An interesting Link shows that the CLEFIA S-box and the Rijndael (AES) S-box are affine equivalentâmeaning one can be transformed into the other through invertible affine transformations over the finite field $\mathbb{F}_2^{8}$.
Formally, two functions ( f ) and ( g ) are affine equivalent if there exist invertible affine mappings ( A ), ( B ), and constants ( a ), ( b ) such that:
$$
f(x) = (B \circ g \circ A)(x \oplus a) \oplus b
$$
Pairwise independence may look like a simple probability idea, but it plays an important role in proving the security of block ciphers such as AES.
1. Pairwise Independence and Ideal Permutations
Two random variables are independent if knowing one does not give information about the other. A set of random variables is pairwise independent if every pair is independent, though this does not mean full independence across all of them.
A few years ago, I explored one of my favorite cryptographic building blocks: the substitution box (S-box). Back then, I came across the elegant paper A Very Compact Rijndael S-box, which showed how to eliminate lookup tables by leveraging normal basis representation and logical operations in $F_{2^{8}}$. That approach deeply resonated with meâcompact, efficient, and mathematically sound.
Recently, I decided to revisit that workâbut this time with a new challenge: re-implementing the CLEFIA S-box using the same principles. CLEFIA, Sonyâs lightweight block cipher, uses two $8 \times 8$ S-boxes ($S_0$ and $S_1$), and I focused on reconstructing Sâ using field inversion and affine transformationsâall without tables.