# AES key expansion: 256bit key

In AES algorithm, in the key schedule, Why does the expansion of a 256 bit key need an extra application of the S-box, unlike the expansion of 128 bit and 192 bit keys ?

(The obvious answer would be "because it is more secure" ... but why ? And if it is more secure, why don't use it on 128 and 192 ?)

-
What research have you done on your own to try to answer your own question? Have you read the Rijndael design docs (e.g., the ones submitted as part of the submission to the AES competition)? On this site we expect you to do some research on your own. If you tell us what you've read so far and what you do/don't understand, we might be more likely to be able to help you. –  D.W. Aug 4 at 21:18

It has to do with the alignment between the size of cipher the key and the size of a round key. Since a 256-bit key is twice the size of a round key, the nonlinearity of the key schedule would be aligned to every other block, and that is bad.

Here is an example of the round keys generated by the key schedule for a key (hex bytes) of value 0000000000000000000000000000000000000000000000000000000000000001:

00  00000000 00000000 00000000 00000000
01  00000000 00000000 00000000 01000000
02  637c6362 637c6362 637c6362 637c6362
03  fb10fbaa fb10fbaa fb10fbaa fa10fbaa
04  cf51a96f ac2dca0d cf51a96f ac2dca0d
05  6ac88f7d 91d874d7 6ac88f7d 90d874d7
06  c131c8f9 6d1c02f4 a24dab9b 0e606196
09  118931e3 414925d9 7b41be9e d191510e
10  0aa339ef c6228335 a8ee9274 c842e2a3
13  d0cc541f 6820d82f ab8dea81 b9b18921


And here is what happens when you take out the extra SubBytes:

00  00000000 00000000 00000000 00000000
01  00000000 00000000 00000000 01000000
02  637c6362 637c6362 637c6362 637c6362
03  637c6362 637c6362 637c6362 627c6362
04  c9d6739b aaaa10f9 c9d6739b aaaa10f9
05  c9d6739b aaaa10f9 c9d6739b abaa10f9
06  50b4df55 fa1ecfac 33c8bc37 9962acce
07  50b4df55 fa1ecfac 33c8bc37 9862acce
08  dbf275cc 21ecba60 12240657 8b46aa99
09  dbf275cc 21ecba60 12240657 8a46aa99
10  358c2f70 14609510 06449347 8d0239de
11  56f04c12 771cf672 6538f025 ef7e5abc
12  5053dcee 443349fe 4277dab9 cf75e367
13  9985af75 ee995907 8ba1a922 64dff39e
14  5b1042a3 1f230b5d 5d54d1e4 92213283


It can be seen as far as round 9 the round keys are still extremely linear, and because the sbox application is performed every other round key, 3 of the 4 subkeys for the round keys are identical to a neighboring round key up to the 9th round, and the 4th only differs by a 4 bit maximum.

-