Suppose we manipulate the zeroth byte of AES state after the 9th round ShiftRow operation and we want to see its effect on the ciphertext. The propagation of the error effect is demonstrated in the figure. enter image description here I have written the equations of each step in the order below and obtained the equation of $V[0]$ in terms of key bytes (The ciphertext is known). $$\begin{cases} Z[0] = C[0] \oplus K_{10}[0] \\ Z[7] = C[7] \oplus K_{10}[7] \\ Z[10] = C[10] \oplus K_{10}[10] \\ Z[13] = C[13] \oplus K_{10}[13] \end{cases} $$

$$\begin{cases} Y[0] = Z[0] = C[0] \oplus K_{10}[0] \\ Y[1] = Z[13] = C[13] \oplus K_{10}[13] \\ Y[2] = Z[10] = C[10] \oplus K_{10}[10] \\ Y[3] = Z[7] = C[7] \oplus K_{10}[7] \end{cases} $$

$$\begin{cases} X[0] = S^{-1}(Y[0]) = S^{-1}(C[0] \oplus K_{10}[0]) \\ X[1] = S^{-1}(Y[1]) = S^{-1}(C[13] \oplus K_{10}[13]) \\ X[2] = S^{-1}(Y[2]) = S^{-1}(C[10] \oplus K_{10}[10]) \\ X[3] = S^{-1}(Y[3]) = S^{-1}(C[7] \oplus K_{10}[7]) \end{cases} $$

$$\begin{cases} W[0] = X[0] \oplus K_{9}[0] = S^{-1}(C[0] \oplus K_{10}[0]) \oplus K_{9}[0] \\ W[1] = X[1] \oplus K_{9}[1] = S^{-1}(C[13] \oplus K_{10}[13]) \oplus K_{9}[1] \\ W[2] = X[2] \oplus K_{9}[2] = S^{-1}(C[10] \oplus K_{10}[10]) \oplus K_{9}[2] \\ W[3] = X[3] \oplus K_{9}[3] = S^{-1}(C[7] \oplus K_{10}[7]) \oplus K_{9}[3] \end{cases} $$

$$ \Rightarrow V[0] = (0E.W[0]) \oplus (0B.W[1]) \oplus (0D.W[2]) \oplus (09.W[3]) \\ = (0E.(S^{-1}(C[0] \oplus K_{10}[0]) \oplus K_{9}[0])) \oplus (0B.(S^{-1}(C[13] \oplus K_{10}[13]) \oplus K_{9}[1])) \oplus (0D.(S^{-1}(C[10] \oplus K_{10}[10]) \oplus K_{9}[2])) \oplus (09.(S^{-1}(C[7] \oplus K_{10}[7]) \oplus K_{9}[3])) $$

My question is, is there an easier way to do this? Is it possible to write a code to do this for us or is there a special software to do this?

  • $\begingroup$ Do you want just symbolic computation? SageMath can do that ( Maple and mathematical, too) $\endgroup$
    – kelalaka
    Commented Oct 18, 2023 at 22:25
  • $\begingroup$ Thank you for helping me @kelalaka . Yes, symbolic computation is enough. Can you tell me exactly what to look for in the Sage tutorial? I mean, what do they call this action? $\endgroup$ Commented Oct 19, 2023 at 7:55
  • $\begingroup$ doc.sagemath.org/html/en/reference/calculus/sage/symbolic/… $\endgroup$
    – kelalaka
    Commented Oct 19, 2023 at 7:59


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.