# Questions tagged [key-schedule]

A key schedule is an algorithm that expands a relatively short master key to a relatively large expanded key for later use in an encryption and decryption algorithm.

62 questions
Filter by
Sorted by
Tagged with
898 views

### AES key expansion question

I'm reading about the key expansion for AES but I can't seem to find the answer to this question yet. The book refers to a cipher key and the expanded key (or key schedule). This is the algorithm from ...
• 31
87 views

### How much information is required to specify a new variant of AES beyond the key length and the number of rounds?

Three different versions of the Advanced Encryption Standard (AES) have been standardized, which use keys of bit length 128, 192, and 256 respectively. They also use different numbers of rounds: 10, ...
• 163
1 vote
51 views

### Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?

The context is iterated ciphers. Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
29 views

### How ko = k16 in DES reverse key schedule?

In the reverse key schedule of Data Encryption Standard how ko = k16 after 16 rounds?
82 views

### Reconstructing the AES-192 key out of the last roundkey

Lets assume we know the last-round key of AES. For AES-128, the whole key can be reconstructed using the last-round key since every WORD in the key schedule is based on the previous 128-bit entry. For ...
• 41
28 views

### How do I preform the inverse key expansion of aes decryption? [duplicate]

I’m working on an aes encryption and decryption project in 8086 assembly! I managed to code an encryption algorithm and it worked perfectly. No I’m working on the decryption algorithm. I’ve managed to ...
1 vote
309 views

### Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

When you know the Salsa20's keystream, how do you know the next keystream? In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
42 views

### mixing round functions and key schedules

what is the security of an encryption algorithm that takes the key schedule of algorithm X and the round function of algorithm Y? should it need a new security proof? or it relies on X and Y's ...
• 75
27 views

### How big could be nothing-up-my-sleeve numbers to initialize key schedule?

Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule? As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...
• 795
1 vote
53 views

### Key scheduling for ISAAC

Does ISAAC use key scheduling? I do not know programming. Is it safe if ISAAC derives subkeys using ISAAC itself?
178 views

### Use large key size for RC4 to avoid RC4 bias

I saw a question on StackOverflow where RC4 was initialized by a 1024 bit key (with 2048 the maximum key size, if I'm not mistaken). Will such a large key size possibly solve any of the bias of the ...
• 84.5k
168 views

### Why didn't people redesign the key scheduling algorithm of DES to use longer keys instead of using 3-DES?

To overcome short key length of DES, Triple DES was devised. What would go wrong or why didn't people redesign the key scheduling algorithm to use longer keys?
• 161
1 vote
248 views

### Difference between Key Scheduling and Key Generation?

I am a little bit confused in the terms i.e Key Scheduling and Key Generation. What is the actual difference between these two terms? According to Wikipedia, the terms are described as: Key ...
58 views

### Is there a two-way key-stretching function which is infinite?

Only for hobby I made some ciphers, it is not my intention to use them in the real world but I am trying to compare them with existing ciphers. An important function of my ciphers is a key stretching ...
1 vote
47 views

### Are slide attacks effective if the primitive is sandwiched? And key schedule vs. Even-Mansour

Suppose you have a cryptographic permutation consisting of identical rounds, that makes it vulnerable to a slide attack. But if you sandwich it between two XORs of key material. Is it still vulnerable?...
135 views

### AES key schedule. Does it use a KDF to generate the round keys?

So for each round in AES a different key is used, and as I saw the keys are created form a master key. My question is how these round keys are generated. Are they created via a Key Derivation ...
244 views

### Difference with round keys and round constant in AES

I am confused with round keys and round constant in AES. Are they the same? Can someone explain it to me?
• 23
1 vote
139 views

### Difference in the key schedule of AES for decryption given different orders of operation

As per the Stallings book, the normal decryption of AES has different sequence of transformations [method 1 below], which leads to two separate software or firmware modules and that is undesirable. ...
• 153
175 views

### How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
• 12.9k
52 views

### Is uneven DES keybit use exploitable?

Question: Is there any cryptanalytic leverage to be had from the fact that some of the 56 "raw" keybits of DES are used more & less often than others? Observation: over the course of the 16 ...
• 106
508 views

### S-AES RC[i] Generation. Can someone explain how to generate the RC[i]s for these two problems I have?

I don't know exactly how to find the RC[ 1 ] of 80, or the RC[2] of 30. Can someone explain how to find them? Here is a picture of the problem I am having with two questions.
138 views

### How secure would AES be with all round keys equal? [duplicate]

In effect the same 128 bit key is XORed at every round and before and after as whitening. Would it be 2^128? What are the dangers of such a naive key schedule and does AES suffer from them? Edit: ...
781 views

### How many rounds of encryption is ideal?

I am a newbie to the cryptography world. I am working on a custom algorithm that encrypts the data multiple times and results in a cipher text. It uses a different key in each round to encrypt it. I ...
270 views

### What happens at this part in the key schedule of a Speck...?

I am trying to figure out the process behind the Speck block cipher. I understand how XOR works (Exclusive-or) when you take 2 strings of bits and you want to XOR them together. However, in the key ...
329 views

### Why do block ciphers use key schedules instead of round constants? (Even-Mansour)

Let's take AES as an example. What would be wrong with just having a 256 bit key that you XOR into your input and then XOR into your output? No key expansion at all. I believe it's even known as the ...
173 views

### Optimizing the AES key schedule when round keys cannot be cached

I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there ...
• 12.9k
154 views

### Implications of identical round keys in AES (Rijndael)

When reading up on the Rijndael key schedule, I learned that the master key itself is used as a round key directly before the key schedule generates additional round keys. When a 256-bit key is used, ...
• 12.9k
1 vote
66 views

• 3,397
61 views

### Crafting secure block ciphers that lack key expansion

There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do ...
• 3,397
1 vote
6k views

### AES key expansion for 192-bit

In AES-192 key expansion there are 12 rounds and 52 keys. I am not sure why 52 keys are derived since each block consist of 4 rows and 6 columns (192 bit keys). So if the block is 4 x 4 then we ...
• 113
231 views

### What is the role of the round counter in the key schedule of PRESENT?

Currently I am working on PRESENT block cipher implementation (Hardware) and I am unable to understand the role of round counter in key scheduling part of cipher. Can some share some insight on round ...
1 vote
130 views

### Attack on Cipher with Highly Related RoundKeys

Consider a variation of AES with modified Key-Schedule and following observation on the Key Schedule. If there exists a relation d between two Master keys, the key schedule is so weak that all sub-...
• 1,998
3k views

### In AES Keyschedule : Infer all round keys and cipher key from last round key

I am given the last round key in AES and I want to infer all round keys and the first round key which is the cipherkey. Can anyone provide an algorithm to do that?
• 163
1 vote
229 views

### Triple DES: Does knowing the plaintext limit my keyspace for brute force?

My goal is to try and decrypt a single 8 byte block of a Triple DES encrypted data block and in doing so discovering the 8 byte keys that were used. This is mostly an academic exercise but could ...
• 111
3k views

### Why do Feistel ciphers need round keys?

Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
• 2,337
43 views

### Amount of key expansion rounds in AES [duplicate]

I am currently in the process of learning how AES actually works and that works great as of now but when it comes to the Rijndael's key schedule I have a question. From what I have read, I have to ...
1 vote
33 views

### Why do we need key scheduling? [duplicate]

I've seen papers saying toy ciphers can be improved with powerful key scheduling, but was wondering if there is evidence they are needed in reasonable ciphers? for instance AES. Is there any ...
• 10.4k
601 views

### Security importance of Key Schedule in Block Cipher

For example block cipher AES-128, Key size is 128bit and it is used to make a 10 round key which is total 320bit. Question 1. If i use another Key schedule algorithm in AES, then security decreased ...
455 views

### Why are multiple rounds with generated subkeys used?

In AES-128, 10 rounds are used with subkeys generated from the 128-bit key. In DES, 48-bit subkeys are generated from a 56-bit key. This seems to be common in symmetric encryption. I ask this because ...
• 183
1k views

### How can I find or reverse engineer the whitening in an AES algorithm?

I am working with this black box cryptography scheme. I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes. I have two ...
• 31
363 views

### Camellia Key Schedule

Camellia is widely used, an international standard now. Its key schedule seems to be too simple compared to other famous ciphers like Twofish and CAST-256. What are the prerequisites for the key ...
• 1,998
86 views

### Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || right)\\...
• 19.2k
3k views

### What are the requirements of a key schedule?

In the first block cipher I designed I used a CSPRNG to generate the round keys. The purpose was to at least have a chance of creating a (hopefully!) secure cipher on the first try (but please don't ...
• 4,633
3k views

### Compression in key generation of DES algorithm

Does anyone have a pseudo-code or an algorithm or even a diagram of the compression (pc2) of the DES algorithm? I can't find a relation between the bits that are dropped, even when I do it manually ...
• 45
7k views

### AES Inverse Key Schedule

I have a 128-bit input-block and the corresponding cipher-block given. Additionally I have the last round-key given. Is it now possible to get (calculate) the associated cipher-key? I already ...
• 121