【暗号】AES暗号について勉強する ③Round Keyの拡張(Key Expansion)

[前回(S-Boxとガロア体について)](https://qiita.com/kawawa1989/items/f255c0dc624efc403ed9)
[前々回(AES暗号各種用語)](https://qiita.com/kawawa1989/items/dcbe38624ba97d3af92c)

この記事では暗号化のラウンド鍵の生成処理についてまとめます。
**鍵スケジュール**、 **鍵の拡張** などとも呼ばれますが、各ラウンドで使用するラウンド鍵を秘密鍵を元に生成します。

**SubWord()** は４バイトのそれぞれに **S-Box** の変換を行います。
```csharp
uint SubWord(uint x)
{
    byte[] sBox = SBoxTable.SBox;
    return sBox[x & 255]
            | ((uint) sBox[(x >> 8) & 255] << 8)
            | ((uint) sBox[(x >> 16) & 255] << 16)
            | ((uint) sBox[(x >> 24) & 255] << 24);
}
```

**RotWord()** は4バイトのデータを左方向に循環シフトさせます。

```csharp
uint RotWord(uint r)
{
    return (r << 8) | ((r >> 24) & 0xFF);
}
```

ラウンド毎に **RCon** という定数を加算します。
ラウンド定数は以下のように定義されています。

```csharp
public static uint[] RCon { get; } =
{
    0x00000000,   // [00000000000000000000000000000000]
    0x01000000,   // [00000001000000000000000000000000]
    0x02000000,   // [00000010000000000000000000000000]
    0x04000000,   // [00000100000000000000000000000000]
    0x08000000,   // [00001000000000000000000000000000]
    0x10000000,   // [00010000000000000000000000000000]
    0x20000000,   // [00100000000000000000000000000000]
    0x40000000,   // [01000000000000000000000000000000]
    0x80000000,   // [10000000000000000000000000000000]
    0x1b000000,   // [00011011000000000000000000000000]
    0x36000000,   // [00110110000000000000000000000000]
    0x6c000000,   // [01101100000000000000000000000000]
    0xd8000000,   // [11011000000000000000000000000000]
    0xab000000,   // [10101011000000000000000000000000]
    0x4d000000,   // [01001101000000000000000000000000]
    0x9a000000,   // [10011010000000000000000000000000]
    0x2f000000,   // [00101111000000000000000000000000]
    0x5e000000,   // [01011110000000000000000000000000]
    0xbc000000,   // [10111100000000000000000000000000]
    0x63000000,   // [01100011000000000000000000000000]
    0xc6000000,   // [11000110000000000000000000000000]
    0x97000000,   // [10010111000000000000000000000000]
    0x35000000,   // [00110101000000000000000000000000]
    0x6a000000,   // [01101010000000000000000000000000]
    0xd4000000,   // [11010100000000000000000000000000]
    0xb3000000,   // [10110011000000000000000000000000]
    0x7d000000,   // [01111101000000000000000000000000]
    0xfa000000,   // [11111010000000000000000000000000]
    0xef000000,   // [11101111000000000000000000000000]
    0xc5000000,   // [11000101000000000000000000000000]
};
```

### ラウンド鍵生成(128bit)
流れとしては以下のような感じで鍵長が128bitであれば4Word周期でRotWord + SubWord + Rconによる鍵生成を行い、その演算結果と直前のブロックのXORした値を次の鍵とします。

<img width="450" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/421285/48d5d26e-134c-1459-0b39-7600a2a66466.jpeg">


```csharp
void InitRoundKeys128(byte[] key, out NativeArray<uint> oRoundKeys, out int oRounds)
{
    const int rounds = 10;
    oRounds = rounds;
    oRoundKeys = new NativeArray<uint>((rounds + 1) * NUM_KEY, Allocator.Persistent);
    
    uint* w = GetRoundKeyPtr(oRoundKeys, 0);
    uint t0 = ToUInt32(key.AsSpan(0));
    uint t1 = ToUInt32(key.AsSpan(4));
    uint t2 = ToUInt32(key.AsSpan(8));
    uint t3 = ToUInt32(key.AsSpan(12));
    // 初期ラウンド
    w[0] = t0;
    w[1] = t1;
    w[2] = t2;
    w[3] = t3;

    for (int i = 1; i <= rounds; ++i)
    {
        uint u = SubWord(RotWord(t3)) ^ RCon[i];
        t0 ^= u;
        t1 ^= t0;
        t2 ^= t1;
        t3 ^= t2;
        w = GetRoundKeyPtr(oRoundKeys, i);
        w[0] = t0;
        w[1] = t1;
        w[2] = t2;
        w[3] = t3;
    }
}
```

### ラウンド鍵生成(192bit)
192bit鍵の場合は6Word周期で鍵生成が行われます。
少し鍵の生成タイミングが複雑でわかりづらいので私は鍵長別に関数を分けて実装しています。
(BouncyCastleの実装がそんな感じだったのでそれを参考にしています)

<img width="450" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/421285/47bee9db-41f2-daff-e7d9-6424fd2ac840.jpeg">

```csharp
static void InitRoundKeys192(byte[] key, out NativeArray<uint> oRoundKeys, out int oRounds)
{
    const int rounds = 12;
    oRounds = rounds;
    oRoundKeys = new NativeArray<uint>((rounds + 1) * NUM_KEY, Allocator.Persistent);
    
    uint* w = GetRoundKeyPtr(oRoundKeys, 0);
    uint t0 = ToUInt32(key.AsSpan(0));
    uint t1 = ToUInt32(key.AsSpan(4));
    uint t2 = ToUInt32(key.AsSpan(8));
    uint t3 = ToUInt32(key.AsSpan(12));
    uint t4 = ToUInt32(key.AsSpan(16));
    uint t5 = ToUInt32(key.AsSpan(20));
    w[0] = t0;
    w[1] = t1;
    w[2] = t2;
    w[3] = t3;
    
    w = GetRoundKeyPtr(oRoundKeys, 1);
    w[0] = t4;
    w[1] = t5;
    int rconIndex = 1;
    uint u = SubWord(RotWord(t5)) ^ RCon[rconIndex++];
    t0 ^= u;
    t1 ^= t0;
    t2 ^= t1;
    t3 ^= t2;
    t4 ^= t3;
    t5 ^= t4;
    w[2] = t0;
    w[3] = t1;

    w = GetRoundKeyPtr(oRoundKeys, 2);
    w[0] = t2;
    w[1] = t3;
    w[2] = t4;
    w[3] = t5;
    
    for (int i = 3; i < rounds; i += 3)
    {
        u = SubWord(RotWord(t5)) ^ RCon[rconIndex++];
        t0 ^= u;
        t1 ^= t0;
        t2 ^= t1;
        t3 ^= t2;
        t4 ^= t3;
        t5 ^= t4;

        w = GetRoundKeyPtr(oRoundKeys, i);
        w[0] = t0;
        w[1] = t1;
        w[2] = t2;
        w[3] = t3;

        w = GetRoundKeyPtr(oRoundKeys, i + 1);
        w[0] = t4;
        w[1] = t5;
        u = SubWord(RotWord(t5)) ^ RCon[rconIndex++];

        t0 ^= u;
        t1 ^= t0;
        t2 ^= t1;
        t3 ^= t2;
        t4 ^= t3;
        t5 ^= t4;
        w[2] = t0;
        w[3] = t1;

        w = GetRoundKeyPtr(oRoundKeys, i + 2);
        w[0] = t2;
        w[1] = t3;
        w[2] = t4;
        w[3] = t5;
    }

    u = SubWord(RotWord(t5)) ^ RCon[rconIndex];
    t0 ^= u;
    t1 ^= t0;
    t2 ^= t1;
    t3 ^= t2;

    w = GetRoundKeyPtr(oRoundKeys, 12);
    w[0] = t0;
    w[1] = t1;
    w[2] = t2;
    w[3] = t3;
}
```

### ラウンド鍵生成(256bit)
256bit鍵の場合は8Word周期で鍵生成が行われますが、128bit、192bitとは異なり
鍵を4Word生成した後にもう一度直前のWordを使ってSubWordのみが行われるタイミングがあります。

<img width="450" src="https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/421285/2edce4f4-fb42-5cb0-ac9b-453ac481a932.jpeg">

```csharp
void InitRoundKeys256(byte[] key, out NativeArray<uint> oRoundKeys, out int oRounds)
{
    const int rounds = 14;
    oRounds = rounds;
    oRoundKeys = new NativeArray<uint>((rounds + 1) * NUM_KEY, Allocator.Persistent);
    
    uint* w = GetRoundKeyPtr(oRoundKeys, 0);
    uint t0 = ToUInt32(key.AsSpan(0));
    uint t1 = ToUInt32(key.AsSpan(4));
    uint t2 = ToUInt32(key.AsSpan(8));
    uint t3 = ToUInt32(key.AsSpan(12));
    w[0] = t0;
    w[1] = t1;
    w[2] = t2;
    w[3] = t3;

    w = GetRoundKeyPtr(oRoundKeys, 1);
    uint t4 = ToUInt32(key.AsSpan(16));
    uint t5 = ToUInt32(key.AsSpan(20));
    uint t6 = ToUInt32(key.AsSpan(24));
    uint t7 = ToUInt32(key.AsSpan(28));
    w[0] = t4;
    w[1] = t5;
    w[2] = t6;
    w[3] = t7;

    uint u;
    int roundConstantIndex = 1;

    for (int i = 2; i < rounds; i += 2)
    {
        u = SubWord(RotWord(t7)) ^ RCon[roundConstantIndex++];
        t0 ^= u;
        t1 ^= t0;
        t2 ^= t1;
        t3 ^= t2;
        w = GetRoundKeyPtr(oRoundKeys, i);
        w[0] = t0;
        w[1] = t1;
        w[2] = t2;
        w[3] = t3;

        u = SubWord(t3);
        t4 ^= u;
        t5 ^= t4;
        t6 ^= t5;
        t7 ^= t6;
        w = GetRoundKeyPtr(oRoundKeys, i + 1);
        w[0] = t4;
        w[1] = t5;
        w[2] = t6;
        w[3] = t7;
    }

    w = GetRoundKeyPtr(oRoundKeys, 14);
    u = SubWord(RotWord(t7)) ^ RCon[roundConstantIndex];
    t0 ^= u;
    t1 ^= t0;
    t2 ^= t1;
    t3 ^= t2;
    w[0] = t0;
    w[1] = t1;
    w[2] = t2;
    w[3] = t3;
}
```