// AES S-box as the 113-gate straight-line program of Boyar and Peralta, translated gate for gate.
//
// Source: the netlist file SLP_AES_113.txt of https://www.cs.yale.edu/homes/peralta/CircuitStuff/
// (fetched 2026-10-30, sha256 de1d21c8...b55c0; 113 gates: 32 AND, 77 XOR, 4 XNOR; depth 27, computed from the
// file). The technique: J. Boyar and R. Peralta, "A new combinational logic minimization technique with
// applications to cryptology", SEA 2010 (LNCS 6049); its journal version: J. Boyar, P. Matthews and
// R. Peralta, "Logic minimization techniques with applications to cryptology", J. Cryptology 26(2), 2013.
// Which of these first printed the 113-gate figure is recalled, not checked.
//
// Translation (tests/aes_sbox/validate/validate.py checks it gate for gate against the fetched file): the file's
// input U<i> is x[7-i] and its output S<i> is y[7-i] (U0 and S0 are the most significant bits, as in FIPS 197
// bit order); "+" is ^, "x" is &, "#" (XNOR) is written a ^ b ^ 1'b1; every name is kept. All 256 inputs
// agree with FIPS 197 Table 4 (validate.py, and Verilator in tests/aes_sbox/validate/).
module aes_sbox (input logic [7:0] x, output logic [7:0] y);
  logic y4, tc5, tc12, tc20, tc26, t37, t27, t4, y10, t23, tc1, y5, t40, z8, t5, t25, z10, t3, y9, t30, y11, t15, y8, t0, tc18, t28, t1, t9, tc7, z17, y3, t45, y6, z5, y18, tc10, t43, t26, t41, t31, z12, t29, t36, z13, tc17, tc13, y15, z7, t13, t44, tc16, y17, z2, z16, t12, t11, z9, y14, y2, z6, tc21, t17, t6, t34, t35, y16, z3, t33, y20, t2, y13, t8, z0, t42, tc2, tc9, tc3, t24, t18, t21, z1, t10, tc11, z4, t7, t32, t39, y12, y21, tc8, t20, y7, t22, z11, z14, t19, t38, y1, y19, z15, tc14, t14, tc6, tc4, t16;
  assign y14 = x[4] ^ x[2];
  assign y13 = x[7] ^ x[1];
  assign y9 = x[7] ^ x[4];
  assign y8 = x[7] ^ x[2];
  assign t0 = x[6] ^ x[5];
  assign y1 = t0 ^ x[0];
  assign y4 = y1 ^ x[4];
  assign y12 = y13 ^ y14;
  assign y2 = y1 ^ x[7];
  assign y5 = y1 ^ x[1];
  assign y3 = y5 ^ y8;
  assign t1 = x[3] ^ y12;
  assign y15 = t1 ^ x[2];
  assign y20 = t1 ^ x[6];
  assign y6 = y15 ^ x[0];
  assign y10 = y15 ^ t0;
  assign y11 = y20 ^ y9;
  assign y7 = x[0] ^ y11;
  assign y17 = y10 ^ y11;
  assign y19 = y10 ^ y8;
  assign y16 = t0 ^ y11;
  assign y21 = y13 ^ y16;
  assign y18 = x[7] ^ y16;
  assign t2 = y12 & y15;
  assign t3 = y3 & y6;
  assign t4 = t3 ^ t2;
  assign t5 = y4 & x[0];
  assign t6 = t5 ^ t2;
  assign t7 = y13 & y16;
  assign t8 = y5 & y1;
  assign t9 = t8 ^ t7;
  assign t10 = y2 & y7;
  assign t11 = t10 ^ t7;
  assign t12 = y9 & y11;
  assign t13 = y14 & y17;
  assign t14 = t13 ^ t12;
  assign t15 = y8 & y10;
  assign t16 = t15 ^ t12;
  assign t17 = t4 ^ y20;
  assign t18 = t6 ^ t16;
  assign t19 = t9 ^ t14;
  assign t20 = t11 ^ t16;
  assign t21 = t17 ^ t14;
  assign t22 = t18 ^ y19;
  assign t23 = t19 ^ y21;
  assign t24 = t20 ^ y18;
  assign t25 = t21 ^ t22;
  assign t26 = t21 & t23;
  assign t27 = t24 ^ t26;
  assign t28 = t25 & t27;
  assign t29 = t28 ^ t22;
  assign t30 = t23 ^ t24;
  assign t31 = t22 ^ t26;
  assign t32 = t31 & t30;
  assign t33 = t32 ^ t24;
  assign t34 = t23 ^ t33;
  assign t35 = t27 ^ t33;
  assign t36 = t24 & t35;
  assign t37 = t36 ^ t34;
  assign t38 = t27 ^ t36;
  assign t39 = t29 & t38;
  assign t40 = t25 ^ t39;
  assign t41 = t40 ^ t37;
  assign t42 = t29 ^ t33;
  assign t43 = t29 ^ t40;
  assign t44 = t33 ^ t37;
  assign t45 = t42 ^ t41;
  assign z0 = t44 & y15;
  assign z1 = t37 & y6;
  assign z2 = t33 & x[0];
  assign z3 = t43 & y16;
  assign z4 = t40 & y1;
  assign z5 = t29 & y7;
  assign z6 = t42 & y11;
  assign z7 = t45 & y17;
  assign z8 = t41 & y10;
  assign z9 = t44 & y12;
  assign z10 = t37 & y3;
  assign z11 = t33 & y4;
  assign z12 = t43 & y13;
  assign z13 = t40 & y5;
  assign z14 = t29 & y2;
  assign z15 = t42 & y9;
  assign z16 = t45 & y14;
  assign z17 = t41 & y8;
  assign tc1 = z15 ^ z16;
  assign tc2 = z10 ^ tc1;
  assign tc3 = z9 ^ tc2;
  assign tc4 = z0 ^ z2;
  assign tc5 = z1 ^ z0;
  assign tc6 = z3 ^ z4;
  assign tc7 = z12 ^ tc4;
  assign tc8 = z7 ^ tc6;
  assign tc9 = z8 ^ tc7;
  assign tc10 = tc8 ^ tc9;
  assign tc11 = tc6 ^ tc5;
  assign tc12 = z3 ^ z5;
  assign tc13 = z13 ^ tc1;
  assign tc14 = tc4 ^ tc12;
  assign y[4] = tc3 ^ tc11;
  assign tc16 = z6 ^ tc8;
  assign tc17 = z14 ^ tc10;
  assign tc18 = tc13 ^ tc14;
  assign y[0] = z12 ^ tc18 ^ 1'b1;
  assign tc20 = z15 ^ tc16;
  assign tc21 = tc2 ^ z11;
  assign y[7] = tc3 ^ tc16;
  assign y[1] = tc10 ^ tc18 ^ 1'b1;
  assign y[3] = tc14 ^ y[4];
  assign y[6] = y[4] ^ tc16 ^ 1'b1;
  assign tc26 = tc17 ^ tc20;
  assign y[5] = tc26 ^ z17 ^ 1'b1;
  assign y[2] = tc21 ^ tc17;
endmodule