I'm implementing an OCB-AES cipher (which is described in RFC 7253), now I have to call the AES encipher function (I'll refer to that as AES-256, described in FIPS 197)

Pre-summary: I'm not sure which encipher function FIPS 197 refers to. Of course, it should be the cipher function; however, the function parameters are different.

Here's an excerpt from OCB's "associated data hash function":

   Function name:
     K, string of KEYLEN bits                      // Key
     A, string of any length                       // Associated data
     Sum, string of 128 bits                       // Hash result
   Sum is defined as follows.
     // Key-dependent variables
     L_* = ENCIPHER(K, zeros(128))
     L_$ = double(L_*)

Another excerpt from OCB:

To be complete, the algorithms in this document require ... a blockcipher operating on 128-bit blocks...


ENCIPHER(K,P)  The blockcipher function mapping 128-bit plaintext block P to its corresponding ciphertext block using KEYLEN-bit [256-bit] key K.

So, I jumped to FIPS 197. Here's the cipher function:

Cipher(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])
    byte state[4,Nb]
    state = in
    AddRoundKey(state, w[0, Nb-1]) 
    // See Sec. 5.1.4
    for round = 1 step 1 to Nr–1
        // See Sec. 5.1.1
        // See Sec. 5.1.2
        // See Sec. 5.1.3
        AddRoundKey(state, w[round*Nb, (round+1)*Nb-1])
    end for
    AddRoundKey(state, w[Nr*Nb, (Nr+1)*Nb-1])
    out = state

After looking at the table (where $1 \text{ words} = 4 \text{ bytes}$)

$$\begin{array}{|c|c|c|c|}& \text{Key length }(Nk \text{ words)} & \text{Block size } (Nb \text{ words)} & \text{Number of rounds }(Nr)\\\text{AES }128&4&4&10 \\\text{AES }192&6&4&12\\\text{AES }256&8&4&14\end{array}$$

Paraphrasing only the input parameters for $256$:

void cipher(char in[16], char w[240]);

Here's the main point: The first excerpt wants me to call AES-256 cipher with 1) the key 2) zeros of 16 bytes. How can I pass the 256-bit key and 128-bit zero? One parameter has $240$ bytes and the other has $16$? Is my "function prototype" for the cipher wrong, or do I need to use key expansion, etc..., somehow?

  • $\begingroup$ Yes, the 240 bytes are the result of the AES key schedule, which takes a key of length 16, 24 or 32 bytes and returns the appropriate round keys w. $\endgroup$
    – SEJPM
    Jul 4, 2018 at 8:14

1 Answer 1


The 256-bit K of OCS-AES must first go thru FIPS 197's

KeyExpansion(byte key[4*Nk], word w[Nb*(Nr+1)], Nk)

where it is key[4*Nk] to be transformed into w[Nb*(Nr+1)] (32×4×(14+1) = 1920-bit), which is the last input of

Cipher(byte in[4*Nb], byte out[4*Nb], word w[Nb*(Nr+1)])


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.