I understand that the irr. poly is used to form the s-box (and inv. s-box), the key schedule and the mix columns. But could we use a different irr. poly for the mix columns and another for the key schedule (using, of course, a different s-box)?


  • 4
    $\begingroup$ Yes, but then it would no longer be AES $\endgroup$ Apr 12 '16 at 10:39
  • $\begingroup$ Technically I don't see why not. You might want to construct a more specific question though; do you want to know if the result would still be secure or if this would have any benefits? Do you have an intended use case (i.e. why do you want to do this)? $\endgroup$
    – Maarten Bodewes
    Apr 13 '16 at 11:20
  • $\begingroup$ @Maarten Bodewes - Assume sender/receiver have a way to agree on how to randomly select any of the 30 irr. polys; perhaps the same one throughout, or better (is it?) use different irr. polys for different parts of the algorithm (one for the s-box, another for the key schedule, say). Would this be harder to cryptanalyse? More secure? $\endgroup$
    – Red Book 1
    Apr 14 '16 at 3:56

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.