AES key schedule

Template:Short description The Advanced Encryption Standard uses a key schedule to expand a short key into a number of separate round keys. The three AES variants have a different number of rounds. Each variant requires a separate 128-bit round key for each round plus one more. The key schedule produces the needed round keys from the initial key.

Round constants

Values of Template:Mvar in hexadecimal

Template:Mvar	1	2	3	4	5	6	7	8	9	10
Template:Mvar	01	02	04	08	10	20	40	80	1B	36

The round constant Template:Mvar for round Template:Mvar of the key expansion is the 32-bit word:Template:Refn

$rco{n}_i=\left[\begin{array}{cccc}r{c}_i& 00_8& 00_8& 00_8\end{array}\right]$

where Template:Mvar is an eight-bit value defined as :

$r{c}_i=\{\begin{array}{ll}1& \text{if }i=1\\ 2\cdot r{c}_{i-1}& \text{if }i>1\text{ and }r{c}_{i-1}<80_{16}\\ (((2\cdot r{c}_{i-1})\oplus {\text{11B}}_{16})\text{ mod }{\text{100}}_{16})& \text{if }i>1\text{ and }r{c}_{i-1}\ge 80_{16}\end{array}$

where $\oplus$ is the bitwise XOR operator and constants such as 00₁₆ and 11B₁₆ are given in hexadecimal. Equivalently:

$r{c}_i=x^{i-1}$

where the bits of Template:Mvar are treated as the coefficients of an element of the finite field $\mathrm{G}\mathrm{F}\mathrm{(}\mathrm{2}\mathrm{)}\mathrm{[}\mathrm{x}\mathrm{]}/\mathrm{(}{\mathrm{x}}^{\mathrm{8}}\mathrm{+}{\mathrm{x}}^{\mathrm{4}}\mathrm{+}{\mathrm{x}}^{\mathrm{3}}\mathrm{+}\mathrm{x}\mathrm{+}\mathrm{1}\mathrm{)}$, so that e.g. $r{c}_{10}=36_{16}=00110110_2$ represents the polynomial $x^5+x^4+x^2+x$.

AES uses up to rcon₁₀ for AES-128 (as 11 round keys are needed), up to rcon₈ for AES-192, and up to rcon₇ for AES-256.

The key schedule

File:AES-Key Schedule 128-bit key.svg

AES key schedule for a 128-bit key.

Define:

• Template:Mvar as the length of the key in 32-bit words: 4 words for AES-128, 6 words for AES-192, and 8 words for AES-256
• K₀, K₁, ... K_N-1 as the 32-bit words of the original key
• Template:Mvar as the number of round keys needed: 11 round keys for AES-128, 13 keys for AES-192, and 15 keys for AES-256
• W₀, W₁, ... W_4R-1 as the 32-bit words of the expanded key

Also define RotWord as a one-byte left circular shift:Template:Refn

$\mathrm{RotWord}(\left[\begin{array}{cccc}{b}_0& b_1& b_2& b_3\end{array}\right])=\left[\begin{array}{cccc}{b}_1& b_2& b_3& b_0\end{array}\right]$

and SubWord as an application of the AES S-box to each of the four bytes of the word:

$\mathrm{SubWord}(\left[\begin{array}{cccc}{b}_0& b_1& b_2& b_3\end{array}\right])=\left[\begin{array}{cccc}\mathrm{S}(b_0)& \mathrm{S}(b_1)& \mathrm{S}(b_2)& \mathrm{S}(b_3)\end{array}\right]$

Then for $i=0\dots 4R-1$:

$W_i=\{\begin{array}{ll}{K}_i& \text{if }i<N\\ W_{i-N}\oplus \mathrm{SubWord}(\mathrm{RotWord}(W_{i-1}))\oplus rco{n}_{i/N}& \text{if }i\ge N\text{ and }i\equiv 0(\mathrm{mod}N)\\ W_{i-N}\oplus \mathrm{SubWord}(W_{i-1})& \text{if }i\ge N\text{, }N>6\text{, and }i\equiv 4(\mathrm{mod}N)\\ W_{i-N}\oplus W_{i-1}& \text{otherwise.}\\ \end{array}$

References

• FIPS PUB 197: the official AES standard (PDF file)

External links

• Description of Rijndael's key schedule
• schematic view of the key schedule for 128 and 256 bit keys for 160-bit keys on Cryptography Stack Exchange