When taking AES for example, the number of rounds increases as the key size increases.

This is done in order to adequately diffuse key bits into the state of the cipher.

Suppose you replace the AES key schedule with SHAKE (SHA-3).

Would such round expansion be necessary? Since every bit of the key would influence every bit of every round key.

  • $\begingroup$ If we use SHAKE, we then wouldn't be bothering to use keyed permutation with small block size such as AES. We'd be constructing ciphers directly out of the Keccak permutation directly (with Duplex mode). $\endgroup$
    – DannyNiu
    Nov 17 at 1:11
  • $\begingroup$ @DannyNiu There are a multitude of scenarios where round key generation is computationally irrelevant, and a fast block cipher is just fine. And it doesn't address the question at all. $\endgroup$ Nov 17 at 2:02
  • $\begingroup$ Look at the differential attacks and linear attacks on the AES. Even the independent round key cannot increase the security like demonstrated for DES. So the rounds are determined against the attacks and the AES team had very high confidence about it and we have more than 20 years of attack on it. The round key expansion was designed to be a cheap operation. $\endgroup$
    – kelalaka
    Nov 17 at 6:04
  • $\begingroup$ "This is done in order to adequately diffuse key bits into the state of the cipher." - is this actually the motivation? $\endgroup$
    – poncho
    Nov 17 at 14:26
  • $\begingroup$ What about the last round key? How much they are diffused? $\endgroup$
    – kelalaka
    Nov 17 at 17:36


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.