Why are multiple rounds with generated subkeys used?

Question

In AES-128, 10 rounds are used with subkeys generated from the 128-bit key. In DES, 48-bit subkeys are generated from a 56-bit key. This seems to be common in symmetric encryption.

I ask this because of my understanding of entropy and randomness. If you were to take a random integer and put it through some function to expand it (the terminology used in the AES standard), aren't you making it more predictable/less random?

If I were to take a random integer and use it as the seed to a PRNG, I'm not getting anything unpredictable from the seed as I retrieve values from it. Surely the stream has the same randomness as the seed alone. I would have thought that it follows that multiple rounds result in encryption with multiple low quality subkeys with significantly less randomness than the original key, assuming the original key was random, or at least we don't know what it is.

(This PRNG and randomness analogy may be misinformed; I'm simply trying to say that you can't make an unpredictable value bigger and be as unpredictable as it was before, which is my understanding.)

Please could someone clarify why using multiple rounds of a lower quality subkey is more desirable than, say, one round with the whole key (in the case where key length is the block length)?

Answer 1

It's true that a badly designed key schedule weakens the cipher.

However the main point is to "stretch" the randomness across all subkeys by using diffusion techniques, while using only $k$ bits of randomness for the key instead of $kr$ bits of randomness if all round keys were independently chosen.

This is doable. AES is a good example where the components of the cipher are used in the key schedule.

More theoretically, James Massey (and one of his students whose name escapes me now) has proved that a construction called perfect local randomiser can extract random looking $k-$tuples (subkey bits) from a uniformly distributed $n-$tuple (randomly uniformly chosen master key) such that these $k-$tuples are locally uniformly distributed. The construction uses orthogonal arrays which can be obtained from certain MDS codes under certain conditions. MDS codes are intimately related to the branch number of AES MixColumns operation, see, e.g. The answer to this question.

Edit: Also, a one round cipher will not have enough diffusion for linear and differential probabilities to drop to safely low levels, as it happens through multiple rounds.