- When the key is changed the prefix of sha1(key) function is automatically filled in the IV field. You still may change the IV. The feature is intended only for your convenience. Using the radio buttons under the Key input field, you can specify whether the entered key value should be interpreted as a plain text or a hexadecimal value.
- Such a step is easily reversed by another exclusive-or of the same key with the ciphertext. In the case of the AES, there are a number of rounds, each needing its own key, so the actual key is ``stretched out' and transformed to give portions of key for each round. This is the key.
AES uses a key schedule to expand a short key into a number of separate round keys. The three AES variants have a different number of rounds. Each variant requires a separate 128-bit round key for each round plus one more.[note 1] The key schedule produces the needed round keys from the initial key.
Round constants[edit]
| i | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 |
|---|---|---|---|---|---|---|---|---|---|---|
| rci | 01 | 02 | 04 | 08 | 10 | 20 | 40 | 80 | 1B | 36 |
AES Example - Input (128 bit key and message) Key in English: Thats my Kung Fu (16 ASCII characters, 1 byte each) Translation into Hex: T h a t s m y K u n g F u.
The round constant rconi for round i of the key expansion is the 32-bit word:
- rconi=[rci001600160016]{displaystyle rcon_{i}={begin{bmatrix}rc_{i}&00_{16}&00_{16}&00_{16}end{bmatrix}}}
where rci is an eight-bit value defined as:
- rci={1if i=12⋅rci−1if i>1 and rci−1<8016(2⋅rci−1)⊕1B16if i>1 and rci−1≥8016{displaystyle rc_{i}={begin{cases}1&{text{if }}i=12cdot rc_{i-1}&{text{if }}i>1{text{ and }}rc_{i-1}<80_{16}(2cdot rc_{i-1})oplus {text{1B}}_{16}&{text{if }}i>1{text{ and }}rc_{i-1}geq 80_{16}end{cases}}}
where ⊕{displaystyle oplus } is the bitwise XOR operator and constants such as 0016 and 1B16 are given in hexadecimal. Equivalently:
Aes Round Key
- rci=xi−1{displaystyle rc_{i}=x^{i-1}}
where the bits of rci are treated as the coefficients of an element of the finite fieldGF(2)[x]/(x8+x4+x3+x+1){displaystyle {rm {{GF}(2)[x]/(x^{8}+x^{4}+x^{3}+x+1)}}}, so that e.g. rc10=3616=001101102{displaystyle rc_{10}=36_{16}=00110110_{2}} represents the polynomial x5+x4+x2+x{displaystyle x^{5}+x^{4}+x^{2}+x}.
AES uses up to rcon10 for AES-128 (as 11 round keys are needed), up to rcon8 for AES-192, and up to rcon7 for AES-256.[note 2]
The key schedule[edit]
Define:
- N as the length of the key in 32-bit words: 4 words for AES-128, 6 words for AES-192, and 8 words for AES-256
- K0, K1, ... KN-1 as the 32-bit words of the original key
- R as the number of round keys needed: 11 round keys for AES-128, 13 keys for AES-192, and 15 keys for AES-256[note 3]
- W0, W1, ... W4R-1 as the 32-bit words of the expanded key[note 4]
Also define RotWord as a one-byte left circular shift:
- RotWord([b0b1b2b3])=[b1b2b3b0]{displaystyle operatorname {RotWord} ({begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}end{bmatrix}})={begin{bmatrix}b_{1}&b_{2}&b_{3}&b_{0}end{bmatrix}}}
Aes 256 Key Generator
and SubWord as an application of the AES S-box to each of the four bytes of the word:
- SubWord([b0b1b2b3])=[S(b0)S(b1)S(b2)S(b3)]{displaystyle operatorname {SubWord} ({begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}end{bmatrix}})={begin{bmatrix}operatorname {S} (b_{0})&operatorname {S} (b_{1})&operatorname {S} (b_{2})&operatorname {S} (b_{3})end{bmatrix}}}
Then for i=0…4R−1{displaystyle i=0ldots 4R-1}:
- Wi={Kiif i<NWi−N⊕SubWord(RotWord(Wi−1))⊕rconi/Nif i≥N and i≡0(modN)Wi−N⊕SubWord(Wi−1)if i≥N, N>6, and i≡4(modN)Wi−N⊕Wi−1otherwise.{displaystyle W_{i}={begin{cases}K_{i}&{text{if }}i<NW_{i-N}oplus operatorname {SubWord} (operatorname {RotWord} (W_{i-1}))oplus rcon_{i/N}&{text{if }}igeq N{text{ and }}iequiv 0{pmod {N}}W_{i-N}oplus operatorname {SubWord} (W_{i-1})&{text{if }}igeq N{text{, }}N>6{text{, and }}iequiv 4{pmod {N}}W_{i-N}oplus W_{i-1}&{text{otherwise.}}end{cases}}}
Notes[edit]
- ^Non-AES Rijndael variants require up to 256 bits of expanded key per round
- ^The Rijndael variants with larger block sizes use more of these constants, up to rcon29 for Rijndael with 128-bit keys and 256 bit blocks (needs 15 round keys of each 256 bit, which means 30 full rounds of key expansion, which means 29 calls to the key schedule core using the round constants). The remaining constants for i ≥ 11 are: 6C, D8, AB, 4D, 9A, 2F, 5E, BC, 63, C6, 97, 35, 6A, D4, B3, 7D, FA, EF and C5
- ^Other Rijndael variants require max(N, B) + 7 round keys, where B is the block size in words
- ^Other Rijndael variants require BR words of expanded key, where B is the block size in words
References[edit]
- FIPS PUB 197: the official AES standard (PDF file)
External links[edit]
- schematic view of the key schedule for 128 and 256 bit keysfor 160-bit keys on Cryptography Stack Exchange