# In which order are the round keys used during AES decryption?

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step?

Is it the 10th round key? For example, is this the right order?

addRoundKey(subBytes,roundKey10);


Here "secret key" is my secret key that I used in encryption.

In the expansion of my secret key in decryption, is it the same procedure like in encryption?

-
Assuming you are using AES-128 (i.e. 10 rounds), yes, you'll have to start with the last part of your expanded key, where you expanded the key the same way as in encryption. [This follows from the idea that we want to undo the encryption.] – Paŭlo Ebermann May 25 '12 at 17:57
Also, please stop adding the security tag to all your questions - it doesn't add anything here. – Paŭlo Ebermann May 25 '12 at 17:58

If you want to undo the encryption, you'll have to undo the whole sequence of the encryption procedure - i.e. undo each encryption step, in the inverse order.

Encryption has these steps (here for AES-128, the number of rounds differs for other Rijndael versions):

AddRoundKey(State, ExpandedKey[0]

SubBytes(State);
ShiftRows(State);
MixColumns(State);

SubBytes(State);
ShiftRows(State);
MixColumns(State);

...

SubBytes(State);
ShiftRows(State);
MixColumns(State);

SubBytes(State);
ShiftRows(State);


So, for decryption, you'll have go through this list from bottom to top, undoing each step by applying its inverse transformation. Luckily, the inverse of AddRoundKey is just AddRoundKey with the same round key, so we get something like this:

AddRoundKey(State, ExpandedKey[10]);
InvShiftRows(State);
InvSubBytes(State);

InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

...

InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);