SubBytes & The S-box

SubBytes replaces each byte with its mapping in a fixed 256-entry lookup table — the S-box.

The S-box is the only NONLINEAR step in AES — its job is to thwart linear cryptanalysis (which would otherwise let attackers solve AES like a system of linear equations).

How is the S-box constructed? Each byte b is replaced with:

SBOX[b] = affine_transform(inverse_in_GF(b))   (with 0 mapping to 0)

The inverse in GF(2^8) is what makes it nonlinear. The affine transform spreads bits.

In practice you don't compute it — you store the 256-byte precomputed table:

SBOX = [0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, ...]

For decryption, the inverse table:

INV_SBOX = [0x52, 0x09, 0x6a, ...]

InvSubBytes uses INV_SBOX. Same structure, opposite mapping.