How secure is the AES master key if Round Keys are found

Question

If an attacker finds some round key of AES256, is it possible to find the master key?

How safe is the master key if an attackers finds multiple round keys?

Answer 1

If an attacker find some round key of AES256. Is it possible to find the master key ?

If the attacker is given a single round key from an 256 bit AES key, it is infeasible to reconstruct the full key (even if you have access to chosen plaintext/ciphertext against the full key).

This single round key reduces the number of possible AES keys from $2^{256}$ to $2^{128}$; however a search over the remaining 128 unknown bits would be computationally infeasible. In addition, there is no obvious way to use you single known round to aid a Pt/Ct attack, because while there's a subkey which you know the key, there are 14 subkeys which you have no information on (AES-256 has 14 rounds, but 15 round keys). Known "chosen key" attacks on AES-256 involve modifying the key; there's no obvious way to exploit that here.

How safe is the master key if an attackers finds multiple round keys?

That's different; if the attacker finds two adjacent subkeys, then it's game over; he can trivially reconstruct everything. For AES-256, each round key is an easily computed function of both the previous two round keys, or the next two round keys; hence with two adjacent round keys, you can reconstruct everything. In fact, some hardware AES-256 implementations store two subround keys; the first two for encryption, and the last two for decryption; they reconstruct all the other round keys on the fly during the en/decryption process.

Now, what if the attacker finds two subkeys, but they're not adjacent? Well, that's not quite as clear. My instincts tell me that would be safer to assume that the attacker is able to recover everything, but how easy that really is might depend on how close the exposed rounds are; if they have a gap of one, you ought to be able to trivially reconstruct the round key between the two; if what's exposed is the first and last round keys, it might be a tad trickier.

Answer 2

To close the question I've found the answer. If a round key is found, the master is found too.

I consider this notation :

K,i,n => The n column of the round i.

sub() => Substitution function

shift() => Shifting function

For example : K(4,3) => the 3rd column of 4th round

We have those equalities

K(i, 1) = sub(shift(K(i-1, 4)) XOR K(i-1, 1) XOR RCON(i)
K(i, 2) = K(i, 1) XOR K(i-1, 2)
K(i, 3) = K(i, 2) XOR K(i-1, 3)
K(i, 4) = K(i, 3) XOR K(i-1, 4)

If a round key is found we know the value of

K(i,1)
K(i,2)
K(i,3) 
K(i,4)

And we know that A XOR B XOR B = A

So we have those equalities

K(i-1, 4) = K(i, 3) XOR K(i, 4)
K(i-1, 3) = K(i, 2) XOR K(i, 3)
K(i-1, 2) = K(i, 1) XOR K(i, 2)
K(i-1, 1) = K(i, 1) XOR sub(shift(K(i-1, 4)) XOR RCON(i)

Except for K(i-1, 1), we know everything so it's trivial to find the sub(shift(K(i-1, 4))) and with every round key we're able to find the previous round and so on find the master key.