Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step?

Is it the 10th round key? For example, is this the right order?

addRoundKey(subBytes,roundKey10);
addRoundKey(subBytes,roundKey09);
addRoundKey(subBytes,roundKey08);
addRoundKey(subBytes,roundKey07);
addRoundKey(subBytes,roundKey06);
addRoundKey(subBytes,roundKey05);
addRoundKey(subBytes,roundKey04);
addRoundKey(subBytes,roundKey03);
addRoundKey(subBytes,roundKey02);
addRoundKey(subBytes,roundKey01);
addRoundKey(subBytes,secret key);

Here "secret key" is my secret key that I used in encryption.

In the expansion of my secret key in decryption, is it the same procedure like in encryption?

share|improve this question
    
Assuming you are using AES-128 (i.e. 10 rounds), yes, you'll have to start with the last part of your expanded key, where you expanded the key the same way as in encryption. [This follows from the idea that we want to undo the encryption.] –  Paŭlo Ebermann May 25 '12 at 17:57
    
Also, please stop adding the security tag to all your questions - it doesn't add anything here. –  Paŭlo Ebermann May 25 '12 at 17:58

1 Answer 1

up vote 2 down vote accepted

If you want to undo the encryption, you'll have to undo the whole sequence of the encryption procedure - i.e. undo each encryption step, in the inverse order.

Encryption has these steps (here for AES-128, the number of rounds differs for other Rijndael versions):

AddRoundKey(State, ExpandedKey[0]

SubBytes(State);
ShiftRows(State);
MixColumns(State);
AddRoundKey(State, ExpandedKey[1]);

SubBytes(State);
ShiftRows(State);
MixColumns(State);
AddRoundKey(State, ExpandedKey[2]);

...

SubBytes(State);
ShiftRows(State);
MixColumns(State);
AddRoundKey(State, ExpandedKey[9]);

SubBytes(State);
ShiftRows(State);
AddRoundKey(State, ExpandedKey[10]);

So, for decryption, you'll have go through this list from bottom to top, undoing each step by applying its inverse transformation. Luckily, the inverse of AddRoundKey is just AddRoundKey with the same round key, so we get something like this:

AddRoundKey(State, ExpandedKey[10]);
InvShiftRows(State);
InvSubBytes(State);

AddRoundKey(State, ExpandedKey[9]);
InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

...

AddRoundKey(State, ExpandedKey[2]);
InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

AddRoundKey(State, ExpandedKey[1]);
InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

AddRoundKey(State, ExpandedKey[0]);

(Yes, ExpandedKey[0] is the original encryption/decryption key for AES-128.)

So, to answer your question: Round key 9 is the first which gets XORed with the subbytes result, but before that (at the very start of decryption), round key 10 gets XORed with the ciphertext.

As we have to use the same subkeys for encryption and decryption, you'll have to do the same (or equivalent) key schedule, too.

Note that in addition to this straight-forward (or actually straight-backward) decryption, there is an alternative (equivalent) one which uses a different ordering of the operations, and a mixed version of the sub keys (i.e. a changed key schedule).

But I recommend you to stick to this one here, as it is easier to understand. (No, actually I recommend not to implement AES yourself, but use an existing implementation.)

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.