Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am implementing AES 256-bit Algorithm from the Theory given in the book, "Cryptography and Network Security" by Behrouz A. Forouzan.

The Algorithm described in the Book in relation to Key Expansion, defines AddRoundKey like this:

From the given 32-Bytes Cipher Key, I am supposed to generate 4 * (Nr + 1) words. Nr being the number of rounds which is equal to 14 in 256bit AES and each word is equal to 4-Bytes.

So, according to the equation, 4 * (Nr + 1), We have total 4*(15) = 60 Words to be generated. Those 60 words are w[0],w[1],w[2],w[3],…,w[59]. The first 8 words would be generated directly from the given 32bytes cipher key:

w[0] = First 4Bytes of Cipher key
w[1] = Next 4bytes of Cipher Key
w[2] = Next 4 bytes of Cipher.
w[7] = last 4-bytes of Cipher key.

The remaining words (w[8] to w[59]) would be generated according to the following Formula:

If, i mod 8 is not equals to 0 and i is the word number from 8 to 59

    W[i] = W[i-1] ^ W[i-8]
    ; ^ = XOR Operation


  W[i] = t + w[i-8]

where t equals to, SubWord(RotateWord(W[i-1])) ^ RCon(i/4). If i mod 4 = 0, but imod8 is not equals to 0 then, W[i] would be W[i] = SubWord(W[i-1]) + W[i-8] After the above algorithm is implemented, It is quite easy to calculate AddRoundKey.

But Wikipedia's "Rijndael key schedule" article has a totally different method of calculation which I am unable to understand. They use different techniques, and there are few Constants like n and b, which weren't mentioned in the book, nor are they mentioned anywhere else. Yet, Wikipedia's Algorithm is using them.

I would like to know the difference between the AES256 algorithm presented in the book and the AES256 article on Wikipedia. Can you explain and/or help me understand why there are two different approaches for Key Expansion in relation to the AES-256 algorithm?

share|improve this question
up vote 3 down vote accepted

The descriptions are the same thing.

The n and b constants on Wikipedia are simply the original key length in bytes and the number of bytes in the generated key schedule. Here, you have a 256-bit key generating a 60-word keyschedule, so n = 32 and b = 240.

I'm going to re-structure the provided algorithm to be more clear. The special case i mod 4 should be broken out as a separate block, I'll tweak the conditionals, and I'll reorder the cases to occur more sequentially.

if i mod 8 = 0:
    t = SubWord(RotateWord(W[i-1])) ^ RCon(i/4)
    W[i] = t + w[i-8]
else if i mod 4 = 0:
    W[i] = SubWord(W[i-1]) + W[i-8]
    W[i] = W[i-1] ^ W[i-8]

It's the same code, just written a little differently. It already looks more like the Wikipedia description.

The version here is word-based and uses the constant 8, whereas the Wikipedia version uses byte offsets and the variable n, which means it takes a bit of effort to compare computed offsets between them. Just in case it isn't obvious, note that W[i-8] here is equivalent to the frequently used phrase "four-byte block n bytes before the new expanded key" on Wikipedia.

Now compare the structure:

  • The first 8 words are a straight copy of the key.

    Compare Wikipedia step 1 with the initial w[0] ... w[7] assignment here.

  • Both descriptions have a loop that generates the keys in sets of 8 words.

    This is step 3 on Wikipedia. (The substeps there aren't numbered, but I'll refer to them as 3.x.)

  • The first word of each set of 16 has special processing.

    Compare Wikipedia step 3.1 with the case i mod 8 = 0 here.

    The t value in this step is the same as the "key schedule core" from Wikipedia. Note that the index value to RCon in the Key Schedule Core only increments once per loop. Here it increments 4 times per loop because it is a word-based counter, but we divide by 4 to re-normalize it.

  • The next 3 words have the simple definition: XOR the previous word with the word 8 words back.

    Compare Wikipedia step 3.2 with the else case here.

  • The next word (the fifth of the round) has special processing. Compare Wikipedia step 3.3 with the case i mod 4 = 0 here. (Note that the i index here is zero-based, so i mod 4 = 0 means we're at an index of 5.)

  • The next 3 words have the same definition as two points above. Compare Wikipedia step 3.4 with the else case here.

That's all. They're the exact same thing, down to the step.

share|improve this answer
Where is the difference between ^ and + in your algorithm? Aren't they the same? – Paŭlo Ebermann Oct 18 '13 at 19:13
Good catch. I copied the code from the OP, I don't know why there is + notation. The actual algorithm uses the XOR operation, so maybe those instances should be changed to ^ for clarity. I assume they were intended to indicate the same thing. – B-Con Oct 18 '13 at 19:22

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.