The number of AES rounds increases with the key length. Why increase the number of rounds at all, and how were these round counts chosen?

  • $\begingroup$ This question is related to this one. $\endgroup$ – user1449 May 21 '12 at 14:49
  • $\begingroup$ Maybe this article provides some explanations: research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf The math behind the attacks that are detailed in the paper is a bit too much for me, though. $\endgroup$ – Mihai Todor May 21 '12 at 16:40
  • 3
    $\begingroup$ $N_r = len(key)/4 + 6$. $\endgroup$ – Chris Smith May 21 '12 at 17:38
  • $\begingroup$ Chris Smith, can you elaborate? $\endgroup$ – user1449 May 23 '12 at 9:18
  • 3
    $\begingroup$ As to the choice for the round numbers? Have a look at this document: csrc.nist.gov/archive/aes/rijndael/Rijndael-ammended.pdf. Note the "Number of rounds" section under "Motivation for design choices". $\endgroup$ – Chris Smith May 23 '12 at 15:40

There are two reasons:

  • More rounds means more security against cryptanalysis, simply, since there is more confusion and diffusion.
  • For a secure block cipher, there should be no attack faster than exhaustive key search (i.e. brute force). As exhaustive key search takes a lot longer for a larger key size, a theoretical attacker can afford more work to "break" the larger cipher. Thus we also increase the round number a bit to increase the security level of our cipher accordingly.
  • For a larger key size (as well as a larger block size), we need more rounds so that every key bit affects every ciphertext bit in a similar way, i.e. without measurable differences which would allow any cryptanalysis.

The 10 rounds for AES-128 seem to be about the lower level of what is (approximately) 128-bit-secure, and 10 rounds for a AES-256-like-cipher would have way below 256 bits of security.

  • 2
    $\begingroup$ keep in mind that while this is generally true for good ciphers (aes, twofish, serpent, etc) there are some attacks that will make the number of rounds a cipher has irrelevant e.g: increasing the number of rounds will not give any additional security against that attack (the slide attack being the one that comes to mind first). $\endgroup$ – cipher May 21 '12 at 20:45
  • $\begingroup$ @cipher: I used my moderator powers to convert your answer to a comment, as wished. Normally one needs to earn 50 reputation before being able to comment on posts other than your own (or answers to your question). $\endgroup$ – Paŭlo Ebermann May 21 '12 at 21:46
  • $\begingroup$ Thanks for noting the slide attack, I'll read up on it (but not today). $\endgroup$ – Paŭlo Ebermann May 21 '12 at 21:47
  • $\begingroup$ Is there a more technical explanation? $\endgroup$ – user1449 May 23 '12 at 9:18
  • $\begingroup$ This is a bit more detailed in the Rijndael specification (the book one), but I don't have it on hand. Maybe someone else can give a more detailed answer here (I would certainly upvote it). $\endgroup$ – Paŭlo Ebermann May 23 '12 at 16:59

Some quotes from The Design of Rijndael (pdf, see Section 3.5 "The Number of Rounds"):

For Rijndael with a block length and key length of 128 bits, no shortcut attacks had been found for reduced versions with more than six rounds. We added four rounds as a security margin.

The addition of four rounds is justified by:

Two rounds of Rijndael provide 'full diffusion' in the following sense: every state bit depends on all state bits two rounds ago, or a change in one state bit is likely to affect half of the state bits after two rounds. Adding four rounds can be seen as adding a 'full diffusion step' at the beginning and at the end of the cipher.

Regarding longer key lengths:

For Rijndael versions with a longer key, the number of rounds was raised by one for every additional 32 bits in the cipher key.

Unfortunately no derivation of this magic 1:32 ratio is given.


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy