I have written an algorithm in Python to find the main AES 128 key from the last round key. However, it doesn't work; I can not find back my main key.

I know that the general principle is to do $w[i] = w[i+3] \oplus w[i+4]$, with $w$ being a buffer of dimension 2 : 44 * 4 bytes. The last key is therefore $w[40]$, $w[41]$, $w[42]$ and $w[43]$.

What I don't understand is : when do we use rcon and the sboxes?

I apply $w[i+3] = \operatorname{sboxWord}(\operatorname{rotate}(w[i+3])) \oplus \operatorname{rconWord}[{i \over 4} + 1]$ if $i \bmod 4 = 0$.

  • 1
    $\begingroup$ Here's a C implementation of the inverse key schedule; maybe it helps to compare your Python to that code. $\endgroup$ – yyyyyyy Mar 8 '18 at 16:14
  • $\begingroup$ I've formatted your code and made the title more specific, view changes here. Note that single line ends do nothing squared; you need to use two to create a new section or use double space, enter to insert a single line break. $\endgroup$ – Maarten Bodewes Mar 9 '18 at 10:28

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.