Skip to main content
Source Link
Johnvox
  • 109
  • 1
  • 5

To close the question I've found the answer. If a round key is found, the master is found too.

I consider this notation :

K,i,n => The n column of the round i.

sub() => Substitution function

shift() => Shifting function

For example : K(4,3) => the 3rd column of 4th round

We have those equalities

K(i, 1) = sub(shift(K(i-1, 4)) XOR K(i-1, 1) XOR RCON(i)
K(i, 2) = K(i, 1) XOR K(i-1, 2)
K(i, 3) = K(i, 2) XOR K(i-1, 3)
K(i, 4) = K(i, 3) XOR K(i-1, 4)

If a round key is found we know the value of

K(i,1)
K(i,2)
K(i,3) 
K(i,4)

And we know that A XOR B XOR B = A

So we have those equalities

K(i-1, 4) = K(i, 3) XOR K(i, 4)
K(i-1, 3) = K(i, 2) XOR K(i, 3)
K(i-1, 2) = K(i, 1) XOR K(i, 2)
K(i-1, 1) = K(i, 1) XOR sub(shift(K(i-1, 4)) XOR RCON(i)

Except for K(i-1, 1), we know everything so it's trivial to find the sub(shift(K(i-1, 4))) and with every round key we're able to find the previous round and so on find the master key.

Post Made Community Wiki by Johnvox