## 2 Materials and Methods  
### Fundamentals of the AES-128 Encryption/Decryption Algorithm  
The AES algorithm is a block cipher at the bit level, like the Data Encryption Standard (DES), where each block length is fixed to 128 bits, whereas the key length can be equal to 128, 192 or 256 bits [20]. Each 128-bit data block is partitioned into 16 bytes, mapped on a \(4\times 4\) array named state, and each byte of the state corresponds to an element of the Galois Field (GF) with \(2^{8}\) cardinality. Based on the key length, the algorithm includes \(n\) iterations, called rounds, where \(n\) is 10, 12 or 14 when the key length is 128, 192 or 256 bits, respectively. Each round of the encryption process, except for the last one, consists of four operations:  
* Substitute Bytes
* Shift Rows
* Mix Columns
* Add Round Key  
All the operations are carried out sequentially within each round, except for the initial Add Round Key; in the last round, the Mix Columns operation is not performed (Figure 1). The Substitute Bytes step is a non-linear transformation, where each byte in the state array is replaced with the entry of a fixed 8-bit Substitution Box (Sbox) implemented as a lookup table with \(2^{8}\) words of 8 bits each, used to hide the relationship between the key and the cipher-text. The used Sbox is derived from the multiplicative inverse over GF\(\left(2^{8}\right)\), combined with an invertible geometric transformation, to avoid attacks based on simple algebraic properties, obtaining a \(16\times 16\) bytes table (Figure 2). The permutation is obtained addressing the Sbox locations based on the most significative nibble and the less significative one of the 8-bit input data. The Shift Rows step operates on the rows of the state array, circularly shifting the bytes in each row by a given offset. The first row is left unchanged, whereas each byte of the second row is shifted one position to the left; likewise, the third and fourth rows are shifted respectively by two and three bytes to the left. The Mix Columns step is a linear transformation mixing the column of the state array; each column, treated as a polynomial over GF\(\left(2^{8}\right)\), is multiplied, modulo \(z^{4}+1\), with a fixed polynomial (i.e., \(c(z)=03z^{3}+01z^{2}+01z+02\)). Both the Shift Rows and the Mix Columns operations are needed to hide the relationship between the cipher-In the Add Round Key step, the key is combined with the state array to make the cipher safer; for each round, a subkey is derived from the expansion of the main key, obtaining, at the end of the encryption process, an expanded key of 176 bytes, arranged in a linear array of 44 words (using a key length of 128-bit). After the initialization of the word array (\(W[i]\) for \(0\leq i\leq 43\)), by inserting the key in the first four words, the other ones are obtained using the following relation:  
\[W[i]=W[i-1]\oplus W[i-4]. \tag{1}\]  
A particular exception is made for the words with index multiple of four, for which, non-linear relationships, different from bit-to-bit XOR are used:  
\[Subword(Retword(w[i-1]))\oplus Recon[i/4], \tag{2}\]  
where the Subword sub-function replaces each byte of the word, provided as argument of the function, using the Sbox, whereas the Retword sub-function simply shifts one byte to left; furthermore,  
Figure 1: Schematic representation of the Advanced Encryption Standard (AES) encryption algorithm. Figure 2: Sbox involved in the Substitute Bytes transformation. the function \(\text{Rcon}[i]\) is a round constant, represented by the word array \(\left[x^{i-1},\left\{00\right\},\left\{00\right\},\left\{00\right\}\right]\), where \(x^{i-1}\) is the \((i-1)\)-th exponentiation operator in GF(28). The encryption and decryption procedures employ two different algorithms; nevertheless, each operation in the encryption process corresponds to an inverse equivalent one in the decryption process. However, both are arranged in 10 rounds and both perform the Add Round Key step in the same way.