If an attacker finds some round key of AES256, is it possible to find the master key?

How safe is the master key if an attackers finds multiple round keys?

  • $\begingroup$ This looks like homework, that's why I let you find the answer. Hint: Examine how the round keys are computed from the master key. Also, check how hardware implementations find the round keys during decryption. Read the rationale for AES, section 7.5. $\endgroup$ – fgrieu Mar 24 '14 at 14:51
  • $\begingroup$ I examine it, but I'm not a crypto-guru, so for myself I believe it is safe but not sure. $\endgroup$ – Johnvox Mar 24 '14 at 14:53
  • $\begingroup$ Consider which round keys you're giving them access to if you think it's secure. What happens if they have the first two round keys? $\endgroup$ – figlesquidge Mar 24 '14 at 15:04
  • $\begingroup$ poncho's answer is the correct one, in fact, this was a design feature of AES for use on devices with very limited memory resources $\endgroup$ – Richie Frame Mar 24 '14 at 19:01

If an attacker find some round key of AES256. Is it possible to find the master key ?

If the attacker is given a single round key from an 256 bit AES key, it is infeasible to reconstruct the full key (even if you have access to chosen plaintext/ciphertext against the full key).

This single round key reduces the number of possible AES keys from $2^{256}$ to $2^{128}$; however a search over the remaining 128 unknown bits would be computationally infeasible. In addition, there is no obvious way to use you single known round to aid a Pt/Ct attack, because while there's a subkey which you know the key, there are 14 subkeys which you have no information on (AES-256 has 14 rounds, but 15 round keys). Known "chosen key" attacks on AES-256 involve modifying the key; there's no obvious way to exploit that here.

How safe is the master key if an attackers finds multiple round keys?

That's different; if the attacker finds two adjacent subkeys, then it's game over; he can trivially reconstruct everything. For AES-256, each round key is an easily computed function of both the previous two round keys, or the next two round keys; hence with two adjacent round keys, you can reconstruct everything. In fact, some hardware AES-256 implementations store two subround keys; the first two for encryption, and the last two for decryption; they reconstruct all the other round keys on the fly during the en/decryption process.

Now, what if the attacker finds two subkeys, but they're not adjacent? Well, that's not quite as clear. My instincts tell me that would be safer to assume that the attacker is able to recover everything, but how easy that really is might depend on how close the exposed rounds are; if they have a gap of one, you ought to be able to trivially reconstruct the round key between the two; if what's exposed is the first and last round keys, it might be a tad trickier.


To close the question I've found the answer. If a round key is found, the master is found too.

I consider this notation :

K,i,n => The n column of the round i.

sub() => Substitution function

shift() => Shifting function

For example : K(4,3) => the 3rd column of 4th round

We have those equalities

K(i, 1) = sub(shift(K(i-1, 4)) XOR K(i-1, 1) XOR RCON(i)
K(i, 2) = K(i, 1) XOR K(i-1, 2)
K(i, 3) = K(i, 2) XOR K(i-1, 3)
K(i, 4) = K(i, 3) XOR K(i-1, 4)

If a round key is found we know the value of


And we know that A XOR B XOR B = A

So we have those equalities

K(i-1, 4) = K(i, 3) XOR K(i, 4)
K(i-1, 3) = K(i, 2) XOR K(i, 3)
K(i-1, 2) = K(i, 1) XOR K(i, 2)
K(i-1, 1) = K(i, 1) XOR sub(shift(K(i-1, 4)) XOR RCON(i)

Except for K(i-1, 1), we know everything so it's trivial to find the sub(shift(K(i-1, 4))) and with every round key we're able to find the previous round and so on find the master key.

  • 5
    $\begingroup$ I believe that's assuming the key scheduling for AES128. Yes, for AES128, learning any one round key gives you everything. However, the original question specified AES256; AES uses a different key expansion process when it is given 256 bit keys. If, with AES256, you can determine the entire transform with just one 128 bit round key, that would mean that AES256 encrypts in at most $2^{128}$ different ways, and hence it would effectively have a 128 bit key. $\endgroup$ – poncho Mar 24 '14 at 17:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.