0
$\begingroup$

I want to attack a hardware AES. It is with a 128bit in its key. However, according to the documentation I have 11 rounds in this AES.

  1. I don't understand why I have 11 rounds? What is the role of the 11th round?

  2. Let's suppose that I want t attack the 10th round, must I compute the 10th ciphertext? (I mean that my 11th subkey is different from the 10th round subkey.)

Improve this question
$\endgroup$
3
  • $\begingroup$ AES has a defined number of rounds in the standard. If that is not 10 (for 128 bit keys), then it's not AES - and almost surely does not produce the same output as AES. $\endgroup$
    – tylo
    Commented Sep 8, 2017 at 8:59
  • $\begingroup$ It is a new work, it is an AES which really includ 11rounds $\endgroup$
    – nani92
    Commented Sep 8, 2017 at 9:06
  • 2
    $\begingroup$ Well, then it's not the standad anymore. Anyway, from the question it's not clear what the actual problem is - you give no details at all about what it is or what you have done. So right now it's even impossible to judge if this question falls under the off-topic closing reasons or not (quite possibly, depends on whether you have a detail question or ask for cryptanalysis of a new design). $\endgroup$
    – tylo
    Commented Sep 8, 2017 at 9:33

1 Answer 1

Reset to default
2
$\begingroup$

I don't understand why I have 11 rounds? What is the role of the 11th round?

I suspect that they are doing standard AES-128, and thus have 10 rounds.

By '11 rounds', I suspect they mean '11 subkeys'; AES uses one more subkey than it has rounds.

Let's suppose that I want t attack the 10th round, must I compute the 10th ciphertext?

I rather suspect what's actually needed to perform the attack will depend on the details of the attack. On the other hand, without the final subkey, you can't compute the intermediate cipherstate (and if you knew the final subkey, that'd give you the entire key anyways).

I suspect that it's easiest, for a DPA-style attack, to attack either the first or the last subkey; those subkey bits satisfy the equation $S = K \oplus I$, where $S$ is one of the subkey bits, and $K$ is a bit you know (it's either a plaintext bit or a ciphertext bit), and $I$ is a bit of the AES internal state; if you can find a correlation with $I$, you can recover $S$; recover enough $S$ bits, and that's the game...

Improve this answer
$\endgroup$
1
  • $\begingroup$ I have already tried to attack the first round and the last round, but I don't have a good results, I have already correct plaintexts, 1st subkey, last subkey(11th subkey) and ciphertexts. So based on those results I decide to try the 10th round (10th subkey I have already compute it ), but I am not sure if I must compute the 10th ciphertexts or not? $\endgroup$
    – nani92
    Commented Sep 8, 2017 at 9:12

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.