Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

From Wikipedia:

For a 256-bit block, the first row is unchanged and the shifting for the second, third and fourth row is 1 byte, 3 bytes and 4 bytes respectively.

Why the change? Is there any difference than in using 0, 1, 2, 3 like the other keysizes?

share|improve this question
    
The basic idea is that the block is wider now (8 columns instead of 4 or 6), so we shift more so changes in one column earlier influence all the columns. –  Paŭlo Ebermann Jan 27 '13 at 19:40

1 Answer 1

up vote 5 down vote accepted

That variation directly implements Rinjdael's ShiftRow as specified (section 4.2.2) in the proposal to NIST, defining Shitftrows for 128, 192 and 256-bit block size (Nb=4, 6 and 8).

Shitftrows for 128, 192 and 256-bit block size (Nb=4, 6 and 8)


Loosely speaking, the offsets improve the mixing (diffusion) properties of consecutive rounds of the cipher. More precisely the authors state their motivation (section 7.4) as:

The ShiftRow offsets

The choice from all possible combinations has been made based on the following criteria:

  1. The four offsets are different and C0 = 0;
  2. Resistance against attacks using truncated differentials [Kn95];
  3. Resistance against the Square attack [DaKnRi97];
  4. Simplicity

For certain combinations, attacks using truncated differentials can tackle more rounds (typically only one) than for other combinations. For certain combinations the Square attack can tackle more rounds than others. From the combinations that are best with respect to criteria 2 and 3, the simplest ones have been chosen.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.