In our hardware security exercise, I am trying to calculate the ANF function manually (Sboxes) for the given table:
And I came up with the result as:
I thought I was calculating it correctly using the XOR function but then dont remember when did our professor applied the AND function for it. So right now I am not even sure if I am doing it correctly. Anyone care to explain when to use the xor function and when to use the AND function in the table?

