AES key schedule

The round constant for round of the key expansion is the 32-bit word: :rcon_i = \begin{bmatrix} rc_i & 00_{16} & 00_{16} & 00_{16} \end{bmatrix} where is an eight-bit value defined as : : rc_i = \begin{cases} 1 & \text{if } i = 1 \\ 2 \cdot rc_{i-1} & \text{if } i > 1 \text{ and } rc_{i-1} 1 \text{ and } rc_{i-1} \ge 80_{16} \end{cases} where \oplus is the bitwise XOR operator and constants such as and are given in hexadecimal. Equivalently: :rc_i = x^{i-1} where the bits of are treated as the coefficients of an element of the finite field \rm{GF}(2^8)[x]/(x^8 + x^ 4 + x^3 + x + 1), so that e.g. rc_{10} = 36_{16} = 00110110_2 represents the polynomial x^5 + x^4 + x^2 + x. AES uses up to for AES-128 (as 11 round keys are needed), up to for AES-192, and up to for AES-256. == The key schedule ==

Define: • as the length of the key in 32-bit words: 4 words for AES-128, 6 words for AES-192, and 8 words for AES-256 • , , ... as the 32-bit words of the original key • as the number of round keys needed: 11 round keys for AES-128, 13 keys for AES-192, and 15 keys for AES-256 • , , ... as the 32-bit words of the expanded key Also define as a one-byte left circular shift: :\operatorname{RotWord}(\begin{bmatrix} b_0 & b_1 & b_2 & b_3 \end{bmatrix}) = \begin{bmatrix} b_1 & b_2 & b_3 & b_0 \end{bmatrix} and as an application of the AES S-box to each of the four bytes of the word: :\operatorname{SubWord}(\begin{bmatrix} b_0 & b_1 & b_2 & b_3 \end{bmatrix}) = \begin{bmatrix} \operatorname{S}(b_0) & \operatorname{S}(b_1) & \operatorname{S}(b_2) & \operatorname{S}(b_3) \end{bmatrix} Then for i = 0 \ldots 4R-1: :W_i = \begin{cases} K_i & \text{if } i 6 \text{, and } i \equiv 4 \pmod{N} \\ W_{i-N} \oplus W_{i-1} & \text{otherwise.} \\ \end{cases} == Notes ==