In which order are the round keys used during AES decryption?

Question

In the Add Round Key step in AES decryption, which part of the expanded key will I XOR first to the result of the SubBytes step?

Is it the 10th round key? For example, is this the right order?

addRoundKey(subBytes,roundKey10);
addRoundKey(subBytes,roundKey09);
addRoundKey(subBytes,roundKey08);
addRoundKey(subBytes,roundKey07);
addRoundKey(subBytes,roundKey06);
addRoundKey(subBytes,roundKey05);
addRoundKey(subBytes,roundKey04);
addRoundKey(subBytes,roundKey03);
addRoundKey(subBytes,roundKey02);
addRoundKey(subBytes,roundKey01);
addRoundKey(subBytes,secret key);

Here "secret key" is my secret key that I used in encryption.

In the expansion of my secret key in decryption, is it the same procedure like in encryption?

Answer 1

If you want to undo the encryption, you'll have to undo the whole sequence of the encryption procedure - i.e. undo each encryption step, in the inverse order.

Encryption has these steps (here for AES-128, the number of rounds differs for other Rijndael versions):

AddRoundKey(State, ExpandedKey[0]

SubBytes(State);
ShiftRows(State);
MixColumns(State);
AddRoundKey(State, ExpandedKey[1]);

SubBytes(State);
ShiftRows(State);
MixColumns(State);
AddRoundKey(State, ExpandedKey[2]);

...

SubBytes(State);
ShiftRows(State);
MixColumns(State);
AddRoundKey(State, ExpandedKey[9]);

SubBytes(State);
ShiftRows(State);
AddRoundKey(State, ExpandedKey[10]);

So, for decryption, you'll have go through this list from bottom to top, undoing each step by applying its inverse transformation. Luckily, the inverse of AddRoundKey is just AddRoundKey with the same round key, so we get something like this:

AddRoundKey(State, ExpandedKey[10]);
InvShiftRows(State);
InvSubBytes(State);

AddRoundKey(State, ExpandedKey[9]);
InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

...

AddRoundKey(State, ExpandedKey[2]);
InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

AddRoundKey(State, ExpandedKey[1]);
InvMixColumns(State);
InvShiftRows(State);
InvSubBytes(State);

AddRoundKey(State, ExpandedKey[0]);

(Yes, ExpandedKey[0] is the original encryption/decryption key for AES-128.)

So, to answer your question: Round key 9 is the first which gets XORed with the subbytes result, but before that (at the very start of decryption), round key 10 gets XORed with the ciphertext.

As we have to use the same subkeys for encryption and decryption, you'll have to do the same (or equivalent) key schedule, too.

Note that in addition to this straight-forward (or actually straight-backward) decryption, there is an alternative (equivalent) one which uses a different ordering of the operations, and a mixed version of the sub keys (i.e. a changed key schedule).

But I recommend you to stick to this one here, as it is easier to understand. (No, actually I recommend not to implement AES yourself, but use an existing implementation.)