# What are the RCons for mini-AES if you want to encrypt more than 2 rounds?

I'm implementing impossible differential cryptanalysis on mini-AES using Raphael phan's paper.

I've coded mini-AES using Raphael phan's first paper on the structure of mini-AES, where he only mentions 2-round mini-AES.

But in the impossible differential paper we're attacking 5-round mini-AES so I need to extend the key generation algorithm and to do this I need $$5\;rcon$$ but the paper only mentions 2.

I've seen that for AES, RCon is calculated using $$rcon(i) = [X^{i-1}, 0, 0, 0]$$

I can use the same formula to calculate first four $$rcon$$ but I can't use it to calculate $$rcon(5)$$ because it will result in $$(10)_{hex}$$ and each word in mini-AES is only 4 bit

So how can I calculate the last $$3\;rcons$$?

• the two papers you link to are the same paper Mar 22 at 13:55

For Mini-AES, as defined in the original paper the field with 16 elements is defined as $$\textrm{GF}(2^4)=\textrm{GF}(2)[X]/(X^4+X+1).$$
By using this polynomial representation, and the suggested constant iteration, we have the sequence $$X^{i-1}:i=1,2,\ldots$$ which is given by after taking remainders modulo $$X^4+X+1,$$ $$1,X,X^2,X^3,X^4=X+1, X^5=X^2+X,X^6=X^3+X^2,\ldots$$ which correspond to $$0001,0010,0100,1000,0011,0110,1100$$ etc. by identifying the coefficients of the resulting polynomial $$a_3 X^3+a_2 X^2 + a_1 X+ a_0$$ with the bitsring $$a_3a_2a_1a_0.$$ Note that the arithmetic is explained in section 2 of that paper.