24
$\begingroup$

I was reading about the AES algorithm to be used in one of our projects and found that the exact number of rounds is fixed in AES for specific key sizes:

$$ \begin{array}{|c|c|} \hline \begin{array}{c} \textbf{Key Size} \\ \left(\text{bits}\right) \end{array} &\begin{array}{c} \textbf{Rounds} \\ \left(\text{number}\right) \end{array} \\ \hline 128 & 10 \\ \hline 192 & 12 \\ \hline 256 & 14 \\ \hline \end{array} $$

Why these specific numbers of rounds only?

Improve this question
$\endgroup$
1
  • $\begingroup$ Note that AES is a subset of the Rijndael cipher. The same number of rounds are applicable for Rijndael, but there are more options available depending on key size and block size (AES has just one block size: 128 bits and 3 key sizes, Rijndael has 3 block sizes and 5 key sizes, and therefore 15 combinations of both, rather than just the 3 for AES). $\endgroup$
    – Maarten Bodewes ♦
    Mar 24, 2019 at 13:32

1 Answer 1

Reset to default
32
$\begingroup$

Why these specific number of rounds only?

Because AES is a standard; AES is an acronym for "Advanced Encryption Standard".

The standard specifies these specific number of rounds to ensure that different implementations are interoperable.

Why not more or less?

The reason these specific numbers of rounds were chosen was a choice of the designers. They did a lot of math to determine that these were the sweet spot between sufficient security and optimal performance.

Less might be insecure, and more might be slower with no benefit.

To quote the above book (from Section 3.5 The Number of Rounds):

For Rijndael versions with a longer key, the number of rounds was raised by one for every additional 32 bits in the cipher key. This was done for the following reasons:

  1. One of the main objectives is the absence of shortcut attacks, i.e. attacks that are more efficient than an exhaustive key search. Since the workload of an exhaustive key search grows with the key length, shortcut attacks can afford to be less efficient for longer keys.

  2. (Partially) known-key and related-key attacks exploit the knowledge of cipher key bits or the ability to apply different cipher keys. If the cipher key grows, the range of possibilities available to the cryptanalyst increases.

Improve this answer
$\endgroup$
3
  • 2
    $\begingroup$ That quote only explains why with longer keys the number of rounds is higher. It does not explain why exactly the 128 bit version uses 10 rounds. The reason for the 10 rounds (which I could misrebemmer since it has been almost 20 years) is as follows: The security against all known attacks was analyzed and 6 rounds was found to be enough against attacks known at the time. It takes 2 rounds to achieve a full avalanche effect in AES, so 10 rounds corresponds to enough rounds for a full avalanche effect before and after the 6 rounds needed for security against known attacks. $\endgroup$
    – kasperd
    Mar 22, 2019 at 10:58
  • $\begingroup$ @kasperd I think it was 6 rounds at the time + 2 rounds because attacks only get better + 2 rounds for full avalanche. $\endgroup$
    – Martin Bonner supports Monica
    Mar 22, 2019 at 12:14
  • 1
    $\begingroup$ @MartinBonner The way the paper described it was "so it can be thought of as padding the vulnerable 6 rounds with two full diffusion steps" or something along those lines, as kasperd says. $\endgroup$
    – forest
    Mar 22, 2019 at 22:44

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.