# Since it gives negative power, how is rcon(0) calculated in AES?

I'm trying to calculate Rijndael key schedule "Rcon" values manually. I know how to calculate each value with the equation rcon(i) = x^(i-1) mod x^8 + x^4 + x^3 + x^1 + 1, for example:

recon(10) = x^(10-1) mod x^8 + x^4 + x^3 + x^1 + 1
x^(9) mod (x^8 + x^4 + x^3 + x^1 + 1)
=> x^5 + x^4 + x^2 + x
=> 0011 0110
=> 0x36 (10th number in RCON Table)


But if i equals to 0 then

rcon(0) = x^(-1) mod x^8 + x^4 + x^3 + x^1 + 1


According to "Wikipedia: Rijndael key schedule ~ Rcon", the first value in Rcon table is 0x8d, which most probably is the value for rcon[0]. I would like to know how it is calculated.

I know how to calculate the mod on paper and this is exactly how I calculated the 0x36 above. But since the power of x is -1 in this case, I am stuck with it. How is rcon[0] calculated in AES?

-

## 1 Answer

See my previous answer here regarding rcon calculation:

Rijndael: explanation of Rcon on Wikipedia?

It is essentially caulcated by division of 0x01 within the finite field.

The most important thing about rcon(0) is that there is no round 0, and thus you will never actually use it in any calculation. Also take note of my comment that the Wikipedia page is not completely correct. I will probably edit the page if someone else does not get to it first.

-
Spot on. I think it's sort of disingenuous to include the 0th element, really, even if it is technically correct. In the Rijndael spec given in The Design of Rijndael, Rijmen and Daemen don't even define RC[0], as they call it: they give RC[1], RC[2], and RC[j] for j>2. In FIPS 197, they explicitly state that in Rcon[i], i >= 1. So... – Reid Oct 17 '13 at 6:07