Simplified AES S-box multiplication - calculation error I have a problem to calculate the S-box in S-AES. The affine transformation is defined:



I read that it is a normal matrix multiplication. I chose the bits $0101$ and built the inverse $1011$. $b_0$ is my least significant bit. So I define my inverse $b_0 = 1$, $b_1 = 1$, $b_2 = 0$, $b_3 = 1$.

Then I start to multiply with the first row:

$$(1*b_0) + (0*b_1) + (1*b_2) + (1*b_3) +(1) =\\ (1*1)+(0*1)+(0*0)+(1*1) + (1) =\\ 1+1+1 =\\ 1$$

The second row : $$(1*1)+(1*1)+(0*0)+(1*1) + (0) =\\ 1+1+1 =\\ 1$$ and that is wrong. The result is $0001$.

So where is my mistake?
Endianness strikes again! Quoting the S-AES paper


  we associate the nibble $b_0 b_1 b_2 b_3$ with the polynomial $b_0x^3+b_1x^2+b_2x+b_3$.


The nibble $0101$ maps to $b_0=0$, $b_1=1$, $b_2=0$, $b_3=1$ associated to the polynomial $x^2+1$. Its inverse modulo $x^4+x+1$ is $x^3+x+1$, associated to the nibble $1011$ that maps to$b_0=1$, $b_1=0$, $b_2=1$, $b_3=1$ rather than$b_0=1$, $b_1=1$, $b_2=0$, $b_3=1$ in the question.



Note: this comment voices puzzlement that coefficients of a polynomial are numbered differently (and in reverse order) than the corresponding powers of $x$. There are two reasons for this convention:


Technical: it is common in telecoms to both receive bits sequentially with their number initially unknown (naturally numbering them starting from 0 onward), and perform on-the-fly a Cyclic Redundancy Check by division of the polynomial associated to the message by a shorter fixed-size polynomial. Polynomial division is performed starting from the high-order coefficient of the dividend, hence the convention. Analogy: finding $d\bmod 97$ by performing Euclidean division while given integer $d$ of initially unknown magnitude as a stream of decimal digits in usual reading order.
Precedent: the block cipher DES numbered bits from left to right starting from 1 onward in inputs, output, and internal variables including S-box-index (on page marked 14 of FIPS&nbsp;46-3 the numbering of bits grows as their weight in base 2 decreases, and doing otherwise would have required shuffle of the S-boxes). Time and reason largely shifted practice towards numbering from 0 in fresh cryptographic work, but the numbering direction sticks. Modern practice is to number things according to binary weight up to some size, then the other way around (the threshold is often octet for the external form of large integers as used in RSA and ECC; in FIPS&nbsp;180 it is 32-bit in SHA-256, 64-bit in SHA-512, with an exception in the padding).