I'm a little confused as to what constitutes a single AES round. Most sources say it's this:
t0=Te0[s0>>24]^Te1[(s1>>16)&0xff]^Te2[(s2>>8)&0xff]^Te3[s3&0xff]^rk[4]; t1=Te0[s1>>24]^Te1[(s2>>16)&0xff]^Te2[(s3>>8)&0xff]^Te3[s0&0xff]^rk[5]; t2=Te0[s2>>24]^Te1[(s3>>16)&0xff]^Te2[(s0>>8)&0xff]^Te3[s1&0xff]^rk[6]; t3=Te0[s3>>24]^Te1[(s0>>16)&0xff]^Te2[(s1>>8)&0xff]^Te3[s2&0xff]^rk[7];

If so, then (by my testing) it requires 3, not 2, rounds for diffusion. It's also hard to implement an even number of rounds because it seems to require I begin and end on a t0=... round (vs. the alternating s0=... round).


A single full AES round consists of the following:

S-box application
Add round keys

2 subsequent applications of shift-rows and mixcolumns provides complete diffusion of the state and the initial round key.

What you posted is a software optimized design, which combines the first 3 steps into a table lookup, then adds round key words. Te0[] is the first lookup table, and s0 is the first word of the state. I would suggest looking at how the tables are generated.

It's also hard to implement an even number of rounds

In that design, you simply set s0-s3 to t0-t3, and begin the next round with the correct round subkeys.

  • $\begingroup$ Thank you for the explanation and suggestion. I did try assigning s0... to t0... but probably got the round keys wrong. I only wanted to test diffusion over 1, 2 and 3 rounds (it seems to require at least 4 of the above) and since decryption wasn't necessary it didn't really matter. The math underlying the substitution boxes is a bit over my head, though I understand they're designed to thwart various known attacks. $\endgroup$ – Chris Miller Jul 25 '18 at 16:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.