1. Secret Key Systems (block encoding)
Encrypting a small block of text (say 64 bits)
General Considerations:

2. Secret Key Systems Encrypting a small block of text (say 64 bits)
General Considerations:
● Encrypted data should look random.
As though someone flipped a fair coin 64 times and heads
means 1 and tails 0.
Any change in one bit of output corresponds to a huge
change in the input (bits are uncorrelated).
Should be about as many 1's as 0's usually.

3. Secret Key Systems Encrypting a small block of text (say 64 bits)
General Considerations:
● Encrypted data should look random.
As though someone flipped a fair coin 64 times and heads
means 1 and tails 0.
Any change in one bit of output corresponds to a huge
change in the input (bits are uncorrelated).
Should be about as many 1's as 0's usually.
● Try to spread the influence of each input bit to all output bits
and change in one input bit should have 50% chance of
changing any of the output bits (hence many rounds).

4. Secret Key Systems Encrypting a small block of text (say 64 bits)
General Considerations:
● Encrypted data should look random.
As though someone flipped a fair coin 64 times and heads
means 1 and tails 0.
Any change in one bit of output corresponds to a huge
change in the input (bits are uncorrelated).
Should be about as many 1's as 0's usually.
● Try to spread the influence of each input bit to all output bits
and change in one input bit should have 50% chance of
changing any of the output bits (hence many rounds).
● Operations should be invertable – hence xor and table lookup.
Use of one key for both encryption and decryption.

5. Secret Key Systems Encrypting a small block of text (say 64 bits)
General Considerations:
● Encrypted data should look random.
As though someone flipped a fair coin 64 times and heads
means 1 and tails 0.
Any change in one bit of output corresponds to a huge
change in the input (bits are uncorrelated).
Should be about as many 1's as 0's usually.
● Try to spread the influence of each input bit to all output bits
and change in one input bit should have 50% chance of
changing any of the output bits (hence many rounds).
● Operations should be invertable – hence xor and table lookup.
Use of one key for both encryption and decryption.
● Attacks may be mitigated if they rely on operations that are
not efficiently implemented in hardware yet allow normal
operation to complete efficiently, even in software (permute).

6. Secret Key Systems - DES
IBM/NSA bit blocks, 56 bit key, 8 bits parity
64 bit input block
32 bit Li
32 bit Ri
Mangler
Function Ki
Encryption
Round ⊕
32 bit Li+1
32 bit Ri+1
64 bit output block

7. Secret Key Systems - DES
IBM/NSA bit blocks, 56 bit key, 8 bits parity
64 bit input block
64 bit output block
32 bit Li
32 bit Ri
32 bit Li
32 bit Ri
Mangler
Function Kn
Mangler
Function Kn
Decryption
Round
Encryption
Round ⊕ ⊕
32 bit Li+1
32 bit Ri+1
32 bit Li+1
32 bit Ri+1
64 bit output block
64 bit input block

8. Secret Key Systems - DES
Generating per round keys K1 K2 ... K16 from the 56 bit Key + 8 parity bits
Key bits:
1...8
9...16

9. Secret Key Systems - DES
Generating per round keys K1 K2 ... K16 from the 56 bit Key + 8 parity bits
Key bits:
C0:
1...8
9...16
D0:

10. Secret Key Systems - DES
Generating per round keys K1 K2 ... K16 from the 56 bit Key + 8 parity bits
Key bits:
C0:
1...8
9...16
D0:
Each round: Ki has 48 bits assembled in 2 halves permuted from 24 bits each of
Ci and Di, Ki+1 is obtained by rotating Ci and Di left to form Ci+1 and Di+1
(rotation is 1 bit for rounds 1,2,9,16 and 2 bits for other rounds)

11. Secret Key Systems - DES
Generating per round keys K1 K2 ... K16 from the 56 bit Key + 8 parity bits
Key bits:
C0:
1...8
9...16
D0:
Each round: Ki has 48 bits assembled in 2 halves permuted from 24 bits each of
Ci and Di, Ki+1 is obtained by rotating Ci and Di left to form Ci+1 and Di+1
(rotation is 1 bit for rounds 1,2,9,16 and 2 bits for other rounds)
Permutations:
Left half Ci: (9,18,22,25 are missing)
Right half Di: (35,38,43,54 are missing)

12. Secret Key Systems - DES
The Mangler function: mixes 32 bit input with 48 bit key to produce 32 bits
32 bit Ri
Mangler
Function Ki ⊕
32 bit Ri+1

13. Secret Key Systems - DES
The Mangler function: mixes 32 bit input with 48 bit key to produce 32 bits
32 bit Ri
1. Expansion of input bits:
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
Mangler
Function Ki ⊕
32 bit Ri+1

14. Secret Key Systems - DES
The Mangler function: mixes 32 bit input with 48 bit key to produce 32 bits
32 bit Ri
1. Expansion of input bits:
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
Mangler
Function Ki
Ri (32 bits)
...
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits ⊕
32 bit Ri+1

15. Secret Key Systems - DES
The Mangler function: mixes 32 bit input with 48 bit key to produce 32 bits
32 bit Ri
1. Expansion of input bits:
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
Mangler
Function Ki
Ri (32 bits)
...
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits ⊕
Expanded input (48 bits)
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
32 bit Ri+1
Ki (48 bits)

16. Secret Key Systems - DES
The Mangler function: mixes 32 bit input with 48 bit key to produce 32 bits
32 bit Ri
1. Expansion of input bits:
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
Mangler
Function Ki
Ri (32 bits)
...
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits ⊕
Expanded input (48 bits)
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
32 bit Ri+1
Ki (48 bits) ⊕
2. Mixing with key:
6 bits
...
S Boxi
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits

17. Secret Key Systems - DES
The Mangler function: mixes 32 bit input with 48 bit key to produce 32 bits
32 bit Ri
1. Expansion of input bits:
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
Mangler
Function Ki
Ri (32 bits)
...
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits ⊕
Expanded input (48 bits)
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
6 bits
32 bit Ri+1
Ki (48 bits) ⊕
2. Mixing with key:
6 bits
...
S Boxi
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
4 bits
Ri+1 (32 bits)

18. Secret Key Systems - DES
The S Box: maps 6 bit blocks to 4 bit sections
S Box1 (first 6 bits):
Input bits 2,3,4,5
Input bits 1 and 6
Final permutation:

19. Secret Key Systems - DES
Weak and semi-weak keys:
If key is such that C0 or D0 are:
1) all 0s;
2) all 1s;
3) alternating 1s and 0s,
then attack is easy. There are 16 such keys. Keys for which
C0 and D0 are both 0 or both 1 are called weak (encrypting
with key gives same result as decrypting).

20. Secret Key Systems - DES
Weak and semi-weak keys:
If key is such that C0 or D0 are:
1) all 0s;
2) all 1s;
3) alternating 1s and 0s,
then attack is easy. There are 16 such keys. Keys for which
C0 and D0 are both 0 or both 1 are called weak (encrypting
with key gives same result as decrypting).
Discussion:
1. Not much known about the design – not made public
Probably attempt to prevent known attacks
2. Changing S-Boxes has resulted in provably weaker system

21. Secret Key Systems - 3DES
Two keys K1 and K2:
K1 K2 K1
m E D E c
K1 K2 K1
c D E D m
encryption
decryption

22. Secret Key Systems - 3DES
Two keys K1 and K2:
K1 K2 K1
m E D E c
K1 K2 K1
c D E D m
encryption
decryption
Why not 2DES
1. Double encryption with the same key still requires searching 256 keys

23. Secret Key Systems - 3DES
Two keys K1 and K2:
K1 K2 K1
m E D E c
K1 K2 K1
c D E D m
encryption
decryption
Why not 2DES
1. Double encryption with the same key still requires searching 256 keys
2. Double encryption with two different keys is just as vulnerable as DES
due to the following, assuming some <m,c> pairs are known:

24. { Secret Key Systems - 3DES Two keys K1 and K2: K1 K2 K1 K1 K2 K1
m E D E c
K1 K2 K1
c D E D m
encryption
decryption
Why not 2DES
1. Double encryption with the same key still requires searching 256 keys
2. Double encryption with two different keys is just as vulnerable as DES
due to the following, assuming some <m,c> pairs are known:
m: K E(K1,m) {
256

25. { { Secret Key Systems - 3DES Two keys K1 and K2: K1 K2 K1 K1 K2 K1
m E D E c
K1 K2 K1
c D E D m
encryption
decryption
Why not 2DES
1. Double encryption with the same key still requires searching 256 keys
2. Double encryption with two different keys is just as vulnerable as DES
due to the following, assuming some <m,c> pairs are known:
m: K E(K1,m)
c: K D(K2,c) { {
256
256

26. { { Secret Key Systems - 3DES Two keys K1 and K2: K1 K2 K1 K1 K2 K1
m E D E c
K1 K2 K1
c D E D m
encryption
decryption
Why not 2DES
1. Double encryption with the same key still requires searching 256 keys
2. Double encryption with two different keys is just as vulnerable as DES
due to the following, assuming some <m,c> pairs are known:
m: K E(K1,m)
c: K D(K2,c) { {
256
256

27. { { Secret Key Systems - 3DES Two keys K1 and K2: K1 K2 K1 m E D E c
c D E D m
encryption
decryption
Why not 2DES
1. Double encryption with the same key still requires searching 256 keys
2. Double encryption with two different keys is just as vulnerable as DES
due to the following, assuming some <m,c> pairs are known:
m: K E(K1,m)
c: K D(K2,c)
Test matches on
other <m,c> pairs { {
256
256
m E(K1,m)
D(K2,c) c

28. Secret Key Systems - 3DES
Why not 2DES
2. Double encryption with two different keys is just as vulnerable as DES
due to the following, assuming some <m,c> pairs are known:
How many <m,c> pairs do you need?
264 possible blocks
256 table entries
each block has probability 2-8 = 1/256 of showing in a table
probability a block is in both tables is 2-16
average number of matches is 248
average number of matches for two <m,c> pairs is about 232
for three <m,c> pairs is about 216
for four <m,c> pairs is about 20
3. Triple encryption with two different keys
- 112 bits of key is considered enough
- straightforward to find a triple of keys that maps a given plaintext
to a given ciphertext (no known attack with 2 keys)
- EDE: use same keys to get DES, EEE: effect of permutations lost

29. Secret Key Systems - 3DES
CBC with 3DES: mi
mi+1 mi
mi+1 ⊕ ⊕ ⊕ ⊕ K1 E E K1 E E K2 D D K2 D D ⊕ ⊕ K1 E E K1 E E ci
ci+1 ci
ci+1
outside
inside

30. Secret Key Systems - 3DES
CBC with 3DES:
1. On the outside – same attack as with CBC – change a block with side
effect of garbling another
2. On the inside – attempt at changing a block results in all block garbled
to the end of the message.
3. On the inside – use three times as much hardware to pipeline encryptions
resulting in DES speeds.
4. On the outside – EDE simply is a drop-in replacement for what might
have been there before.

31. ⊗ ⊙ ⊙ ⊗ ⊗ ⊙ Secret Key Systems - IDEA
ETH Zuria bit blocks, 128 bit key, 0 bits parity:
64 bit input block
Odd Encryption
Round
16 bit Xi,a
16 bit Xi,b
16 bit Xi,c
16 bit Xi,d ⊗
Multiplication mod is treated as 216
(invertible)
Ki,a
Ki,a
Ki,a
Ki,a ⊗ ⊙ ⊙ ⊗ ⊙
Addition but throw away carries
16 bit Xi+1,a
16 bit Xi+1,b
16 bit Xi+1,c
16 bit Xi+1,d
64 bit output block

32. ⊗ ⊗ ⊙ ⊙ ⊙ ⊙ Secret Key Systems - IDEA
ETH Zuria bit blocks, 128 bit key, 0 bits parity:
64 bit input block
Even Encryption
Round
16 bit Xi,a
16 bit Xi,b
16 bit Xi,c
16 bit Xi,d
Yin = Xi,a ⊗ Xi,b
Zin = Xi,c ⊗ Xi,d
Yout = ((Ki,e⊗Yin)⊙Zin⊗Ki,f
Zout = (Ki,e⊗Yin)⊙Yout
Xi+1,a = Xi,a ⊙ Yout
Xi+1,b = Xi,b ⊙ Yout
Xi+1,c = Xi,c ⊙ Zout
Xi+1,d = Xi,d ⊙ Zout ⊗ ⊗
Mangler
Function ⊙ ⊙ ⊙ ⊙
Ki,e
Ki,f
16 bit Xi+1,a
16 bit Xi+1,b
16 bit Xi+1,c
16 bit Xi+1,d
64 bit output block

33. Secret Key Systems - IDEA
Key generation bit keys needed (2 per even round 4 per odd):
128 bit key
K1,a
K1,b
K1,c
K1,d
K2,e
K2,f
K3,a
K3,b

34. Secret Key Systems - IDEA
Key generation bit keys needed (2 per even round 4 per odd):
128 bit key
K1,a
K1,b
K1,c
K1,d
K2,e
K2,f
K3,a
K3,b
128 bit key
128 bit key
... 
K3,c
K3,d
K4,e
K4,f
K5,a
K5,b
K5,c
K5,d
25 bits

35. ⊕ ⊕ Secret Key Systems - AES
NIST (2001) parameterized key size (128 bits to 256 bits)
4Nb octet inp
4Nk octet key
a0,0
a0,3
k0,0
k0,3
a1,0
a1,3
k1,0
k1,3
...
...
a2,0
a2,3
k2,0
k2,3
a3,0
a3,3
k3,0
k3,3
key expansion ⊕ K0 K1
round 1
... ⊕
...

36. Secret Key Systems - AES
The State: An array of four rows and Nb columns – each element is a byte.
Initially: next block of 4Nb input bytes.
Execution: all operations are performed on the State.
Example: Nb = 4
in0
in4
in8
in12
s0,0
s0,1
s0,2
s0,3
in1
in5
in9
in13
s1,1
s1,2
s1,3
s1,0
in2
in6
in10
in14
s2,2
s2,3
s2,0
s2,1
in3
in7
in11
in15
s3,3
s3,0
s3,1
s3,2

37. Secret Key Systems - AES
Addition: modulo 2 addition (xor) of polynomials of maximum degree 7
Examples:
(x6+x4+x2+x1+1) + (x7+x1+1) = x7+x6+x4+x (polynomial)
⊕ = (binary notation)
0x57 ⊕ 0x83 = D (hexadecimal)

38. Secret Key Systems - AES
Multiplication of two degree 7 polynomials (bytes):
Just like ordinary multiplication except mod m(x) = (x8+x4+x3+x1+1)
Reason: for each byte there will be an inverse: a  a-1 = 1 mod m(x)
Basis: x  b = b7x8 + b6x7 + b5x6 + b4x5 + b3x4 + b2x3 + b1x2 + b0x
Shift b left by 1, if result has a degree 8 bit, xor with m(x)
This operation is called xtime(x) = (x << 1)  (((x >> 7) & 1) * 0x11b)
Example:
xtime(x7 + x5 + x3 + x2 + x) = x6 + x2 + x or
⊕ = or xtime(0xAE) = 0x47
(x6 + x4 + x2 + x1 + 1) ⊗ (x4 + x + 1) = 0x57 ⊗ 0x13
(x6 + x4 + x2 + x1 + 1) ⊗ x = xtime(0x57) = 0xAE
(x6 + x4 + x2 + x1 + 1) ⊗ x2 = xtime(0xAE) = 0x47
(x6 + x4 + x2 + x1 + 1) ⊗ x3 = xtime(0x47) = 0x8E
(x6 + x4 + x2 + x1 + 1) ⊗ x4 = xtime(0x8E) = 0x7
0x57 ⊗ 0x13 = 0x7  0xAE  0x57 = 0xFE

39. Secret Key Systems - AES
Multiplication of two degree 7 polynomials (bytes):
Find the inverse of a polynomial:
a(x) ⊗ b(x)  m(x) ⊗ c(x) = 1
Example:
0x57 ⊗ 0xBF = so 0xBF is the inverse of 0x57
S-Box number:
Apply the transformation
on the right to the inverse
getSbox(0x57) = 0x5B
b0' b
b1' b
b2' b
b3' b3  0
b4' b
b5' b
b6' b
b7' b =

40. Secret Key Systems - AES
The S-Box: y
a b c d e f
c 77 7b f2 6b 6f c b fe d7 ab 76
1 ca 82 c9 7d fa f0 ad d4 a2 af 9c a4 72 c0
2 b7 fd f f7 cc 34 a5 e5 f1 71 d
3 04 c7 23 c a e2 eb 27 b2 75
c 1a 1b 6e 5a a0 52 3b d6 b3 29 e3 2f 84
5 53 d1 00 ed 20 fc b1 5b 6a cb be 39 4a 4c 58 cf
6 d0 ef aa fb 43 4d f9 02 7f 50 3c 9f a8
x a3 40 8f 92 9d 38 f5 bc b6 da ff f3 d2
8 cd 0c 13 ec 5f c4 a7 7e 3d 64 5d 19 73
f dc 22 2a ee b8 14 de 5e 0b db
a e0 32 3a 0a c c2 d3 ac e4 79
b e7 c8 37 6d 8d d5 4e a9 6c 56 f4 ea 65 7a ae 08
c ba e 1c a6 b4 c6 e8 dd 74 1f 4b bd 8b 8a
d 70 3e b f6 0e b9 86 c1 1d 9e
e e1 f d9 8e 94 9b 1e 87 e9 ce df
f 8c a1 89 0d bf e d 0f b0 54 bb 16

41. Secret Key Systems - AES
The Inverse S-Box: y
a b c d e f
a d a5 38 bf 40 a3 9e 81 f3 d7 fb
1 7c e b 2f ff e c4 de e9 cb
b a6 c2 23 3d ee 4c 95 0b 42 fa c3 4e
e a d9 24 b2 76 5b a2 49 6d 8b d1 25
4 72 f8 f d4 a4 5c cc 5d 65 b6 92
5 6c fd ed b9 da 5e a7 8d 9d 84
6 90 d8 ab 00 8c bc d3 0a f7 e b8 b
x 7 d0 2c 1e 8f ca 3f 0f 02 c1 af bd a 6b
8 3a f 67 dc ea 97 f2 cf ce f0 b4 e6 73
9 96 ac e7 ad e2 f9 37 e8 1c 75 df 6e
a 47 f1 1a 71 1d 29 c5 89 6f b7 62 0e aa 18 be 1b
b fc 56 3e 4b c6 d a db c0 fe 78 cd 5a f4
c 1f dd a c7 31 b ec 5f
d f a9 19 b5 4a 0d 2d e5 7a 9f 93 c9 9c ef
e a0 e0 3b 4d ae 2a f5 b0 c8 eb bb 3c
f 17 2b 04 7e ba 77 d6 26 e c 7d

42. Secret Key Systems - AES
Four term polynomials with 4 bit coefficients:
a(x) = a3x3 + a2x2 + a1x + a0
b(x) = b3x3 + b2x2 + b1x + b0
Addition: a(x) + b(x) = (a3  b3) x3 + (a3  b3) x3 + (a3  b3) x3 + (a3  b3) x3
Multiply:
1. create c(x) = c6x6 + c5x5 + c4x4 + c3x3 + c2x2 + c1x + c0
Where c0 = a0 ⊗ b c1 = (a1 ⊗ b0)  (a0 ⊗ b1)
c2 = (a2 ⊗ b0)  (a1 ⊗ b1)  (a0 ⊗ b2)
c3 = (a3 ⊗ b0)  (a2 ⊗ b1)  (a1 ⊗ b2)  (a0 ⊗ b3)
c4 = (a3 ⊗ b1)  (a2 ⊗ b2)  (a1 ⊗ b3)
c5 = (a3 ⊗ b2)  (a2 ⊗ b3) c6 = a3 ⊗ b3

43. Secret Key Systems - AES
Four term polynomials with 4 bit coefficients:
Multiply: a(x)  b(x)
d(x) = d3x3 + d2x2 + d1x + d0
Where d0 = (a0  b0)  (a3  b1)  (a2  b2)  (a1  b3)
d1 = (a1  b0)  (a0  b1)  (a3  b2)  (a2  b3)
d2 = (a2  b0)  (a1  b1)  (a0  b2)  (a3  b3)
d3 = (a3  b0)  (a2  b1)  (a1  b2)  (a0  b3)
Let a(x) = 3x3 + x2 + x + 2 ; a-1(x) = 11x3 + 13x2 + 9x + 14

44. Secret Key Systems - AES
void Cipher () { // Nr is the number of rounds
int i, j, round=0;
// Copy the input PlainText to state array.
state = in;
AddRoundKey(0);
for (round=1 ; round < Nr ; round++) {
SubBytes();
ShiftRows();
MixColumns();
AddRoundKey(round); }
AddRoundKey(Nr);
// Copy the state array to the Output array.
out = state;

45. Secret Key Systems - AES
SubBytes ( ):
Make substitutions from the S-Box

46. Secret Key Systems - AES
ShiftRows ( ):
s0,0
s0,1
s0,2
s0,3
s0,0
s0,1
s0,2
s0,3
s1,0
s1,1
s1,2
s1,3
s1,1
s1,2
s1,3
s1,0
s2,0
s2,1
s2,2
s2,3
s2,2
s2,3
s2,0
s2,1
s3,0
s3,1
s3,2
s3,3
s3,3
s3,0
s3,1
s3,2
Row Nb

47. Secret Key Systems - AES
MixColumns ( ) :
tmp = s0,c  s1,c  s2,c  s3,c
s0,c = xtime(s0,c s1,c )  tmp  s0,c
s1,c = xtime(s1,c s2,c )  tmp  s1,c
s2,c = xtime(s2,c s3,c )  tmp  s2,c
s3,c = xtime(s0,c s3,c )  tmp  s3,c '
s0,c s0,c
s1,c s1,c
s2,c s2,c
s3,c s3,c =
Replace state columns by matrix
multiplication ( and ) above
Columns are considered as
polynomials over GF(28) and
multiplied mod x4+1 by a fixed
polynomial given by
3x3 + x2 + x + 2
Example:
0xD x04
0xBF x66
0x5D x81
0x xE5

48. ⊕ Secret Key Systems - AES AddRoundKey ( ): s0,0 s0,0 s0,1 s0,1 s0,2
b1,3
s1,1
s1,2
s1,3
s1,0
s1,0
s1,1
s1,2
s2,1
s2,2
s2,2
s2,3
s2,0
s2,0
s2,1
s2,3
s3,3
s3,3
s3,0
s3,1
s3,2
s3,0
s3,1
s3,2
w0,0
w0,1
w0,2
w0,3
w1,0
w1,1
w1,2
w1,3
first round only -
generally it's
wi,r+c
where c is the column
and r is the round
w2,0
w2,1
w2,2
w2,3
w3,0
w3,1
w3,2
w3,3
k0,0
k0,5
k1,0
k1,5
...
k2,0
k2,5
k3,0
k3,5

49. Secret Key Systems - AES
Key Schedule: example for Nk=4
...
1st round
2nd round
w0,0 , w1,0 , w2,0 , w3, w0,3 , w1,3 , w2,3 , w3,3 w0,4 , w1,4 , w2,4 , w3,4
All rounds: 32*Nk bits for a round key

50. Secret Key Systems - AES
Key Expansion: example for Nk= 4
RotWord ( ): changes [ a0 , a1 , a2 , a3 ] to [ a3 , a2 , a1 , a0 ]
Rcon[i]: the word [ xi-1, 0, 0, 0 ] mod x4 + 1, where x = 2
SubWord ( ): maps each byte of [ a0 , a1 , a2 , a3 ] using S-Box values

51. Secret Key Systems - AES
Key Expansion: example for Nk= 4
First Round: the original key (16 bytes if Nk = 4)
Other Rounds: [ w0,l , w1,l , w2,l , w3,l ] smallest l is Nk-1
[ w3,l , w2,l , w1,l , w0,l ] apply RotWord
[ S(w0,l ) , S(w1,l ), S(w2,l ), S(w3,l) ] apply SubWord
[ S(w0,l )  Rcon[(l+1)/Nk], S(w1,l ), S(w2,l ), S(w3,l ) ] use Rcon
[ S(w0,l )  Rcon[(l+1)/Nk]  w0,l , S(w1,l )  w1,l , S(w2,l )  w2,l , S(w3,l )  w3,l]
[ w0,l+1 , w1,l+1 , w2,l+1 , w3,l+1 ] next key word
RotWord ( ): changes [ a0 , a1 , a2 , a3 ] to [ a3 , a2 , a1 , a0 ]
Rcon[i]: the word [ xi-1, 0, 0, 0 ] mod x4 + 1, where x = 2
SubWord ( ): maps each byte of [ a0 , a1 , a2 , a3 ] using S-Box values

52. Key: 2B 7E AE D2 A6 AB F CF 4F 3C

53. Key: 2B 7E AE D2 A6 AB F CF 4F 3C

54. Secret Key Systems - AES
Example: E0 A F
A8 8D A
Input:
2B AB 09
7E AE F7 CF
D F
A C
Key:

55.  Secret Key Systems - AES Example: 32 88 31 E0 43 5A 31 37F
A8 8D A
A0 9A E9
3D F4 C6 F8
E3 E D 48
BE 2B 2A 08
Input: 
beginning of first round -
input placed into the state and
key has been added to state
2B AB 09
7E AE F7 CF
D F
A C
Key:

56. Secret Key Systems - AES
Example:
A0 9A E9
3D F4 C6 F8
E3 E D 48
BE 2B 2A 08
D4 E0 B E
BF B
D 52
AE F1 E
S-Box
State:
ShiftRows E
66 CB F D
E5 9A 7A 4C
D4 E0 B E
BF B 5D
AE F1 E5
MixColumns

57. Secret Key Systems - AES
Notes:
1. Many operations are table look ups so they are fast
2. Parallelism can be exploited
3. Key expansion only needs to be done one time until the key is changed
4. The S-box minimizes the correlation between input and output bits
5. There are no known weak keys

58. Secret Key Systems - AES
Number of rounds: Nk Nb