0
$\begingroup$

It seems AES uses fixed shiftrows as follows:

B0  B4  B8  B12  No shift
B1  B5  B9  B13  Right-shift 3 places
B2  B6  B10 B14  Right-shift 2 places
B3  B7  B11 B15  Right-shift 1 place

Would it make a difference to security if the rows were shifted differently? Not to disturb the carefully selected shifts (0, 1, 2 and 3 shifts), but just the order of them: For example:

Right-shift 3 places
No shift
Right-shift 1 place
Right-shift 2 places
Improve this question
$\endgroup$
1

1 Answer 1

Reset to default
2
$\begingroup$

No it would not make a difference to security, but it will no longer be AES since it does not match the specification.

As long as all 4 rows have a different rotation count through 0-3 bytes, the permutation will fully mix the state after 2 rounds.

Improve this answer
$\endgroup$
1
  • $\begingroup$ Actually, we don't know if it would make a difference to security. The proofs against linear and differential crypto would still apply; however there are deeper attacks against (reduced round) AES known; unless someone sits down and studies how these attacks would work against the modified AES (and they may work better, and they may work worse), one ought to be hesitant to say $\endgroup$
    – poncho
    Commented Aug 1, 2016 at 15:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.