Reference construction uses two BearSSL AES Boolean circuits separated by invertible affine maps. The target is a newly generated fixed function, not the AES substitution table. This is a circuit-synthesis instance and makes no claim of cryptographic security.

BearSSL source: https://www.bearssl.org/gitweb/?p=BearSSL;a=blob_plain;f=src/symcipher/aes_ct.c;hb=HEAD
Downloaded 2026-10-15. Copyright Thomas Pornin, MIT license, notice included. The construction script and exact affine maps are reference-side material only.

The reference contains 64 AND gates and 316 total gates. This is a witnessed feasible bound, not a claim of global minimality.
