Problem reproducing AES results

Question

First of all, I just implemented AES because I wanted to understand how it works and as a challenge to see if I could do it and I won't use to encrypt anything important, ever.

The (German) Wikipedia article of AES linked to a flash animation which demonstrated precisely how AES-128 in ECB mode worked. I implemented AES exactly as shown in that animation and I am able to reproduce the same encrypted byte array they get in the result.

In that example the hex string: 328831e0435a3137f6309807a88da234 encrypted with the key 2b28ab097eaef7cf15d2154f16a6883c results in the encrypted hexadecimal string 3902dc1925dc116a8409850b1dfb9732 and I get the same result.

Encrypting given test vectors however does not work with my algorithm and neither does encrypting the examples given in the animation with an AES encryption tool (which encrypted the test vectors correctly) work. Is there anything wrong with that flash animation or am I missing something obvious?

Answer 1

I think the flash implementation is wrong: (using Linux, OS X terminal etc.) not true, see below

echo 328831e0435a3137f6309807a88da234 | xxd -r -p > plain.dat
openssl enc -e -aes-128-ecb -iv 00 -K 2b28ab097eaef7cf15d2154f16a6883c -in plain.dat -out plain.dat.out -nopad

yields

hd plain.dat.out                                  

00000000 57 16 aa fa 2c c6 8b 9b 8b 9b e5 0d 30 e3 f2 06 |W...,.......0...|

And I do trust openssl to give the right results.

Are you sure you use raw bytes (not ASCII representations of hex or something like that?). This is one block, using a 16 byte key. I tried the first of the AES-128 test vectors using openssl in the same way, and that gave the right result.

Post your code if you are in doubt.

Added:

I remembered that the order in the blockstate and keystate are different than one would think! Specifically, the block used in the flash implementation is really

32 43 f6 a8 88 5a 30 8d  31 31 98 a2 e0 37 07 34

Because a block is put into the state by column, not by row! The same holds for the key, which is really

2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

(which is, probably not by accident, the same as the one used in the test vectors you linked to)

So the flash implementation is right, but you need to realise that you have to put the blocks from the test vectors in by column, not by row. I made the same mistake in my initial answer as well. So if the state is a matrix a[i][j] and the block is b[i], we see that a[i][j] = b[4*j+i], and similarly for the key. See page 9 of the AES document, e.g.