# Software Design and Experimental Evaluation of a Reduced AES for IoT Applications
## 3 Materials and Methods
### Key Expander  
The 128-bit length of the LAES key keeps the design persistent in terms of the agent's brute force attack, in comparison to the smaller key size used in previous studies [32; 35]. The key is divided into two halves, each of which is a 64-bit 4 \(\times\) 4 matrix. Each entry in the matrix consists of 4 bits, instead of the 8 bits in AES.  
The key expander simply expands the left part of the key during each round until the ninth round of LAES is completed. The right part of the key is then expanded during the final round. The basic principles of AES key expansion were followed in the design of LAES [38]:  
* The total number of round key bits is equal to the block length multiplied by the number of rounds, plus 1.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c} \hline \hline
**Input (x)** & **0** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **A** & **B** & **C** & **D** & **E** & **F** \\ \hline Output (x) & A & 1 & 6 & C & 5 & 7 & 0 & 4 & 9 & 8 & 2 & D & B & F & 3 & E \\ \hline \hline \end{tabular}
\end{table}
Table 6: Inv S-box.  
\begin{table}
\begin{tabular}{c c c c c c c c c c c c c c c c c} \hline \hline
**Input (x)** & **0** & **1** & **2** & **3** & **4** & **5** & **6** & **7** & **8** & **9** & **A** & **B** & **C** & **D** & **E** & **F** \\ \hline Output (x\({}^{\prime}\)) & 6 & 1 & A & E & 7 & 4 & 2 & 5 & 9 & 8 & 0 & C & 3 & B & F & D \\ \hline \hline \end{tabular}
\end{table}
Table 5: S-box lookup.  
* The key is expanded into an expanded key.
* Round keys are taken from this expanded key.  
The S-box lookup and the round constant tables are used during the expansion process of generating 36 new columns from the left part and 4 new columns from the right part. The S-box lookup and the round constant tables are used to minimize the correlation between the key parts, and to eliminate symmetricity and enhance the non-linearity of the expanded key, which affects the LAES diffusion property.  
The left part of the key consists of 64 bits arranged into a 4 \(\times\) 4 matrix, where each entry has 4 bits. The matrix is then expanded by joining 40 more columns. Considering that the initial values of key columns are \(C\) (0), \(C\) (1), \(C\) (2), and \(C\) (3), the new columns are defined as in Equation (4).  
\[C(i)=\left\{\begin{array}{c}C(i-4)\;\oplus\;C(i-1)\;,\;i\;\%\;4\;\
eq 0\\ C(i-4)\;\oplus\;Tr(C(i-1)),\;i\;\%\;4=0\end{array}\right. \tag{4}\]  
where \(Tr(C(i-1))\) is the transformation of \(C(i-1)\) obtained as follows. Let the elements of \(C(i-1)\) have the values a, b, c, and d. Shift-left these elements cyclically to obtain \(b\), \(c\), \(d\), and \(a\), then replace each of these values with the corresponding element in the S-box lookup table, to obtain the values \(e,f,g\), and \(h\). Finally, \(Tr(C(i-1))\) is the column vector that equals \(\mathrm{e}\oplus r(i),f,g\), and \(h\), in which \(r(i)\) is a round constant of the \(i\)th round. In this way, columns \(C(4)\)... \(C(39)\) are generated from the initial four columns of the left part key. The final four columns generated (\(C(40)\), \(C(41)\), \(C(42)\), and \(C(43)\)) from the right part of the key are obtained using a similar algorithm. Figure 3 illustrates the algorithm of key expansion in LAES.