Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I stumbled onto the explanation of Rijndael Rcon on Wikipedia, and I can't follow it.

The example for Rcon indicates that Rcon(9) is 0x1b.
That could make sense… rcon(9) = (2 ^ (9 - 1) mod (256)) + 16 + 8 + 2 + 1

But I don't understand Rcon(10) or anything past that.

Can someone please explain it to me? Also, why is Rcon(0) = 0x8d?

share|improve this question

Rcon(9) is 0x1b because 0x80 multiplied by 0x02 is 0x100, which is reduced to 0x00 xor 0x1b in the finite field.

Rcon(10) is twice Rcon(9), and so forth.

Rcon(0) is 0x8d because 0x8d multiplied by 0x02 is 0x01 in the finite field.

If what I mean by finite field is not understood, it is because the numbers you are dealing with are actually polynomials, see: Rijndael's Finite Field

share|improve this answer
Thanks, that is what I saw on some other pages. What I can't follow is Wikipedia's explanation. Can you take a look at that and explain what they mean. For example, what does: rcon(i) = x^(i-1) mod x^8 + x^4 + x^3 + x + 1 mean, and how does that work for rcon(10)? – nachum Oct 1 '13 at 16:38
x^8 + x^4 + x^3 + x + 1 is the reduction polynomial 0x11B, that sentence from Wikipedia is technically incorrect, as modulo 0x11B only happens if the value exceeds 0xFF – Richie Frame Oct 1 '13 at 18:13

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.