Withdrawn NIST Technical Series Publication
Warning Notice
The attached publication has been withdrawn (archived), and is provided solely for historical purposes.
It may have been superseded by another publication (indicated below).

Withdrawn Publication
Series/Number
Title
Publication Date(s)Withdrawal Date
Withdrawal Note

Federal Information Processing Standards (FIPS) Publication 197
Advanced Encryption Standard (AES)
November 26, 2001
May 9, 2023
FIPS 197 is updated by NIST FIPS 197-upd1

Superseding Publication(s) (if applicable)
The attached publication has been superseded by the following publication(s):Series/Number
Title
Author(s)Publication Date(s)URL/DOINIST FIPS 197-upd1
Advanced Encryption Standard (AES)
National Institute of Standards and Technology
November 26, 2001; Updated May 9, 2023
https://doi.org/10.6028/NIST.FIPS.197-upd1

Additional Information (if applicable)
Contact
Latest revision of theattached publication
Related Information
Withdrawal
Announcement Link

Computer Security Division (Information Technology Laboratory)
This update makes no technical changes to the algorithm specified in theoriginal (2001) release of this standard. This update includes extensive editorial
improvements to the original version.
https://csrc.nist.gov/News/2023/nist-updates-fips-197-advanced-encryptionstandard

Date updated: May 9, 2023

Federal Information
Processing Standards Publication 197
November 26, 2001

Announcing the
ADVANCED ENCRYPTION STANDARD (AES)
Federal Information Processing Standards Publications (FIPS PUBS) are issued by the National
Institute of Standards and Technology (NIST) after approval by the Secretary of Commerce
pursuant to Section 5131 of the Information Technology Management Reform Act of 1996
(Public Law 104-106) and the Computer Security Act of 1987 (Public Law 100-235).
1.

Name of Standard. Advanced Encryption Standard (AES) (FIPS PUB 197).

2.

Category of Standard. Computer Security Standard, Cryptography.

3.
Explanation. The Advanced Encryption Standard (AES) specifies a FIPS-approved
cryptographic algorithm that can be used to protect electronic data. The AES algorithm is asymmetric block cipher that can encrypt (encipher) and decrypt (decipher) information.
Encryption converts data to an unintelligible form called ciphertext; decrypting the ciphertext
converts the data back into its original form, called plaintext.
The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encryptand decrypt data in blocks of 128 bits.
4.

Approving Authority. Secretary of Commerce.

5.
Maintenance Agency. Department of Commerce, National Institute of Standards andTechnology, Information Technology Laboratory (ITL).
6.
Applicability. This standard may be used by Federal departments and agencies when an
agency determines that sensitive (unclassified) information (as defined in P. L. 100-235) requires
cryptographic protection.
Other FIPS-approved cryptographic algorithms may be used in addition to, or in lieu of, thisstandard. Federal agencies or departments that use cryptographic devices for protecting classified
information can use those devices for protecting sensitive (unclassified) information in lieu of
this standard.
In addition, this standard may be adopted and used by non-Federal Government organizations.
Such use is encouraged when it provides the desired security for commercial and privateorganizations.

7.
Specifications. Federal Information Processing Standard (FIPS) 197, Advanced
Encryption Standard (AES) (affixed).
8.
Implementations. The algorithm specified in this standard may be implemented insoftware, firmware, hardware, or any combination thereof. The specific implementation may
depend on several factors such as the application, the environment, the technology used, etc. The
algorithm shall be used in conjunction with a FIPS approved or NIST recommended mode ofoperation. Object Identifiers (OIDs) and any associated parameters for AES used in these modes
are available at the Computer Security Objects Register (CSOR), located at
http://csrc.nist.gov/csor/ [2].
Implementations of the algorithm that are tested by an accredited laboratory and validated will beconsidered as complying with this standard. Since cryptographic security depends on manyfactors besides the correct implementation of an encryption algorithm, Federal Government
employees, and others, should also refer to NIST Special Publication 800-21, Guideline for
Implementing Cryptography in the Federal Government, for additional information and guidance(NIST SP 800-21 is available at http://csrc.nist.gov/publications/).
9.

Implementation Schedule. This standard becomes effective on May 26, 2002.

10.
Patents. Implementations of the algorithm specified in this standard may be covered by
U.S. and foreign patents.
11.
Export Control. Certain cryptographic devices and technical data regarding them aresubject to Federal export controls. Exports of cryptographic modules implementing this standard
and technical data regarding them must comply with these Federal regulations and be licensed by
the Bureau of Export Administration of the U.S. Department of Commerce. Applicable Federal
government export controls are specified in Title 15, Code of Federal Regulations (CFR) Part
740.17; Title 15, CFR Part 742; and Title 15, CFR Part 774, Category 5, Part 2.
12.
Qualifications. NIST will continue to follow developments in the analysis of the AES
algorithm. As with its other cryptographic algorithm standards, NIST will formally reevaluate
this standard every five years.
Both this standard and possible threats reducing the security provided through the use of thisstandard will undergo review by NIST as appropriate, taking into account newly available
analysis and technology. In addition, the awareness of any breakthrough in technology or any
mathematical weakness of the algorithm will cause NIST to reevaluate this standard and provide
necessary revisions.
13.
Waiver Procedure. Under certain exceptional circumstances, the heads of Federal
agencies, or their delegates, may approve waivers to Federal Information Processing Standards(FIPS). The heads of such agencies may redelegate such authority only to a senior official
designated pursuant to Section 3506(b) of Title 44, U.S. Code. Waivers shall be granted only
when compliance with this standard would
a. adversely affect the accomplishment of the mission of an operator of Federal computer
system orb. cause a major adverse financial impact on the operator that is not offset by governmentwide savings.

iiAgency heads may act upon a written waiver request containing the information detailed above.
Agency heads may also act without a written waiver request when they determine that conditions
for meeting the standard cannot be met. Agency heads may approve waivers only by a written
decision that explains the basis on which the agency head made the required finding(s). A copyof each such decision, with procurement sensitive or classified portions clearly identified, shallbe sent to: National Institute of Standards and Technology; ATTN: FIPS Waiver Decision,
Information Technology Laboratory, 100 Bureau Drive, Stop 8900, Gaithersburg, MD 20899­
8900.
In addition, notice of each waiver granted and each delegation of authority to approve waivers
shall be sent promptly to the Committee on Government Operations of the House ofRepresentatives and the Committee on Government Affairs of the Senate and shall be publishedpromptly in the Federal Register.
When the determination on a waiver applies to the procurement of equipment and/or services, a
notice of the waiver determination must be published in the Commerce Business Daily as a partof the notice of solicitation for offers of an acquisition or, if the waiver determination is madeafter that notice is published, by amendment to such notice.
A copy of the waiver, any supporting documents, the document approving the waiver and any
supporting and accompanying documents, with such deletions as the agency is authorized anddecides to make under Section 552(b) of Title 5, U.S. Code, shall be part of the procurement
documentation and retained by the agency.
14.
Where to obtain copies. This publication is available electronically by accessing
http://csrc.nist.gov/publications/. A list of other available computer security publications,
including ordering information, can be obtained from NIST Publications List 91, which isavailable at the same web site. Alternatively, copies of NIST computer security publications areavailable from: National Technical Information Service (NTIS), 5285 Port Royal Road,
Springfield, VA 22161.

iii

iv

Federal Information
Processing Standards Publication 197
November 26, 2001

Specification for the
ADVANCED ENCRYPTION STANDARD (AES)
Table of Contents
1.

INTRODUCTION............................................................................................................................................. 52.

DEFINITIONS .................................................................................................................................................. 5

3.

4.

2.1

GLOSSARY OF TERMS AND ACRONYMS ........................................................................................................... 5

2.2

ALGORITHM PARAMETERS, SYMBOLS, AND FUNCTIONS ................................................................................. 6

NOTATION AND CONVENTIONS............................................................................................................... 7
3.1

INPUTS AND OUTPUTS ..................................................................................................................................... 7

3.2

BYTES ............................................................................................................................................................. 8

3.3

ARRAYS OF BYTES .......................................................................................................................................... 8

3.4

THE STATE ...................................................................................................................................................... 9

3.5

THE STATE AS AN ARRAY OF COLUMNS ........................................................................................................ 10

MATHEMATICAL PRELIMINARIES ....................................................................................................... 10
4.1

ADDITION ...................................................................................................................................................... 10

4.2

MULTIPLICATION .......................................................................................................................................... 10

4.2.1
4.3
5.

Multiplication by x .............................................................................................................................. 11

POLYNOMIALS WITH COEFFICIENTS IN GF(28) .............................................................................................. 12

ALGORITHM SPECIFICATION................................................................................................................. 13
5.1

CIPHER .......................................................................................................................................................... 14

5.1.1

SubBytes()Transformation............................................................................................................ 15

5.1.2

ShiftRows() Transformation ........................................................................................................ 17

5.1.3

MixColumns() Transformation...................................................................................................... 17

5.1.4

AddRoundKey() Transformation .................................................................................................. 18

5.2

KEY EXPANSION ........................................................................................................................................... 19

5.3

INVERSE CIPHER............................................................................................................................................ 20

6.

5.3.1

InvShiftRows() Transformation ................................................................................................. 21

5.3.2

InvSubBytes() Transformation ................................................................................................... 22

5.3.3

InvMixColumns() Transformation............................................................................................... 23

5.3.4

Inverse of the AddRoundKey() Transformation............................................................................. 23

5.3.5

Equivalent Inverse Cipher .................................................................................................................. 23

IMPLEMENTATION ISSUES ...................................................................................................................... 25
6.1

KEY LENGTH REQUIREMENTS ....................................................................................................................... 25

6.2

KEYING RESTRICTIONS ................................................................................................................................. 26

6.3

PARAMETERIZATION OF KEY LENGTH, BLOCK SIZE, AND ROUND NUMBER ................................................. 26

6.4

IMPLEMENTATION SUGGESTIONS REGARDING VARIOUS PLATFORMS ........................................................... 26

APPENDIX A - KEY EXPANSION EXAMPLES ................................................................................................ 27
A.1 EXPANSION OF A 128-BIT CIPHER KEY .......................................................................................................... 27
A.2 EXPANSION OF A 192-BIT CIPHER KEY .......................................................................................................... 28
A.3 EXPANSION OF A 256-BIT CIPHER KEY .......................................................................................................... 30
APPENDIX B – CIPHER EXAMPLE.................................................................................................................... 33
APPENDIX C – EXAMPLE VECTORS................................................................................................................ 35
C.1 AES-128 (NK=4, NR=10).............................................................................................................................. 35
C.2 AES-192 (NK=6, NR=12).............................................................................................................................. 38
C.3 AES-256 (NK=8, NR=14).............................................................................................................................. 42
APPENDIX D - REFERENCES.............................................................................................................................. 47

2

Table of Figures
Figure 1.

Hexadecimal representation of bit patterns.................................................................. 8

Figure 2.

Indices for Bytes and Bits. ........................................................................................... 9

Figure 3.

State array input and output. ........................................................................................ 9

Figure 4.

Key-Block-Round Combinations............................................................................... 14

Figure 5.

Pseudo Code for the Cipher. ...................................................................................... 15

Figure 6.

SubBytes() applies the S-box to each byte of the State. ...................................... 16

Figure 7.

S-box: substitution values for the byte xy (in hexadecimal format). ....................... 16

Figure 8.

ShiftRows() cyclically shifts the last three rows in the State.............................. 17

Figure 9.

MixColumns() operates on the State column-by-column. .................................... 18

Figure 10. AddRoundKey() XORs each column of the State with a word from the keyschedule....................................................................................................................... 19
Figure 11. Pseudo Code for Key Expansion................................................................................ 20
Figure 12. Pseudo Code for the Inverse Cipher........................................................................... 21
Figure 13. InvShiftRows()cyclically shifts the last three rows in the State. ....................... 22
Figure 14. Inverse S-box: substitution values for the byte xy (in hexadecimal format)............. 22
Figure 15. Pseudo Code for the Equivalent Inverse Cipher......................................................... 25

3

4

1.

Introduction

This standard specifies the Rijndael algorithm ([3] and [4]), a symmetric block cipher that canprocess data blocks of 128 bits, using cipher keys with lengths of 128, 192, and 256 bits.
Rijndael was designed to handle additional block sizes and key lengths, however they are not
adopted in this standard.
Throughout the remainder of this standard, the algorithm specified herein will be referred to as“the AES algorithm.” The algorithm may be used with the three different key lengths indicatedabove, and therefore these different “flavors” may be referred to as “AES-128”, “AES-192”, and“AES-256”.
This specification includes the following sections:
2. Definitions of terms, acronyms, and algorithm parameters, symbols, and functions;
3. Notation and conventions used in the algorithm specification, including the ordering andnumbering of bits, bytes, and words;
4. Mathematical properties that are useful in understanding the algorithm;
5. Algorithm specification, covering the key expansion, encryption, and decryption routines;
6. Implementation issues, such as key length support, keying restrictions, and additional
block/key/round sizes.
The standard concludes with several appendices that include step-by-step examples for Key
Expansion and the Cipher, example vectors for the Cipher and Inverse Cipher, and a list ofreferences.

2.

Definitions

2.1

Glossary of Terms and Acronyms

The following definitions are used throughout this standard:
AES

Advanced Encryption Standard

AffineTransformation

A transformation consisting of multiplication by a matrix followed by
the addition of a vector.

Array

An enumerated collection of identical entities (e.g., an array of bytes).

Bit

A binary digit having a value of 0 or 1.

Block

Sequence of binary bits that comprise the input, output, State, andRound Key. The length of a sequence is the number of bits it contains.
Blocks are also interpreted as arrays of bytes.

Byte

A group of eight bits that is treated either as a single entity or as anarray of 8 individual bits.

5

2.2

CipherSeries of transformations that converts plaintext to ciphertext using the
Cipher Key.

Cipher Key

Secret, cryptographic key that is used by the Key Expansion routine togenerate a set of Round Keys; can be pictured as a rectangular array ofbytes, having four rows and Nk columns.

Ciphertext

Data output from the Cipher or input to the Inverse Cipher.

Inverse Cipher

Series of transformations that converts ciphertext to plaintext using the
Cipher Key.

Key Expansion

Routine used to generate a series of Round Keys from the Cipher Key.

Plaintext

Data input to the Cipher or output from the Inverse Cipher.

Rijndael

Cryptographic algorithm specified in this Advanced Encryption
Standard (AES).

Round Key

Round keys are values derived from the Cipher Key using the Key
Expansion routine; they are applied to the State in the Cipher andInverse Cipher.

StateIntermediate Cipher result that can be pictured as a rectangular arrayof bytes, having four rows and Nb columns.

S-box

Non-linear substitution table used in several byte substitution
transformations and in the Key Expansion routine to perform a onefor-one substitution of a byte value.

Word

A group of 32 bits that is treated either as a single entity or as an arrayof 4 bytes.

Algorithm Parameters, Symbols, and Functions

The following algorithm parameters, symbols, and functions are used throughout this standard:
AddRoundKey()

Transformation in the Cipher and Inverse Cipher in which a RoundKey is added to the State using an XOR operation. The length of aRound Key equals the size of the State (i.e., for Nb = 4, the RoundKey length equals 128 bits/16 bytes).

InvMixColumns()Transformation in the Inverse Cipher that is the inverse of
MixColumns().
InvShiftRows() Transformation in the Inverse Cipher that is the inverse of
ShiftRows().
InvSubBytes()

Transformation in the Inverse Cipher that is the inverse of
SubBytes().

K

Cipher Key.

6

MixColumns()

Transformation in the Cipher that takes all of the columns of theState and mixes their data (independently of one another) to
produce new columns.

Nb

Number of columns (32-bit words) comprising the State. For thisstandard, Nb = 4. (Also see Sec. 6.3.)

Nk

Number of 32-bit words comprising the Cipher Key. For thisstandard, Nk = 4, 6, or 8. (Also see Sec. 6.3.)

Nr

Number of rounds, which is a function of Nk and Nb (which isfixed). For this standard, Nr = 10, 12, or 14. (Also see Sec. 6.3.)

Rcon[]The round constant word array.

RotWord()

Function used in the Key Expansion routine that takes a four-byte
word and performs a cyclic permutation.

ShiftRows()

Transformation in the Cipher that processes the State by cyclicallyshifting the last three rows of the State by different offsets.

SubBytes()

Transformation in the Cipher that processes the State using a non­linear byte substitution table (S-box) that operates on each of theState bytes independently.

SubWord()

Function used in the Key Expansion routine that takes a four-byte
input word and applies an S-box to each of the four bytes to
produce an output word.

XOR

Exclusive-OR operation.

¯

Exclusive-OR operation.

˜

Multiplication of two polynomials (each with degree < 4) modulo
x4 + 1.

•Finite field multiplication.

3.

Notation and Conventions

3.1

Inputs and Outputs

The input and output for the AES algorithm each consist of sequences of 128 bits (digits withvalues of 0 or 1). These sequences will sometimes be referred to as blocks and the number ofbits they contain will be referred to as their length. The Cipher Key for the AES algorithm is asequence of 128, 192 or 256 bits. Other input, output and Cipher Key lengths are not permitted
by this standard.
The bits within such sequences will be numbered starting at zero and ending at one less than thesequence length (block length or key length). The number i attached to a bit is known as its index
and will be in one of the ranges 0 £ i < 128, 0 £ i < 192 or 0 £ i < 256 depending on the block
length and key length (specified above).
7

3.2

Bytes

The basic unit for processing in the AES algorithm is a byte, a sequence of eight bits treated as asingle entity. The input, output and Cipher Key bit sequences described in Sec. 3.1 are processed
as arrays of bytes that are formed by dividing these sequences into groups of eight contiguous
bits to form arrays of bytes (see Sec. 3.3). For an input, output or Cipher Key denoted by a, thebytes in the resulting array will be referenced using one of the two forms, an or a[n], where n will
be in one of the following ranges:
Key length = 128 bits, 0 £ n < 16;

Block length = 128 bits, 0 £ n < 16;

Key length = 192 bits, 0 £ n < 24;
Key length = 256 bits, 0 £ n < 32.
All byte values in the AES algorithm will be presented as the concatenation of its individual bit
values (0 or 1) between braces in the order {b7, b6, b5, b4, b3, b2, b1, b0}. These bytes areinterpreted as finite field elements using a polynomial representation:
7

b7 x 7 + b6 x 6 + b5 x 5 + b4 x 4 + b3 x 3 + b2 x 2 + b1 x + b0 = � bi x i .

(3.1)

i=0

For example, {01100011} identifies the specific finite field element x 6 + x 5 + x + 1.
It is also convenient to denote byte values using hexadecimal notation with each of two groups offour bits being denoted by a single character as in Fig. 1.
Bit Pattern

Character

Bit Pattern

Character

Bit Pattern

Character

Bit Pattern

Character

0000
0001
0010
0011

0
1
2
3

0100
0101
0110
0111

4
5
6
7

1000
1001
1010
1011

8
9
a
b

1100
1101
1110
1111

c
d
e
f

Figure 1. Hexadecimal representation of bit patterns.

Hence the element {01100011} can be represented as {63}, where the character denoting thefour-bit group containing the higher numbered bits is again to the left.
Some finite field operations involve one additional bit (b8) to the left of an 8-bit byte. Where thisextra bit is present, it will appear as ‘{01}’ immediately preceding the 8-bit byte; for example, a9-bit sequence will be presented as {01}{1b}.

3.3Arrays of Bytes

Arrays of bytes will be represented in the following form:a 0 a1 a 2 ...a15
The bytes and the bit ordering within bytes are derived from the 128-bit input sequence
input0 input1 input2 … input126 input127
as follows:8a0 = {input0, input1, …, input7};
a1 = {input8, input9, …, input15};M
a15 = {input120, input121, …, input127}.
The pattern can be extended to longer sequences (i.e., for 192- and 256-bit keys), so that, ingeneral,an = {input8n, input8n+1, …, input8n+7}.

(3.2)

Taking Sections 3.2 and 3.3 together, Fig. 2 shows how bits within each byte are numbered.
Input bit sequence

0

1

2

3

Byte number

4

5

6

7

8

9

10

11

0

Bit numbers in byte

7

6

5

4

12

13

14

15

16

17

18

19

1
3

2

1

0

7

6

5

4

20

21

22

23

2
3

2

1

0

7

6

5

4

…
3

2

1

0

Figure 2. Indices for Bytes and Bits.

3.4

The State

Internally, the AES algorithm’s operations are performed on a two-dimensional array of bytes
called the State. The State consists of four rows of bytes, each containing Nb bytes, where Nb isthe block length divided by 32. In the State array denoted by the symbol s, each individual byte
has two indices, with its row number r in the range 0 £ r < 4 and its column number c in therange 0 £ c < Nb. This allows an individual byte of the State to be referred to as either sr,c ors[r,c]. For this standard, Nb=4, i.e., 0 £ c < 4 (also see Sec. 6.3).
At the start of the Cipher and Inverse Cipher described in Sec. 5, the input – the array of bytes
in0, in1, … in15 – is copied into the State array as illustrated in Fig. 3. The Cipher or Inverse
Cipher operations are then conducted on this State array, after which its final value is copied tothe output – the array of bytes out0, out1, … out15.
input bytes

in0

in4

in8 in12

in1

in5

in9 in13

in2

in6 in10 in14

in3

in7 in11 in15

�State array

output bytes

s0,0 s0,1 s0,2 s0,3

out0 out4 out8 out12

s1,0 s1,1 s1,2 s1,3
s2,0 s2,1 s2,2 s2,3
s3,0 s3,1 s3,2 s3,3�out1 out5 out9 out13
out2 out6 out10 out14
out3 out7 out11 out15

Figure 3. State array input and output.

Hence, at the beginning of the Cipher or Inverse Cipher, the input array, in, is copied to the Statearray according to the scheme:s[r, c] = in[r + 4c]

for 0 £ r < 4 and 0 £ c < Nb,

9

…

(3.3)

…

and at the end of the Cipher and Inverse Cipher, the State is copied to the output array out asfollows:out[r + 4c] = s[r, c]

3.5

for 0 £ r < 4 and 0 £ c < Nb.

(3.4)

The State as an Array of Columns

The four bytes in each column of the State array form 32-bit words, where the row number r
provides an index for the four bytes within each word. The state can hence be interpreted as a
one-dimensional array of 32 bit words (columns), w0...w3, where the column number c provides
an index into this array. Hence, for the example in Fig. 3, the State can be considered as an arrayof four words, as follows:4.

w0 = s 0,0 s 1,0 s 2,0 s 3,0

w2 = s 0,2 s 1,2 s 2,2 s 3,2

w1 = s 0,1 s 1,1 s 2,1 s 3,1

w3 = s 0,3 s 1,3 s 2,3 s 3,3 .

(3.5)

Mathematical Preliminaries

All bytes in the AES algorithm are interpreted as finite field elements using the notation
introduced in Sec. 3.2. Finite field elements can be added and multiplied, but these operations
are different from those used for numbers. The following subsections introduce the basic
mathematical concepts needed for Sec. 5.

4.1

Addition

The addition of two elements in a finite field is achieved by “adding” the coefficients for thecorresponding powers in the polynomials for the two elements. The addition is performed with
the XOR operation (denoted by ¯ ) - i.e., modulo 2 - so that 1¯ 1 = 0 , 1¯ 0 = 1 , and 0 ¯ 0 = 0 .
Consequently, subtraction of polynomials is identical to addition of polynomials.
Alternatively, addition of finite field elements can be described as the modulo 2 addition ofcorresponding bits in the byte. For two bytes {a7a6a5a4a3a2a1a0} and {b7b6b5b4b3b2b1b0}, the sum is{c7c6c5c4c3c2c1c0}, where each ci = ai ¯ bi (i.e., c7 = a7 ¯ b7, c6 = a6 ¯ b6, ...c0 = a0 ¯ b0).
For example, the following expressions are equivalent to one another:

4.2(x 6 + x 4 + x 2 + x + 1) + (x 7 + x + 1) = x 7 + x 6 + x 4 + x 2(polynomial notation);{01010111} ¯ {10000011} = {11010100}(binary notation);{57} ¯ {83} = {d4}(hexadecimal notation).

Multiplication

In the polynomial representation, multiplication in GF(28) (denoted by •) corresponds with themultiplication of polynomials modulo an irreducible polynomial of degree 8. A polynomial isirreducible if its only divisors are one and itself. For the AES algorithm, this irreducible
polynomial ism(x) = x 8 + x 4 + x 3 + x +1 ,
10

(4.1)

or {01}{1b} in hexadecimal notation.
For example, {57} • {83} = {c1}, because(x 6 + x 4 + x 2 + x +1) (x 7 + x +1)

x 13 + x 11 + x 9 + x 8 + x 7 +=x7 + x5 + x3 + x 2 + x +x 6 + x 4 + x 2 + x +1
x 13 + x 11 + x 9 + x 8 + x 6 + x 5 + x 4 + x 3 +1=
andx 13 + x 11 + x 9 + x 8 + x 6 + x 5 + x 4 + x 3 +1 modulo ( x 8 + x 4 + x 3 + x +1)
x 7 + x 6 +1.

=

The modular reduction by m(x) ensures that the result will be a binary polynomial of degree lessthan 8, and thus can be represented by a byte. Unlike addition, there is no simple operation at thebyte level that corresponds to this multiplication.
The multiplication defined above is associative, and the element {01} is the multiplicative
identity. For any non-zero binary polynomial b(x) of degree less than 8, the multiplicative
inverse of b(x), denoted b-1(x), can be found as follows: the extended Euclidean algorithm [7] isused to compute polynomials a(x) and c(x) such thatb(x)a(x) + m(x)c(x) = 1.

(4.2)

Hence, a(x) • b(x) mod m(x) = 1, which meansb -1 (x) = a(x) mod m(x) .

(4.3)

Moreover, for any a(x), b(x) and c(x) in the field, it holds thata(x) • (b(x) + c(x)) = a(x) • b(x) + a(x) • c(x) .
It follows that the set of 256 possible byte values, with XOR used as addition and themultiplication defined as above, has the structure of the finite field GF(28).
4.2.1 Multiplication by x
Multiplying the binary polynomial defined in equation (3.1) with the polynomial x results inb7 x 8 + b6 x 7 + b5 x 6 + b4 x 5 + b3 x 4 + b2 x 3 + b1 x 2 + b0 x .

(4.4)

The result x • b(x) is obtained by reducing the above result modulo m(x), as defined in equation(4.1). If b7 = 0, the result is already in reduced form. If b7 = 1, the reduction is accomplished bysubtracting (i.e., XORing) the polynomial m(x). It follows that multiplication by x (i.e.,{00000010} or {02}) can be implemented at the byte level as a left shift and a subsequentconditional bitwise XOR with {1b}. This operation on bytes is denoted by xtime().
Multiplication by higher powers of x can be implemented by repeated application of xtime().
By adding intermediate results, multiplication by any constant can be implemented.
For example, {57} • {13} = {fe} because
11

{57} • {02} = xtime({57}) = {ae}{57} • {04} = xtime({ae}) = {47}{57} • {08} = xtime({47}) = {8e}{57} • {10} = xtime({8e}) = {07},thus,{57} • {13} = {57} • ({01} ¯ {02} ¯ {10})= {57} ¯ {ae} ¯ {07}= {fe}.

4.3

Polynomials with Coefficients in GF(28)Four-term polynomials can be defined - with coefficients that are finite field elements - as:a(x) = a 3 x 3 + a 2 x 2 + a1 x + a0

(4.5)

which will be denoted as a word in the form [a0 , a1 , a2 , a3 ]. Note that the polynomials in thissection behave somewhat differently than the polynomials used in the definition of finite field
elements, even though both types of polynomials use the same indeterminate, x. The coefficientsin this section are themselves finite field elements, i.e., bytes, instead of bits; also, themultiplication of four-term polynomials uses a different reduction polynomial, defined below.
The distinction should always be clear from the context.
To illustrate the addition and multiplication operations, letb(x) = b3 x 3 + b2 x 2 + b1 x + b0

(4.6)

define a second four-term polynomial. Addition is performed by adding the finite field
coefficients of like powers of x. This addition corresponds to an XOR operation between thecorresponding bytes in each of the words – in other words, the XOR of the complete wordvalues.
Thus, using the equations of (4.5) and (4.6),
a(x) + b(x) = (a3 ¯ b3 )x 3 + (a2 ¯ b2 )x 2 + (a1 ¯ b1 )x + (a0 ¯ b0 )(4.7)

Multiplication is achieved in two steps. In the first step, the polynomial product c(x) = a(x) •b(x) is algebraically expanded, and like powers are collected to givec(x) = c6 x 6 + c5 x 5 + c4 x 4 + c3 x 3 + c2 x 2 + c1 x + c0

(4.8)

where
c0 = a0 • b0

c4 = a3 • b1 ¯ a2 • b2 ¯ a1 • b3

c1 = a1 • b0 ¯ a 0 • b1

c5 = a 3 • b2 ¯ a2 • b3

c2 = a 2 • b0 ¯ a1 • b1 ¯ a 0 • b2

c6 = a3 • b3

12

(4.9)

c3 = a 3 • b0 ¯ a 2 • b1 ¯ a1 • b2 ¯ a 0 • b3 .
The result, c(x), does not represent a four-byte word. Therefore, the second step of themultiplication is to reduce c(x) modulo a polynomial of degree 4; the result can be reduced to apolynomial of degree less than 4. For the AES algorithm, this is accomplished with thepolynomial x4 + 1, so thatx i mod(x 4 + 1) = x i mod 4 .

(4.10)The modular product of a(x) and b(x), denoted by a(x) ˜ b(x), is given by the four-term
polynomial d(x), defined as follows:
d (x) = d 3 x 3 + d 2 x 2 + d 1 x + d 0(4.11)

withd 0 = (a0 • b0 ) ¯ (a3 • b1 ) ¯ (a 2 • b2 ) ¯ (a1 • b3 )d1 = (a1 • b0 ) ¯ (a 0 • b1 ) ¯ (a3 • b2 ) ¯ (a 2 • b3 )(4.12)

d 2 = (a 2 • b0 ) ¯ (a1 • b1 ) ¯ (a 0 • b2 ) ¯ (a3 • b3 )d 3 = (a3 • b0 ) ¯ (a 2 • b1 ) ¯ (a1 • b2 ) ¯ (a0 • b3 )When a(x) is a fixed polynomial, the operation defined in equation (4.11) can be written in
matrix form as:
Ød 0 ø
Øa0Œd œŒaŒ 1œ = Œ 1
Œd 2 œ
Œa 2
Œ œŒ
ºd 3 ß
º a3

a3

a2

a0
a1

a3
a0
a1

a2

a1 ø Øb0 ø
a 2 œ Œ b1 œœŒ œ
a 3 œ Œb2 œœŒ œ
a 0 ß ºb3 ß(4.13)

Because x 4 + 1 is not an irreducible polynomial over GF(28), multiplication by a fixed four-term
polynomial is not necessarily invertible. However, the AES algorithm specifies a fixed four-term
polynomial that does have an inverse (see Sec. 5.1.3 and Sec. 5.3.3):
a(x) = {03}x3 + {01}x2 + {01}x + {02}(4.14)

a-1(x) = {0b}x3 + {0d}x2 + {09}x + {0e}.

(4.15)

Another polynomial used in the AES algorithm (see the RotWord() function in Sec. 5.2) has a0= a1 = a2 = {00} and a3 = {01}, which is the polynomial x3. Inspection of equation (4.13) above
will show that its effect is to form the output word by rotating bytes in the input word. Thismeans that [b0, b1, b2, b3] is transformed into [b1, b2, b3, b0].

5.

Algorithm Specification

For the AES algorithm, the length of the input block, the output block and the State is 128
bits. This is represented by Nb = 4, which reflects the number of 32-bit words (number ofcolumns) in the State.
13

For the AES algorithm, the length of the Cipher Key, K, is 128, 192, or 256 bits. The key
length is represented by Nk = 4, 6, or 8, which reflects the number of 32-bit words (number ofcolumns) in the Cipher Key.
For the AES algorithm, the number of rounds to be performed during the execution of thealgorithm is dependent on the key size. The number of rounds is represented by Nr, where Nr =10 when Nk = 4, Nr = 12 when Nk = 6, and Nr = 14 when Nk = 8.
The only Key-Block-Round combinations that conform to this standard are given in Fig. 4.
For implementation issues relating to the key length, block size and number of rounds, see Sec.
6.3.
Key Length

Block Size

(Nk words)(Nb words)

Number ofRounds(Nr)

AES-128

4

4

10

AES-192

6

4

12

AES-2568

4

14

Figure 4. Key-Block-Round Combinations.

For both its Cipher and Inverse Cipher, the AES algorithm uses a round function that iscomposed of four different byte-oriented transformations: 1) byte substitution using asubstitution table (S-box), 2) shifting rows of the State array by different offsets, 3) mixing thedata within each column of the State array, and 4) adding a Round Key to the State. Thesetransformations (and their inverses) are described in Sec. 5.1.1-5.1.4 and 5.3.1-5.3.4.
The Cipher and Inverse Cipher are described in Sec. 5.1 and Sec. 5.3, respectively, while the Key
Schedule is described in Sec. 5.2.

5.1

CipherAt the start of the Cipher, the input is copied to the State array using the conventions described inSec. 3.4. After an initial Round Key addition, the State array is transformed by implementing around function 10, 12, or 14 times (depending on the key length), with the final round differingslightly from the first Nr -1 rounds. The final State is then copied to the output as described inSec. 3.4.
The round function is parameterized using a key schedule that consists of a one-dimensional
array of four-byte words derived using the Key Expansion routine described in Sec. 5.2.
The Cipher is described in the pseudo code in Fig. 5. The individual transformations SubBytes(), ShiftRows(), MixColumns(), and AddRoundKey() – process the Stateand are described in the following subsections. In Fig. 5, the array w[] contains the keyschedule, which is described in Sec. 5.2.
As shown in Fig. 5, all Nr rounds are identical with the exception of the final round, which does
not include the MixColumns() transformation.

14

Appendix B presents an example of the Cipher, showing values for the State array at the
beginning of each round and after the application of each of the four transformations described in
the following sections.
Cipher(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])
begin
byte state[4,Nb]
state = in
AddRoundKey(state, w[0, Nb-1])// See Sec. 5.1.4

for round = 1 step 1 to Nr–1
SubBytes(state)// See Sec. 5.1.1
ShiftRows(state)// See Sec. 5.1.2
MixColumns(state)// See Sec. 5.1.3
AddRoundKey(state, w[round*Nb, (round+1)*Nb-1])
end for
SubBytes(state)
ShiftRows(state)
AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb-1])
out = state
end

Figure 5. Pseudo Code for the Cipher.1

5.1.1 SubBytes()Transformation
The SubBytes() transformation is a non-linear byte substitution that operates independently
on each byte of the State using a substitution table (S-box). This S-box (Fig. 7), which isinvertible, is constructed by composing two transformations:
1. Take the multiplicative inverse in the finite field GF(28), described in Sec. 4.2; theelement {00} is mapped to itself.
2. Apply the following affine transformation (over GF(2) ):bi' = bi ¯ b(i + 4) mod 8 ¯ b(i +5) mod 8 ¯ b(i +6) mod 8 ¯ b(i +7) mod 8 ¯ ci

(5.1)

for 0 £ i < 8 , where bi is the ith bit of the byte, and ci is the ith bit of a byte c with thevalue {63} or {01100011}. Here and elsewhere, a prime on a variable (e.g., b¢ )indicates that the variable is to be updated with the value on the right.
In matrix form, the affine transformation element of the S-box can be expressed as:

1

The various transformations (e.g., SubBytes(), ShiftRows(), etc.) act upon the State array that is addressedby the ‘state’ pointer. AddRoundKey() uses an additional pointer to address the Round Key.

15Øb0' ø Ø1
Œ 'œ Œ
Œ b1 œ Œ1
Œb2' œ Œ1
Œ 'œ Œ
Œb3 œ = Œ1
Œb ' œ Œ1
Œ 4' œ Œ
Œb5 œ Œ0Œb' œ Œ0
Œ 6œ Œ
Œºb7' œß Œº0

0 0 0 1 1 1 1ø Øb0 ø Ø1ø
1 0 0 0 1 1 1œœ ŒŒ b1 œœ ŒŒ1œœ
1 1 0 0 0 1 1œ Œb2 œ Œ0œ
œŒ œ Œ œ
1 1 1 0 0 0 1œ Œb3 œ Œ0œ
+.
1 1 1 1 0 0 0œ Œb4 œ Œ0œ
œŒ œ Œ œ
1 1 1 1 1 0 0œ Œb5 œ Œ1œ
0 1 1 1 1 1 0œ Œb6 œ Œ1œ
œŒ œ Œ œ
0 0 1 1 1 1 1œß Œºb7 ßœ Œº0œß

(5.2)

Figure 6 illustrates the effect of the SubBytes() transformation on the State.

s0,0 s0,1 s0,2 s0,3

S-Box

'
'
'
'
s0,0
s0,1
s0,2
s0,3

s1,0 s1,1 s1,2 s1,3

'
s1,0

'
s1' ,1' s1,2

s2,0 s2,1 s2,2 s2,3

s

'
2,0

'
2,1

s3,0 s3,1 s3,2 s3,3

'
'
'
'
s3,0
s3,1
s3,2
s3,3

sr ,c

sr ,c

s

'
s1,3

'
'
s2,2
s2,3

Figure 6. SubBytes() applies the S-box to each byte of the State.

The S-box used in the SubBytes() transformation is presented in hexadecimal form in Fig. 7.
For example, if s1,1 = {53}, then the substitution value would be determined by the intersectionof the row with index ‘5’ and the column with index ‘3’ in Fig. 7. This would result in s1¢,1 having
a value of {ed}.
y
0
1
2
3
4
5
6
7
x
8
9
a
b
c
d
e
f

0
63
ca
b7
04
09
53
d0
51
cd
60
e0
e7
ba
70
e1
8c

1
7c
82
fd
c7
83
d1
ef
a3
0c
81
32
c8
78
3e
f8
a1

2
77
c9
93
23
2c
00
aa
40
13
4f
3a
37
25
b5
98
89

3
7b
7d
26
c3
1a
ed
fb
8f
ec
dc
0a
6d
2e
66
11
0d

4
f2
fa
36
18
1b
20
43
92
5f
22
49
8d
1c
48
69
bf

5
6b
59
3f
96
6e
fc
4d
9d
97
2a
06
d5
a6
03
d9
e6

6
6f
47
f7
05
5a
b1
33
38
44
90
24
4e
b4
f6
8e
42

7
c5
f0
cc
9a
a0
5b
85
f5
17
88
5c
a9
c6
0e
94
68

8
30
ad
34
07
52
6a
45
bc
c4
46
c2
6c
e8
61
9b
41

9
01
d4
a5
12
3b
cb
f9
b6
a7
ee
d3
56
dd
35
1e
99

a
67
a2
e5
80
d6
be
02
da
7e
b8
ac
f4
74
57
87
2d

b
2b
af
f1
e2
b3
39
7f
21
3d
14
62
ea
1f
b9
e9
0f

c
fe
9c
71
eb
29
4a
50
10
64
de
91
65
4b
86
ce
b0

d
d7
a4
d8
27
e3
4c
3c
ff
5d
5e
95
7a
bd
c1
55
54

e
ab
72
31
b2
2f
58
9f
f3
19
0b
e4
ae
8b
1d
28
bb

f
76
c0
15
75
84
cf
a8
d2
73
db
79
08
8a
9e
df
16

Figure 7. S-box: substitution values for the byte xy (in hexadecimal format).

16

5.1.2 ShiftRows() Transformation
In the ShiftRows() transformation, the bytes in the last three rows of the State are cyclicallyshifted over different numbers of bytes (offsets). The first row, r = 0, is not shifted.
Specifically, the ShiftRows() transformation proceeds as follows:sr' ,c = sr ,(c + shift (r , Nb)) mod Nb for 0 < r < 4 and 0 £ c < Nb,(5.3)

where the shift value shift(r,Nb) depends on the row number, r, as follows (recall that Nb = 4):
shift(1,4) = 1 ; shift(2,4) = 2 ; shift(3,4) = 3 .

(5.4)

This has the effect of moving bytes to “lower” positions in the row (i.e., lower values of c in agiven row), while the “lowest” bytes wrap around into the “top” of the row (i.e., higher values ofc in a given row).
Figure 8 illustrates the ShiftRows() transformation.
ShiftRows()

sr' , 0 sr' ,1 sr' , 2 sr' ,3sr , 0 sr ,1 sr , 2 sr ,3SS’

s0,0 s0,1 s0,2 s0,3

s0,0 s0,1 s0,2 s0,3

s1,0 s1,1 s1,2 s1,3s1,1s2,0 s2,1 s2,2 s2,3

s2,2 s2,3 s2,0 s2,1

s3,0 s3,1 s3,2 s3,3

s3,3 s3,0 s3,1 s3,2

s1,2

s1,3

s1,0

Figure 8. ShiftRows() cyclically shifts the last three rows in the State.

5.1.3 MixColumns() Transformation
The MixColumns() transformation operates on the State column-by-column, treating eachcolumn as a four-term polynomial as described in Sec. 4.3. The columns are considered aspolynomials over GF(28) and multiplied modulo x4 + 1 with a fixed polynomial a(x), given bya(x) = {03}x3 + {01}x2 + {01}x + {02} .
As described in Sec. 4.3, this can be written as a matrix multiplication. Lets ¢(x) = a(x) ˜ s(x) :

17

(5.5)

Ø s0,' c ø Ø02
Œ ' œ ŒŒ s1, c œ = Œ 01
Œ s2,' c œ Œ 01
Œ ' œ ŒŒº s3, c œß º03

03
02
01
01

01
03
02
01

01ø Ø s0, c øŒ œ01œœ Œ s1, c œ
03œ Œ s2, c œœŒ œ02ß º s3, c ß

for 0 £ c < Nb.

(5.6)

As a result of this multiplication, the four bytes in a column are replaced by the following:s 0,¢ c = ({02} • s0,c ) ¯ ({03} • s1,c ) ¯ s 2,c ¯ s3,cs1,¢ c = s0,c ¯ ({02} • s1,c ) ¯ ({03} • s 2,c ) ¯ s3,cs 2,¢ c = s0,c ¯ s1,c ¯ ({02} • s 2,c ) ¯ ({03} • s3,c )s3,¢ c = ({03} • s0,c ) ¯ s1,c ¯ s 2,c ¯ ({02} • s3,c ).

Figure 9 illustrates the MixColumns() transformation.
MixColumns()s0,cs0,0 s0,1 s0, 2 s0,3ss'0' ,c'0, 0ss0,1 s0' , 2 s0' ,3'1, 0

ss '1' ,c s 's1' ,3s1, 0 s11,,1c s1, 2 s1,3s

s2, 0 ss22,,1c s2, 2 s2 ,3s2' , 0 ss2'2,1,c s2' , 2 s2' ,3s3, 0 ss33,,1c s3, 2 s3,3

s3' ,0 ss3'3,1,c s3' , 2 s3' ,3

1,1

1, 2

'

'

Figure 9. MixColumns() operates on the State column-by-column.

5.1.4 AddRoundKey() Transformation
In the AddRoundKey() transformation, a Round Key is added to the State by a simple bitwise
XOR operation. Each Round Key consists of Nb words from the key schedule (described in Sec.
5.2). Those Nb words are each added into the columns of the State, such that[ s ' 0,c , s '1,c , s ' 2,c , s '3,c ] = [ s 0,c , s1,c , s 2,c , s 3,c ] ¯ [ wround *Nb+c ]for 0 £ c < Nb,(5.7)

where [wi] are the key schedule words described in Sec. 5.2, and round is a value in the range
0 £ round £ Nr. In the Cipher, the initial Round Key addition occurs when round = 0, prior to
the first application of the round function (see Fig. 5). The application of the AddRoundKey()
transformation to the Nr rounds of the Cipher occurs when 1 £ round £ Nr.
The action of this transformation is illustrated in Fig. 10, where l = round * Nb. The byte
address within words of the key schedule was described in Sec. 3.1.

18

l = round * Nbs0,cs0' ,cs0,0 s0,1 s0, 2 s0,3s0' , 0 s0' ,1' s0' , 2 s0' ,3s1,cs1, 0 s1,1 s1, 2 s1,3

¯w w w
l

l +1

l +2

s1,c

wl + 3s1' ,0 s1' ,1 s1' , 2 s1' ,3
'

s2 ,3

s2' , 0 ss2' ,12,c s2' , 2 s2' ,3s3, 0 s3s,1 s3, 2 s3,3

s3' ,0 s3s' ,13,c s3' , 2 s3' ,3s2 , 0s s2,c s

wl+c

2 ,1

2, 2

'

3,c

Figure 10. AddRoundKey() XORs each column of the State with a wordfrom the key schedule.

5.2

Key Expansion

The AES algorithm takes the Cipher Key, K, and performs a Key Expansion routine to generate a
key schedule. The Key Expansion generates a total of Nb (Nr + 1) words: the algorithm requires
an initial set of Nb words, and each of the Nr rounds requires Nb words of key data. The
resulting key schedule consists of a linear array of 4-byte words, denoted [wi ], with i in the range
0 £ i < Nb(Nr + 1).
The expansion of the input key into the key schedule proceeds according to the pseudo code in
Fig. 11.
SubWord() is a function that takes a four-byte input word and applies the S-box (Sec. 5.1.1,
Fig. 7) to each of the four bytes to produce an output word. The function RotWord() takes aword [a0,a1,a2,a3] as input, performs a cyclic permutation, and returns the word [a1,a2,a3,a0]. The
round constant word array, Rcon[i], contains the values given by [xi-1,{00},{00},{00}], with
x i-1 being powers of x (x is denoted as {02}) in the field GF(28), as discussed in Sec. 4.2 (notethat i starts at 1, not 0).
From Fig. 11, it can be seen that the first Nk words of the expanded key are filled with the
Cipher Key. Every following word, w[[i]], is equal to the XOR of the previous word, w[[i-1]], andthe word Nk positions earlier, w[[i-Nk]]. For words in positions that are a multiple of Nk, atransformation is applied to w[[i-1]] prior to the XOR, followed by an XOR with a roundconstant, Rcon[i]. This transformation consists of a cyclic shift of the bytes in a word
(RotWord()), followed by the application of a table lookup to all four bytes of the word
(SubWord()).
It is important to note that the Key Expansion routine for 256-bit Cipher Keys (Nk = 8) isslightly different than for 128- and 192-bit Cipher Keys. If Nk = 8 and i-4 is a multiple of Nk,
then SubWord() is applied to w[[i-1]] prior to the XOR.

19

KeyExpansion(byte key[4*Nk], word w[Nb*(Nr+1)], Nk)
beginword temp
i = 0
while (i < Nk)
w[i] = word(key[4*i], key[4*i+1], key[4*i+2], key[4*i+3])
i = i+1
end whilei = Nkwhile (i < Nb * (Nr+1)]
temp = w[i-1]if (i mod Nk = 0)
temp = SubWord(RotWord(temp)) xor Rcon[i/Nk]
else if (Nk > 6 and i mod Nk = 4)
temp = SubWord(temp)
end ifw[i] = w[i-Nk] xor tempi = i + 1
end while
end
Note that Nk=4, 6, and 8 do not all have to be implemented;
they are all included in the conditional statement above for
conciseness.
Specific implementation requirements for the
Cipher Key are presented in Sec. 6.1.

Figure 11. Pseudo Code for Key Expansion.2

Appendix A presents examples of the Key Expansion.

5.3

Inverse Cipher

The Cipher transformations in Sec. 5.1 can be inverted and then implemented in reverse order toproduce a straightforward Inverse Cipher for the AES algorithm. The individual transformations
used in the Inverse Cipher - InvShiftRows(), InvSubBytes(),InvMixColumns(),
and AddRoundKey() – process the State and are described in the following subsections.
The Inverse Cipher is described in the pseudo code in Fig. 12. In Fig. 12, the array w[] contains
the key schedule, which was described previously in Sec. 5.2.

2

The functions SubWord() and RotWord() return a result that is a transformation of the function input, whereas
the transformations in the Cipher and Inverse Cipher (e.g., ShiftRows(), SubBytes(), etc.) transform theState array that is addressed by the ‘state’ pointer.

20

InvCipher(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])
begin
byte state[4,Nb]
state = in
AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb-1]) // See Sec. 5.1.4
for round = Nr-1 step -1 downto 1
InvShiftRows(state)// See Sec. 5.3.1
InvSubBytes(state)// See Sec. 5.3.2
AddRoundKey(state, w[round*Nb, (round+1)*Nb-1])
InvMixColumns(state)// See Sec. 5.3.3
end forInvShiftRows(state)
InvSubBytes(state)
AddRoundKey(state, w[0, Nb-1])
out = state
end

Figure 12. Pseudo Code for the Inverse Cipher.3

5.3.1 InvShiftRows() Transformation
InvShiftRows() is the inverse of the ShiftRows() transformation. The bytes in the last
three rows of the State are cyclically shifted over different numbers of bytes (offsets). The firstrow, r = 0, is not shifted. The bottom three rows are cyclically shifted by Nb - shift(r, Nb)
bytes, where the shift value shift(r,Nb) depends on the row number, and is given in equation (5.4)(see Sec. 5.1.2).
Specifically, the InvShiftRows() transformation proceeds as follows:sr' ,(c + shift (r, Nb)) mod Nb = sr,c for 0 < r < 4 and 0 £ c < Nb

(5.8)

Figure 13 illustrates the InvShiftRows() transformation.

3

The various transformations (e.g., InvSubBytes(), InvShiftRows(), etc.) act upon the State array that isaddressed by the ‘state’ pointer. AddRoundKey() uses an additional pointer to address the Round Key.

21

InvShiftRows()

sr' , 0 sr' ,1 sr' , 2 sr' ,3sr , 0 sr ,1 sr , 2 sr ,3SS’

s0,0 s0,1 s0,2 s0,3

s0,0 s0,1 s0,2 s0,3

s1,0 s1,1 s1,2 s1,3s1,3s2,0 s2,1 s2,2 s2,3

s2,2 s2,3 s2,0 s2,1

s3,0 s3,1 s3,2 s3,3

s3,1 s3,2 s3,3 s3,0s1,0s1,1 s1,2

Figure 13. InvShiftRows()cyclically shifts the last three rows in the State.

5.3.2 InvSubBytes() Transformation
InvSubBytes() is the inverse of the byte substitution transformation, in which the inverse Sbox is applied to each byte of the State. This is obtained by applying the inverse of the affine
transformation (5.1) followed by taking the multiplicative inverse in GF(28).
The inverse S-box used in the InvSubBytes() transformation is presented in Fig. 14:
y
0
1
2
3
4
5
6
7
x
8
9
a
b
c
d
e
f

0
52
7c
54
08
72
6c
90
d0
3a
96
47
fc
1f
60
a0
17

1
09
e3
7b
2e
f8
70
d8
2c
91
ac
f1
56
dd
51
e0
2b

2
6a
39
94
a1
f6
48
ab
1e
11
74
1a
3e
a8
7f
3b
04

3
d5
82
32
66
64
50
00
8f
41
22
71
4b
33
a9
4d
7e

4
30
9b
a6
28
86
fd
8c
ca
4f
e7
1d
c6
88
19
ae
ba

5
36
2f
c2
d9
68
ed
bc
3f
67
ad
29
d2
07
b5
2a
77

6
a5
ff
23
24
98
b9
d3
0f
dc
35
c5
79
c7
4a
f5
d6

7
38
87
3d
b2
16
da
0a
02
ea
85
89
20
31
0d
b0
26

8
bf
34
ee
76
d4
5e
f7
c1
97
e2
6f
9a
b1
2d
c8
e1

9
40
8e
4c
5b
a4
15
e4
af
f2
f9
b7
db
12
e5
eb
69

a
a3
43
95
a2
5c
46
58
bd
cf
37
62
c0
10
7a
bb
14

b
9e
44
0b
49
cc
57
05
03
ce
e8
0e
fe
59
9f
3c
63

c
81
c4
42
6d
5d
a7
b8
01
f0
1c
aa
78
27
93
83
55

d
f3
de
fa
8b
65
8d
b3
13
b4
75
18
cd
80
c9
53
21

Figure 14. Inverse S-box: substitution values for the byte xy (inhexadecimal format).

22

e
d7
e9
c3
d1
b6
9d
45
8a
e6
df
be
5a
ec
9c
99
0c

f
fb
cb
4e
25
92
84
06
6b
73
6e
1b
f4
5f
ef
61
7d

5.3.3 InvMixColumns() Transformation
InvMixColumns() is the inverse of the MixColumns() transformation.
InvMixColumns() operates on the State column-by-column, treating each column as a fourterm polynomial as described in Sec. 4.3. The columns are considered as polynomials over
GF(28) and multiplied modulo x4 + 1 with a fixed polynomial a-1(x), given bya-1(x) = {0b}x3 + {0d}x2 + {09}x + {0e}.

(5.9)

As described in Sec. 4.3, this can be written as a matrix multiplication. Lets ¢(x) = a -1 (x) ˜ s(x) :Ø s0,' c ø Ø 0e 0b 0d 09 ø Ø s0, c øŒ ' œ ŒœŒ œŒ s1, c œ = Œ 09 0e 0b 0d œ Œ s1, c œŒ s2,' c œ Œ0d 09 0e 0b œ Œ s2, c œŒ ' œ ŒœŒ œ
Œº s3, c ßœ º 0b 0d 09 0e ß º s3, c ß

for 0 £ c < Nb.

(5.10)As a result of this multiplication, the four bytes in a column are replaced by the following:s 0,¢ c = ({0e} • s0,c ) ¯ ({0b} • s1,c ) ¯ ({0d} • s 2,c ) ¯ ({09} • s3,c )s1,¢ c = ({09} • s0,c ) ¯ ({0e} • s1,c ) ¯ ({0b} • s 2,c ) ¯ ({0d} • s3,c )s ¢2,c = ({0d} • s0,c ) ¯ ({09} • s1,c ) ¯ ({0e} • s 2,c ) ¯ ({0b} • s3,c )s3,¢ c = ({0b} • s0,c ) ¯ ({0d} • s1,c ) ¯ ({09} • s 2,c ) ¯ ({0e} • s3,c )
5.3.4 Inverse of the AddRoundKey() Transformation
AddRoundKey(), which was described in Sec. 5.1.4, is its own inverse, since it only involves
an application of the XOR operation.
5.3.5 Equivalent Inverse Cipher
In the straightforward Inverse Cipher presented in Sec. 5.3 and Fig. 12, the sequence of thetransformations differs from that of the Cipher, while the form of the key schedules forencryption and decryption remains the same. However, several properties of the AES algorithm
allow for an Equivalent Inverse Cipher that has the same sequence of transformations as the
Cipher (with the transformations replaced by their inverses). This is accomplished with a change
in the key schedule.
The two properties that allow for this Equivalent Inverse Cipher are as follows:
1. The SubBytes() and ShiftRows() transformations commute; that is, a
SubBytes() transformation immediately followed by a ShiftRows()
transformation is equivalent to a ShiftRows() transformation immediately
followed buy a SubBytes() transformation. The same is true for their inverses,
InvSubBytes() and InvShiftRows.
23

2. The column mixing operations - MixColumns() and InvMixColumns() - arelinear with respect to the column input, which means
InvMixColumns(state XOR Round Key) =InvMixColumns(state) XOR InvMixColumns(Round Key).

These properties allow the order of InvSubBytes() and InvShiftRows()
transformations to be reversed. The order of the AddRoundKey() and InvMixColumns()
transformations can also be reversed, provided that the columns (words) of the decryption key
schedule are modified using the InvMixColumns() transformation.
The equivalent inverse cipher is defined by reversing the order of the InvSubBytes() andInvShiftRows() transformations shown in Fig. 12, and by reversing the order of the
AddRoundKey() and InvMixColumns() transformations used in the “round loop” after
first modifying the decryption key schedule for round = 1 to Nr-1 using the
InvMixColumns() transformation. The first and last Nb words of the decryption key
schedule shall not be modified in this manner.
Given these changes, the resulting Equivalent Inverse Cipher offers a more efficient structure
than the Inverse Cipher described in Sec. 5.3 and Fig. 12. Pseudo code for the Equivalent
Inverse Cipher appears in Fig. 15. (The word array dw[] contains the modified decryption key
schedule. The modification to the Key Expansion routine is also provided in Fig. 15.)

24

EqInvCipher(byte in[4*Nb], byte out[4*Nb], word dw[Nb*(Nr+1)])
begin
byte state[4,Nb]
state = in
AddRoundKey(state, dw[Nr*Nb, (Nr+1)*Nb-1])
for round = Nr-1 step -1 downto 1
InvSubBytes(state)
InvShiftRows(state)
InvMixColumns(state)
AddRoundKey(state, dw[round*Nb, (round+1)*Nb-1])
end forInvSubBytes(state)
InvShiftRows(state)
AddRoundKey(state, dw[0, Nb-1])
out = stateend

For the Equivalent Inverse Cipher, the following pseudo code is added at
the end of the Key Expansion routine (Sec. 5.2):
for i = 0 step 1 to (Nr+1)*Nb-1
dw[i] = w[i]end forfor round = 1 step 1 to Nr-1
InvMixColumns(dw[round*Nb, (round+1)*Nb-1])
type
end for//notechangeofNote that, since InvMixColumns operates on a two-dimensional array of bytes
while the Round Keys are held in an array of words, the call to
InvMixColumns in this code sequence involves a change of type (i.e. theinput to InvMixColumns() is normally the State array, which is considered
to be a two-dimensional array of bytes, whereas the input here is a RoundKey computed as a one-dimensional array of words).

Figure 15. Pseudo Code for the Equivalent Inverse Cipher.

6.

Implementation Issues

6.1

Key Length Requirements

An implementation of the AES algorithm shall support at least one of the three key lengths
specified in Sec. 5: 128, 192, or 256 bits (i.e., Nk = 4, 6, or 8, respectively). Implementations
25

may optionally support two or three key lengths, which may promote the interoperability ofalgorithm implementations.

6.2

Keying Restrictions

No weak or semi-weak keys have been identified for the AES algorithm, and there is norestriction on key selection.

6.3

Parameterization of Key Length, Block Size, and Round NumberThis standard explicitly defines the allowed values for the key length (Nk), block size (Nb), andnumber of rounds (Nr) – see Fig. 4. However, future reaffirmations of this standard could
include changes or additions to the allowed values for those parameters. Therefore,
implementers may choose to design their AES implementations with future flexibility in mind.

6.4

Implementation Suggestions Regarding Various Platforms

Implementation variations are possible that may, in many cases, offer performance or otheradvantages. Given the same input key and data (plaintext or ciphertext), any implementation that
produces the same output (ciphertext or plaintext) as the algorithm specified in this standard is anacceptable implementation of the AES.
Reference [3] and other papers located at Ref. [1] include suggestions on how to efficiently
implement the AES algorithm on a variety of platforms.

26

Appendix A - Key Expansion Examples
This appendix shows the development of the key schedule for various key sizes. Note that multibyte values are presented using the notation described in Sec. 3. The intermediate values
produced during the development of the key schedule (see Sec. 5.2) are given in the following
table (all values are in hexadecimal format, with the exception of the index column (i)).

A.1

Expansion of a 128-bit Cipher Key

This section contains the key expansion of the following cipher key:
Cipher Key = 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

for Nk = 4, which results in
w0 = 2b7e1516

w1 = 28aed2a6

w2 = abf71588

w3 = 09cf4f3c

After XOR
After
After
Rcon[i/Nk]
RotWord() SubWord()with Rcon

w[i–Nk]w[i]=temp XOR
w[i-Nk]cf4f3c09

2b7e1516

a0fafe17a0fafe1728aed2a6

88542cb1

688542cb1

abf71588

23a33939

7

23a33939

09cf4f3c

2a6c7605

8

2a6c7605

a0fafe17

f2c295f2

9

f2c295f2

88542cb1

7a96b943

10

7a96b943

23a33939

5935807a

115935807a2a6c7605

7359f67f

127359f67f

f2c295f2

3d80477d

13

3d80477d

7a96b943

4716fe3e

144716fe3e5935807a

1e237e4415

1e237e447359f67f

6d7a883b16

6d7a883b

3d80477d

ef44a541

17

ef44a5414716fe3ea8525b7f

18

a8525b7f

1e237e44b671253b

19

b671253b6d7a883b

db0bad00

20

db0bad00

ef44a541

d4d1c6f8

21

d4d1c6f8

a8525b7f

7c839d87

22

7c839d87

b671253b

caf2b8bc

23

caf2b8bc

db0bad00

11f915bc

i
(dec)

temp

4

09cf4f3c

5

6c76052a

59f67f73

7a883b6d0bad00db

8a84eb01

50386be5

cb42d28f

dac4e23c

2b9563b9

01000000

02000000

04000000

08000000

1000000027

8b84eb01

52386be5

cf42d28f

d2c4e23c

3b9563b9

24

11f915bc

25

d4d1c6f8

6d88a37a

6d88a37a

7c839d87

110b3efd26

110b3efd

caf2b8bc

dbf98641

27

dbf98641

11f915bc

ca0093fd

28

ca0093fd

6d88a37a

4e54f70e

29

4e54f70e

110b3efd

5f5fc9f330

5f5fc9f3

dbf98641

84a64fb2

31

84a64fb2

ca0093fd

4ea6dc4f

32

4ea6dc4f

4e54f70e

ead2732133

ead27321

5f5fc9f3

b58dbad2

34

b58dbad2

84a64fb2

312bf560

35

312bf560

4ea6dc4f

7f8d292f

36

7f8d292f

ead27321

ac7766f3

37

ac7766f3

b58dbad2

19fadc21

38

19fadc21

312bf560

28d12941

39

28d12941

7f8d292f

575c006e40

575c006e

ac7766f3

d014f9a8

41d014f9a8

19fadc21

c9ee258942c9ee2589

28d12941

e13f0cc843

e13f0cc8575c006e

b6630ca6

A.2

f915bc110093fdca

a6dc4f4e

8d292f7f

5c006e5799596582

63dc5474

2486842f

5da515d2

4a639f5b

20000000

40000000

80000000

1b000000

36000000b9596582

23dc5474

a486842f

46a515d2

7c639f5b

Expansion of a 192-bit Cipher Key

This section contains the key expansion of the following cipher key:
Cipher Key =8e 73 b0 f7 da 0e 64 52 c8 10 f3 2b
80 90 79 e5 62 f8 ea d2 52 2c 6b 7bfor Nk = 6, which results in
w0 = 8e73b0f7

w1 = da0e6452

w4 = 62f8ead2

w5 = 522c6b7b

w2 = c810f32b

w3 = 809079e5

After XOR
After
After
Rcon[i/Nk]
RotWord() SubWord()with Rcon

w[i–Nk]w[i]=temp XOR
w[i-Nk]2c6b7b52

8e73b0f7

fe0c91f7

fe0c91f7

da0e6452

2402f5a52402f5a5

c810f32bec12068e

i
(dec)

temp

6

522c6b7b7
8717f2100

01000000

28

707f2100

9ec12068e

809079e56c827f6b106c827f6b

62f8ead2

0e7a95b9

11

0e7a95b9

522c6b7b

5c56fec2

12

5c56fec2

fe0c91f7

4db7b4bd

13

4db7b4bd

2402f5a5

69b54118

1469b54118

ec12068e

85a74796

15

85a74796

6c827f6be92538fd

16e92538fd

0e7a95b9e75fad4417

e75fad44

5c56fec2

bb095386

18

bb095386

4db7b4bd

485af057

19

485af057

69b54118

21efb14f

20

21efb14f

85a74796

a448f6d9

21

a448f6d9e92538fd

4d6dce2422

4d6dce24

e75fad44aa326360

23

aa326360

bb095386

113b30e6

24

113b30e6

485af057

a25e7ed525

a25e7ed5

21efb14f

83b1cf9a

26

83b1cf9aa448f6d9

27f93943

27

27f93943

4d6dce24

6a94f767

28

6a94f767

aa326360

c0a6940729

c0a69407

113b30e6

d19da4e130

d19da4e1

a25e7ed5

ec1786eb

31

ec1786eb

83b1cf9a

6fa64971

32

6fa64971

27f93943

485f7032

33

485f7032

6a94f767

22cb8755

34

22cb8755

c0a69407

e26d1352

35

e26d1352

d19da4e1

33f0b7b3

36

33f0b7b3

ec1786eb

40beeb28

37

40beeb28

6fa64971

2f18a259

38

2f18a259

485f7032

6747d26b

396747d26b

22cb8755

458c553e40

458c553ee26d1352

a7e1466c

41

a7e1466c

33f0b7b3

9411f1df

42

9411f1df

40beeb28

821f750a

43

821f750a

2f18a259

ad07d753

56fec25c

095386bb

3b30e611

9da4e1d1

f0b7b333

11f1df94

b1bb254a

01ed44ea

e2048e82

5e49f83e

8ca96dc3

82a19e22

02000000

04000000

08000000

10000000

20000000

4000000029

b3bb254a05ed44eaea048e82

4e49f83e

aca96dc3

c2a19e22

44

ad07d753

6747d26b

ca40053845

ca400538

458c553e

8fcc5006

46

8fcc5006

a7e1466c

282d166a47

282d166a

9411f1df

bc3ce7b548

bc3ce7b5

821f750ae98ba06f

49

e98ba06f

ad07d753

448c773c50

448c773c

ca400538

8ecc720451

8ecc72048fcc5006

01002202

A.3

3ce7b5bc

eb94d565

80000000

6b94d565

Expansion of a 256-bit Cipher Key

This section contains the key expansion of the following cipher key:
Cipher Key =60 3d eb 10 15 ca 71 be 2b 73 ae f0 85 7d 77 81
1f 35 2c 07 3b 61 08 d7 2d 98 10 a3 09 14 df f4

for Nk = 8, which results in
w0 = 603deb10

w1 = 15ca71be

w2 = 2b73aef0

w3 = 857d7781

w4 = 1f352c07

w5 = 3b6108d7

w6 = 2d9810a3

w7 = 0914dff4

After XOR
After
After
Rcon[i/Nk]
RotWord() SubWord()with Rcon

w[i–Nk]w[i]=temp XOR
w[i-Nk]14dff409

603deb10

9ba35411

9ba35411

15ca71be8e6925af

108e6925af

2b73aef0

a51a8b5f

11

a51a8b5f

857d7781

2067fcde

122067fcde

1f352c07

a8b09c1a13

a8b09c1a3b6108d7

93d194cd

14

93d194cd

2d9810a3

be49846e15

be49846e

0914dff4

b75d5b9a16

b75d5b9a9ba35411d59aecb8

17d59aecb88e6925af

5bf3c917

18

5bf3c917

a51a8b5f

fee94248

19

fee94248

2067fcdede8ebe96

20

de8ebe96

a8b09c1ab5a9328a21

b5a9328a93d194cd

2678a647222678a647

be49846e

98312229

i
(dec)

temp

8

0914dff4

9

fa9ebf01

01000000

fb9ebf01

b785b01d

5d5b9ab7

4c39b8a902000000

1d19ae9030

4e39b8a9

2398312229

b75d5b9a2f6c79b3

24

2f6c79b3d59aecb8

812c81ad25

812c81ad

5bf3c917

dadf48ba26

dadf48ba

fee94248

24360af2

2724360af2

de8ebe96

fab8b464

28

fab8b464

b5a9328a98c5bfc929

98c5bfc92678a647

bebd198e30

bebd198e

98312229

268c3ba7

31268c3ba7

2f6c79b3

09e0421432

09e04214

812c81ad

68007bac

33

68007bac

dadf48ba

b2df3316

34

b2df3316

24360af2

96e939e435

96e939e4

fab8b464

6c518d80

36

6c518d80

98c5bfc9

c814e20437

c814e204

bebd198e

76a9fb8a38

76a9fb8a268c3ba75025c02d

395025c02d

09e04214

59c58239

40

59c58239

68007bacde136967

41

de136967

b2df3316

6ccc5a71

42

6ccc5a71

96e939e4

fa256395

43

fa256395

6c518d80

9674ee15

449674ee15c814e204

5886ca5d

45

5886ca5d

76a9fb8a2e2f31d7

46

2e2f31d7

5025c02d

7e0af1fa

47

7e0af1fa

59c58239

27cf73c3

48

27cf73c3

de136967

749c47ab49

749c47ab

6ccc5a71

18501dda

50

18501dda

fa256395

e2757e4f

51

e2757e4f

9674ee157401905a

527401905a

5886ca5d

cafaaae3

53

cafaaae3

2e2f31d7

e4d59b3454

e4d59b34

7e0af1fa

9adf6ace55

9adf6ace

27cf73c3

bd10190d

56

bd10190d

749c47ab

fe4890d1

57

fe4890d1

18501dda

e6188d0b

6c79b32f

50b66d15

04000000

54b66d15

2d6c8d43e0421409

e12cfa01

08000000

e92cfa01

50d15dcd

c5823959

a61312cb

10000000

b61312cb

90922859

cf73c327

8a8f2ecc

20000000

aa8f2ecc

927c60be10190dbd

cad4d77a

4000000031

8ad4d77a

58e6188d0be2757e4f

046df34459

046df344

7401905a706c631e

32Appendix B – Cipher Example
The following diagram shows the values in the State array as the Cipher progresses for a block
length and a Cipher Key length of 16 bytes each (i.e., Nb = 4 and Nk = 4).
Input =

32 43 f6 a8 88 5a 30 8d 31 31 98 a2 e0 37 07 34

Cipher Key = 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

The Round Key values are taken from the Key Expansion example in Appendix A.
Round
NumberStart of
Round

After
SubBytes

After
ShiftRows

After
MixColumns

Round KeyValue

32 88 31 e0

2b 28 ab 09

43 5a 31 37

¯

input
f6 30 98 07
a8 8d a2 34

19 a0 9a e97e ae f7 cf=
15 d2 15 4f
16 a6 88 3c

d4 e0 b8 1e

d4 e0 b8 1e

04 e0 48 28

a0 88 23 2a

3d f4 c6 f8

27 bf b4 41

bf b4 41 27

66 cb f8 06

e3 e2 8d 48

11 98 5d 52

5d 52 11 98

81 19 d3 26

be 2b 2a 08

ae f1 e5 30

30 ae f1 e5e5 9a 7a 4c

17 b1 39 05

a4 68 6b 02

49 45 7f 77

49 45 7f 77

58 1b db 1b

f2 7a 59 73

9c 9f 5b 6a

de db 39 02

db 39 02 de

4d 4b e7 6b

7f 35 ea 50

d2 96 87 53

87 53 d2 96

ca 5a ca b0

f2 2b 43 49

89 f1 1a 3b

3b 89 f1 1a

f1 ac a8 e5

f2 43 7a 7f

aa 61 82 68

ac ef 13 45

ac ef 13 45

75 20 53 bb

3d 47 1e 6d

1

2

¯

¯

fa 54 a3 6c=
fe 2c 39 76

c2 96 35 59=
95 b9 80 f6

8f dd d2 32

73 c1 b5 23

c1 b5 23 73

ec 0b c0 25

5f e3 4a 46

cf 11 d6 5a

d6 5a cf 11

09 63 cf d0

03 ef d2 9a7b df b5 b8

b8 7b df b5

93 33 7c dc

7d 3e 44 3b

48 67 4d d6

52 85 e3 f6

52 85 e3 f6

0f 60 6f 5e

ef a8 b6 db

6c 1d e3 5f

50 a4 11 cf

a4 11 cf 50

d6 31 c0 b3

4e 9d b1 58

2f 5e c8 6a

c8 6a 2f 5e

da 38 10 13

ee 0d 38 e7

28 d7 07 94

94 28 d7 07

a9 bf 6b 01

41 7f 3b 00

e0 c8 d9 85

e1 e8 35 97

e1 e8 35 97

25 bd b6 4c

d4 7c ca 1134

92 63 b1 b8

4f fb c8 6cfb c8 6c 4f

d1 11 3a 4c

7f 63 35 be

d2 fb 96 ae

96 ae d2 fb

a9 d1 33 c0

e8 c0 50 01

9b ba 53 7c

7c 9b ba 53

ad 68 8e b0

5

33

¯

¯

¯

80 16 23 7a=
47 fe 7e 88

44 52 71 0b=
a5 5b 25 ad

d1 83 f2 f9=
c6 9d b8 15
f8 87 bc bc

f1 c1 7c 5d

a1 78 10 4c

a1 78 10 4c

4b 2c 33 37

00 92 c8 b5

63 4f e8 d5

4f e8 d5 63

86 4a 9d d2

6f 4c 8b d5

a8 29 3d 03

3d 03 a8 29

8d 89 f4 18

55 ef 32 0c

fc df 23 fefe fc df 23

6d 80 e8 d8

7a fd 41 fd

26 3d e8 fd

f7 27 9b 54

f7 27 9b 54

14 46 27 34

4e 5f 84 4e6

6d 11 db ca¯

88 0b f9 00=
a3 3e 86 93

0e 41 64 d2

ab 83 43 b5

83 43 b5 ab

15 16 46 2a2e b7 72 8b

31 a9 40 3d

40 3d 31 a9

b5 15 56 d8

17 7d a9 25

f0 ff d3 3f

3f f0 ff d3

bf ec d7 43

0e f3 b2 4f

5a 19 a3 7a

be d4 0a da

be d4 0a da

00 b1 54 faea b5 31 7f

41 49 e0 8c

83 3b e1 64

3b e1 64 83

51 c8 76 1b

42 dc 19 04

2c 86 d4 f2

d4 f2 2c 86

2f 89 6d 99

b1 1f 65 0c

c8 c0 4d fe

fe c8 c0 4d

d1 ff cd ea

21 d2 60 2f

ea 04 65 85

87 f2 4d 97

87 f2 4d 97

47 40 a3 4c

ac 19 28 57

78

83 45 5d 96

ec 6e 4c 90

6e 4c 90 ec

37 d4 70 9f

5c 33 98 b0

4a c3 46 e7

46 e7 4a c3

94 e4 3a 42

f0 2d ad c58c d8 95 a6

a6 8c d8 95

ed a5 a6 bc

eb 59 8b 1be9 cb 3d af

e9 cb 3d af

40 2e a1 c3

09 31 32 2e

31 32 2e 09

f2 38 13 42

89 07 7d 2c

7d 2c 89 07

1e 84 e7 d2

72 5f 94 b5

b5 72 5f 94

910

39 02 dc 19
25 dc 11 6a
output84 09 85 0b
1d fb 97 32

34

¯

¯

¯

54 5f a6 a6=
f7 c9 4f dc

d2 8d 2b 8d=
73 ba f5 29

77 fa d1 5c=
66 dc 29 00
f3 21 41 6ed0 c9 e1 b6¯

14 ee 3f 63=
f9 25 0c 0c
a8 89 c8 a6

Appendix C – Example Vectors
This appendix contains example vectors, including intermediate values – for all three AES key
lengths (Nk = 4, 6, and 8), for the Cipher, Inverse Cipher, and Equivalent Inverse Cipher that aredescribed in Sec. 5.1, 5.3, and 5.3.5, respectively. Additional examples may be found at [1] and[5].
All vectors are in hexadecimal notation, with each pair of characters giving a byte value in which
the left character of each pair provides the bit pattern for the 4 bit group containing the higher
numbered bits using the notation explained in Sec. 3.2, while the right character provides the bit
pattern for the lower-numbered bits. The array index for all bytes (groups of two hexadecimal
digits) within these test vectors starts at zero and increases from left to right.
Legend for CIPHER (ENCRYPT) (round number r = 0 to 10, 12 or 14):
input:
start:
s_box:
s_row:
m_col:
k_sch:
output:cipher input
state at start of round[r]state after SubBytes()state after ShiftRows()
state after MixColumns()
key schedule value for round[r]cipher output

Legend for INVERSE CIPHER (DECRYPT) (round number r = 0 to 10, 12 or 14):
iinput: inverse cipher input
istart: state at start of round[r]is_box: state after InvSubBytes()
is_row: state after InvShiftRows()
ik_sch: key schedule value for round[r]ik_add: state after AddRoundKey()
ioutput: inverse cipher output

Legend for EQUIVALENT INVERSE CIPHER (DECRYPT) (round number r = 0 to 10, 12
or 14):
iinput: inverse cipher input
istart: state at start of round[r]is_box: state after InvSubBytes()
is_row: state after InvShiftRows()
im_col: state after InvMixColumns()
ik_sch: key schedule value for round[r]ioutput: inverse cipher output

C.1

AES-128 (Nk=4, Nr=10)

PLAINTEXT:
KEY:

00112233445566778899aabbccddeeff
000102030405060708090a0b0c0d0e0f

CIPHER (ENCRYPT):

35

round[ 0].input
round[ 0].k_sch
round[ 1].startround[ 1].s_box
round[ 1].s_row
round[ 1].m_colround[ 1].k_sch
round[ 2].startround[ 2].s_box
round[ 2].s_row
round[ 2].m_colround[ 2].k_sch
round[ 3].startround[ 3].s_box
round[ 3].s_row
round[ 3].m_colround[ 3].k_sch
round[ 4].startround[ 4].s_box
round[ 4].s_row
round[ 4].m_colround[ 4].k_sch
round[ 5].startround[ 5].s_box
round[ 5].s_row
round[ 5].m_colround[ 5].k_sch
round[ 6].startround[ 6].s_box
round[ 6].s_row
round[ 6].m_colround[ 6].k_sch
round[ 7].startround[ 7].s_box
round[ 7].s_row
round[ 7].m_colround[ 7].k_sch
round[ 8].startround[ 8].s_box
round[ 8].s_row
round[ 8].m_colround[ 8].k_sch
round[ 9].startround[ 9].s_box
round[ 9].s_row
round[ 9].m_colround[ 9].k_sch
round[10].startround[10].s_box
round[10].s_row
round[10].k_sch
round[10].output

00112233445566778899aabbccddeeff
000102030405060708090a0b0c0d0e0f
00102030405060708090a0b0c0d0e0f0
63cab7040953d051cd60e0e7ba70e18c
6353e08c0960e104cd70b751bacad0e7
5f72641557f5bc92f7be3b291db9f91a
d6aa74fdd2af72fadaa678f1d6ab76fe
89d810e8855ace682d1843d8cb128fe4
a761ca9b97be8b45d8ad1a611fc97369
a7be1a6997ad739bd8c9ca451f618b61
ff87968431d86a51645151fa773ad009
b692cf0b643dbdf1be9bc5006830b3fe
4915598f55e5d7a0daca94fa1f0a63f7
3b59cb73fcd90ee05774222dc067fb68
3bd92268fc74fb735767cbe0c0590e2d
4c9c1e66f771f0762c3f868e534df256
b6ff744ed2c2c9bf6c590cbf0469bf41
fa636a2825b339c940668a3157244d17
2dfb02343f6d12dd09337ec75b36e3f0
2d6d7ef03f33e334093602dd5bfb12c7
6385b79ffc538df997be478e7547d691
47f7f7bc95353e03f96c32bcfd058dfd
247240236966b3fa6ed2753288425b6c
36400926f9336d2d9fb59d23c42c3950
36339d50f9b539269f2c092dc4406d23
f4bcd45432e554d075f1d6c51dd03b3c
3caaa3e8a99f9deb50f3af57adf622aa
c81677bc9b7ac93b25027992b0261996
e847f56514dadde23f77b64fe7f7d490
e8dab6901477d4653ff7f5e2e747dd4f
9816ee7400f87f556b2c049c8e5ad036
5e390f7df7a69296a7553dc10aa31f6b
c62fe109f75eedc3cc79395d84f9cf5d
b415f8016858552e4bb6124c5f998a4cb458124c68b68a014b99f82e5f15554c
c57e1c159a9bd286f05f4be098c63439
14f9701ae35fe28c440adf4d4ea9c026
d1876c0f79c4300ab45594add66ff41f
3e175076b61c04678dfc2295f6a8bfc0
3e1c22c0b6fcbf768da85067f6170495
baa03de7a1f9b56ed5512cba5f414d23
47438735a41c65b9e016baf4aebf7ad2
fde3bad205e5d0d73547964ef1fe37f1
5411f4b56bd9700e96a0902fa1bb9aa1
54d990a16ba09ab596bbf40ea111702f
e9f74eec023020f61bf2ccf2353c21c7
549932d1f08557681093ed9cbe2c974e
bd6e7c3df2b5779e0b61216e8b10b689
7a9f102789d5f50b2beffd9f3dca4ea7
7ad5fda789ef4e272bca100b3d9ff59f
13111d7fe3944a17f307a78b4d2b30c5
69c4e0d86a7b0430d8cdb78070b4c55a

INVERSE CIPHER (DECRYPT):
round[ 0].iinput
69c4e0d86a7b0430d8cdb78070b4c55around[ 0].ik_sch
13111d7fe3944a17f307a78b4d2b30c5
round[ 1].istart
7ad5fda789ef4e272bca100b3d9ff59f

36

round[ 1].is_row
round[ 1].is_box
round[ 1].ik_sch
round[ 1].ik_add
round[ 2].istartround[ 2].is_row
round[ 2].is_box
round[ 2].ik_sch
round[ 2].ik_add
round[ 3].istartround[ 3].is_row
round[ 3].is_box
round[ 3].ik_sch
round[ 3].ik_add
round[ 4].istartround[ 4].is_row
round[ 4].is_box
round[ 4].ik_sch
round[ 4].ik_add
round[ 5].istartround[ 5].is_row
round[ 5].is_box
round[ 5].ik_sch
round[ 5].ik_add
round[ 6].istartround[ 6].is_row
round[ 6].is_box
round[ 6].ik_sch
round[ 6].ik_add
round[ 7].istartround[ 7].is_row
round[ 7].is_box
round[ 7].ik_sch
round[ 7].ik_add
round[ 8].istartround[ 8].is_row
round[ 8].is_box
round[ 8].ik_sch
round[ 8].ik_add
round[ 9].istartround[ 9].is_row
round[ 9].is_box
round[ 9].ik_sch
round[ 9].ik_add
round[10].istartround[10].is_row
round[10].is_box
round[10].ik_sch
round[10].ioutput

7a9f102789d5f50b2beffd9f3dca4ea7
bd6e7c3df2b5779e0b61216e8b10b689
549932d1f08557681093ed9cbe2c974e
e9f74eec023020f61bf2ccf2353c21c7
54d990a16ba09ab596bbf40ea111702f
5411f4b56bd9700e96a0902fa1bb9aa1
fde3bad205e5d0d73547964ef1fe37f1
47438735a41c65b9e016baf4aebf7ad2
baa03de7a1f9b56ed5512cba5f414d23
3e1c22c0b6fcbf768da85067f6170495
3e175076b61c04678dfc2295f6a8bfc0
d1876c0f79c4300ab45594add66ff41f
14f9701ae35fe28c440adf4d4ea9c026
c57e1c159a9bd286f05f4be098c63439
b458124c68b68a014b99f82e5f15554c
b415f8016858552e4bb6124c5f998a4c
c62fe109f75eedc3cc79395d84f9cf5d5e390f7df7a69296a7553dc10aa31f6b
9816ee7400f87f556b2c049c8e5ad036
e8dab6901477d4653ff7f5e2e747dd4f
e847f56514dadde23f77b64fe7f7d490
c81677bc9b7ac93b25027992b0261996
3caaa3e8a99f9deb50f3af57adf622aa
f4bcd45432e554d075f1d6c51dd03b3c
36339d50f9b539269f2c092dc4406d23
36400926f9336d2d9fb59d23c42c3950
247240236966b3fa6ed2753288425b6c
47f7f7bc95353e03f96c32bcfd058dfd
6385b79ffc538df997be478e7547d691
2d6d7ef03f33e334093602dd5bfb12c7
2dfb02343f6d12dd09337ec75b36e3f0
fa636a2825b339c940668a3157244d17
b6ff744ed2c2c9bf6c590cbf0469bf41
4c9c1e66f771f0762c3f868e534df256
3bd92268fc74fb735767cbe0c0590e2d
3b59cb73fcd90ee05774222dc067fb68
4915598f55e5d7a0daca94fa1f0a63f7
b692cf0b643dbdf1be9bc5006830b3fe
ff87968431d86a51645151fa773ad009
a7be1a6997ad739bd8c9ca451f618b61
a761ca9b97be8b45d8ad1a611fc97369
89d810e8855ace682d1843d8cb128fe4
d6aa74fdd2af72fadaa678f1d6ab76fe
5f72641557f5bc92f7be3b291db9f91a
6353e08c0960e104cd70b751bacad0e763cab7040953d051cd60e0e7ba70e18c
00102030405060708090a0b0c0d0e0f0
000102030405060708090a0b0c0d0e0f
00112233445566778899aabbccddeeff

EQUIVALENT INVERSE CIPHER (DECRYPT):
round[ 0].iinput
69c4e0d86a7b0430d8cdb78070b4c55around[ 0].ik_sch
13111d7fe3944a17f307a78b4d2b30c5
round[ 1].istart
7ad5fda789ef4e272bca100b3d9ff59f
round[ 1].is_box
bdb52189f261b63d0b107c9e8b6e776eround[ 1].is_row
bd6e7c3df2b5779e0b61216e8b10b689
round[ 1].im_col4773b91ff72f354361cb018ea1e6cf2c37

round[ 1].ik_sch
round[ 2].istartround[ 2].is_box
round[ 2].is_row
round[ 2].im_colround[ 2].ik_sch
round[ 3].istartround[ 3].is_box
round[ 3].is_row
round[ 3].im_colround[ 3].ik_sch
round[ 4].istartround[ 4].is_box
round[ 4].is_row
round[ 4].im_colround[ 4].ik_sch
round[ 5].istartround[ 5].is_box
round[ 5].is_row
round[ 5].im_colround[ 5].ik_sch
round[ 6].istartround[ 6].is_box
round[ 6].is_row
round[ 6].im_colround[ 6].ik_sch
round[ 7].istartround[ 7].is_box
round[ 7].is_row
round[ 7].im_colround[ 7].ik_sch
round[ 8].istartround[ 8].is_box
round[ 8].is_row
round[ 8].im_colround[ 8].ik_sch
round[ 9].istartround[ 9].is_box
round[ 9].is_row
round[ 9].im_colround[ 9].ik_sch
round[10].istartround[10].is_box
round[10].is_row
round[10].ik_sch
round[10].ioutput

C.2

13aa29be9c8faff6f770f58000f7bf03
54d990a16ba09ab596bbf40ea111702f
fde596f1054737d235febad7f1e3d04e
fde3bad205e5d0d73547964ef1fe37f1
2d7e86a339d9393ee6570a1101904e16
1362a4638f2586486bff5a76f7874a83
3e1c22c0b6fcbf768da85067f6170495
d1c4941f7955f40fb46f6c0ad68730ad
d1876c0f79c4300ab45594add66ff41f
39daee38f4f1a82aaf432410c36d45b9
8d82fc749c47222be4dadc3e9c7810f5
b458124c68b68a014b99f82e5f15554c
c65e395df779cf09ccf9e1c3842fed5d
c62fe109f75eedc3cc79395d84f9cf5d
9a39bf1d05b20a3a476a0bf79fe51184
72e3098d11c5de5f789dfe1578a2cccb
e8dab6901477d4653ff7f5e2e747dd4f
c87a79969b0219bc2526773bb016c992
c81677bc9b7ac93b25027992b0261996
18f78d779a93eef4f6742967c47f5ffd
2ec410276326d7d26958204a003f32de
36339d50f9b539269f2c092dc4406d23
2466756c69d25b236e4240fa8872b332
247240236966b3fa6ed2753288425b6c
85cf8bf472d124c10348f545329c0053
a8a2f5044de2c7f50a7ef79869671294
2d6d7ef03f33e334093602dd5bfb12c7
fab38a1725664d2840246ac957633931
fa636a2825b339c940668a3157244d17
fc1fc1f91934c98210fbfb8da340eb21
c7c6e391e54032f1479c306d6319e50c
3bd92268fc74fb735767cbe0c0590e2d
49e594f755ca638fda0a59a01f15d7fa
4915598f55e5d7a0daca94fa1f0a63f7
076518f0b52ba2fb7a15c8d93be45e00
a0db02992286d160a2dc029c2485d561
a7be1a6997ad739bd8c9ca451f618b61
895a43e485188fe82d121068cbd8ced889d810e8855ace682d1843d8cb128fe4
ef053f7c8b3d32fd4d2a64ad3c93071a
8c56dff0825dd3f9805ad3fc8659d7fd
6353e08c0960e104cd70b751bacad0e70050a0f04090e03080d02070c01060b0
00102030405060708090a0b0c0d0e0f0
000102030405060708090a0b0c0d0e0f
00112233445566778899aabbccddeeff

AES-192 (Nk=6, Nr=12)

PLAINTEXT:
KEY:

00112233445566778899aabbccddeeff
000102030405060708090a0b0c0d0e0f1011121314151617

CIPHER (ENCRYPT):
round[ 0].input
round[ 0].k_sch
round[ 1].start

00112233445566778899aabbccddeeff
000102030405060708090a0b0c0d0e0f
00102030405060708090a0b0c0d0e0f0

38

round[ 1].s_box
round[ 1].s_row
round[ 1].m_colround[ 1].k_sch
round[ 2].startround[ 2].s_box
round[ 2].s_row
round[ 2].m_colround[ 2].k_sch
round[ 3].startround[ 3].s_box
round[ 3].s_row
round[ 3].m_colround[ 3].k_sch
round[ 4].startround[ 4].s_box
round[ 4].s_row
round[ 4].m_colround[ 4].k_sch
round[ 5].startround[ 5].s_box
round[ 5].s_row
round[ 5].m_colround[ 5].k_sch
round[ 6].startround[ 6].s_box
round[ 6].s_row
round[ 6].m_colround[ 6].k_sch
round[ 7].startround[ 7].s_box
round[ 7].s_row
round[ 7].m_colround[ 7].k_sch
round[ 8].startround[ 8].s_box
round[ 8].s_row
round[ 8].m_colround[ 8].k_sch
round[ 9].startround[ 9].s_box
round[ 9].s_row
round[ 9].m_colround[ 9].k_sch
round[10].startround[10].s_box
round[10].s_row
round[10].m_colround[10].k_sch
round[11].startround[11].s_box
round[11].s_row
round[11].m_colround[11].k_sch
round[12].startround[12].s_box
round[12].s_row

63cab7040953d051cd60e0e7ba70e18c
6353e08c0960e104cd70b751bacad0e7
5f72641557f5bc92f7be3b291db9f91a
10111213141516175846f2f95c43f4fe
4f63760643e0aa85aff8c9d041fa0de4
84fb386f1ae1ac977941dd70832dd769
84e1dd691a41d76f792d389783fbac70
9f487f794f955f662afc86abd7f1ab29
544afef55847f0fa4856e2e95c43f4fe
cb02818c17d2af9c62aa64428bb25fd7
1f770c64f0b579deaaac432c3d37cf0e
1fb5430ef0accf64aa370cde3d77792c
b7a53ecbbf9d75a0c40efc79b674cc1140f949b31cbabd4d48f043b810b7b342
f75c7778a327c8ed8cfebfc1a6c37f53
684af5bc0acce85564bb0878242ed2ed
68cc08ed0abbd2bc642ef555244ae878
7a1e98bdacb6d1141a6944dd06eb2d3e58e151ab04a2a5557effb5416245080c
22ffc916a81474416496f19c64ae2532
9316dd47c2fa92834390a1de43e43f23
93faa123c2903f4743e4dd83431692de
aaa755b34cffe57cef6f98e1f01c13e6
2ab54bb43a02f8f662e3a95d66410c08
80121e0776fd1d8a8d8c31bc965d1fee
cdc972c53854a47e5d64c765904cc028
cd54c7283864c0c55d4c727e90c9a465
921f748fd96e937d622d7725ba8ba50c
f501857297448d7ebdf1c6ca87f33e3c
671ef1fd4e2a1e03dfdcb1ef3d789b30
8572a1542fe5727b9e86c8df27bc1404
85e5c8042f8614549ebca17b277272df
e913e7b18f507d4b227ef652758acbcc
e510976183519b6934157c9ea351f1e0
0c0370d00c01e622166b8accd6db3a2c
fe7b5170fe7c8e93477f7e4bf6b98071
fe7c7e71fe7f807047b95193f67b8e4b6cf5edf996eb0a069c4ef21cbfc25762
1ea0372a995309167c439e77ff12051e
7255dad30fb80310e00d6c6b40d0527c
40fc5766766c7bcae1d7507f09700010
406c501076d70066e17057ca09fc7b7f
7478bcdce8a50b81d4327a9009188262
dd7e0e887e2fff68608fc842f9dcc154
a906b254968af4e9b4bdb2d2f0c44336
d36f3720907ebf1e8d7a37b58c1c1a05
d37e3705907a1a208d1c371e8c6fbfb50d73cc2d8f6abe8b0cf2dd9bb83d422e
859f5f237a8d5a3dc0c02952beefd63a
88ec930ef5e7e4b6cc32f4c906d29414
c4cedcabe694694e4b23bfdd6fb522fa
c494bffae62322ab4bb5dc4e6fce69dd
71d720933b6d677dc00b8f28238e0fb7
de601e7827bcdf2ca223800fd8aeda32
afb73eeb1cd1b85162280f27fb20d585
79a9b2e99c3e6cd1aa3476cc0fb70397
793e76979c3403e9aab7b2d10fa96ccc

39

round[12].k_sch
round[12].output

a4970a331a78dc09c418c271e3a41d5d
dda97ca4864cdfe06eaf70a0ec0d7191

INVERSE CIPHER (DECRYPT):
round[ 0].iinput
dda97ca4864cdfe06eaf70a0ec0d7191
round[ 0].ik_sch
a4970a331a78dc09c418c271e3a41d5d
round[ 1].istart
793e76979c3403e9aab7b2d10fa96ccc
round[ 1].is_row
79a9b2e99c3e6cd1aa3476cc0fb70397
round[ 1].is_box
afb73eeb1cd1b85162280f27fb20d585
round[ 1].ik_sch
de601e7827bcdf2ca223800fd8aeda32
round[ 1].ik_add
71d720933b6d677dc00b8f28238e0fb7
round[ 2].istartc494bffae62322ab4bb5dc4e6fce69dd
round[ 2].is_row
c4cedcabe694694e4b23bfdd6fb522fa
round[ 2].is_box
88ec930ef5e7e4b6cc32f4c906d29414
round[ 2].ik_sch
859f5f237a8d5a3dc0c02952beefd63a
round[ 2].ik_add
0d73cc2d8f6abe8b0cf2dd9bb83d422e
round[ 3].istart
d37e3705907a1a208d1c371e8c6fbfb5
round[ 3].is_row
d36f3720907ebf1e8d7a37b58c1c1a05
round[ 3].is_box
a906b254968af4e9b4bdb2d2f0c44336
round[ 3].ik_sch
dd7e0e887e2fff68608fc842f9dcc154
round[ 3].ik_add
7478bcdce8a50b81d4327a9009188262
round[ 4].istart
406c501076d70066e17057ca09fc7b7f
round[ 4].is_row
40fc5766766c7bcae1d7507f09700010
round[ 4].is_box
7255dad30fb80310e00d6c6b40d0527cround[ 4].ik_sch
1ea0372a995309167c439e77ff12051e
round[ 4].ik_add
6cf5edf996eb0a069c4ef21cbfc25762
round[ 5].istart
fe7c7e71fe7f807047b95193f67b8e4bround[ 5].is_row
fe7b5170fe7c8e93477f7e4bf6b98071
round[ 5].is_box
0c0370d00c01e622166b8accd6db3a2cround[ 5].ik_sch
e510976183519b6934157c9ea351f1e0
round[ 5].ik_add
e913e7b18f507d4b227ef652758acbcc
round[ 6].istart
85e5c8042f8614549ebca17b277272df
round[ 6].is_row
8572a1542fe5727b9e86c8df27bc1404
round[ 6].is_box
671ef1fd4e2a1e03dfdcb1ef3d789b30
round[ 6].ik_sch
f501857297448d7ebdf1c6ca87f33e3c
round[ 6].ik_add
921f748fd96e937d622d7725ba8ba50c
round[ 7].istart
cd54c7283864c0c55d4c727e90c9a465
round[ 7].is_row
cdc972c53854a47e5d64c765904cc028
round[ 7].is_box
80121e0776fd1d8a8d8c31bc965d1fee
round[ 7].ik_sch
2ab54bb43a02f8f662e3a95d66410c08
round[ 7].ik_add
aaa755b34cffe57cef6f98e1f01c13e6
round[ 8].istart
93faa123c2903f4743e4dd83431692deround[ 8].is_row
9316dd47c2fa92834390a1de43e43f23
round[ 8].is_box
22ffc916a81474416496f19c64ae2532
round[ 8].ik_sch
58e151ab04a2a5557effb5416245080cround[ 8].ik_add
7a1e98bdacb6d1141a6944dd06eb2d3eround[ 9].istart
68cc08ed0abbd2bc642ef555244ae878
round[ 9].is_row
684af5bc0acce85564bb0878242ed2edround[ 9].is_box
f75c7778a327c8ed8cfebfc1a6c37f53
round[ 9].ik_sch
40f949b31cbabd4d48f043b810b7b342
round[ 9].ik_add
b7a53ecbbf9d75a0c40efc79b674cc11
round[10].istart
1fb5430ef0accf64aa370cde3d77792c
round[10].is_row
1f770c64f0b579deaaac432c3d37cf0eround[10].is_box
cb02818c17d2af9c62aa64428bb25fd7
round[10].ik_sch
544afef55847f0fa4856e2e95c43f4fe
round[10].ik_add
9f487f794f955f662afc86abd7f1ab29
round[11].istart
84e1dd691a41d76f792d389783fbac70

40

round[11].is_row
round[11].is_box
round[11].ik_sch
round[11].ik_add
round[12].istartround[12].is_row
round[12].is_box
round[12].ik_sch
round[12].ioutput

84fb386f1ae1ac977941dd70832dd769
4f63760643e0aa85aff8c9d041fa0de4
10111213141516175846f2f95c43f4fe
5f72641557f5bc92f7be3b291db9f91a
6353e08c0960e104cd70b751bacad0e763cab7040953d051cd60e0e7ba70e18c
00102030405060708090a0b0c0d0e0f0
000102030405060708090a0b0c0d0e0f
00112233445566778899aabbccddeeff

EQUIVALENT INVERSE CIPHER (DECRYPT):
round[ 0].iinput
dda97ca4864cdfe06eaf70a0ec0d7191
round[ 0].ik_sch
a4970a331a78dc09c418c271e3a41d5d
round[ 1].istart
793e76979c3403e9aab7b2d10fa96ccc
round[ 1].is_box
afd10f851c28d5eb62203e51fbb7b827
round[ 1].is_row
afb73eeb1cd1b85162280f27fb20d585
round[ 1].im_col
122a02f7242ac8e20605afce51cc7264
round[ 1].ik_sch
d6bebd0dc209ea494db073803e021bb9
round[ 2].istartc494bffae62322ab4bb5dc4e6fce69dd
round[ 2].is_box
88e7f414f532940eccd293b606ece4c9
round[ 2].is_row
88ec930ef5e7e4b6cc32f4c906d29414
round[ 2].im_col
5cc7aecce3c872194ae5ef8309a933c7
round[ 2].ik_sch
8fb999c973b26839c7f9d89d85c68c72
round[ 3].istart
d37e3705907a1a208d1c371e8c6fbfb5
round[ 3].is_box
a98ab23696bd4354b4c4b2e9f006f4d2
round[ 3].is_row
a906b254968af4e9b4bdb2d2f0c44336
round[ 3].im_colb7113ed134e85489b20866b51d4b2c3bround[ 3].ik_sch
f77d6ec1423f54ef5378317f14b75744
round[ 4].istart
406c501076d70066e17057ca09fc7b7f
round[ 4].is_box
72b86c7c0f0d52d3e0d0da104055036b
round[ 4].is_row
7255dad30fb80310e00d6c6b40d0527cround[ 4].im_col
ef3b1be1b9b0e64bdcb79f1e0a707fbb
round[ 4].ik_sch
1147659047cf663b9b0ece8dfc0bf1f0
round[ 5].istart
fe7c7e71fe7f807047b95193f67b8e4bround[ 5].is_box
0c018a2c0c6b3ad016db7022d603e6cc
round[ 5].is_row
0c0370d00c01e622166b8accd6db3a2cround[ 5].im_col
592460b248832b2952e0b831923048f1
round[ 5].ik_sch
dcc1a8b667053f7dcc5c194ab5423a2e
round[ 6].istart
85e5c8042f8614549ebca17b277272df
round[ 6].is_box
672ab1304edc9bfddf78f1033d1e1eef
round[ 6].is_row
671ef1fd4e2a1e03dfdcb1ef3d789b30
round[ 6].im_col
0b8a7783417ae3a1f9492dc0c641a7ceround[ 6].ik_sch
c6deb0ab791e2364a4055fbe568803ab
round[ 7].istart
cd54c7283864c0c55d4c727e90c9a465
round[ 7].is_box
80fd31ee768c1f078d5d1e8a96121dbc
round[ 7].is_row
80121e0776fd1d8a8d8c31bc965d1fee
round[ 7].im_col
4ee1ddf9301d6352c9ad769ef8d20515
round[ 7].ik_sch
dd1b7cdaf28d5c158a49ab1dbbc497cb
round[ 8].istart
93faa123c2903f4743e4dd83431692deround[ 8].is_box
2214f132a896251664aec94164ff749c
round[ 8].is_row
22ffc916a81474416496f19c64ae2532
round[ 8].im_col
1008ffe53b36ee6af27b42549b8a7bb7
round[ 8].ik_sch
78c4f708318d3cd69655b701bfc093cf
round[ 9].istart
68cc08ed0abbd2bc642ef555244ae878
round[ 9].is_box
f727bf53a3fe7f788cc377eda65cc8c1
round[ 9].is_row
f75c7778a327c8ed8cfebfc1a6c37f53
round[ 9].im_col
7f69ac1ed939ebaac8ece3cb12e159e3

41

round[ 9].ik_sch
round[10].istartround[10].is_box
round[10].is_row
round[10].im_colround[10].ik_sch
round[11].istartround[11].is_box
round[11].is_row
round[11].im_colround[11].ik_sch
round[12].istartround[12].is_box
round[12].is_row
round[12].ik_sch
round[12].ioutput

C.3

60dcef10299524ce62dbef152f9620cf
1fb5430ef0accf64aa370cde3d77792c
cbd264d717aa5f8c62b2819c8b02af42
cb02818c17d2af9c62aa64428bb25fd7
cfaf16b2570c18b52e7fef50cab267ae
4b4ecbdb4d4dcfda5752d7c74949cbde
84e1dd691a41d76f792d389783fbac70
4fe0c9e443f80d06affa76854163aad0
4f63760643e0aa85aff8c9d041fa0de4
794cf891177bfd1d8a327086f3831b39
1a1f181d1e1b1c194742c7d74949cbde
6353e08c0960e104cd70b751bacad0e70050a0f04090e03080d02070c01060b0
00102030405060708090a0b0c0d0e0f0
000102030405060708090a0b0c0d0e0f
00112233445566778899aabbccddeeff

AES-256 (Nk=8, Nr=14)

PLAINTEXT:
KEY:

00112233445566778899aabbccddeeff
000102030405060708090a0b0c0d0e0f101112131415161718191a1b1c1d1e1f

CIPHER (ENCRYPT):
round[ 0].input
round[ 0].k_sch
round[ 1].startround[ 1].s_box
round[ 1].s_row
round[ 1].m_colround[ 1].k_sch
round[ 2].startround[ 2].s_box
round[ 2].s_row
round[ 2].m_colround[ 2].k_sch
round[ 3].startround[ 3].s_box
round[ 3].s_row
round[ 3].m_colround[ 3].k_sch
round[ 4].startround[ 4].s_box
round[ 4].s_row
round[ 4].m_colround[ 4].k_sch
round[ 5].startround[ 5].s_box
round[ 5].s_row
round[ 5].m_colround[ 5].k_sch
round[ 6].startround[ 6].s_box
round[ 6].s_row
round[ 6].m_colround[ 6].k_sch
round[ 7].startround[ 7].s_box

00112233445566778899aabbccddeeff
000102030405060708090a0b0c0d0e0f
00102030405060708090a0b0c0d0e0f0
63cab7040953d051cd60e0e7ba70e18c
6353e08c0960e104cd70b751bacad0e7
5f72641557f5bc92f7be3b291db9f91a
101112131415161718191a1b1c1d1e1f
4f63760643e0aa85efa7213201a4e705
84fb386f1ae1ac97df5cfd237c49946b
84e1fd6b1a5c946fdf4938977cfbac23
bd2a395d2b6ac438d192443e615da195
a573c29fa176c498a97fce93a572c09c
1859fbc28a1c00a078ed8aadc42f6109
adcb0f257e9c63e0bc557e951c15ef01
ad9c7e017e55ef25bc150fe01ccb6395
810dce0cc9db8172b3678c1e88a1b5bd
1651a8cd0244beda1a5da4c10640bade
975c66c1cb9f3fa8a93a28df8ee10f63
884a33781fdb75c2d380349e19f876fb
88db34fb1f807678d3f833c2194a759e
b2822d81abe6fb275faf103a078c0033
ae87dff00ff11b68a68ed5fb03fc1567
1c05f271a417e04ff921c5c104701554
9c6b89a349f0e18499fda678f2515920
9cf0a62049fd59a399518984f26be178
aeb65ba974e0f822d73f567bdb64c877
6de1f1486fa54f9275f8eb5373b8518d
c357aae11b45b7b0a2c7bd28a8dc99fa
2e5bacf8af6ea9e73ac67a34c286ee2d2e6e7a2dafc6eef83a86ace7c25ba934
b951c33c02e9bd29ae25cdb1efa08cc7c656827fc9a799176f294cec6cd5598b
7f074143cb4e243ec10c815d8375d54c
d2c5831a1f2f36b278fe0c4cec9d0329

42

round[ 7].s_row
round[ 7].m_colround[ 7].k_sch
round[ 8].startround[ 8].s_box
round[ 8].s_row
round[ 8].m_colround[ 8].k_sch
round[ 9].startround[ 9].s_box
round[ 9].s_row
round[ 9].m_colround[ 9].k_sch
round[10].startround[10].s_box
round[10].s_row
round[10].m_colround[10].k_sch
round[11].startround[11].s_box
round[11].s_row
round[11].m_colround[11].k_sch
round[12].startround[12].s_box
round[12].s_row
round[12].m_colround[12].k_sch
round[13].startround[13].s_box
round[13].s_row
round[13].m_colround[13].k_sch
round[14].startround[14].s_box
round[14].s_row
round[14].k_sch
round[14].output

d22f0c291ffe031a789d83b2ecc5364c
ebb19e1c3ee7c9e87d7535e9ed6b9144
3de23a75524775e727bf9eb45407cf39
d653a4696ca0bc0f5acaab5db96c5e7d
f6ed49f950e06576be74624c565058ff
f6e062ff507458f9be50497656ed654c
5174c8669da98435a8b3e62ca974a5ea
0bdc905fc27b0948ad5245a4c1871c2f
5aa858395fd28d7d05e1a38868f3b9c5
bec26a12cfb55dff6bf80ac4450d56a6
beb50aa6cff856126b0d6aff45c25dc4
0f77ee31d2ccadc05430a83f4ef96ac3
45f5a66017b2d387300d4d33640a820a
4a824851c57e7e47643de50c2af3e8c9d61352d1a6f3f3a04327d9fee50d9bdd
d6f3d9dda6279bd1430d52a0e513f3fe
bd86f0ea748fc4f4630f11c1e9331233
7ccff71cbeb4fe5413e6bbf0d261a7df
c14907f6ca3b3aa070e9aa313b52b5ec
783bc54274e280e0511eacc7e200d5ce
78e2acce741ed5425100c5e0e23b80c7
af8690415d6e1dd387e5fbedd5c89013
f01afafee7a82979d7a5644ab3afe640
5f9c6abfbac634aa50409fa766677653
cfde0208f4b418ac5309db5c338538ed
cfb4dbedf4093808538502ac33de185c
7427fae4d8a695269ce83d315be0392b
2541fe719bf500258813bbd55a721c0a
516604954353950314fb86e401922521
d133f22a1aed2a7bfa0f44697c4f3ffd
d1ed44fd1a0f3f2afa4ff27b7c332a69
2c21a820306f154ab712c75eee0da04f
4e5a6699a9f24fe07e572baacdf8cdea
627bceb9999d5aaac945ecf423f56da5
aa218b56ee5ebeacdd6ecebf26e63c06
aa5ece06ee6e3c56dde68bac2621bebf
24fc79ccbf0979e9371ac23c6d68de36
8ea2b7ca516745bfeafc49904b496089

INVERSE CIPHER (DECRYPT):
round[ 0].iinput
8ea2b7ca516745bfeafc49904b496089
round[ 0].ik_sch
24fc79ccbf0979e9371ac23c6d68de36
round[ 1].istartaa5ece06ee6e3c56dde68bac2621bebf
round[ 1].is_row
aa218b56ee5ebeacdd6ecebf26e63c06
round[ 1].is_box
627bceb9999d5aaac945ecf423f56da5
round[ 1].ik_sch
4e5a6699a9f24fe07e572baacdf8cdea
round[ 1].ik_add
2c21a820306f154ab712c75eee0da04f
round[ 2].istart
d1ed44fd1a0f3f2afa4ff27b7c332a69
round[ 2].is_row
d133f22a1aed2a7bfa0f44697c4f3ffd
round[ 2].is_box
516604954353950314fb86e401922521
round[ 2].ik_sch
2541fe719bf500258813bbd55a721c0around[ 2].ik_add
7427fae4d8a695269ce83d315be0392b
round[ 3].istart
cfb4dbedf4093808538502ac33de185c
round[ 3].is_row
cfde0208f4b418ac5309db5c338538ed
round[ 3].is_box
5f9c6abfbac634aa50409fa766677653
round[ 3].ik_sch
f01afafee7a82979d7a5644ab3afe640
round[ 3].ik_add
af8690415d6e1dd387e5fbedd5c89013

43round[ 4].istartround[ 4].is_row
round[ 4].is_box
round[ 4].ik_sch
round[ 4].ik_add
round[ 5].istartround[ 5].is_row
round[ 5].is_box
round[ 5].ik_sch
round[ 5].ik_add
round[ 6].istartround[ 6].is_row
round[ 6].is_box
round[ 6].ik_sch
round[ 6].ik_add
round[ 7].istartround[ 7].is_row
round[ 7].is_box
round[ 7].ik_sch
round[ 7].ik_add
round[ 8].istartround[ 8].is_row
round[ 8].is_box
round[ 8].ik_sch
round[ 8].ik_add
round[ 9].istartround[ 9].is_row
round[ 9].is_box
round[ 9].ik_sch
round[ 9].ik_add
round[10].istartround[10].is_row
round[10].is_box
round[10].ik_sch
round[10].ik_add
round[11].istartround[11].is_row
round[11].is_box
round[11].ik_sch
round[11].ik_add
round[12].istartround[12].is_row
round[12].is_box
round[12].ik_sch
round[12].ik_add
round[13].istartround[13].is_row
round[13].is_box
round[13].ik_sch
round[13].ik_add
round[14].istartround[14].is_row
round[14].is_box
round[14].ik_sch
round[14].ioutput

78e2acce741ed5425100c5e0e23b80c7
783bc54274e280e0511eacc7e200d5ce
c14907f6ca3b3aa070e9aa313b52b5ec
7ccff71cbeb4fe5413e6bbf0d261a7df
bd86f0ea748fc4f4630f11c1e9331233
d6f3d9dda6279bd1430d52a0e513f3fe
d61352d1a6f3f3a04327d9fee50d9bdd
4a824851c57e7e47643de50c2af3e8c9
45f5a66017b2d387300d4d33640a820a
0f77ee31d2ccadc05430a83f4ef96ac3
beb50aa6cff856126b0d6aff45c25dc4
bec26a12cfb55dff6bf80ac4450d56a6
5aa858395fd28d7d05e1a38868f3b9c5
0bdc905fc27b0948ad5245a4c1871c2f
5174c8669da98435a8b3e62ca974a5ea
f6e062ff507458f9be50497656ed654c
f6ed49f950e06576be74624c565058ff
d653a4696ca0bc0f5acaab5db96c5e7d3de23a75524775e727bf9eb45407cf39
ebb19e1c3ee7c9e87d7535e9ed6b9144
d22f0c291ffe031a789d83b2ecc5364c
d2c5831a1f2f36b278fe0c4cec9d0329
7f074143cb4e243ec10c815d8375d54c
c656827fc9a799176f294cec6cd5598b
b951c33c02e9bd29ae25cdb1efa08cc7
2e6e7a2dafc6eef83a86ace7c25ba934
2e5bacf8af6ea9e73ac67a34c286ee2d
c357aae11b45b7b0a2c7bd28a8dc99fa
6de1f1486fa54f9275f8eb5373b8518d
aeb65ba974e0f822d73f567bdb64c877
9cf0a62049fd59a399518984f26be178
9c6b89a349f0e18499fda678f2515920
1c05f271a417e04ff921c5c104701554
ae87dff00ff11b68a68ed5fb03fc1567
b2822d81abe6fb275faf103a078c0033
88db34fb1f807678d3f833c2194a759e
884a33781fdb75c2d380349e19f876fb
975c66c1cb9f3fa8a93a28df8ee10f63
1651a8cd0244beda1a5da4c10640bade
810dce0cc9db8172b3678c1e88a1b5bd
ad9c7e017e55ef25bc150fe01ccb6395
adcb0f257e9c63e0bc557e951c15ef01
1859fbc28a1c00a078ed8aadc42f6109
a573c29fa176c498a97fce93a572c09c
bd2a395d2b6ac438d192443e615da195
84e1fd6b1a5c946fdf4938977cfbac23
84fb386f1ae1ac97df5cfd237c49946b
4f63760643e0aa85efa7213201a4e705
101112131415161718191a1b1c1d1e1f
5f72641557f5bc92f7be3b291db9f91a
6353e08c0960e104cd70b751bacad0e763cab7040953d051cd60e0e7ba70e18c
00102030405060708090a0b0c0d0e0f0
000102030405060708090a0b0c0d0e0f
00112233445566778899aabbccddeeff

EQUIVALENT INVERSE CIPHER (DECRYPT):

44

round[ 0].iinput
round[ 0].ik_sch
round[ 1].istartround[ 1].is_box
round[ 1].is_row
round[ 1].im_colround[ 1].ik_sch
round[ 2].istartround[ 2].is_box
round[ 2].is_row
round[ 2].im_colround[ 2].ik_sch
round[ 3].istartround[ 3].is_box
round[ 3].is_row
round[ 3].im_colround[ 3].ik_sch
round[ 4].istartround[ 4].is_box
round[ 4].is_row
round[ 4].im_colround[ 4].ik_sch
round[ 5].istartround[ 5].is_box
round[ 5].is_row
round[ 5].im_colround[ 5].ik_sch
round[ 6].istartround[ 6].is_box
round[ 6].is_row
round[ 6].im_colround[ 6].ik_sch
round[ 7].istartround[ 7].is_box
round[ 7].is_row
round[ 7].im_colround[ 7].ik_sch
round[ 8].istartround[ 8].is_box
round[ 8].is_row
round[ 8].im_colround[ 8].ik_sch
round[ 9].istartround[ 9].is_box
round[ 9].is_row
round[ 9].im_colround[ 9].ik_sch
round[10].istartround[10].is_box
round[10].is_row
round[10].im_colround[10].ik_sch
round[11].istartround[11].is_box
round[11].is_row
round[11].im_colround[11].ik_sch

8ea2b7ca516745bfeafc49904b496089
24fc79ccbf0979e9371ac23c6d68de36
aa5ece06ee6e3c56dde68bac2621bebf
629deca599456db9c9f5ceaa237b5af4
627bceb9999d5aaac945ecf423f56da5
e51c9502a5c1950506a61024596b2b07
34f1d1ffbfceaa2ffce9e25f2558016e
d1ed44fd1a0f3f2afa4ff27b7c332a69
5153862143fb259514920403016695e4
516604954353950314fb86e401922521
91a29306cc450d0226f4b5eaef5efed8
5e1648eb384c350a7571b746dc80e684
cfb4dbedf4093808538502ac33de185c
5fc69f53ba4076bf50676aaa669c34a7
5f9c6abfbac634aa50409fa766677653
b041a94eff21ae9212278d903b8a63f6
c8a305808b3f7bd043274870d9b1e331
78e2acce741ed5425100c5e0e23b80c7
c13baaeccae9b5f6705207a03b493a31
c14907f6ca3b3aa070e9aa313b52b5ec
638357cec07de6300e30d0ec4ce2a23c
b5708e13665a7de14d3d824ca9f151c2
d6f3d9dda6279bd1430d52a0e513f3fe
4a7ee5c9c53de85164f348472a827e0c
4a824851c57e7e47643de50c2af3e8c9
ca6f71058c642842a315595fdf54f685
74da7ba3439c7e50c81833a09a96ab41
beb50aa6cff856126b0d6aff45c25dc4
5ad2a3c55fe1b93905f3587d68a88d88
5aa858395fd28d7d05e1a38868f3b9c5
ca46f5ea835eab0b9537b6dbb221b6c2
3ca69715d32af3f22b67ffade4ccd38e
f6e062ff507458f9be50497656ed654c
d6a0ab7d6cca5e695a6ca40fb953bc5d
d653a4696ca0bc0f5acaab5db96c5e7d
2a70c8da28b806e9f319ce42be4baead
f85fc4f3374605f38b844df0528e98e1
d22f0c291ffe031a789d83b2ecc5364c
7f4e814ccb0cd543c175413e8307245d
7f074143cb4e243ec10c815d8375d54c
f0073ab7404a8a1fc2cba0b80df08517
de69409aef8c64e7f84d0c5fcfab2c23
2e6e7a2dafc6eef83a86ace7c25ba934
c345bdfa1bc799e1a2dcaab0a857b728
c357aae11b45b7b0a2c7bd28a8dc99fa
3225fe3686e498a32593c1872b613469
aed55816cf19c100bcc24803d90ad511
9cf0a62049fd59a399518984f26be178
1c17c554a4211571f970f24f0405e0c1
1c05f271a417e04ff921c5c104701554
9d1d5c462e655205c4395b7a2eac55e2
15c668bd31e5247d17c168b837e6207c
88db34fb1f807678d3f833c2194a759e
979f2863cb3a0fc1a9e166a88e5c3fdf
975c66c1cb9f3fa8a93a28df8ee10f63
d24bfb0e1f997633cfce86e37903fe87
7fd7850f61cc991673db890365c89d12

45

round[12].istartround[12].is_box
round[12].is_row
round[12].im_colround[12].ik_sch
round[13].istartround[13].is_box
round[13].is_row
round[13].im_colround[13].ik_sch
round[14].istartround[14].is_box
round[14].is_row
round[14].ik_sch
round[14].ioutput

ad9c7e017e55ef25bc150fe01ccb6395
181c8a098aed61c2782ffba0c45900ad
1859fbc28a1c00a078ed8aadc42f6109
aec9bda23e7fd8aff96d74525cdce4e72a2840c924234cc026244cc5202748c4
84e1fd6b1a5c946fdf4938977cfbac23
4fe0210543a7e706efa476850163aa32
4f63760643e0aa85efa7213201a4e705
794cf891177bfd1ddf67a744acd9c4f6
1a1f181d1e1b1c191217101516131411
6353e08c0960e104cd70b751bacad0e70050a0f04090e03080d02070c01060b0
00102030405060708090a0b0c0d0e0f0
000102030405060708090a0b0c0d0e0f
00112233445566778899aabbccddeeff46

Appendix D - References[1]

AES page available via http://www.nist.gov/CryptoToolkit.4[2]

Computer Security Objects Register (CSOR): http://csrc.nist.gov/csor/.

[3]

J. Daemen and V. Rijmen, AES Proposal: Rijndael, AES Algorithm Submission,
September 3, 1999, available at [1].

[4]

J. Daemen and V. Rijmen, The block cipher Rijndael, Smart Card research andApplications, LNCS 1820, Springer-Verlag, pp. 288-296.

[5]

B. Gladman’s AES related home page
http://fp.gladman.plus.com/cryptography_technology/.

[6]

A. Lee, NIST Special Publication 800-21, Guideline for Implementing Cryptography
in the Federal Government, National Institute of Standards and Technology,
November 1999.

[7]

A. Menezes, P. van Oorschot, and S. Vanstone, Handbook of Applied Cryptography,
CRC Press, New York, 1997, p. 81-83.

[8]

J. Nechvatal, et. al., Report on the Development of the Advanced Encryption Standard(AES), National Institute of Standards and Technology, October 2, 2000, available at[1].

4

A complete set of documentation from the AES development effort – including announcements, public comments,
analysis papers, conference proceedings, etc. – is available from this site.

47