4

I am trying to find the inverse of a polynomial $3x^3+x^2+x+2$ over the field $GF(2^8)$ with polynomial $(x^4-1 )$

Here is what I did,

$$ \dfrac{(x^4-1)}{3x^3+x^2+x+2}$$

$$ (x^4-1) = (171x+199)(3x^3+x^2+x+2)+ (142x^2+227x+115)$$ $$ \dfrac{(3x^3+x^2+x+2)}{(142x^2+227x+115)}$$

But I can not divide further because 142 does not provide me odd multiples to cancel $3x^3$. Can I use fractional number to get rid this? I tried fractional number too, but they made its too much complicated.

How can I do this? Or I am following a wrong approach?

Raoul722
  • 3,003
  • 3
  • 23
  • 42
Sajid Khan
  • 51
  • 1
  • 5

3 Answers3

5

I think the root of the misunderstanding is that there are two completely disjoint notions of polynomials at work here.

First there is the finite field $\mathbb{F}_{2^8}$. It's the field where coefficients like "3" live. Following the AES notations, you represent these elements as integers, but they really are finite field elements. The definition of the finite field usually involves polynomials (of degree less than 8 and with coefficients in $\mathbb{F}_2$) but that's best viewed as a matter internal to that field.

Then the question you are trying to solve is about polynomials whose coefficients are themselves elements of $\mathbb{F}_{2^8}$. These polynomials are not at all the same polynomials as the ones used internally by $\mathbb{F}_{2^8}$.

Apparently you are trying to do computations with the coefficients (the ones in $\mathbb{F}_{2^8}$ as if they were integers, so your numbers are off. Let's see things in details:

You want to divide $x^4-1$ by $3x^3+x^2+x+2$. Not that in $\mathbb{F}_{2^8}$, addition really is XOR, so subtraction is the same as addition; thus, $x^4-1$ is also $x^4+1$. But anyway, in the course of the division, you want to "cancel out" the top coefficient of $x^4-1$ with a multiple of $3x^3+x^2+x+2$. In $\mathbb{F}_{2^8}$, $3\times246 = 1$, so you can write:

$$x^4 - 1 = 246x(3x^3+x^2+x+2) - 246x^3 - 246x^2 - 247x - 1$$

Next step is to cancel out this spurious $-246x^3$. Again, take care that this "$-246$" is not an integer; it is a field element in $\mathbb{F}_{2^8}$. Also, since (again) addition is XOR in that field, we can remove the minus sign (in binary fields $\mathbb{F}_{2^m}$, $z = -z$ for all elements $z$). Acknowledging that additions and subtractions are the same thing in a binary field, we can write this:

$$x^4 + 1 = 246x(3x^3+x^2+x+2) + 246x^3 + 246x^2 + 247x + 1$$

In the field, $246 = 82\times 3$ (yeah, for once, this matches integer multiplication, but it is fortuitous). So we can write this:

$$x^4 + 1 = (246x + 82)(3x^3 + x^2 + x + 2) + 164x^2 + 165x + 165$$

So the first "long division" in the Extended Euclidean Algorithm yields a quotient of $246x+82$, and the remainder is $164x^2+165x+165$.

Next step in the Extended Euclidean Algorithm will be to divide $3x^3+x^2+x+2$ by $164x^2+165x+165$. And that one will begin by dividing $3$ by $164$ in the field $\mathbb{F}_{2^8}$. The result of that division is $138$; that is, in the finite field: $3 = 164\times 138$. Computing out the division, we get:

$$ 3x^3 + x^2 + x + 2 = (138x + 79)(164x^2 + 165x + 165) + 79x + 168 $$

I am too lazy to finish it by hand. The crucial point to understand is that all computations on coefficients are in $\mathbb{F}_{2^8}$, which is a finite field with its own rules, which are not the same rules as integers, even though they are represented as integers. In particular, there should be no notion of "odd integer".

Here is a piece of C code that implements computations in $\mathbb{F}_{2^8}$:

static unsigned
add(unsigned x, unsigned y)
{
        return x ^ y;
}

static unsigned
mul(unsigned x, unsigned y)
{
        unsigned z;
        int i;

        z = 0;
        for (i = 0; i < 8; i ++) {
                z ^= x & -(y & 1);
                y >>= 1;
                x <<= 1;
                x ^= (0x11B & -(x >> 8));
        }
        return z;
}

static unsigned
invert(unsigned x)
{
        unsigned z;
        int i;

        z = x;
        for (i = 0; i < 6; i ++) {
                z = mul(z, z);
                z = mul(z, x);
        }
        return mul(z, z);
}

static unsigned
divide(unsigned x, unsigned y)
{
        return mul(x, invert(y));
}

In this code, every element of $\mathbb{F}_{2^8}$ is represented as an integer in the $0$ to $255$ range (0xFF is $255$). As you see, addition really is XOR (the C operator ^ is bitwise XOR). Multiplication is done bit by bit; the weird-looking code:

                x <<= 1;
                x ^= (0x11B & -(x >> 8));

is really a "left shift" of x in $\mathbb{F}_{2^8}$ (try to work out why it works, it's enlightening). Finally, inversion (invert() function) is done with exponentiation: since there are exactly $255$ invertible elements in $\mathbb{F}_{2^8}$ (all except $0$: it's a field), then the inverse of $z$ is $z^{254}$ for all elements $z\neq 0$. The invert() function computes $z^{254}$ by repeated squarings and multiplications. (Note: that invert() function will happily compute the inverse of $0$ as $0$, even though $0$ is not invertible.)

Thomas Pornin
  • 88,324
  • 16
  • 246
  • 315
2

Thomas Pornin's post was useful in helping me to get started with finding the inverse of a polynomial with coefficients in GF(2^8). I thought it may be helpful to show a complete version of his worked example, using hexadecimal instead of decimal representation for the coefficients.

I am also tremendously grateful to @corpsfini in helping me to find the inverse using the Extended Euclidean algorithm here.

Let's say you have a polynomial a(x) with coefficients that are elements of GF(2^8).

a(x) = {03}x^3 + {01}x^2 + {01}x + {02}

In AES, these coefficients are elements of the finite field GF(2^8). I am representing these in hexadecimal, but if you convert them to binary each bit is a coefficient in GF(2) of another polynomial. So you could think of a(x) as a "polynomial of polynomials".

{03} = {00000011} = x + 1
{01} = {00000001} = 1
{01} = {00000001} = 1
{01} = {00000010} = x

We also have a polynomial modulus of x^4 + 1. You could write this polynomial as having the following coefficients:

p(x) = {01}x^4 + {01}

We can find the inverse of {03}x^3 + {01}x^2 + {01}x + {02} mod {01}x^4 + {01} using the Extended Euclidean Algorithm.

Euclidean Algorithm

First of all, we use the division algorithm to find the gcd(a(x), p(x)).

In these steps I will be using long division for polynomials. The coefficients for these polynomials are elements of GF(2^8), so we are not using typical integer arithmetic but Polynomial Arithmetic,

Step 0:
                                   {f6}x   + {52}
                                 --------------------------------------------
{03}x^3 + {01}x^2 + {01}x + {02} | {01}x^4 + {00}x^3 + {00}x^2 + {00}x + {01}
                                   {01}x^4 + {f6}x^3 + {f6}x^2 + {f7}x
                                   ------------------------------------------
                                             {f6}x^3 + {f6}x^2 + {f7}x + {01}
                                             {f6}x^3 + {52}x^2 + {52}x + {a4}
                                             --------------------------------
                                                       {a4}x^2 + {a5}x + {a5}

For example, to find how many times {03} "goes in to" {01}, you need to find the multiplicative inverse of x + 1 mod x^8 + x^4 + x^3 + x + 1, which works out to be {f6}. As you may notice, you also use the Extended Euclidean algorithm for finding multiplicative inverses of polynomials, although it will be somewhat simpler than this current example as the coefficients for these polynomials are in GF(2).

Subtraction of the two polynomials is the same as adding each of the coefficients (addition in GF(2)). This is the same as XORing each of the coefficients.

On to the next step of the Euclidean algorithm.

Step 1:
                         {8a}x   + {4f}
                       ----------------------------------
{a4}x^2 + {a5}x + {a5} | {03}x^3 + {01}x^2 + {01}x + {02}
                         {03}x^3 + {89}x^2 + {89}x        
                         --------------------------------
                                   {88}x^2 + {88}x + {02}         
                                   {88}x^2 + {c7}x + {c7}
                                   ----------------------
                                             {4f}x + {c5}

Similarly, to find how many times {a4} "goes in to" {03}, you start by finding the inverse of {a4}, which is {8f}. If we multiply {8f} by {03} we get {8a}, therefore {8a} * {a4} = {03}.

From here I'll continue with the rest of the division algorithm until we end up with a remainder of {00}.

Step 2:

               {f3}x   + {ca}  
             ------------------------
{4f}x + {c5} | {a4}x^2 + {a5}x + {a5}
               {a4}x^2 + {bf}x         
               ----------------------
                         {1a}x + {a5}                  
                         {1a}x + {3f}          
                         ------------
                                 {9a}       

Step 3:

       {a8}x + {9a}       
     --------------
{9a} | {4f}x + {c5}
       {4f}x                
       ------------
               {c5}                      
               {c5}              
               ----
               {00}

So now we know that gcd(a(x), p(x)) = {9a}, which was the last non-zero remainder after repeatedly using the division algorithm for these two polynomials.

You might think that {03}x^3 + {01}x^2 + {01}x + {02} does not have an inverse mod {01}x^4 + {01} as the gcd worked out to be {9a} (and not {01}). However, this {9a} can be converted to {01} by multiplying it by its inverse, which we will see in a moment.

Extended Euclidean Algorithm

From the Euclidean algorithm above we found that:

gcd(a(x), p(x)) = {9a}

Now that we know the gcd, the extended Euclidean algorithm allows us to find the polynomials s(x) and t(x) that satisfy:

s(x)a(x) + t(x)p(x) = {9a}

If we write this equation as a congruence mod p(x) we have:

s(x)a(x) = {9a} mod p(x)

The auxiliary calculation to find s(x) is as follows:

si = si-2 - (si-1 * qi-2)

s0 = {00}

s1 = {01}

s2 = {00} - ({01})*({f6}x + {52})
   = {00} - {f6}x - {52}
   = {f6}x + {52}

s3 = {01} - ({f6}x + {52})*({8a}x + {4f})
   = {01} - ({8f}x^2 + {cc}x + {8c}x + {44})
   = {8f}x^2 + {40}x + {45}

s4 = ({f6}x + {52}) - ({8f}x^2 + {40}x + {45})*({f3}x + {ca})
   = ({f6}x + {52}) - ({09}x^3 + {ea}x^2 + {92}x^2 + {50}x + {80}x + {9f})
   = {09}x^3 + {78}x^2 + {26}x + {cd}

Therefore we can now say that:

({09}x^3 + {78}x^2 + {26}x + {cd}) * a(x) = {9a} mod p(x)

However, multiplying a(x) with this polynomial results in {9a}, so it's not quite yet the multiplicative inverse.

To get {01} on the right-hand side of the equation, we can multiply both sides by the inverse of {9a}, which is {9f}:

{9f} * ({09}x^3 + {78}x^2 + {26}x + {cd}) * a(x) = {9a} * {9f} mod p(x)

Which results in:

({0b}x^3 + {0d}x^2 + {09}x + {0e}) * a(x) = {01} mod p(x)

So now we have found that {0b}x^3 + {0d}x^2 + {09}x + {0e} is the inverse of {03}x^3 + {01}x^2 + {01}x + {02} mod {01}x^4 + {01}.

inersha
  • 63
  • 1
  • 10
0

You are trying to find an inverse for an element, that's not in the $GF(2^8)$ field. Polynomials in this field do have coefficients in $\in \{0,1\}$. I don't know, where your polynomial is coming from, but I think you should first map the polynomial into the field by doing $\mod 2$ on every coefficient: $x^3 + x^2 + x$

Patrick K
  • 171
  • 6