AES Cipher

AES Cipher

1. AES at a Glance (FIPS-197, Rijndael)

128-bit blocks as $4 \times 4$ byte state, key 128/192/256 bits → 10/12/14 rounds. Unlike DES (Feistel), AES is an SPN: every layer must invert, encryption ≠ decryption circuit (uses InvSubBytes/InvShiftRows/InvMixColumns). Round structure:

AddRoundKey(K0)                                    [pre-whitening]
9/11/13 × {SubBytes → ShiftRows → MixColumns → AddRoundKey}
Final: SubBytes → ShiftRows → AddRoundKey          [no MixColumns]

Decrypt runs inverse steps with reversed (inverse-transformed for EquivInverse) round keys.

2. The Four Transformations (Each with Worked Bite)

Step	What it does	Worked bite
SubBytes (confusion)	Each byte $a \to S(a)$: $GF(2^8)$ inverse ($0 \to 0$) + affine transform	$S(0x53) = 0xED$ (standard table check); 1 input bit flips $\approx 4$ output bits (nonlinear)
ShiftRows (diffusion)	Row $r$ cyclic-left by $r$: $[0,1,2,3]$	State row 1 $[a,b,c,d] \to [b,c,d,a]$; row 0 unchanged — spreads columns across rows
MixColumns (diffusion)	Each column $\times$ fixed matrix over $GF(2^8)$ mod $x^4+1$: $[02,03,01,01]$ rows	$[01] \to [02,01,01,03]^T$-style mix: 1 input byte changes all 4 output bytes (branch number 5)
AddRoundKey	State $\oplus$ 128-bit round key	Only key-mixing step; involution (own inverse); pre/post whitening blocks key-guessing ends

Wide Trail: SubBytes (active S-boxes) × MixColumns (branch 5) guarantees $\ge 25$ active S-boxes per 4 rounds → differential/linear bounds $\le 2^{-150}$.

3. Key Expansion (Worked Logic)

128-bit key → 11 round keys (1408 bits) via 4-word columns: $W[i] = W[i-4] \oplus f(W[i-1])$ where $f$ = RotWord → SubWord → $\oplus$ Rcon ($Rcon_j = x^{j-1}$ in $GF(2^8)$: 01, 02, 04, 08, ...), plain XOR for other words. 192/256-bit variants differ only in $Nk$ rhythm (8-word with extra SubWord for 256). Numerical habit: given $W[0..3]$, $W[4] = W[0] \oplus \text{SubRot}(W[3]) \oplus Rcon_1$ — exams test one-word derivation, not all 44.

4. Decryption and Implementation Notes

• EquivInverseCipher: $InvMixColumns$ moved through $AddRoundKey$ with transformed keys $DW_i = InvMixColumns(W_i)$ — same round shape as encryption (HW reuse).
• S-box tables: 256-byte forward + inverse (or compute inverse + affine on the fly); T-table implementations fuse Sub+ Shift+Mix (fast, cache-timing vulnerable → AES-NI/masked).
• Test vector anchor: AES-128 key 00..00, plaintext 00..00 → ciphertext 66e94bd4ef8a2c3b884cfa59ca342b2e2 — quote to prove standard compliance.

5. AES vs DES (Exam Table)

Point	DES	AES
Block / key	64 / 56	128 / 128, 192, 256
Structure	Feistel (F needn't invert)	SPN (all layers invert)
Rounds	16	10 / 12 / 14
Nonlinearity	8 × $6{\to}4$ S-boxes (secret criteria)	1 × $8{\to}8$ S-box ($GF$ inverse + affine, public)
Diffusion	E + P-box	ShiftRows + MixColumns (branch 5)
Status	Broken (brute force)	Secure (only side-channel/related-key certificational)

Exam Points

• State diagram + round pseudocode with pre-whitening and no-MixColumns final — 5-mark diagram core.
• Four steps with one worked bite each ($S(0x53)$, ShiftRows shift counts, MixColumns branch 5, AddRoundKey XOR) — favourite 5-marker.
• Key-expansion $W[i]$ formula + Rcon sequence + one-word numerical.
• AES-vs-DES table; wide-trail $2^{-150}$ bound line.