I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper.

I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions 2-round mini-AES.

But in the impossible differential paper we're attacking 5-round mini-AES so I need to extend the key generation algorithm and to do this I need $5\;rcon$ but the paper only mentions 2.

I've seen that for AES, RCon is calculated using $rcon(i) = [X^{i-1}, 0, 0, 0]$

I can use the same formula to calculate first four $rcon$ but I can't use it to calculate $rcon(5)$ because it will result in $(10)_{hex}$ and each word in mini-AES is only 4 bit

So how can I calculate the last $3\;rcons$?

  • $\begingroup$ the two papers you link to are the same paper $\endgroup$
    – kodlu
    Mar 22, 2023 at 13:55

1 Answer 1


For Mini-AES, as defined in the original paper the field with 16 elements is defined as $$\textrm{GF}(2^4)=\textrm{GF}(2)[X]/(X^4+X+1).$$

By using this polynomial representation, and the suggested constant iteration, we have the sequence $$ X^{i-1}:i=1,2,\ldots $$ which is given by after taking remainders modulo $X^4+X+1,$ $$ 1,X,X^2,X^3,X^4=X+1, X^5=X^2+X,X^6=X^3+X^2,\ldots $$ which correspond to $$ 0001,0010,0100,1000,0011,0110,1100 $$ etc. by identifying the coefficients of the resulting polynomial $a_3 X^3+a_2 X^2 + a_1 X+ a_0$ with the bitsring $a_3a_2a_1a_0.$ Note that the arithmetic is explained in section 2 of that paper.

This presents no difficulties, just like AES definition by similar powering presents no difficulties since the constants are defined until the tenth round but the field has bitsize 8, so a similar feedback in computing the constants occurs there as well.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.