Recovering plaintext from AES-128 given round key 10 and ciphertext

Question

I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?

Answer 1

Since CTF has gone and our policy cover this. Here is the complete answer;

AES's all key schedule is invertible ( and Rijndael, too) regardless the key size.

• Let us have $n_k$ bit AES ( $n_k = (128|192|256)$ for AES).
• Let $N_K = keyLength/32$, i.e. word size of the key ( for AES we have $N_K =(4|6|8)$) depending on the key size.
• Let $K_i$ represent the words of the initial key.
• Let denote the expanded key as 32-bit words with $W_i$.

The key schedule in simple terms

• First, the $n_k$ bits are used to initialize the first $n_K$-bits of the expanded key. So either 4,6, or 8 words are initialized.
• The $W_i$ can be computed from $W_{i-N_k}$ to $W_{i-1}$. In other words each eack $N_K$ blocks of $W_i$ can be computed from the previous $N_K$ block.

The Full AES Key schedule

_{$ W_i= \begin{cases} K_i & \text{if } i < N_K \\ W_{i-N_K} \oplus \operatorname{SubWord}(\operatorname{RotWord}(W_{i-1})) \oplus rcon_{i/N_K} & \text {if } i \ge N_K \text{ and } i \equiv 0 \pmod{N_K} \\ W_{i-N_K} \oplus \operatorname{SubWord}(W_{i-1}) & \text{if } i \ge N_K \text{, } N_K > 6 \text{, and } i \equiv 4 \pmod{N_K} \\ W_{i-N_K} \oplus W_{i-1} & \text{otherwise.} \\ \end{cases} $}

---

AES-128

defn AES_Key_Schedule_128( K)

    #The init part
    W[0] = K[0] 
    W[1] = K[1] 
    W[2] = K[2] 
    W[3] = K[3] 
 
    for i from 1 to 10:
         W[ i*4    ] =  W[ (i-1)*4     ] \oplus SubWord(RotWord(W[i*4-1]) \oplus rcon[i]
         W[ i*4 + 1] =  W[ (i-1)*4 + 1 ] \oplus W[i*4     ])
         W[ i*4 + 2] =  W[ (i-1)*4 + 2 ] \oplus W[i*4 + 1 ])
         W[ i*4 + 3] =  W[ (i-1)*4 + 3 ] \oplus W[i*4 + 2 ])

Now the one round inverse key schedule assuming we are in the round boundaries;

defn One_Round_Inv_AES_Key_Schedule_128(W[i*4],W[i*4+1],W[i*4 +2],W[i*4+3])

    W[ (i-1)*4 + 3 ] = W[ i*4 + 3] \oplus W[i*4 + 2 ])
    W[ (i-1)*4 + 2 ] = W[ i*4 + 2] \oplus W[i*4 + 1 ])
    W[ (i-1)*4 + 1 ] = W[ i*4 + 1] \oplus W[i*4     ])
    W[ (i-1)*4 + 0 ] = W[ i*4    ] \oplus SubWord(RotWord(W[i*4-1]) \oplus rcon[i]

SubWord is AES's SBox and RotWord is just a Rotation of a word left by 1-byte.

---

I'm working on an old CTF challenge where AES-128 was used on a 16 byte block. I have the round 10 key and the ciphertext. What techniques exist for obtaining the plaintext?

Use the invertibility to generate AES Key. Then you can decrypt the ciphertext.

In other words, if you have one round key then you have all of it!.