# Why the AES perform encryption in 10 rounds Instead of one?

I'm a Master's Degree student and researching about AES-128 encryption. My Advisor asked me a question about necessity of iterative rounds in AES. he asked:"why we couldn't encrypt a 128-bit plaintext with a 128-bit key by doing simple XOR operation on it? it have 2^128 key space and hard to attack.Why we should perform iterative rounds?" can anyone explain it for me by references?

• Block ciphers are meant to encrypt very long plaintexts, not just 128 bits. – mikeazo Feb 21 '18 at 1:20
• So when the round key is inserted into the state what operation is used? – Q-Club Feb 21 '18 at 4:32
• @Q-Club Carryless addition modulo 2, of course! – forest Jun 26 at 7:42

This is actually two questions, so its interesting that your advisor questioned it in this way.

The simple 128-bit XOR operation is what is known as a One Time Use Pad. The cryptographic behavior of this is very well understood. Some of its behaviors are desirable, some are not. For example, they suffer from malleability if the attacker already knows the plaintext.

The question of why we use multiple rounds instead of one big round is a very different one. We use multiple rounds because the construction of cyphers from small repeated rounds is well understood. The security of it is easier to analyze. For example, we can construct them in a way such that, in the event of an attack, there's a good chance that increasing the number of rounds solves the attack. If we had one big algorithm, the probability that one failure may destroy the entire algorithm seems to go up. I say seems to, because you can't prove such things with statistics, but the cryptographic community has found that, in general, its a rule that works.

• On the first question, a reason "why we couldn't encrypt a 128-bit plaintext with a 128-bit key by doing simple XOR operation on it" is that the key could trivially be found form a single plaintext/ciphertext pair, then allowing to perform any other encryption/decryption, against the security model of the block cipher. Nice explanation for the second. – fgrieu Feb 21 '18 at 9:18

Cort Ammon makes good points. There is also another reason that rounds are required, to do with resources.

AES is essentially a substitution /permutation network with a block width of 128 bits. It's technically impossible to make direct like for like substitutions of a 128 bit variable. You'd need ~10^40 bytes of RAM (2^128*16) to hold a look up table. So AES does it in the SubBytes component using 8 bits at a time. To make this effective with the old confusion and diffusion adage, these substituted bits need to be permuted over the whole block width and the other 15 bytes. That's what ShiftRows and MixColumns does. But it takes more than one iteration.

If you look at the The Design of Rijndael, section 3.5, the bits can be fully diffused with just 2 rounds. These two iterations effectively create a 128 bit wide S box. The other 8 - 12 rounds add resistance to analysis.

Have only one big algorithm to encrypt is not considered a good design criteria Encryption algorithms (ciphers) are constructed from building blocks like SBox, PBox , Rounds , Key schedule or expansion

Historically, one time pad algorithm which is a simple Xor of plaintext with secret key usually chose random The problem with this algorithm , if cipher-text got change in transit, the receiver has no way to detect such modifications

Compare the case, where we used AES for example to encrypt the plaintext, if change in transit , it will be decrypted to random message that could not be parse or recognized by receiver

Also, the cipher with iterative rounds , can be further enhanced by increasing number of rounds in case and attack is found

Also, the iterative round cipher could encrypt several blocks of 128-bit using the same 128-bit key whereas in Simple Xor cipher you could not do that and you will need as much secret key as plaintext nneded to be encrypted