GF256AES (Bouncy Castle Library 1.85 API Specification)
Date: 2026-07-12

org.bouncycastle.math.raw

## Class GF256AES

- java.lang.Object
- - org.bouncycastle.math.raw.GF256AES

-     public class GF256AES
      extends java.lang.Object

  Constant-time GF(2^8) primitives over the AES reduction polynomial x^8 + x^4 + x^3 + x + 1 (0x11b).

  The `AES` suffix names that specific irreducible polynomial: GF(2^8) is a single field up to isomorphism but admits many representations, and the AES choice is by far the most common (also used by SM4, GHASH's sibling fields, etc.). The polynomial alone pins down the arithmetic — e.g. Rainbow's GF(2^8) uses a tower basis whose products differ, so it deliberately does not share this class. Callers relying on the AES element encoding should depend on the name, not just "GF(256)".

  Shared home for the word-parallel bitsliced scalar-times-vector multiply used by the multivariate / MPC-in-the-head schemes (SDitH, UOV, ...). Companion to `GF16` for the GF(2^4) nibble field.

- - ### Method Summary

    All Methods Static Methods Concrete Methods
    Modifier and Type | Method and Description
    --- | ---
    `static int` | `inv(int a)` Constant-time GF(256) multiplicative inverse over 0x11b via the Fermat addition chain `a^254 = a^-1` (since `a^255 = 1` for nonzero `a`).
    `static int` | `mul(int a, int b)` Constant-time GF(256) scalar multiply over the AES polynomial 0x11b: returns `a * b`.
    `static long` | `mulFx8(int s, long v)` Word-parallel constant-time GF(256) scalar-times-vector multiply: returns `s * v` where `v` packs eight GF(256) elements, one per byte lane, and the result packs the eight products in the same lanes.
    `static int` | `sqr(int a)` Constant-time GF(256) squaring over 0x11b.

    - ### Methods inherited from class java.lang.Object

      `clone, equals, finalize, getClass, hashCode, notify, notifyAll, toString, wait, wait, wait`

- - ### Method Detail

    - #### mul

          public static int mul(int a,
                                int b)

      Constant-time GF(256) scalar multiply over the AES polynomial 0x11b: returns `a * b`. There is no table lookup and no data-dependent branch — safe to feed secret operands. This is the scalar companion of `mulFx8(int, long)` and is byte-identical to the per-scheme forms it replaces (UOV's mul256, SDitH's mulNaive, MQOM's gf256Mult).

    - #### sqr

          public static int sqr(int a)

      Constant-time GF(256) squaring over 0x11b. Squaring is GF(2)-linear, so `a^2` is just the bit-spread of `a` (interleave a zero between each bit), reduced mod 0x11b.

    - #### inv

          public static int inv(int a)

      Constant-time GF(256) multiplicative inverse over 0x11b via the Fermat addition chain `a^254 = a^-1` (since `a^255 = 1` for nonzero `a`). The chain maps `0 -> 0`, so no data-dependent zero check is needed and none is done: branching on zero-ness would leak whether a (secret-derived) value was singular. No table is used. The seven squarings go through the dedicated `sqr(int)`; the four genuine products through `mul(int, int)`.

    - #### mulFx8

          public static long mulFx8(int s,
                                    long v)

      Word-parallel constant-time GF(256) scalar-times-vector multiply: returns `s * v` where `v` packs eight GF(256) elements, one per byte lane, and the result packs the eight products in the same lanes.

      Algorithm: `s*v = XOR_k s_k (x^k . v)` over the 8 bits `s_k` of the scalar, where `x^k . v` is `k`-fold GF(256) doubling (xtime) of every lane. xtime is the branchless SWAR step `((v<<1) & 0xFE..) ^ ((v>>>7 & 0x01..) * 0x1b)`, and each scalar bit selects via the mask `-(s_k)` (0 or -1). No table and no data-dependent branch, so it is safe to feed secret scalars (the operand of a secret-share multiply-accumulate).