2
$\begingroup$

I am trying to figure out AES in two rounds with 128 keys. If I have a known plaintext and the ciphertext that comes from this procedure. I get another plaintext which is similar to the previous with the difference of only one byte. I don't know the keys. Everything is 128 bits. How much will be the final ciphertext be affected?

I am taking this step by step for the two plaintexts (with one-byte difference) and I see that:

  1. XORing with the first key: Only the different byte will change.
  2. Byte substitution: Comparing the result of the 2 cases everything will stay the same except form the different byte.
  3. Shift byte: The two outcomes will change the same way and the different byte will still be one just in a different place.

(is that correct so far?)

  1. Then comes the mixcolumn... Here I am confused as to how much the result will be affected if I compare the two cases.

Any help with that?

Improve this question
$\endgroup$
5
  • $\begingroup$ Is this a homework question? If so please indicate! $\endgroup$
    – kelalaka
    Commented Nov 27, 2019 at 19:35
  • $\begingroup$ Yes kelalaka it is. Is it ok? $\endgroup$
    – Pitsi
    Commented Nov 27, 2019 at 20:12
  • $\begingroup$ It is okay to ask homework here, however, as our current policy we only provide hints on comments not answer. $\endgroup$
    – kelalaka
    Commented Nov 27, 2019 at 20:14
  • $\begingroup$ Absolutely! I was not expecting a solution. More of a guidance. Thank you for letting me know about the policy though. :) $\endgroup$
    – Pitsi
    Commented Nov 27, 2019 at 21:14
  • $\begingroup$ You need an empty line in front of the initial value for markdown to recognize a list and format accordingly... $\endgroup$
    – Maarten Bodewes ♦
    Commented Nov 28, 2019 at 18:16

1 Answer 1

Reset to default
2
$\begingroup$

The difference of one byte before MixColumn will propagate to the whole column. The goal of this step is to mix the four bytes together to get another four bytes. Look at the definition and try it yourself.

Also, there is some nice property here. There are $256$ possible values for the XOR difference of the two bytes and since MixColumn is linear, the XOR difference of the two columns after applying MixColumn will be the same as applying MixColumn to the difference of the columns before. So there are only $256$ possible values for the entire difference of the two columns after MixColumn.

To make it clear: if $C_1$ and $C_2$ are the two columns that differ in only one of the four bytes, then there are $256$ values for $C_1 \oplus C_2$, and we have $\mathrm{MC}(C_1 \oplus C_2) = \mathrm{MC}(C_1) \oplus \mathrm{MC}(C_2)$, so only $256$ possible values for $\mathrm{MC}(C_1) \oplus \mathrm{MC}(C_2)$.

I think it's a nice property.

Improve this answer
$\endgroup$
1
  • $\begingroup$ This is related to the Square attack. $\endgroup$
    – kodlu
    Commented Nov 27, 2019 at 20:57

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.