4. Information: Composite fields are among the most efficient ways to implement the S-box in hardware (LUTs are good on FPGAs but composite fields are more area-efficient on ASICs). As you know, inversion in finite field GF(28) is costly. Thus, it is preferred to perform transformation from binary field to tower fields in composite fields and after computing the inverse, go back to binary fields. Inversion in GF(28) can be done using a couple of multiplications (below, you need to do a simple one), a squaring, and one inversion in composite field denoted as GF(24). This is the base for composite fields: To transform, do the arithmetic less-costly there, and go back to binary field. You only need to do this simple calculation: Show that for inputs a(x)=a3x3+a2x2+a1x+ao and b(x)=b3x+b2x2+b1x+bo and the multiplication result g(x)=93x+q2x2+91x+qo in GF(24) with the irreducible polynomial p(x)=x++x+1, we get the following for a(x).b(x) mod p(x). Subexpression sharing has been done to reduce the complexity as you see. Remember that you do not need to know details of composite fields for this calculation. 9(x) = a(c) b(x) = a(x) .b() mod P(x), a(x), 6(x), 9(2) GF(24) aA = ao a3, B = 22 23 qo = aobo a3b1a2b2 163 91 = a;bo a Abi abb2 e (a1a2)63 42 = 22bo abi a 4b2a3b3 43 = a3bo a2b1 a1b2 a 4b3. 4. Information: Composite fields are among the most efficient ways to implement the S-box in hardware (LUTs are good on FPGAs but composite fields are more area-efficient on ASICs). As you know, inversion in finite field GF(28) is costly. Thus, it is preferred to perform transformation from binary field to tower fields in composite fields and after computing the inverse, go back to binary fields. Inversion in GF(28) can be done using a couple of multiplications (below, you need to do a simple one), a squaring, and one inversion in composite field denoted as GF(24). This is the base for composite fields: To transform, do the arithmetic less-costly there, and go back to binary field. You only need to do this simple calculation: Show that for inputs a(x)=a3x3+a2x2+a1x+ao and b(x)=b3x+b2x2+b1x+bo and the multiplication result g(x)=93x+q2x2+91x+qo in GF(24) with the irreducible polynomial p(x)=x++x+1, we get the following for a(x).b(x) mod p(x). Subexpression sharing has been done to reduce the complexity as you see. Remember that you do not need to know details of composite fields for this calculation. 9(x) = a(c) b(x) = a(x) .b() mod P(x), a(x), 6(x), 9(2) GF(24) aA = ao a3, B = 22 23 qo = aobo a3b1a2b2 163 91 = a;bo a Abi abb2 e (a1a2)63 42 = 22bo abi a 4b2a3b3 43 = a3bo a2b1 a1b2 a 4b3