0
$\begingroup$

I understand the purpose of the SubBytes layer (confusion) and the ShiftRows and MixColumns layers (diffusion).

But I don't see the purpose of having more than one key addition layer. What I've been able to find is that it can mitigate side channel attacks if the AES implementation leaks information, but I don't see the connection there.

Improve this question
$\endgroup$
1
  • $\begingroup$ actually, I do not see how it will mitigate side channel attacks $\endgroup$ – Richie Frame Jan 31 '19 at 23:55
2
$\begingroup$

Suppose you remove the key addition layer. What happens then?

(Mouse over to see the answer. Try figuring out yourself first!)

Denote AES without the key addition layer by $\operatorname{f}$. Suppose an adversary has $\operatorname{f}(x)$. They can recover $x$ by applying $\operatorname{f}^{-1}(x)$. If there is no secret information (the key), then anyone can perform the permutation/inverse permutation at will. You cannot have confidentiality without a secret decryption key.

Edit in response to modified question

If the key is only applied once, then given a ciphertext an adversary can apply the inverse permutation on the ciphertext until they end up with $m' \oplus k$. This allows them to recover $k$ via exclusive-or with $m'$, where $m'$ is the result of $f'(x)$ and $f'$ is the first steps of AES up to the key addition layer.

Improve this answer
$\endgroup$
7
  • $\begingroup$ I shoud've clarified. I meant to ask why there are multiple key addition layers rather than just one at the beginning. $\endgroup$ – Bastien Jan 31 '19 at 23:52
  • $\begingroup$ @Bastien That is indeed quite a different question... $\endgroup$ – Ella Rose Jan 31 '19 at 23:53
  • 1
    $\begingroup$ actually the answer still applies, you reverse all the diffusion operations leaving only key xor $\endgroup$ – Richie Frame Jan 31 '19 at 23:54
  • $\begingroup$ @Bastien Are you asking why the key is added more than once time in general (after each round), or why multiple keys are derived and used? Those are again very different questions. $\endgroup$ – Ella Rose Jan 31 '19 at 23:54
  • $\begingroup$ @EllaRose Why multiple keys are derived :-D. But I think you answered that as well. If multiple keys aren't derived then it'd be the equivalent of using one key. $\endgroup$ – Bastien Feb 1 '19 at 0:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.