Source: https://www.scribd.com/doc/70505110/fips-197
Timestamp: 2016-10-22 19:09:15
Document Index: 557249716

Matched Legal Cases: ['art\n1', 'art\n5', 'art\n6', 'art\n2', 'art\n3', 'art\n7']

BrowseBrowseInterestsBiography & MemoirBusiness & LeadershipFiction & LiteraturePolitics & EconomyHealth & WellnessSociety & CultureHappiness & Self-HelpMystery, Thriller & CrimeHistoryYoung AdultBrowse byBooksAudiobooksComicsSheet MusicBrowse allUploadSign inJoinBooksAudiobooksComicsSheet MusicFederal InformationProcessing Standards Publication 197
5............................................................................................. NR=12)................5
Equivalent Inverse Cipher ........................3..........................................................................................................................................KEY EXPANSION EXAMPLES ..........................................................3..................................................................... 26
APPENDIX A ...3..........................................2 AES-192 (NK=6..... 22
6....................... 27
A.............................................................. 25
6...................... 25
6................. 23
5...... 35
InvMixColumns() Transformation.................................................................................................................................................................... AND ROUND NUMBER .................................................. 30
APPENDIX B – CIPHER EXAMPLE..... 38
InvSubBytes() Transformation .....................3......1 AES-128 (NK=4..... NR=10).................................... 33
APPENDIX C – EXAMPLE VECTORS................................................................2
KEYING RESTRICTIONS ....REFERENCES................................................................... 23
5.............................................. 42
APPENDIX D ................................................................. BLOCK SIZE......................................................................................................
5.................................................................................................... 35
C...........................................................2 EXPANSION OF A 192-BIT CIPHER KEY .3 EXPANSION OF A 256-BIT CIPHER KEY ............ 26
6..........................................................3
PARAMETERIZATION OF KEY LENGTH...................................3.....................................1
InvShiftRows() Transformation ....... 27
A......................................3 AES-256 (NK=8....... NR=14).............................................................................................................................................................. 28
A............................................................................................1
KEY LENGTH REQUIREMENTS ... 23
IMPLEMENTATION ISSUES .............1 EXPANSION OF A 128-BIT CIPHER KEY ..........................................4
IMPLEMENTATION SUGGESTIONS REGARDING VARIOUS PLATFORMS ...6............................................................................................................4
Inverse of the AddRoundKey() Transformation............. 47
S-box: substitution values for the byte xy (in hexadecimal format)..
Pseudo Code for the Cipher........................................................................ 9
Figure 4....................... 9
Figure 3.......................... ...............................................................
SubBytes() applies the S-box to each byte of the State..................Table of Figures
Figure 1... 20
Figure 12................. ........................ 22
Figure 15................ 16
Figure 7................................................................ 18
Figure 10........................... 15
Figure 6............................................ 16
Figure 8....... 25
Figure 13................... ...................................... 22
Figure 14......
Key-Block-Round Combinations.. 19
Figure 11............ Pseudo Code for the Equivalent Inverse Cipher. . 14
Figure 5............. ................................................. Pseudo Code for Key Expansion.
State array input and output....................... AddRoundKey() XORs each column of the State with a word from the key
Hexadecimal representation of bit patterns......... Pseudo Code for the Inverse Cipher.................................................. 17
Figure 9.................. ..........
ShiftRows() cyclically shifts the last three rows in the State. Inverse S-box: substitution values for the byte xy (in hexadecimal format).............................
Indices for Bytes and Bits.........
MixColumns() operates on the State column-by-column.......... InvShiftRows()cyclically shifts the last three rows in the State................................................................................ 8
Figure 2..........................
Round Key.
Rijndael was designed to handle additional block sizes and key lengths. and additional
block/key/round sizes. including the ordering and
numbering of bits. bytes.
. and therefore these different “flavors” may be referred to as “AES-128”.
Sequence of binary bits that comprise the input.1
A transformation consisting of multiplication by a matrix followed by
the addition of a vector. a symmetric block cipher that can
process data blocks of 128 bits. State. The length of a sequence is the number of bits it contains.
A group of eight bits that is treated either as a single entity or as an
array of 8 individual bits. 192. Notation and conventions used in the algorithm specification. covering the key expansion.
2. such as key length support. encryption. and a list of
references. “AES-192”. symbols. Definitions of terms. Implementation issues. and words. an array of bytes).
Throughout the remainder of this standard. keying restrictions.
Blocks are also interpreted as arrays of bytes. and decryption routines. example vectors for the Cipher and Inverse Cipher.
An enumerated collection of identical entities (e. however they are not
adopted in this standard. and algorithm parameters. output. the algorithm specified herein will be referred to as
“the AES algorithm.g.
6.” The algorithm may be used with the three different key lengths indicated
The standard concludes with several appendices that include step-by-step examples for Key
Expansion and the Cipher. Mathematical properties that are useful in understanding the algorithm. Algorithm specification. acronyms. using cipher keys with lengths of 128. and 256 bits.
This standard specifies the Rijndael algorithm ([3] and [4]). and
“AES-256”. and functions..
InvMixColumns()Transformation in the Inverse Cipher that is the inverse of
InvShiftRows() Transformation in the Inverse Cipher that is the inverse of
Cryptographic algorithm specified in this Advanced Encryption
Standard (AES).2
Series of transformations that converts plaintext to ciphertext using the
Cipher Key. symbols.
Data output from the Cipher or input to the Inverse Cipher. having four rows and Nb columns.
Transformation in the Inverse Cipher that is the inverse of
Secret. the Round
Key length equals 128 bits/16 bytes).
Series of transformations that converts ciphertext to plaintext using the
Cipher Key. cryptographic key that is used by the Key Expansion routine to
generate a set of Round Keys. and Functions
The following algorithm parameters.
Routine used to generate a series of Round Keys from the Cipher Key. they are applied to the State in the Cipher and
Inverse Cipher.
A group of 32 bits that is treated either as a single entity or as an array
of 4 bytes.
Intermediate Cipher result that can be pictured as a rectangular array
Non-linear substitution table used in several byte substitution
transformations and in the Key Expansion routine to perform a onefor-one substitution of a byte value. and functions are used throughout this standard:
Transformation in the Cipher and Inverse Cipher in which a Round
Key is added to the State using an XOR operation. having four rows and Nk columns.
Round keys are values derived from the Cipher Key using the Key
Expansion routine. for Nb = 4. Symbols.e.2. The length of a
Round Key equals the size of the State (i.
. can be pictured as a rectangular array of
The round constant word array. The Cipher Key for the AES algorithm is a
sequence of 128. (Also see Sec.1
The input and output for the AES algorithm each consist of sequences of 128 bits (digits with
values of 0 or 1).
Exclusive-OR operation. The number i attached to a bit is known as its index
and will be in one of the ranges 0 ≤ i < 128. Nb = 4. 6. (Also see Sec. which is a function of Nk and Nb (which is
fixed).)
Number of 32-bit words comprising the Cipher Key.
Multiplication of two polynomials (each with degree < 4) modulo
Number of columns (32-bit words) comprising the State. 6. 192 or 256 bits.
The bits within such sequences will be numbered starting at zero and ending at one less than the
sequence length (block length or key length). For this
standard. Other input. 6.)
Transformation in the Cipher that processes the State by cyclically
shifting the last three rows of the State by different offsets. 0 ≤ i < 192 or 0 ≤ i < 256 depending on the block
length and key length (specified above).
Function used in the Key Expansion routine that takes a four-byte
input word and applies an S-box to each of the four bytes to
produce an output word. 6. (Also see Sec. or 14.MixColumns()
Transformation in the Cipher that takes all of the columns of the
State and mixes their data (independently of one another) to
produce new columns.
3. Nr = 10.3.
word and performs a cyclic permutation. For this
Finite field multiplication. Nk = 4. For this standard.3.
Exclusive-OR operation. These sequences will sometimes be referred to as blocks and the number of
bits they contain will be referred to as their length.
Transformation in the Cipher that processes the State using a nonlinear byte substitution table (S-box) that operates on each of the
State bytes independently. output and Cipher Key lengths are not permitted
by this standard. or 8.
It is also convenient to denote byte values using hexadecimal notation with each of two groups of
four bits being denoted by a single character as in Fig.1 are processed
as arrays of bytes that are formed by dividing these sequences into groups of eight contiguous
bits to form arrays of bytes (see Sec. b6. b2. 0 ≤ n < 24.3
a 0 a1 a 2 . where the character denoting the
four-bit group containing the higher numbered bits is again to the left. for example.
3. 1. 0 ≤ n < 16.3). it will appear as ‘{01}’ immediately preceding the 8-bit byte. the
bytes in the resulting array will be referenced using one of the two forms..
Some finite field operations involve one additional bit (b8) to the left of an 8-bit byte. where n will
be in one of the following ranges:
Key length = 128 bits. Where this
extra bit is present. b3.a15
. 3. 0 ≤ n < 32. These bytes are
interpreted as finite field elements using a polynomial representation:
b7 x 7 + b6 x 6 + b5 x 5 + b4 x 4 + b3 x 3 + b2 x 2 + b1 x + b0 = ∑ bi x i . a
9-bit sequence will be presented as {01}{1b}. b5. an or a[n]. b1.
Hence the element {01100011} can be represented as {63}.
All byte values in the AES algorithm will be presented as the concatenation of its individual bit
values (0 or 1) between braces in the order {b7. Hexadecimal representation of bit patterns. 3. output or Cipher Key denoted by a.
Key length = 192 bits. output and Cipher Key bit sequences described in Sec.
Figure 1. For an input.3.
Block length = 128 bits.2
The basic unit for processing in the AES algorithm is a byte. b0}.1)
For example.. The input. 0 ≤ n < 16.
Key length = 256 bits. {01100011} identifies the specific finite field element x 6 + x 5 + x + 1 . b4. a sequence of eight bits treated as a
5. i.1 s0.3
out1 out5 out9 out13
out2 out6 out10 out14
out3 out7 out11 out15
Figure 3. the input array. 2 shows how bits within each byte are numbered.1 s1.4
Internally. the AES algorithm’s operations are performed on a two-dimensional array of bytes
called the State. out1.
general. … out15. The State consists of four rows of bytes.
At the start of the Cipher and Inverse Cipher described in Sec. Fig. The Cipher or Inverse
Cipher operations are then conducted on this State array.c].2 s3. ….1 s2. is copied to the State
array according to the scheme:
in8 in12
in9 in13
in6 in10 in14
in7 in11 in15
s0. each containing Nb bytes. the input – the array of bytes
in0. in.and 256-bit keys). … in15 – is copied into the State array as illustrated in Fig.2 s1. input15}. with its row number r in the range 0 ≤ r < 4 and its column number c in the
range 0 ≤ c < Nb. input9.2)
Taking Sections 3. State array input and output. 0 ≤ c < 4 (also see Sec. Indices for Bytes and Bits.
3.e. input127}. For this standard. Nb=4. ….3
out0 out4 out8 out12
s1. ….2 and 3. c] = in[r + 4c]
for 0 ≤ r < 4 and 0 ≤ c < Nb.3 together.3
s2. …. for 192.
a15 = {input120. each individual byte
has two indices.3
s3. in1. In the State array denoted by the symbol s.3)
.0 s0. at the beginning of the Cipher or Inverse Cipher.e.. where Nb is
the block length divided by 32.0 s3. This allows an individual byte of the State to be referred to as either sr. input7}.2 s2.c or
s[r. so that.
a1 = {input8. 6. after which its final value is copied to
the output – the array of bytes out0..2 s0.
(3. input8n+7}.
(3.0 s1. 3.
The pattern can be extended to longer sequences (i. input8n+1.
Hence. input1.0 s2.
an = {input8n.3). input121.1 s3.a0 = {input0.
w2 = s 0.
Alternatively. The addition is performed with
the XOR operation (denoted by ⊕ ) . 5.2 s 2.
( x 6 + x 4 + x 2 + x + 1) + ( x 7 + x + 1) = x 7 + x 6 + x 4 + x 2
(polynomial notation).4)
The four bytes in each column of the State array form 32-bit words.1)
.1 s 3. addition of finite field elements can be described as the modulo 2 addition of
corresponding bits in the byte.5
for 0 ≤ r < 4 and 0 ≤ c < Nb. the following expressions are equivalent to one another:
w3 = s 0.w3. subtraction of polynomials is identical to addition of polynomials.1 s 2. where the row number r
provides an index for the four bytes within each word.
(hexadecimal notation).
(3.2 s 1.0 s 3.5)
All bytes in the AES algorithm are interpreted as finite field elements using the notation
introduced in Sec.and at the end of the Cipher and Inverse Cipher.c0 = a0 ⊕ b0).2. A polynomial is
irreducible if its only divisors are one and itself.e. as follows:
4. c6 = a6 ⊕ b6.3 s 2. 1 ⊕ 0 = 1 . and 0 ⊕ 0 = 0 . for the example in Fig.
In the polynomial representation.1 s 1. modulo 2 . the sum is
{c7c6c5c4c3c2c1c0}. but these operations
are different from those used for numbers. For two bytes {a7a6a5a4a3a2a1a0} and {b7b6b5b4b3b2b1b0}..3 . 3. The state can hence be interpreted as a
one-dimensional array of 32 bit words (columns).e.. where each ci = ai ⊕ bi (i.
Consequently. the State is copied to the output array out as
out[r + 4c] = s[r. w0.
w0 = s 0. where the column number c provides
an index into this array.1
The addition of two elements in a finite field is achieved by “adding” the coefficients for the
corresponding powers in the polynomials for the two elements. multiplication in GF(28) (denoted by •) corresponds with the
multiplication of polynomials modulo an irreducible polynomial of degree 8. the State can be considered as an array
of four words.0 s 1. this irreducible
m( x ) = x 8 + x 4 + x 3 + x + 1 .0 s 2.2
w1 = s 0..2 s 3.. c7 = a7 ⊕ b7.i. Hence. For the AES algorithm.
(3.. c]
{01010111} ⊕ {10000011} = {11010100}
(binary notation).
(4. . The following subsections introduce the basic
mathematical concepts needed for Sec. 3.. Finite field elements can be added and multiplied.3 s 3.so that 1 ⊕ 1 = 0 .3 s 1.
If b7 = 0.
By adding intermediate results. the reduction is accomplished by
subtracting (i. has the structure of the finite field GF(28).3)
Moreover. For any non-zero binary polynomial b(x) of degree less than 8. and the element {01} is the multiplicative
The multiplication defined above is associative.
For example. the multiplicative
inverse of b(x).
It follows that the set of 256 possible byte values.e. If b7 = 1. denoted b-1(x). a ( x) • b( x) mod m( x) = 1 . it holds that
a( x) • (b( x) + c( x)) = a( x) • b( x) + a ( x) • c( x) . there is no simple operation at the
byte level that corresponds to this multiplication. can be found as follows: the extended Euclidean algorithm [7] is
used to compute polynomials a(x) and c(x) such that
b( x ) a ( x ) + m( x )c ( x ) = 1 .
{00000010} or {02}) can be implemented at the byte level as a left shift and a subsequent
conditional bitwise XOR with {1b}. the result is already in reduced form.2. for any a(x).
(4.or {01}{1b} in hexadecimal notation.1) with the polynomial x results in
b7 x 8 + b6 x 7 + b5 x 6 + b4 x 5 + b3 x 4 + b2 x 3 + b1 x 2 + b0 x . and thus can be represented by a byte. {57} • {83} = {c1}. as defined in equation
Multiplication by higher powers of x can be implemented by repeated application of xtime(). multiplication by any constant can be implemented. It follows that multiplication by x (i.e. which means
b −1 ( x) = a( x) mod m( x) .
The result x • b(x) is obtained by reducing the above result modulo m(x).2)
The modular reduction by m(x) ensures that the result will be a binary polynomial of degree less
than 8.1 Multiplication by x
Multiplying the binary polynomial defined in equation (3. Unlike addition. b(x) and c(x) in the field.. because
( x 6 + x 4 + x 2 + x + 1) ( x 7 + x + 1)
x 13 + x 11 + x 9 + x 8 + x 7 +
x7 + x5 + x3 + x 2 + x +
x 6 + x 4 + x 2 + x +1
x 13 + x 11 + x 9 + x 8 + x 6 + x 5 + x 4 + x 3 + 1
x 13 + x 11 + x 9 + x 8 + x 6 + x 5 + x 4 + x 3 + 1 modulo ( x 8 + x 4 + x 3 + x + 1 )
x 7 + x 6 +1. with XOR used as addition and the
multiplication defined as above.1).
(4. XORing) the polynomial m(x). This operation on bytes is denoted by xtime().. {57} • {13} = {fe} because
Note that the polynomials in this
section behave somewhat differently than the polynomials used in the definition of finite field
elements.6)
define a second four-term polynomial.5)
which will be denoted as a word in the form [a0 .
= {fe}. also. a2 . let
b( x) = b3 x 3 + b2 x 2 + b1 x + b0
Four-term polynomials can be defined .9)
. even though both types of polynomials use the same indeterminate.with coefficients that are finite field elements . defined below.5) and (4. Addition is performed by adding the finite field
coefficients of like powers of x. x. and like powers are collected to give
c( x) = c6 x 6 + c5 x 5 + c4 x 4 + c3 x 3 + c2 x 2 + c1 x + c0
(4.{57} • {02} = xtime({57}) = {ae}
{57} • {10} = xtime({8e}) = {07}. using the equations of (4.8)
c0 = a0 • b0
c4 = a3 • b1 ⊕ a 2 • b2 ⊕ a1 • b3
c1 = a1 • b0 ⊕ a 0 • b1
c5 = a 3 • b2 ⊕ a2 • b3
c2 = a 2 • b0 ⊕ a1 • b1 ⊕ a0 • b2
c6 = a3 • b3
(4. a1 .
The distinction should always be clear from the context.
Thus..7)
Multiplication is achieved in two steps. the polynomial product c(x) = a(x) •
b(x) is algebraically expanded. the XOR of the complete word
values.6). bytes.e.
To illustrate the addition and multiplication operations.
4. i. In the first step.as:
a ( x) = a 3 x 3 + a 2 x 2 + a1 x + a0
(4. This addition corresponds to an XOR operation between the
corresponding bytes in each of the words – in other words. instead of bits. a3 ]. the
multiplication of four-term polynomials uses a different reduction polynomial. The coefficients
in this section are themselves finite field elements.
a( x) + b( x) = (a3 ⊕ b3 ) x 3 + (a2 ⊕ b2 ) x 2 + (a1 ⊕ b1 ) x + (a0 ⊕ b0 )
c(x). the length of the input block. so that
x i mod( x 4 + 1) = x i mod 4 . Therefore. b0]. which reflects the number of 32-bit words (number of
columns) in the State.3. b3.15)
Another polynomial used in the AES algorithm (see the RotWord() function in Sec.13)
Because x 4 + 1 is not an irreducible polynomial over GF(28). multiplication by a fixed four-term
polynomial is not necessarily invertible.3 and Sec.c3 = a 3 • b0 ⊕ a 2 • b1 ⊕ a1 • b2 ⊕ a 0 • b3 .
The modular product of a(x) and b(x). the output block and the State is 128
(4. does not represent a four-byte word. b2.1. this is accomplished with the
polynomial x4 + 1. is given by the four-term
polynomial d(x). b2. For the AES algorithm.14)
a-1(x) = {0b}x3 + {0d}x2 + {09}x + {0e}.
The result. This is represented by Nb = 4. the AES algorithm specifies a fixed four-term
polynomial that does have an inverse (see Sec.2) has a0
= a1 = a2 = {00} and a3 = {01}. b1. which is the polynomial x3. denoted by a(x) ⊗ b(x).
d 0 = (a0 • b0 ) ⊕ (a3 • b1 ) ⊕ (a 2 • b2 ) ⊕ (a1 • b3 )
d1 = (a1 • b0 ) ⊕ (a 0 • b1 ) ⊕ (a3 • b2 ) ⊕ (a 2 • b3 )
(4. the second step of the
multiplication is to reduce c(x) modulo a polynomial of degree 4.
(4. However. 5.13) above
will show that its effect is to form the output word by rotating bytes in the input word. the result can be reduced to a
polynomial of degree less than 4.3):
(4. the operation defined in equation (4. b3] is transformed into [b1.11) can be written in
d 0 
a0
 1 =  1
d 2 
a 2
d 3 
 a3
a1  b0 
a 2   b1 
a 3  b2 
a 0  b3 
For the AES algorithm. This
means that [b0. Inspection of equation (4. defined as follows:
d ( x) = d 3 x 3 + d 2 x 2 + d1 x + d 0
(4. 5.12)
d 2 = (a 2 • b0 ) ⊕ (a1 • b1 ) ⊕ (a 0 • b2 ) ⊕ (a3 • b3 )
d 3 = (a3 • b0 ) ⊕ (a 2 • b1 ) ⊕ (a1 • b2 ) ⊕ (a 0 • b3 )
When a(x) is a fixed polynomial. 5.
length is represented by Nk = 4.
The Cipher is described in the pseudo code in Fig. Key-Block-Round Combinations.3.
For the AES algorithm. 4. 5. the input is copied to the State array using the conventions described in
Sec.1. which reflects the number of 32-bit words (number of
columns) in the Cipher Key. 5. see Sec. 5.
For implementation issues relating to the key length. These
transformations (and their inverses) are described in Sec.
Figure 4. the AES algorithm uses a round function that is
composed of four different byte-oriented transformations: 1) byte substitution using a
substitution table (S-box). the State array is transformed by implementing a
round function 10. 5. 5.2.
.3. or 8.4. respectively. The final State is then copied to the output as described in
Sec.1. or 14 times (depending on the key length).For the AES algorithm.1-5. the array w[] contains the key
schedule.4. the number of rounds to be performed during the execution of the
algorithm is dependent on the key size.2. The number of rounds is represented by Nr. 3. 5.1
At the start of the Cipher. the length of the Cipher Key. is 128. block size and number of rounds. Nr = 12 when Nk = 6.
The round function is parameterized using a key schedule that consists of a one-dimensional
array of four-byte words derived using the Key Expansion routine described in Sec.
The only Key-Block-Round combinations that conform to this standard are given in Fig. 6. while the Key
Schedule is described in Sec. 3) mixing the
data within each column of the State array. and Nr = 14 when Nk = 8. 12.
The Cipher and Inverse Cipher are described in Sec. 192.1-5.3. 3. In Fig. 5. 5. which does
not include the MixColumns() transformation. The individual transformations SubBytes().3. 5.
5. all Nr rounds are identical with the exception of the final round.2. and 4) adding a Round Key to the State. 2) shifting rows of the State array by different offsets. with the final round differing
slightly from the first Nr − 1 rounds. K. and AddRoundKey() – process the State
and are described in the following subsections.4 and 5.
As shown in Fig. After an initial Round Key addition.
For both its Cipher and Inverse Cipher. ShiftRows(). where Nr =
10 when Nk = 4.1 and Sec. MixColumns(). or 256 bits. which is described in Sec.4.
) act upon the State array that is addressed
by the ‘state’ pointer.1
5. 7). SubBytes().3
AddRoundKey(state. Apply the following affine transformation (over GF(2) ):
bi' = bi ⊕ b( i + 4 ) mod 8 ⊕ b(i + 5) mod 8 ⊕ b(i + 6 ) mod 8 ⊕ b( i + 7 ) mod 8 ⊕ ci
(5.g. the
element {00} is mapped to itself.
2. w[round*Nb.4
// See Sec.1. 5. w[0. described in Sec.Appendix B presents an example of the Cipher.Nb]
AddRoundKey(state. word w[Nb*(Nr+1)])
byte state[4.1
// See Sec.1.1)
for 0 ≤ i < 8 .2.. b′ )
indicates that the variable is to be updated with the value on the right.2
// See Sec. which is
invertible.1 SubBytes()Transformation
The SubBytes() transformation is a non-linear byte substitution that operates independently
on each byte of the State using a substitution table (S-box). Take the multiplicative inverse in the finite field GF(28).
Cipher(byte in[4*Nb].1.g. w[Nr*Nb. and ci is the ith bit of a byte c with the
value {63} or {01100011}.1. byte out[4*Nb].
In matrix form. Here and elsewhere. is constructed by composing two transformations:
1. Pseudo Code for the Cipher. etc. This S-box (Fig. 5. (round+1)*Nb-1])
AddRoundKey(state. 5. AddRoundKey() uses an additional pointer to address the Round Key. 5. the affine transformation element of the S-box can be expressed as:
The various transformations (e. showing values for the State array at the
beginning of each round and after the application of each of the four transformations described in
the following sections. 4. ShiftRows(). a prime on a variable (e.
. Nb-1])
// See Sec..1. where bi is the ith bit of the byte. (Nr+1)*Nb-1])
0 s3' . 2 s3.1 s2' .1 = {53}.
0 b4  0
0 b5  1
0 b6  1
1 b7  0
. then the substitution value would be determined by the intersection
of the row with index ‘5’ and the column with index ‘3’ in Fig.
sr .1 s0.1 having
a value of {ed}. 0 s2.3
s3' . 2 s0. if s1. SubBytes() applies the S-box to each byte of the State.1 s3' .
For example. 2 s3' .
The S-box used in the SubBytes() transformation is presented in hexadecimal form in Fig. 0 s1. 0 s2' . 2
sr .1 s2.3
s1' .1 s1.1 s0' .0 s0.3
s2' . 0 s0' . 2 s2 . 2 s0' .3
s3. 2 s1. 7.3
s0' .1 s3.b0'  1
 ' 
 b1  1
b2'  1
b3  = 1
b '  1
 4'  
b5  0
b '  0
 6 
b7'  0
1 b0  1
1  b1  1
1 b2  0
1 b3  0
. 2 s2' .2)
Figure 6 illustrates the effect of the SubBytes() transformation on the State. 0 s3. 7.0
s1' .c
s1' .3
Figure 6. S-box: substitution values for the byte xy (in hexadecimal format).1' s1' . This would result in s1′.
As described in Sec.
sr' . as follows (recall that Nb = 4):
shift (1.2 ShiftRows() Transformation
In the ShiftRows() transformation.1.1 s1.4)
This has the effect of moving bytes to “lower” positions in the row (i.1
s2. 2 sr' .3 MixColumns() Transformation
The MixColumns() transformation operates on the State column-by-column.1 s0.3
s0. shift (3. Let
s ′( x) = a ( x) ⊗ s ( x) :
s2. ShiftRows() cyclically shifts the last three rows in the State.3 s2.0 s0.3
(5.1 sr' .1 s3. 2 s0.3 s3. is not shifted. 2 s2.3
s1.. 4. shift (2.1
s3. higher values of
c in a given row). 0 s3. The first row.3
Specifically.1 s2. 0 s2.
where the shift value shift(r.3. treating each
column as a four-term polynomial as described in Sec. 2 s3. ( c + shift ( r . Nb )) mod Nb for 0 < r < 4 and 0 ≤ c < Nb. given by
a(x) = {03}x3 + {01}x2 + {01}x + {02} .Nb) depends on the row number. c = sr . r. 2 sr . 0 s3. the bytes in the last three rows of the State are cyclically
shifted over different numbers of bytes (offsets). the ShiftRows() transformation proceeds as follows:
sr' . 0 s1. this can be written as a matrix multiplication.5)
.4) = 1 .5. 2 s1. 0 sr . 2 s2 .3
s3.1 s0.0 s0.1 s3.e. 0 s2.. 2
s1.e.
(5. The columns are considered as
polynomials over GF(28) and multiplied modulo x4 + 1 with a fixed polynomial a(x). r = 0.3. while the “lowest” bytes wrap around into the “top” of the row (i.1 sr .4) = 2 . lower values of c in a
given row). 4. 0
Figure 8. 2 s0.4) = 3 .
Figure 8 illustrates the ShiftRows() transformation. 0 sr' .3
1.c . c 
for 0 ≤ c < Nb.
(5.c ] = [ s 0. s '3.c ⊕ ({02} • s3.
.2). The byte
address within words of the key schedule was described in Sec.c .
5.1 s0. c 
01  s1..c = ({03} • s0 . 5). 2 s2' . 0
s'0' . MixColumns() operates on the State column-by-column. a Round Key is added to the State by a simple bitwise
XOR operation.1
1.1c s1. 5.1.c ) ⊕ ({03} • s 2.c ).1.c = s0 . prior to
the first application of the round function (see Fig.1 s0' .c ] ⊕ [ wround ∗ Nb + c ]
for 0 ≤ c < Nb.4 AddRoundKey() Transformation
In the AddRoundKey() transformation.c s3' .3
ss '1' .3
s2.0 ss3'3.c ⊕ s 2 .c .3
s1′. 0 ss22. Each Round Key consists of Nb words from the key schedule (described in Sec.
s0. 2 s0' . c  =  01
 s2' .c ⊕ s1.c ) ⊕ ({03} • s3. In the Cipher. 2
1. 2 s3' . such that
[ s ' 0.3
s1.1.c ⊕ ({02} • s1. 0
s3.c = s0 . the initial Round Key addition occurs when round = 0.1c s2. c 
02  s3. where l = round * Nb.c ) ⊕ s3. 0 s11. c  02
 '  
 s1.
(5. and round is a value in the range
0 ≤ round ≤ Nr.
The action of this transformation is illustrated in Fig.c s2' . 2 s3. The application of the AddRoundKey()
transformation to the Nr rounds of the Cipher occurs when 1 ≤ round ≤ Nr.
Figure 9 illustrates the MixColumns() transformation. Those Nb words are each added into the columns of the State. c 
03  s2.c . the four bytes in a column are replaced by the following:
s 0′ .3
s2' .c s ' s '
1. 2 s0. s0' .0 s0.1c s3. 0
s0. 10. s ' 2. s1. c   01
 s3.c ) ⊕ s1. c  03
01  s0.c . 2 s1.c = ({02} • s0 .. 0 ss33.c ⊕ ({02} • s 2 . 2 s2 .c ) ⊕ ({03} • s1. s 3.2. s '1.7)
where [wi] are the key schedule words described in Sec.3
ss2'2. 3.c ) ⊕ s 2.3
Figure 9. s 2..c
0.c )
s3′ .c .6)
As a result of this multiplication.
5.c ⊕ s3.c
s ′2.3
s3' .
4. 0 s1.c
s1.0 s0. denoted [wi ].1 s3. 2 s3. followed by the application of a table lookup to all four bytes of the word
(SubWord()). a
transformation is applied to w[[i-1]] prior to the XOR.1
2. contains the values given by [xi-1.a3] as input.a0]. 3
s2' .3
5. not 0). and returns the word [a1.
The expansion of the input key into the key schedule proceeds according to the pseudo code in
Fig. w[[i]].3
wl wl +1 wl + 2 wl + 3
s1. 11. 0 s0' . 0 ss2' .
It is important to note that the Key Expansion routine for 256-bit Cipher Keys (Nk = 8) is
slightly different than for 128.c s
s0' . 2 s1' .3
. This transformation consists of a cyclic shift of the bytes in a word
(RotWord()).1 s1' .3
s1. 5. with i in the range
0 ≤ i < Nb(Nr + 1). Rcon[i].and 192-bit Cipher Keys. 2 s1. with
x i-1 being powers of x (x is denoted as {02}) in the field GF(28).{00}]. is equal to the XOR of the previous word. 2
3.0 s1' .2
The AES algorithm takes the Cipher Key. Rcon[i]. 0
s s2. The
round constant word array.12. 2 s0' . K.
SubWord() is a function that takes a four-byte input word and applies the S-box (Sec. w[[i-Nk]]. and
the word Nk positions earlier. 2 s3' .3
s3. as discussed in Sec. performs a cyclic permutation.1.c
Figure 10.{00}.c
s0.0 s3s' . The Key Expansion generates a total of Nb (Nr + 1) words: the algorithm requires
an initial set of Nb words. 0 s3s.
then SubWord() is applied to w[[i-1]] prior to the XOR. and each of the Nr rounds requires Nb words of key data. 11.
From Fig.13.a3.c
s0. AddRoundKey() XORs each column of the State with a word
from the key schedule. 7) to each of the four bytes to produce an output word.a2.a2.c
s1' .{00}.2 (note
that i starts at 1.a1. and performs a Key Expansion routine to generate a
key schedule.1. w[[i-1]].1 s0. 2 s2' .
s3' . The
resulting key schedule consists of a linear array of 4-byte words. If Nk = 8 and i-4 is a multiple of Nk. followed by an XOR with a round
constant.1 s1. For words in positions that are a multiple of Nk.3
s2 . Every following word.1' s0' . 2 s0. The function RotWord() takes a
word [a0.c s2' . it can be seen that the first Nk words of the expanded key are filled with the
Cipher Key.c s3' .l = round * Nb
s0' .
The functions SubWord() and RotWord() return a result that is a transformation of the function input.
. ShiftRows(). 6. the array w[] contains
the key schedule.InvShiftRows().2
Figure 11. Nk)
w[i] = word(key[4*i]. and 8 do not all have to be implemented. 6.) transform the
State array that is addressed by the ‘state’ pointer.InvMixColumns(). etc. 5. Pseudo Code for Key Expansion. SubBytes().
they are all included in the conditional statement above for
conciseness. 5.3
The Cipher transformations in Sec. 12. whereas
the transformations in the Cipher and Inverse Cipher (e. 12. which was described previously in Sec.1 can be inverted and then implemented in reverse order to
produce a straightforward Inverse Cipher for the AES algorithm. key[4*i+2].1. key[4*i+1].2.g.
Specific implementation requirements for the
Cipher Key are presented in Sec. InvSubBytes(). The individual transformations
used in the Inverse Cipher .. word w[Nb*(Nr+1)].
The Inverse Cipher is described in the pseudo code in Fig. In Fig.
and AddRoundKey() – process the State and are described in the following subsections. key[4*i+3])
Note that Nk=4.KeyExpansion(byte key[4*Nk].
where the shift value shift(r. w[round*Nb.
.3. AddRoundKey() uses an additional pointer to address the Round Key.4)
(see Sec. and is given in equation (5.InvCipher(byte in[4*Nb].Nb]
AddRoundKey(state.
Specifically. Nb)
bytes. Pseudo Code for the Inverse Cipher. 5.1. 5.3. the InvShiftRows() transformation proceeds as follows:
sr' .1. Nb )) mod Nb = sr . ( c + shift ( r . The bytes in the last
three rows of the State are cyclically shifted over different numbers of bytes (offsets). 5. (round+1)*Nb-1])
// See Sec.8)
Figure 13 illustrates the InvShiftRows() transformation. Nb-1])
Figure 12. is not shifted.1
// See Sec.3
5. InvSubBytes()..Nb) depends on the row number. c for 0 < r < 4 and 0 ≤ c < Nb
(5. 5. InvShiftRows(). byte out[4*Nb].
The various transformations (e. word w[Nb*(Nr+1)])
byte state[4.2).2
AddRoundKey(state. 5.4
// See Sec. w[Nr*Nb. The bottom three rows are cyclically shifted by Nb − shift (r .3.3.) act upon the State array that is
addressed by the ‘state’ pointer. w[0.1 InvShiftRows() Transformation
InvShiftRows() is the inverse of the ShiftRows() transformation. The first
row.3
AddRoundKey(state. etc. r = 0. (Nr+1)*Nb-1]) // See Sec.g.
Inverse S-box: substitution values for the byte xy (in
hexadecimal format). 0 sr' . 2 s1.3
s0.InvShiftRows()
sr' .3
sr .1 s1.1 s1. InvShiftRows()cyclically shifts the last three rows in the State. 2
Figure 13. 14:
The inverse S-box used in the InvSubBytes() transformation is presented in Fig.3
5.1 sr .3
s2. 2 s3.3 s2.1 s0. 2 sr . 0 s2. 2 s3.1 s0.3
s2.1 s3.
s1. 0 sr .0 s0. 2 s0. 2 sr' . 0 s1.2 InvSubBytes() Transformation
InvSubBytes() is the inverse of the byte substitution transformation.0 s0. 2 s2.1 s3. 0
s0. in which the inverse Sbox is applied to each byte of the State.1 s2. This is obtained by applying the inverse of the affine
transformation (5.1) followed by taking the multiplicative inverse in GF(28).3 s3. 2 s2 . 0 s2.1
s3.3.1 sr' .3
s3. 2 s0. 0 s3.
c  0d 09 0e 0b   s2.c ) ⊕ ({0b} • s1.c )
5.c ) ⊕ ({09} • s 2. c   0e 0b 0d 09   s0. c 
 s2' .5 Equivalent Inverse Cipher
In the straightforward Inverse Cipher presented in Sec. given by
1.1.c ) ⊕ ({0e} • s 2. 4.c ) ⊕ ({0d} • s 2. Let
s ′( x) = a −1 ( x) ⊗ s ( x) :
 s0' .c ) ⊕ ({09} • s1.3. 12.c ) ⊕ ({0b} • s 2.c )
s ′2. The columns are considered as polynomials over
GF(28) and multiplied modulo x4 + 1 with a fixed polynomial a-1(x). a
SubBytes() transformation immediately followed by a ShiftRows()
transformation is equivalent to a ShiftRows() transformation immediately
followed buy a SubBytes() transformation. the four bytes in a column are replaced by the following:
s 0′ . The SubBytes() and ShiftRows() transformations commute.10)
As a result of this multiplication.4 Inverse of the AddRoundKey() Transformation
AddRoundKey().c ) ⊕ ({0b} • s3.c ) ⊕ ({0d} • s1.3.5. the sequence of the
transformations differs from that of the Cipher.c ) ⊕ ({0e} • s1. This is accomplished with a change
in the key schedule. c   0b 0d 09 0e   s3.9)
As described in Sec.c = ({0b} • s0 .c ) ⊕ ({09} • s3. 4.3. 5. that is. treating each column as a fourterm polynomial as described in Sec.
InvSubBytes() and InvShiftRows.4.c )
s3′ .c ) ⊕ ({0e} • s3.c = ({0d} • s0 . while the form of the key schedules for
encryption and decryption remains the same.
. The same is true for their inverses. c 
 s1. is its own inverse. c 
for 0 ≤ c < Nb. However. c  =  09 0e 0b 0d   s1. which was described in Sec.c )
5.3. 5.c = ({09} • s0 . since it only involves
an application of the XOR operation.3. this can be written as a matrix multiplication. c 
 s3.c ) ⊕ ({0d} • s3.3 InvMixColumns() Transformation
InvMixColumns() is the inverse of the MixColumns() transformation.c = ({0e} • s0 .3 and Fig. several properties of the AES algorithm
allow for an Equivalent Inverse Cipher that has the same sequence of transformations as the
Cipher (with the transformations replaced by their inverses).
InvMixColumns() operates on the State column-by-column.
Given these changes. 15. The modification to the Key Expansion routine is also provided in Fig. 12. which means
InvMixColumns(state) XOR InvMixColumns(Round Key). The first and last Nb words of the decryption key
schedule shall not be modified in this manner.3 and Fig. Pseudo code for the Equivalent
Inverse Cipher appears in Fig.MixColumns() and InvMixColumns() .
These properties allow the order of InvSubBytes() and InvShiftRows()
transformations to be reversed. The order of the AddRoundKey() and InvMixColumns()
transformations can also be reversed. 5. 15.
The equivalent inverse cipher is defined by reversing the order of the InvSubBytes() and
InvShiftRows() transformations shown in Fig. and by reversing the order of the
AddRoundKey() and InvMixColumns() transformations used in the “round loop” after
first modifying the decryption key schedule for round = 1 to Nr-1 using the
InvMixColumns() transformation.are
linear with respect to the column input. The column mixing operations .)
.2. (The word array dw[] contains the modified decryption key
schedule. provided that the columns (words) of the decryption key
schedule are modified using the InvMixColumns() transformation. the resulting Equivalent Inverse Cipher offers a more efficient structure
than the Inverse Cipher described in Sec. 12.
e. 192. Nk = 4. (Nr+1)*Nb-1])
AddRoundKey(state. dw[0. 5. dw[round*Nb. 5: 128. Implementations
. (round+1)*Nb-1])
Note that.1
An implementation of the AES algorithm shall support at least one of the three key lengths
specified in Sec.e. which is considered
to be a two-dimensional array of bytes. or 256 bits (i.
Figure 15. or 8. the
input to InvMixColumns() is normally the State array. respectively). since InvMixColumns operates on a two-dimensional array of bytes
while the Round Keys are held in an array of words. byte out[4*Nb].EqInvCipher(byte in[4*Nb].Nb]
6. Pseudo Code for the Equivalent Inverse Cipher. whereas the input here is a Round
Key computed as a one-dimensional array of words).. 6. the call to
InvMixColumns in this code sequence involves a change of type (i. (round+1)*Nb-1])
AddRoundKey(state. the following pseudo code is added at
the end of the Key Expansion routine (Sec. Nb-1])
For the Equivalent Inverse Cipher. dw[Nr*Nb.2):
InvMixColumns(dw[round*Nb. word dw[Nb*(Nr+1)])
byte state[4.
block size (Nb).
implementers may choose to design their AES implementations with future flexibility in mind.
6. Block Size. any implementation that
produces the same output (ciphertext or plaintext) as the algorithm specified in this standard is an
acceptable implementation of the AES. and there is no
restriction on key selection. Therefore.3
Parameterization of Key Length. and
number of rounds (Nr) – see Fig.
. and Round Number
This standard explicitly defines the allowed values for the key length (Nk).
Implementation variations are possible that may. [1] include suggestions on how to efficiently
implement the AES algorithm on a variety of platforms. offer performance or other
6. which may promote the interoperability of
algorithm implementations. Given the same input key and data (plaintext or ciphertext). in many cases. However. future reaffirmations of this standard could
include changes or additions to the allowed values for those parameters.may optionally support two or three key lengths. 4.2
No weak or semi-weak keys have been identified for the AES algorithm.
Reference [3] and other papers located at Ref.
for Nk = 4.
A. with the exception of the index column (i)). 5. Note that multibyte values are presented using the notation described in Sec. which results in
w0 = 2b7e1516
w1 = 28aed2a6
w2 = abf71588
w3 = 09cf4f3c
temp XOR
w[i-Nk]
RotWord() SubWord()
.2) are given in the following
table (all values are in hexadecimal format.Appendix A .Key Expansion Examples
This appendix shows the development of the key schedule for various key sizes. 3. The intermediate values
produced during the development of the key schedule (see Sec.
w0 = 8e73b0f7
w1 = da0e6452
w4 = 62f8ead2
w5 = 522c6b7b
w2 = c810f32b
w3 = 809079e5
8e 73 b0 f7 da 0e 64 52 c8 10 f3 2b
for Nk = 6.
for Nk = 8. which results in
w0 = 603deb10
w1 = 15ca71be
w2 = 2b73aef0
w3 = 857d7781
w4 = 1f352c07
w5 = 3b6108d7
w6 = 2d9810a3
w7 = 0914dff4
Nb = 4 and Nk = 4).Appendix B – Cipher Example
The following diagram shows the values in the State array as the Cipher progresses for a block
length and a Cipher Key length of 16 bytes each (i..e.
17 b1 39 05
49 45 7f 77
58 1b db 1b
f2 7a 59 73
de db 39 02
db 39 02 de
4d 4b e7 6b
d2 96 87 53
87 53 d2 96
ca 5a ca b0
89 f1 1a 3b
3b 89 f1 1a
f1 ac a8 e5
f2 43 7a 7f
aa 61 82 68
ac ef 13 45
75 20 53 bb
3d 47 1e 6d
8f dd d2 32
73 c1 b5 23
c1 b5 23 73
ec 0b c0 25
5f e3 4a 46
cf 11 d6 5a
d6 5a cf 11
09 63 cf d0
03 ef d2 9a
7b df b5 b8
b8 7b df b5
93 33 7c dc
7d 3e 44 3b
48 67 4d d6
52 85 e3 f6
0f 60 6f 5e
ef a8 b6 db
6c 1d e3 5f
50 a4 11 cf
a4 11 cf 50
d6 31 c0 b3
4e 9d b1 58
2f 5e c8 6a
c8 6a 2f 5e
da 38 10 13
ee 0d 38 e7
28 d7 07 94
94 28 d7 07
a9 bf 6b 01
41 7f 3b 00
e0 c8 d9 85
e1 e8 35 97
25 bd b6 4c
d4 7c ca 11
92 63 b1 b8
4f fb c8 6c
fb c8 6c 4f
d1 11 3a 4c
7f 63 35 be
d2 fb 96 ae
96 ae d2 fb
a9 d1 33 c0
e8 c0 50 01
9b ba 53 7c
7c 9b ba 53
ad 68 8e b0
a0 88 23 2a
fa 54 a3 6c
fe 2c 39 76
c2 96 35 59
95 b9 80 f6
80 16 23 7a
47 fe 7e 88
44 52 71 0b
a5 5b 25 ad
d1 83 f2 f9
c6 9d b8 15
f8 87 bc bc
32 43 f6 a8 88 5a 30 8d 31 31 98 a2 e0 37 07 34
f1 c1 7c 5d
a1 78 10 4c
4b 2c 33 37
00 92 c8 b5
63 4f e8 d5
4f e8 d5 63
86 4a 9d d2
6f 4c 8b d5
a8 29 3d 03
3d 03 a8 29
8d 89 f4 18
55 ef 32 0c
fc df 23 fe
fe fc df 23
6d 80 e8 d8
7a fd 41 fd
26 3d e8 fd
f7 27 9b 54
14 46 27 34
4e 5f 84 4e
0e 41 64 d2
ab 83 43 b5
83 43 b5 ab
15 16 46 2a
2e b7 72 8b
31 a9 40 3d
40 3d 31 a9
b5 15 56 d8
17 7d a9 25
f0 ff d3 3f
3f f0 ff d3
bf ec d7 43
0e f3 b2 4f
5a 19 a3 7a
be d4 0a da
00 b1 54 fa
ea b5 31 7f
41 49 e0 8c
83 3b e1 64
3b e1 64 83
51 c8 76 1b
42 dc 19 04
2c 86 d4 f2
d4 f2 2c 86
2f 89 6d 99
b1 1f 65 0c
c8 c0 4d fe
fe c8 c0 4d
d1 ff cd ea
21 d2 60 2f
ea 04 65 85
87 f2 4d 97
47 40 a3 4c
ac 19 28 57
83 45 5d 96
ec 6e 4c 90
6e 4c 90 ec
37 d4 70 9f
5c 33 98 b0
4a c3 46 e7
46 e7 4a c3
94 e4 3a 42
f0 2d ad c5
8c d8 95 a6
a6 8c d8 95
ed a5 a6 bc
eb 59 8b 1b
e9 cb 3d af
40 2e a1 c3
09 31 32 2e
31 32 2e 09
f2 38 13 42
89 07 7d 2c
7d 2c 89 07
1e 84 e7 d2
72 5f 94 b5
b5 72 5f 94
6d 11 db ca
88 0b f9 00
a3 3e 86 93
54 5f a6 a6
f7 c9 4f dc
d2 8d 2b 8d
73 ba f5 29
77 fa d1 5c
66 dc 29 00
f3 21 41 6e
d0 c9 e1 b6
14 ee 3f 63
f9 25 0c 0c
a8 89 c8 a6
Additional examples may be found at [1] and
[5]. 3. 12 or 14):
s_box:
s_row:
m_col:
k_sch:
state at start of round[r]
state after SubBytes()
state after ShiftRows()
state after MixColumns()
key schedule value for round[r]
cipher output
Legend for INVERSE CIPHER (DECRYPT) (round number r = 0 to 10.5. while the right character provides the bit
pattern for the lower-numbered bits. and Equivalent Inverse Cipher that are
described in Sec. 12 or 14):
iinput: inverse cipher input
istart: state at start of round[r]
is_box: state after InvSubBytes()
is_row: state after InvShiftRows()
ik_sch: key schedule value for round[r]
ik_add: state after AddRoundKey()
ioutput: inverse cipher output
Legend for EQUIVALENT INVERSE CIPHER (DECRYPT) (round number r = 0 to 10. and 8).
All vectors are in hexadecimal notation.1
inverse cipher input
state after InvSubBytes()
state after InvShiftRows()
state after InvMixColumns()
inverse cipher output
AES-128 (Nk=4. respectively. Nr=10)
CIPHER (ENCRYPT):
Legend for CIPHER (ENCRYPT) (round number r = 0 to 10.3. 5. and 5.Appendix C – Example Vectors
This appendix contains example vectors. with each pair of characters giving a byte value in which
the left character of each pair provides the bit pattern for the 4 bit group containing the higher
numbered bits using the notation explained in Sec. 5.3. including intermediate values – for all three AES key
lengths (Nk = 4. for the Cipher. 12
or 14):
is_box:
is_row:
im_col:
ik_sch:
ioutput:
C. Inverse Cipher. The array index for all bytes (groups of two hexadecimal
digits) within these test vectors starts at zero and increases from left to right. 6.
round[ 6].s_box
round[ 4].k_sch
round[ 4].start
round[ 2].s_row
round[ 1].s_row
round[ 9].s_box
round[ 3].output
63cab7040953d051cd60e0e7ba70e18c
6353e08c0960e104cd70b751bacad0e7
5f72641557f5bc92f7be3b291db9f91a
d6aa74fdd2af72fadaa678f1d6ab76fe
89d810e8855ace682d1843d8cb128fe4
a761ca9b97be8b45d8ad1a611fc97369
a7be1a6997ad739bd8c9ca451f618b61
ff87968431d86a51645151fa773ad009
b692cf0b643dbdf1be9bc5006830b3fe
4915598f55e5d7a0daca94fa1f0a63f7
3b59cb73fcd90ee05774222dc067fb68
3bd92268fc74fb735767cbe0c0590e2d
4c9c1e66f771f0762c3f868e534df256
b6ff744ed2c2c9bf6c590cbf0469bf41
fa636a2825b339c940668a3157244d17
2dfb02343f6d12dd09337ec75b36e3f0
2d6d7ef03f33e334093602dd5bfb12c7
6385b79ffc538df997be478e7547d691
47f7f7bc95353e03f96c32bcfd058dfd
247240236966b3fa6ed2753288425b6c
36400926f9336d2d9fb59d23c42c3950
36339d50f9b539269f2c092dc4406d23
f4bcd45432e554d075f1d6c51dd03b3c
3caaa3e8a99f9deb50f3af57adf622aa
c81677bc9b7ac93b25027992b0261996
e847f56514dadde23f77b64fe7f7d490
e8dab6901477d4653ff7f5e2e747dd4f
9816ee7400f87f556b2c049c8e5ad036
5e390f7df7a69296a7553dc10aa31f6b
c62fe109f75eedc3cc79395d84f9cf5d
b415f8016858552e4bb6124c5f998a4c
b458124c68b68a014b99f82e5f15554c
c57e1c159a9bd286f05f4be098c63439
14f9701ae35fe28c440adf4d4ea9c026
d1876c0f79c4300ab45594add66ff41f
3e175076b61c04678dfc2295f6a8bfc0
3e1c22c0b6fcbf768da85067f6170495
baa03de7a1f9b56ed5512cba5f414d23
47438735a41c65b9e016baf4aebf7ad2
fde3bad205e5d0d73547964ef1fe37f1
5411f4b56bd9700e96a0902fa1bb9aa1
54d990a16ba09ab596bbf40ea111702f
e9f74eec023020f61bf2ccf2353c21c7
549932d1f08557681093ed9cbe2c974e
bd6e7c3df2b5779e0b61216e8b10b689
7a9f102789d5f50b2beffd9f3dca4ea7
7ad5fda789ef4e272bca100b3d9ff59f
INVERSE CIPHER (DECRYPT):
round[ 0].start
round[ 4].m_col
round[ 4].input
round[ 0].s_box
round[ 8].m_col
round[ 2].k_sch
round[ 1].ik_sch
round[ 9].s_row
round[ 6].iinput
round[ 7].s_row
round[ 7].start
round[ 5].k_sch
round[ 5].round[ 0].k_sch
round[ 2].start
round[ 3].s_box
round[ 9].k_sch
round[ 6].s_row
round[ 8].start
round[10].m_col
round[ 6].m_col
round[ 8].k_sch
round[ 7].s_box
round[10].k_sch
round[10].s_box
round[ 1].k_sch
round[ 3].start
round[ 1].m_col
round[ 7].m_col
round[ 5].s_row
round[ 8].s_row
round[ 5].start
round[ 6].start
round[10].istart
.m_col
round[ 1].s_box
round[ 5].m_col
round[ 3].k_sch
round[10].s_row
round[ 2].m_col
round[ 9].
round[ 4].istart
round[ 6].istart
round[ 4].ik_sch
round[ 7].is_box
round[ 9].istart
round[ 9].is_row
round[10].ik_sch
round[ 1].is_row
round[ 5].ik_sch
round[ 3].ik_add
round[ 6].is_box
round[ 1].round[ 1].is_box
round[ 2].iinput
round[ 0].is_box
round[ 7].ik_add
round[ 3].ik_sch
round[ 8].ik_sch
round[10].is_row
round[ 9].ik_add
round[ 1].istart
round[ 2].istart
round[ 5].ioutput
EQUIVALENT INVERSE
round[ 0].is_row
round[ 1].ik_add
round[ 6].ik_sch
round[ 6].is_row
round[10].ik_add
round[ 2].ik_add
round[ 8].is_box
round[ 5].is_row
round[ 8].is_row
round[ 3].istart
round[ 2].ik_sch
round[ 2].im_col
CIPHER (DECRYPT):
bdb52189f261b63d0b107c9e8b6e776e
4773b91ff72f354361cb018ea1e6cf2c
.is_box
round[ 4].
round[ 6].im_col
round[ 4].is_box
round[ 3].is_row
round[10].im_col
round[ 7].istart
round[ 9].is_box
round[ 2].round[ 1].is_row
round[ 9].ik_sch
round[ 4].2
AES-192 (Nk=6.istart
round[ 3].is_box
round[ 5]. Nr=12)
13aa29be9c8faff6f770f58000f7bf03
fde596f1054737d235febad7f1e3d04e
2d7e86a339d9393ee6570a1101904e16
1362a4638f2586486bff5a76f7874a83
d1c4941f7955f40fb46f6c0ad68730ad
39daee38f4f1a82aaf432410c36d45b9
8d82fc749c47222be4dadc3e9c7810f5
c65e395df779cf09ccf9e1c3842fed5d
9a39bf1d05b20a3a476a0bf79fe51184
72e3098d11c5de5f789dfe1578a2cccb
c87a79969b0219bc2526773bb016c992
18f78d779a93eef4f6742967c47f5ffd
2ec410276326d7d26958204a003f32de
2466756c69d25b236e4240fa8872b332
85cf8bf472d124c10348f545329c0053
a8a2f5044de2c7f50a7ef79869671294
fab38a1725664d2840246ac957633931
fc1fc1f91934c98210fbfb8da340eb21
c7c6e391e54032f1479c306d6319e50c
49e594f755ca638fda0a59a01f15d7fa
076518f0b52ba2fb7a15c8d93be45e00
a0db02992286d160a2dc029c2485d561
895a43e485188fe82d121068cbd8ced8
ef053f7c8b3d32fd4d2a64ad3c93071a
8c56dff0825dd3f9805ad3fc8659d7fd
0050a0f04090e03080d02070c01060b0
000102030405060708090a0b0c0d0e0f1011121314151617
(ENCRYPT):
0].is_row
round[10].is_box
round[ 4].is_row
round[ 7].im_col
round[ 6].input
0].im_col
round[ 8].istart
round[ 5].istart
round[ 7].is_row
round[ 2].ioutput
C.im_col
round[ 7].ik_sch
round[10].start
.k_sch
1].is_row
round[ 4].im_col
round[ 2].
round[ 3].m_col
round[ 4].s_row
round[11].start
round[ 4].s_box
round[11].round[ 1].start
round[11].m_col
round[12].k_sch
round[ 7].k_sch
round[12].s_row
round[ 1].start
round[11].s_box
round[ 3].s_row
10111213141516175846f2f95c43f4fe
4f63760643e0aa85aff8c9d041fa0de4
84fb386f1ae1ac977941dd70832dd769
84e1dd691a41d76f792d389783fbac70
9f487f794f955f662afc86abd7f1ab29
544afef55847f0fa4856e2e95c43f4fe
cb02818c17d2af9c62aa64428bb25fd7
1f770c64f0b579deaaac432c3d37cf0e
1fb5430ef0accf64aa370cde3d77792c
b7a53ecbbf9d75a0c40efc79b674cc11
40f949b31cbabd4d48f043b810b7b342
f75c7778a327c8ed8cfebfc1a6c37f53
684af5bc0acce85564bb0878242ed2ed
68cc08ed0abbd2bc642ef555244ae878
7a1e98bdacb6d1141a6944dd06eb2d3e
58e151ab04a2a5557effb5416245080c
22ffc916a81474416496f19c64ae2532
9316dd47c2fa92834390a1de43e43f23
93faa123c2903f4743e4dd83431692de
aaa755b34cffe57cef6f98e1f01c13e6
2ab54bb43a02f8f662e3a95d66410c08
80121e0776fd1d8a8d8c31bc965d1fee
cdc972c53854a47e5d64c765904cc028
cd54c7283864c0c55d4c727e90c9a465
921f748fd96e937d622d7725ba8ba50c
f501857297448d7ebdf1c6ca87f33e3c
671ef1fd4e2a1e03dfdcb1ef3d789b30
8572a1542fe5727b9e86c8df27bc1404
85e5c8042f8614549ebca17b277272df
e913e7b18f507d4b227ef652758acbcc
e510976183519b6934157c9ea351f1e0
0c0370d00c01e622166b8accd6db3a2c
fe7b5170fe7c8e93477f7e4bf6b98071
fe7c7e71fe7f807047b95193f67b8e4b
6cf5edf996eb0a069c4ef21cbfc25762
1ea0372a995309167c439e77ff12051e
7255dad30fb80310e00d6c6b40d0527c
40fc5766766c7bcae1d7507f09700010
406c501076d70066e17057ca09fc7b7f
7478bcdce8a50b81d4327a9009188262
dd7e0e887e2fff68608fc842f9dcc154
a906b254968af4e9b4bdb2d2f0c44336
d36f3720907ebf1e8d7a37b58c1c1a05
d37e3705907a1a208d1c371e8c6fbfb5
0d73cc2d8f6abe8b0cf2dd9bb83d422e
859f5f237a8d5a3dc0c02952beefd63a
88ec930ef5e7e4b6cc32f4c906d29414
c4cedcabe694694e4b23bfdd6fb522fa
c494bffae62322ab4bb5dc4e6fce69dd
71d720933b6d677dc00b8f28238e0fb7
de601e7827bcdf2ca223800fd8aeda32
afb73eeb1cd1b85162280f27fb20d585
79a9b2e99c3e6cd1aa3476cc0fb70397
793e76979c3403e9aab7b2d10fa96ccc
round[ 5].s_box
round[ 6].
ik_add
round[ 8].ik_add
round[11].ik_add
round[ 7].iinput
round[ 0].istart
round[ 2].is_box
round[ 5].round[12].is_box
round[ 5].is_box
round[12].ik_add
a4970a331a78dc09c418c271e3a41d5d
round[ 2].is_row
round[ 1].is_box
round[ 7].output
round[ 3].
round[ 5].im_col
round[ 8].im_col
round[ 6].ioutput
round[ 9].round[11].im_col
round[ 9].im_col
round[ 0].ik_sch
round[11].is_box
round[11].istart
round[12].is_row
afd10f851c28d5eb62203e51fbb7b827
122a02f7242ac8e20605afce51cc7264
d6bebd0dc209ea494db073803e021bb9
88e7f414f532940eccd293b606ece4c9
5cc7aecce3c872194ae5ef8309a933c7
8fb999c973b26839c7f9d89d85c68c72
a98ab23696bd4354b4c4b2e9f006f4d2
b7113ed134e85489b20866b51d4b2c3b
f77d6ec1423f54ef5378317f14b75744
72b86c7c0f0d52d3e0d0da104055036b
ef3b1be1b9b0e64bdcb79f1e0a707fbb
1147659047cf663b9b0ece8dfc0bf1f0
0c018a2c0c6b3ad016db7022d603e6cc
592460b248832b2952e0b831923048f1
dcc1a8b667053f7dcc5c194ab5423a2e
672ab1304edc9bfddf78f1033d1e1eef
0b8a7783417ae3a1f9492dc0c641a7ce
c6deb0ab791e2364a4055fbe568803ab
80fd31ee768c1f078d5d1e8a96121dbc
4ee1ddf9301d6352c9ad769ef8d20515
dd1b7cdaf28d5c158a49ab1dbbc497cb
2214f132a896251664aec94164ff749c
1008ffe53b36ee6af27b42549b8a7bb7
78c4f708318d3cd69655b701bfc093cf
f727bf53a3fe7f788cc377eda65cc8c1
7f69ac1ed939ebaac8ece3cb12e159e3
round[12].istart
round[12].is_box
round[11].
4].start
1].is_box
1].ioutput
C.s_box
4f63760643e0aa85efa7213201a4e705
84fb386f1ae1ac97df5cfd237c49946b
84e1fd6b1a5c946fdf4938977cfbac23
bd2a395d2b6ac438d192443e615da195
1859fbc28a1c00a078ed8aadc42f6109
adcb0f257e9c63e0bc557e951c15ef01
ad9c7e017e55ef25bc150fe01ccb6395
810dce0cc9db8172b3678c1e88a1b5bd
975c66c1cb9f3fa8a93a28df8ee10f63
884a33781fdb75c2d380349e19f876fb
88db34fb1f807678d3f833c2194a759e
b2822d81abe6fb275faf103a078c0033
1c05f271a417e04ff921c5c104701554
9c6b89a349f0e18499fda678f2515920
9cf0a62049fd59a399518984f26be178
aeb65ba974e0f822d73f567bdb64c877
c357aae11b45b7b0a2c7bd28a8dc99fa
2e5bacf8af6ea9e73ac67a34c286ee2d
2e6e7a2dafc6eef83a86ace7c25ba934
b951c33c02e9bd29ae25cdb1efa08cc7
7f074143cb4e243ec10c815d8375d54c
d2c5831a1f2f36b278fe0c4cec9d0329
.is_row
round[12].round[ 9].k_sch
6].k_sch
2].s_box
1].k_sch
7].m_col
2].s_row
1].start
5].s_box
6].start
6].im_col
5].start
2].im_col
round[11].ik_sch
5].ik_sch
round[12].ik_sch
round[11].s_row
2].k_sch
4].m_col
6].ik_sch
3].start
3].input
0].s_box
3].is_row
5].istart
round[12].3
AES-256 (Nk=8.start
7].is_row
3].k_sch
5].is_box
3].s_row
6].istart
round[11]. Nr=14)
60dcef10299524ce62dbef152f9620cf
cbd264d717aa5f8c62b2819c8b02af42
cfaf16b2570c18b52e7fef50cab267ae
4b4ecbdb4d4dcfda5752d7c74949cbde
4fe0c9e443f80d06affa76854163aad0
794cf891177bfd1d8a327086f3831b39
1a1f181d1e1b1c194742c7d74949cbde
627bceb9999d5aaac945ecf423f56da5
round[13].m_col
round[13].iinput
round[ 0].k_sch
d133f22a1aed2a7bfa0f44697c4f3ffd
cfb4dbedf4093808538502ac33de185c
d1ed44fd1a0f3f2afa4ff27b7c332a69
round[11].k_sch
round[14].s_row
2c21a820306f154ab712c75eee0da04f
round[ 2].output
d22f0c291ffe031a789d83b2ecc5364c
ebb19e1c3ee7c9e87d7535e9ed6b9144
d653a4696ca0bc0f5acaab5db96c5e7d
f6ed49f950e06576be74624c565058ff
f6e062ff507458f9be50497656ed654c
5174c8669da98435a8b3e62ca974a5ea
5aa858395fd28d7d05e1a38868f3b9c5
bec26a12cfb55dff6bf80ac4450d56a6
beb50aa6cff856126b0d6aff45c25dc4
0f77ee31d2ccadc05430a83f4ef96ac3
4a824851c57e7e47643de50c2af3e8c9
d61352d1a6f3f3a04327d9fee50d9bdd
d6f3d9dda6279bd1430d52a0e513f3fe
bd86f0ea748fc4f4630f11c1e9331233
c14907f6ca3b3aa070e9aa313b52b5ec
783bc54274e280e0511eacc7e200d5ce
78e2acce741ed5425100c5e0e23b80c7
af8690415d6e1dd387e5fbedd5c89013
5f9c6abfbac634aa50409fa766677653
cfde0208f4b418ac5309db5c338538ed
7427fae4d8a695269ce83d315be0392b
516604954353950314fb86e401922521
aa218b56ee5ebeacdd6ecebf26e63c06
aa5ece06ee6e3c56dde68bac2621bebf
round[ 0].s_row
round[14].s_box
round[ 8].round[ 7].s_box
round[ 8].s_box
round[13].start
.s_box
round[14].start
round[12].start
round[14].is_box
round[ 7].
round[ 4].ik_add
round[11].is_row
round[13].ik_add
round[14].is_row
round[ 5].round[ 4].ik_add
round[13].is_row
round[13].is_box
round[14].istart
round[13].ioutput
EQUIVALENT INVERSE CIPHER (DECRYPT):
.ik_add
round[14].ik_sch
629deca599456db9c9f5ceaa237b5af4
e51c9502a5c1950506a61024596b2b07
34f1d1ffbfceaa2ffce9e25f2558016e
5153862143fb259514920403016695e4
91a29306cc450d0226f4b5eaef5efed8
5e1648eb384c350a7571b746dc80e684
5fc69f53ba4076bf50676aaa669c34a7
b041a94eff21ae9212278d903b8a63f6
c8a305808b3f7bd043274870d9b1e331
c13baaeccae9b5f6705207a03b493a31
638357cec07de6300e30d0ec4ce2a23c
b5708e13665a7de14d3d824ca9f151c2
4a7ee5c9c53de85164f348472a827e0c
ca6f71058c642842a315595fdf54f685
74da7ba3439c7e50c81833a09a96ab41
5ad2a3c55fe1b93905f3587d68a88d88
ca46f5ea835eab0b9537b6dbb221b6c2
3ca69715d32af3f22b67ffade4ccd38e
d6a0ab7d6cca5e695a6ca40fb953bc5d
2a70c8da28b806e9f319ce42be4baead
f85fc4f3374605f38b844df0528e98e1
7f4e814ccb0cd543c175413e8307245d
f0073ab7404a8a1fc2cba0b80df08517
de69409aef8c64e7f84d0c5fcfab2c23
c345bdfa1bc799e1a2dcaab0a857b728
3225fe3686e498a32593c1872b613469
aed55816cf19c100bcc24803d90ad511
1c17c554a4211571f970f24f0405e0c1
9d1d5c462e655205c4395b7a2eac55e2
15c668bd31e5247d17c168b837e6207c
979f2863cb3a0fc1a9e166a88e5c3fdf
d24bfb0e1f997633cfce86e37903fe87
7fd7850f61cc991673db890365c89d12
.istart
round[ 1].im_col
round[ 8].round[ 0].ik_sch
round[11].im_col
round[ 3].im_col
round[ 3].iinput
round[13].ik_sch
round[14].im_col
round[13].round[12].ioutput
181c8a098aed61c2782ffba0c45900ad
aec9bda23e7fd8aff96d74525cdce4e7
2a2840c924234cc026244cc5202748c4
4fe0210543a7e706efa476850163aa32
794cf891177bfd1ddf67a744acd9c4f6
1a1f181d1e1b1c191217101516131411
round[13].
. National Institute of Standards and Technology. Rijmen.
November 1999. al. 1997.
September 3.plus. LNCS 1820.gov/csor/. Lee. and S. Report on the Development of the Advanced Encryption Standard
(AES).gov/CryptoToolkit. Nechvatal.
CRC Press. van Oorschot. Gladman’s AES related home page
A. NIST Special Publication 800-21. available at
[1]. New York.
J. October 2.
analysis papers. 288-296. Daemen and V.nist. et. P. 2000. Menezes.4
Computer Security Objects Register (CSOR): http://csrc. AES Algorithm Submission. etc. Daemen and V.
A complete set of documentation from the AES development effort – including announcements. The block cipher Rijndael. 81-83. Springer-Verlag. – is available from this site. Smart Card research and
Applications. 1999. National Institute of Standards and Technology.
A. pp. AES Proposal: Rijndael.Appendix D . conference proceedings.
B. Handbook of Applied Cryptography.com/cryptography_technology/. Rijmen.
J.gladman.References
AES page available via http://www. Guideline for Implementing Cryptography
in the Federal Government. public comments. available at [1].nist. Vanstone.
More From This UserIntroduction to Types of OrganisationAre_Strategies_Real_Things_Mintzberg.pdfPeople of Godlwayo Retain Identity and PrideIsostacy Prooftest1_2010_[Abbott E a] Flatland (1984)Workshop 6Bridge Design Handbook
fips-197 by Siphathisile5 viewsEmbedDownloadRead on Scribd mobile: iPhone, iPad and Android.Copyright: Attribution Non-Commercial (BY-NC)List price: $0.00Download as PDF, TXT or read online from ScribdFlag for inappropriate contentMore informationShow less
RelatedAdvanced Encryption Standard Hardwareby muzammil shadabAdvanced Encryption Standardby phuonglypAESby Mukesh11low cost advanced encryption standard_AES_Bit_Serial_Appby sandeeprathod175AES on FPGA for theby shanmugkitaesIntroby Anand Mohan ReddyAdvanced Encryption Standardby VieViy Anna MUjanadvanced encryption standard Smart Cardby muzammil shadabEncryptionby amit mahajanAESby ami2008Symmetric encryption, DES, AES, MAC, Hash algorithms, HMACby Mukesheverything in Cryptography by RenjithThe AES Algorithmby api-3701346Aes Ppt-Vini Katyalby Vini KatyalAES_finalby Antima SinghAES.pptby Arjun KumarAdvanced Encryption Standardby Ruairi Mc AloranCommunication Securityby no2a2005AES Algorithmby Eswin AngelAesby Nitin PandeyAbstractby Satya Narayanarc4_cryptanalysesby Vladimir ZlidrugText Steganographic Approaches: A Comparisonby AIRCC - IJNSAS2-DESby Sangeeta KakkarWeek7 DES+Modeby Dhanesh GoelAESvhdlby Haile MichaelDes 1by Aditya Singhb 017110713by IOSRjournalSimilar to Advanced Encryption Standard (AES)Advanced Encryption Standard HardwareAdvanced Encryption StandardAES11low cost advanced encryption standard_AES_Bit_Serial_AppAES on FPGA for theaesIntroAdvanced Encryption Standardadvanced encryption standard Smart CardEncryptionAESSymmetric encryption, DES, AES, MAC, Hash algorithms, HMACeverything in Cryptography The AES AlgorithmAes Ppt-Vini KatyalAES_finalAES.pptAdvanced Encryption StandardCommunication SecurityAES AlgorithmAesAbstractrc4_cryptanalysesText Steganographic ApproachesS2-DESWeek7 DES+ModeAESvhdlDes 1b 017110713Symmetric CryptographyDES (Data Encryption Standard)