What are the RCons for mini-AES if you want to encrypt more than 2 rounds?

Question

I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper.

I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions 2-round mini-AES.

But in the impossible differential paper we're attacking 5-round mini-AES so I need to extend the key generation algorithm and to do this I need $5\;rcon$ but the paper only mentions 2.

I've seen that for AES, RCon is calculated using $rcon(i) = [X^{i-1}, 0, 0, 0]$

I can use the same formula to calculate first four $rcon$ but I can't use it to calculate $rcon(5)$ because it will result in $(10)_{hex}$ and each word in mini-AES is only 4 bit

So how can I calculate the last $3\;rcons$?

Answer 1

For Mini-AES, as defined in the original paper the field with 16 elements is defined as $$\textrm{GF}(2^4)=\textrm{GF}(2)[X]/(X^4+X+1).$$

By using this polynomial representation, and the suggested constant iteration, we have the sequence $$ X^{i-1}:i=1,2,\ldots $$ which is given by after taking remainders modulo $X^4+X+1,$ $$ 1,X,X^2,X^3,X^4=X+1, X^5=X^2+X,X^6=X^3+X^2,\ldots $$ which correspond to $$ 0001,0010,0100,1000,0011,0110,1100 $$ etc. by identifying the coefficients of the resulting polynomial $a_3 X^3+a_2 X^2 + a_1 X+ a_0$ with the bitsring $a_3a_2a_1a_0.$ Note that the arithmetic is explained in section 2 of that paper.

This presents no difficulties, just like AES definition by similar powering presents no difficulties since the constants are defined until the tenth round but the field has bitsize 8, so a similar feedback in computing the constants occurs there as well.