# Problems key AES 128 key from last round key

I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key.

I know that the general principle is to do $w[i] = w[i+3] \oplus w[i+4]$, with $w$ being a buffer of dimension 2 : 44 * 4 bytes. The last key is therefore $w[40]$, $w[41]$, $w[42]$ and $w[43]$.

What I don't understand is : when do we use rcon and the sboxes?

I apply $w[i+3] = \operatorname{sboxWord}(\operatorname{rotate}(w[i+3])) \oplus \operatorname{rconWord}[{i \over 4} + 1]$ if $i \bmod 4 = 0$.

• Here's a C implementation of the inverse key schedule; maybe it helps to compare your Python to that code. – yyyyyyy Mar 8 '18 at 16:14
• I've formatted your code and made the title more specific, view changes here. Note that single line ends do nothing squared; you need to use two to create a new section or use double space, enter to insert a single line break. – Maarten Bodewes Mar 9 '18 at 10:28