# RCON for AES 192 and 256

This is question about how many RCON values are used in AES 192 and 256.
I read the NIST Publication introducing AES and in Appendix A.2 and A.3 (Key Expansion for 192 and 256-bit keys), only $$rcon_1$$ to $$rcon_8$$ were used for 192 bits and upto $$rcon_7$$ for 256 bits. My question is how can only 7 or 8 values of $$rcon$$ be used when we have more rounds in AES 192 and 256.
To my understanding, $$rcon$$ is used every round so should't we have more $$rcon$$ values (owing to the increased no. of rounds in AES192 and 256) instead of less?

• Welcome to Cryptography. Did you check the book titled as The Design of RijndaeL: AES - The Advanced Encryption Standard Jul 3, 2020 at 16:25
• No, I have not. Thanks for the suggestion. Jul 3, 2020 at 16:36
• @kelalaka I went through the Key Schedule and No of Rounds. It only specified how the rcon values were generated, but that does not answer my question. Jul 3, 2020 at 17:06
• Nice, there are 21 questions here none mentions this. Jul 3, 2020 at 17:12
• Jul 3, 2020 at 20:24

I've got a response from Vincent Rijmen. Here's the complete response:

rcon is used in the computation of the roundkeys. AES192 and AES256 have less iterations of the roundkey computation, since each of these computations produced more than 128 bits of roundkey material. That’s why we need less rcon values.

Paŭlo Ebermann's great answer gives some details in ASCII images, here I will try to explain this in a different way.

• AES-128 key schedule uses 4 32-bit word columns for 11 round keys that need 10 rcon values.
• AES-192 key schedule uses 6 32-bit word columns for 13 round keys that need 8 rcon values.
• AES-192 key schedule uses 8 32-bit word columns for 15 round keys that need 7 rcon values.

The extra round key is for the initial round key which is XORed with the plaintext.

• In AES-192: the 13 round keys need 52 32-bit words. Using 6 32-bit words with 8 rounds produces keys for 13.5 rounds, a little more than necessary. The first and half of the second is the key itself.

• In AES-256: the 15 round keys need 60 32-bit words. Using 8 32-bit words with 7 rounds produces keys for 16 rounds, more than necessary. The first two are the key itself.

• Thank you for your reply. Just to clarify, in AES 192 and 256, due to >4 columns, we essentially have leftover bytes that carry into the next key expansion round - as for the rcon , these values are used only after our 4x6 (in 192-bit keys) or 4x8 (in 256-bit keys) is exhausted. Is this correct? Jul 6, 2020 at 18:39
• Yes, keep in mind that for 192-bits half is left for the next round. rcon is not leftover, it is simply less used due to the rounds in the key schedule. Jul 6, 2020 at 18:49

You have 10, 12, and 14 rounds respectively; however, they are not linear increments depending on the key schedule. For AES-192, you have 8 different values and you have 7 values for AES-256. The RCON value only changes with every round for AES-128.

The RCON value (in hardware) is generated by a register that is 8-bits and increments every round. It wraps around with the count, and left alone for encryption, you'd get:

0: 00000001
1: 00000010
2: 00000100
3: 00001000
4: 00010000
5: 00100000
6: 01000000
7: 10000000
8: 00011011
9: 00110110
10: 01101100
11: 11011000
12: 10101011
13: 01001101
14: 10011010


This is not what you'll actually use, but it's necessary to have a complete discussion. In the above list, for AES-128, you'd start at round 0, and the final round, 9 (the 10th round), you will have 0x36.

For AES-192 and AES-256, you end up skipping constants due to the key schedule. For AES-192:

0: 00000001
1: 00000001
2: 00000001
3: 00000010
4: 00000100
5: 00000100
6: 00001000
7: 00010000
8: 00010000
9: 00100000
10: 01000000
11: 01000000
12: 10000000


For AES-256:

0: 00000001
1: 00000001
2: 00000001
3: 00000001
4: 00000010
5: 00000010
6: 00000100
7: 00000100
8: 00001000
9: 00001000
10: 00010000
11: 00010000
12: 00100000
13: 00100000
14: 01000000


You can implement this in many ways. The naive approach that you'd have in class, but is easy to follow (also, FPGAs would do this generally):

The way that I generally do it (note, this is encryption, you move tap 4 for decryption):

The clock control increments the value.

• Hmm. The Op asking why less rcon is used for AES 256 while there are more rounds. AES uses up to rcon10 for AES-128 (as 11 round keys are needed), up to rcon8 for AES-192, and up to rcon7 for AES-256 Jul 3, 2020 at 20:02
• This is still not answering the why, it is answering what. It is a design choice by the designer of the AES. So Why do they select like this? Jul 3, 2020 at 20:19
• hold on. ill get that in there too. i’m trying to find time so i’m piecemeal creating an answer Jul 3, 2020 at 20:25
• Maybe the answer linked as a comment under the question may help. Jul 3, 2020 at 20:37
• @kelalaka I put the short answer at the top. Thoughts? I'm trying to make a point to have more complete answers, but it usually takes me a bit to find all of the pieces. Jul 3, 2020 at 21:53