Why does Rijndael with a 256-bit block require the bottom two rows to be shifted one more space than usual?

Question

From Wikipedia:

For a 256-bit block, the first row is unchanged and the shifting for the second, third and fourth row is 1 byte, 3 bytes and 4 bytes respectively.

Why the change? Is there any difference than in using 0, 1, 2, 3 like the other keysizes?

Answer 1

That variation directly implements Rinjdael's ShiftRow as specified (section 4.2.2) in the proposal to NIST, defining Shitftrows for 128, 192 and 256-bit block size (Nb=4, 6 and 8).

---

Loosely speaking, the offsets improve the mixing (diffusion) properties of consecutive rounds of the cipher. More precisely the authors state their motivation (section 7.4) as:

The ShiftRow offsets

The choice from all possible combinations has been made based on the following criteria:

1. The four offsets are different and C0 = 0;
2. Resistance against attacks using truncated differentials [Kn95];
3. Resistance against the Square attack [DaKnRi97];
4. Simplicity

For certain combinations, attacks using truncated differentials can tackle more rounds (typically only one) than for other combinations. For certain combinations the Square attack can tackle more rounds than others. From the combinations that are best with respect to criteria 2 and 3, the simplest ones have been chosen.