I am wondering if for some particular keys the AES 128 key schedule lead to a periodic pattern for the round keys. The key schedule is only 10 rounds, but I am also wondering in the general case where we expand the key much more, as it happens if one use the last round key of an operation as the key for the next operation (definitely not a standard use of AES, but of some interest on small devices with on-the-fly key schedule).
3
-
$\begingroup$ the on-the-fly key schedule still generates the same round keys, it starts from the beginning with a new block $\endgroup$– Richie FrameCommented Dec 5, 2015 at 5:10
-
$\begingroup$ What I have in mind is a hardware implementation with a single 128 bit register to hold the round key. The original key is therefore not available anymore after the first operation. Sure it can be reloaded from a backup location but that's a complication. $\endgroup$– acapolaCommented Dec 5, 2015 at 12:30
-
$\begingroup$ still has to happen, the AES spec requires the round subkeys for each block to be identical for a given key, regardless of implementation $\endgroup$– Richie FrameCommented Dec 6, 2015 at 4:14
Add a comment
|
1 Answer
$\begingroup$
$\endgroup$
2
During each round of the AES key schedule, they stir in an 'rcon' value. This constant differs for each round, and so even if the state of the key schedule just happened to be exactly the same in, say, rounds 2 and 5, the differing rcon values would mean that the keys during round 3 and 6 would differ. Hence, the AES 128 key schedule is nonperiodic.
So, if you take the last subkey, and reuse it as the key for the next block, the only way you can come up with a repeating pattern is to generate the same AES 128 key. Since that's the normal way to use AES, that's not a problem.
On the other hand, doing what you propose would mean that the AES keys you use are related; that the subkey for the last round is exactly the same as the first subkey for the next block. Now, AES-128 is not known to be vulnerable to related key attacks, and the related keys for the known AES-192 and AES-256 vulnerabilities are considerably different; however it does bear wondering whether this is something that you should trust.
-
$\begingroup$ I am still wondering if I can get the same key over and over. As you stated, that's normally not an issue. "not an issue" is nevertheless not the answer to the question... $\endgroup$– acapolaCommented Dec 5, 2015 at 12:27
-
$\begingroup$ What is the normal way to use AES? $\endgroup$– MelabCommented Oct 18, 2017 at 14:23