 0x00 by convention.
Second, apply an affine transformation over GF(2). This is a matrix multiplication (an 8x8 bit matrix) followed by addition of the constant vector 0x63. The matrix is a circulant matrix with the bit pattern 11110001 (circularly shifted). The affine transformation adds diffusion and breaks the algebraic structure of the inversion, making the S-box resistant to algebraic attacks.
The combination of inversion and affine transformation gives the S-box its cryptographic properties. The inversion provides high non-linearity (the S-box has a non-linearity of 112, the maximum for an 8-bit function). The affine transformation ensures the S-box has no fixed points (no input maps to itself) and no opposite fixed points (no input maps to its bitwise complement). These properties are described in the Rijndael proposal and in Daemen and Rijmen's book.
The P-box operations (ShiftRows and MixColumns) provide diffusion. ShiftRows is a byte-level permutation: row i of the state matrix is cyclically shifted left by i positions. Row 0 is not shifted, row 1 shifts by 1, row 2 by 2, row 3 by 3. This spreads bytes across columns.
MixColumns is a linear transformation on each column of the state. Each 4-byte column is treated as a polynomial over GF(2^8) and multiplied by the fixed polynomial 3x^3 + x^2 + x + 2 (mod x^4 + 1). In matrix form, this is multiplication by the circulant matrix [02, 03, 01, 01]. MixColumns ensures that each output byte depends on all four input bytes in the column, providing diffusion within columns. Combined with ShiftRows (which spreads bytes across columns), the two operations ensure that after two rounds, every output byte depends on every input byte.
The AES Encrypt / Decrypt tool shows how SubBytes (the S-box), ShiftRows, MixColumns, and AddRoundKey combine across 10, 12, or 14 rounds. This tool focuses on the S-box construction and the P-box arithmetic in isolation, so you can see the mathematical details that the full AES round view abstracts away.
How to use this tool
- Choose a mode: S-Box (single byte analysis) or P-Box (4-byte ShiftRows and MixColumns)
- In S-Box mode, enter a single hex byte (00 to FF) in the input field
- Read the S-box lookup result: the output byte and the inverse S-box output are displayed immediately
- Examine the mathematical construction: Step 1 shows the GF(2^8) multiplicative inverse, Step 2 shows the affine transformation result, and Step 3 verifies it matches the S-box table
- Scroll down to see the full 256-entry S-box table with your input byte (bold) and output byte (highlighted) marked
- In P-Box mode, enter exactly 4 bytes in hex (e.g. `00 01 02 03` or `00010203`)
- Read the ShiftRows result: the 4 bytes are left-rotated by 1 position, shown with an SVG permutation diagram
- Read the MixColumns result: each output byte is computed as a GF(2^8) matrix multiplication, with the full arithmetic shown for each row
Real-world examples
S-box construction for input 0x53
Enter `53` in S-Box mode. The tool computes the GF(2^8) inverse of 0x53, which is 0xCA (because 0x53 * 0xCA = 1 in GF(2^8) with polynomial 0x11B). Then it applies the affine transformation to 0xCA, producing 0xED. The S-box table confirms S-box[0x53] = 0xED. This matches the FIPS 197 Appendix B example, where 0x53 is the first byte of the test plaintext and SubBytes maps it to 0xED.
The special case of 0x00
Enter `00` in S-Box mode. The multiplicative inverse of 0x00 is 0x00 (by convention, since 0 has no inverse in GF(2^8)). The affine transformation of 0x00 is 0x63 (just the constant, since all input bits are 0). The S-box table confirms S-box[0x00] = 0x63. This is the first entry in the S-box table and is the value used when a plaintext byte is 0x00.
ShiftRows on a 4-byte row
Switch to P-Box mode and enter `00 01 02 03`. ShiftRows left-rotates the row by 1 position: the output is `01 02 03 00`. The SVG diagram shows arrows from each input position to its output position: byte 0 moves to position 3, byte 1 moves to position 0, byte 2 moves to position 1, byte 3 moves to position 2. In the full AES state matrix, each row is shifted by a different amount (0, 1, 2, 3), but this tool shows a single row for clarity.
MixColumns arithmetic on a 4-byte column
In P-Box mode, enter `db 13 53 45` (the first column of the AES state after SubBytes and ShiftRows in the FIPS 197 example). MixColumns computes out[0] = gfMul(02, db) XOR gfMul(03, 13) XOR gfMul(01, 53) XOR gfMul(01, 45). The tool shows each gfMul result: gfMul(02, db) = b3, gfMul(03, 13) = 3d, gfMul(01, 53) = 53, gfMul(01, 45) = 45. XOR them: b3 XOR 3d XOR 53 XOR 45 = 8e. This matches the FIPS 197 example output.
Verifying non-linearity of the S-box
Enter `01` and note the S-box output is 0x7C. Now enter `02` and note the output is 0x77. If the S-box were linear, S-box[02] would equal 2 * S-box[01] in GF(2^8). But 2 * 0x7C = 0xF8 (via gfMul), which is not 0x77. This demonstrates that the S-box is non-linear: the output is not a linear function of the input. This non-linearity is what makes AES resistant to linear cryptanalysis.
Comparison with similar methods
| Method | Complexity | Typical use |
|---|---|---|
| AES S-Box | GF(2^8) inverse + affine transform, 256 entries | AES SubBytes, non-linearity source |
| DES S-Boxes | 8 tables, 6-to-4 bit mapping, hand-tuned | DES F function (legacy) |
| Blowfish S-Boxes | 4 tables, 256 entries of 32 bits, key-dependent | Blowfish F function (legacy) |
| AES ShiftRows | Byte permutation, row shift by 0-3 | AES diffusion, cross-column spreading |
| AES MixColumns | GF(2^8) matrix multiply, 4x4 circulant | AES diffusion, within-column mixing |
Limitations or considerations
This tool shows the S-box and P-box operations in isolation. In AES, SubBytes (S-box), ShiftRows, and MixColumns are applied to a 4x4 byte state matrix across 10, 12, or 14 rounds, interleaved with AddRoundKey. The tool simplifies this: S-box mode processes a single byte, and P-box mode processes a single row (ShiftRows) or column (MixColumns). For the full round-by-round AES visualization, use the AES Encrypt / Decrypt tool.
The GF(2^8) multiplicative inverse is computed by brute force (iterating over all 256 values to find the one that produces 1). This is fine for a single byte but would be slow for bulk encryption. Real AES implementations use a precomputed 256-byte lookup table for the S-box, not on-the-fly computation. Hardware implementations (AES-NI) use dedicated circuits.
The ShiftRows visualization shows a single 4-byte row shifted by 1 position. In the full AES state, ShiftRows shifts row 0 by 0, row 1 by 1, row 2 by 2, and row 3 by 3. The tool cannot show the full 4x4 state matrix shift, but the principle (cyclic rotation per row) is the same.
The MixColumns visualization shows the matrix multiplication for a single column. In the full AES state, MixColumns is applied to all four columns independently. The tool shows one column with full arithmetic, which generalizes to the others.
The tool does not cover the AES key schedule (Rcon, RotWord, SubWord) or AddRoundKey. These are shown in the AES Encrypt / Decrypt tool round visualization. The S-box is also used in the key schedule (SubWord applies the S-box to each byte of a 4-byte word).
The tool does not cover the inverse operations (InvSubBytes, InvShiftRows, InvMixColumns) used in AES decryption. The inverse S-box is shown in S-box mode, but the inverse MixColumns matrix (which uses 0x0E, 0x0B, 0x0D, 0x09 instead of 0x02, 0x03, 0x01, 0x01) is not demonstrated. See the AES Encrypt / Decrypt tool for decryption.
Frequently asked questions
What is GF(2^8) and why does AES use it?
GF(2^8) is a Galois field with 256 elements, where each element is a byte. Addition is XOR, and multiplication is polynomial multiplication modulo the irreducible polynomial x^8 + x^4 + x^3 + x + 1 (0x11B). AES uses GF(2^8) because it maps cleanly to byte operations: every element is exactly one byte, and field operations are efficient in hardware and software. The S-box inversion, MixColumns multiplication, and key schedule all operate in this field.
Why does the AES S-box use multiplicative inversion?
Multiplicative inversion in GF(2^8) has high non-linearity (112 out of 120 maximum for an 8-bit function), which makes the S-box resistant to linear and differential cryptanalysis. The inversion alone has a fixed point (0x01 maps to 0x01) and algebraic structure that could be exploited, so the affine transformation is applied afterward to break these properties. The combination gives a S-box with no fixed points, no opposite fixed points, and high non-linearity.
What is the affine transformation in the S-box?
It is a matrix multiplication over GF(2) (each bit of the output is a XOR of selected input bits) followed by XOR with the constant 0x63. The 8x8 bit matrix is circulant with the pattern 11110001. This transformation is linear over GF(2), so it does not add non-linearity, but it breaks the algebraic structure of the inversion and removes fixed points. The constant 0x63 was chosen to ensure the S-box has no fixed points (no byte maps to itself) and no opposite fixed points (no byte maps to its bitwise complement).
What is the difference between ShiftRows and MixColumns?
ShiftRows is a byte permutation: it moves bytes between columns by cyclically shifting each row. It provides inter-column diffusion. MixColumns is a linear transformation within each column: it mixes the 4 bytes of a column using GF(2^8) matrix multiplication. It provides intra-column diffusion. Together, they ensure that after two rounds, every output byte depends on every input byte. ShiftRows alone would only move bytes, and MixColumns alone would only mix within columns. The combination creates full diffusion.
Why is the MixColumns matrix [02, 03, 01, 01]?
This matrix corresponds to multiplication by the polynomial 3x^3 + x^2 + x + 2 modulo x^4 + 1. The coefficients (2, 3, 1, 1) were chosen to be small (for efficiency in software), to have a branch number of 5 (the maximum for a 4x4 matrix, meaning each output byte depends on all 4 input bytes), and to be invertible (the inverse matrix uses 0x0E, 0x0B, 0x0D, 0x09). The branch number of 5 means that a change in one input byte affects all four output bytes, which is optimal for diffusion.
How does this tool relate to the full AES encryption?
This tool shows the S-box construction and P-box arithmetic in isolation. The AES Encrypt / Decrypt tool shows the full AES with SubBytes (applying the S-box to all 16 bytes), ShiftRows, MixColumns, and AddRoundKey across all rounds. Use this tool to understand the mathematical details of each component, then use the AES tool to see how they combine in the full cipher.
Conclusion
The AES S-box and P-box are the mathematical heart of AES: the S-box provides non-linearity through GF(2^8) inversion and an affine transformation, while ShiftRows and MixColumns provide diffusion through byte permutation and matrix multiplication. This tool shows the construction step by step with full arithmetic. For the complete AES round visualization, see the AES Encrypt / Decrypt tool. For the Feistel cipher structure used by DES and Blowfish (which also uses S-boxes), see the Feistel Network Visualizer. For hardware-accelerated AES-GCM, see the Block Cipher tool.