I am currently trying to implement a AES-256 cipher according to this sepcificaciton: http://techheap.packetizer.com/cryptography/encryption/spec.v36.pdf

As well as on Wikipedia and in the document these offsets for the shift-rows operation are given (depending on the key size):

Row  128 192 256
 1    0   0   0
 2    1   1   1
 3    2   2   3
 4    3   3   4

The example for 256-Bit encryption (page 26 onwards) obivously uses the same offsets (0-1-2-3) for all key sizes:

R[ 1].s_row   d4bf5d30e0b452aeb84111f11e2798e5 (given Example)
R[ 1].s_row   d4bf52aee0b411f1b84198e51e275d30 (my calculation with 0-1-3-4)

Extracting the rows:

Row#  0-1-3-4 calculation  example calculation
 1    d4 e0 b8 1e          d4 e0 b8 1e
 2    bf b4 41 27          bf b4 41 27
 3    52 11 98 5d          5d 52 11 98
 4    ae f1 e5 30          30 ae f1 e5

So the question is: What are the correct offsets: 0-1-2-3 or 0-1-3-4? If the latter is correct (what i believe) there is an error in this document or i missed the up-to-date version since 2003 is already a while ago...


1 Answer 1


Actually, the document talks about Rijndael, not AES.

Aren't Rijndael and AES that same? Well, not precisely; Rijndael is specified with a set of parameters that AES does not support; how example, how it works with different block sizes. AES is defined only with a block size of 128; Rijndael supports a set of different block sizes.

That is where your confusing is coming from; the varient shift-rows are used if you have a block size of 256 bits; since AES never has a block size of 256, those shift rows are never used.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.