As of May 31, 2023, we have updated our Code of Conduct.

Questions tagged [key-schedule]

A key schedule is an algorithm that expands a relatively short master key to a relatively large expanded key for later use in an encryption and decryption algorithm.

Filter by
Sorted by
Tagged with
3 votes
1 answer
31 views

Size of subkey array in Blowfish

I'm writing a school paper about Blowfish encryption, and couldn't seem to find out if the size of the subkey array for Blowfish changes based on the length of the key. I would assume that it doesn't ...
SykesTheLord's user avatar
2 votes
0 answers
33 views

Do symmetric and skew symmetric key schedules have any known weaknesses?

A symmetric key schedule is a key schedule of the form $(k_1,\dots,k_{n-1},k_n,k_{n-1},\dots,k_1)$ or of the form $(k_1,\dots,k_{n-1},k_n,k_n,k_{n-1},\dots,k_1)$. A skew symmetric key schedule is a ...
Joseph Van Name's user avatar
11 votes
1 answer
2k views

Why expand keys? Why not rather generate a longer key?

AES-128 takes a 128-bit key (four 32-bit words), and expands it to a 352-bit key schedule (11 words). Speck48/72 takes a 72-bit key (three 24-bit words), and expands it to a 528-bit key schedule (22 ...
Chris Morgan's user avatar
2 votes
3 answers
1k views

AES key expansion question

I'm reading about the key expansion for AES but I can't seem to find the answer to this question yet. The book refers to a cipher key and the expanded key (or key schedule). This is the algorithm from ...
mirkaim's user avatar
  • 39
2 votes
0 answers
90 views

How much information is required to specify a new variant of AES beyond the key length and the number of rounds?

Three different versions of the Advanced Encryption Standard (AES) have been standardized, which use keys of bit length 128, 192, and 256 respectively. They also use different numbers of rounds: 10, ...
tparker's user avatar
  • 163
1 vote
1 answer
62 views

Statistical Cryptanalysis. Would one "reverse" weak key schedule algorithms or peel off each one of internal rounds?

The context is iterated ciphers. Regarding Differential and Linear Cryptanalysis, the methods seem to make a cryptanalyst able to do an educated guess on a partial subkey (e.g. bits from the last ...
Alessio Proietti's user avatar
2 votes
0 answers
174 views

Reconstructing the AES-192 key out of the last roundkey

Lets assume we know the last-round key of AES. For AES-128, the whole key can be reconstructed using the last-round key since every WORD in the key schedule is based on the previous 128-bit entry. For ...
hooujki's user avatar
  • 41
0 votes
0 answers
29 views

How do I preform the inverse key expansion of aes decryption? [duplicate]

I’m working on an aes encryption and decryption project in 8086 assembly! I managed to code an encryption algorithm and it worked perfectly. No I’m working on the decryption algorithm. I’ve managed to ...
Michael sared's user avatar
1 vote
1 answer
380 views

Is it possible to acquire the next keystream of Salsa20? (If you know part of the keystream)

When you know the Salsa20's keystream, how do you know the next keystream? In other words, can I infer the next keystream when I don't know the Key and IV of Salsa20, but the keystream is ...
Giyoon kim's user avatar
1 vote
1 answer
62 views

mixing round functions and key schedules

what is the security of an encryption algorithm that takes the key schedule of algorithm X and the round function of algorithm Y? should it need a new security proof? or it relies on X and Y's ...
m.nasim's user avatar
  • 105
0 votes
0 answers
30 views

How big could be nothing-up-my-sleeve numbers to initialize key schedule?

Is it fine if algoritm will have $32$ 128-bit numbers that will be nothing-up-my-sleeve numbers to initialize key schedule? As I know from wikipedia the Hasty Pudding Cipher was criticized for its ...
Tom's user avatar
  • 1,181
1 vote
1 answer
66 views

Key scheduling for ISAAC

Does ISAAC use key scheduling? I do not know programming. Is it safe if ISAAC derives subkeys using ISAAC itself?
Mini kute's user avatar
5 votes
1 answer
216 views

Use large key size for RC4 to avoid RC4 bias

I saw a question on StackOverflow where RC4 was initialized by a 1024 bit key (with 2048 the maximum key size, if I'm not mistaken). Will such a large key size possibly solve any of the bias of the ...
Maarten Bodewes's user avatar
  • 90.2k
0 votes
3 answers
202 views

Why didn't people redesign the key scheduling algorithm of DES to use longer keys instead of using 3-DES?

To overcome short key length of DES, Triple DES was devised. What would go wrong or why didn't people redesign the key scheduling algorithm to use longer keys?
Sangjin Kim's user avatar
1 vote
1 answer
413 views

Difference between Key Scheduling and Key Generation?

I am a little bit confused in the terms i.e Key Scheduling and Key Generation. What is the actual difference between these two terms? According to Wikipedia, the terms are described as: Key ...
Muhammad Sarmad Mahmood Malik's user avatar
0 votes
0 answers
60 views

Is there a two-way key-stretching function which is infinite?

Only for hobby I made some ciphers, it is not my intention to use them in the real world but I am trying to compare them with existing ciphers. An important function of my ciphers is a key stretching ...
john-a's user avatar
  • 1
1 vote
0 answers
52 views

Are slide attacks effective if the primitive is sandwiched? And key schedule vs. Even-Mansour

Suppose you have a cryptographic permutation consisting of identical rounds, that makes it vulnerable to a slide attack. But if you sandwich it between two XORs of key material. Is it still vulnerable?...
user avatar
2 votes
1 answer
205 views

AES key schedule. Does it use a KDF to generate the round keys?

So for each round in AES a different key is used, and as I saw the keys are created form a master key. My question is how these round keys are generated. Are they created via a Key Derivation ...
user67441's user avatar
2 votes
1 answer
372 views

Difference with round keys and round constant in AES

I am confused with round keys and round constant in AES. Are they the same? Can someone explain it to me?
jan's user avatar
  • 23
1 vote
0 answers
158 views

Difference in the key schedule of AES for decryption given different orders of operation

As per the Stallings book, the normal decryption of AES has different sequence of transformations [method 1 below], which leads to two separate software or firmware modules and that is undesirable. ...
user3656142's user avatar
8 votes
1 answer
205 views

How complex must round constants be to resist slide attacks?

A key schedule that generates round keys by XORing a round constant with the key is linear and can be vulnerable to related key attacks, but let's ignore that for now. Constants are necessary to avoid ...
forest's user avatar
  • 14.9k
3 votes
0 answers
62 views

Is uneven DES keybit use exploitable?

Question: Is there any cryptanalytic leverage to be had from the fact that some of the 56 "raw" keybits of DES are used more & less often than others? Observation: over the course of the 16 ...
outer's user avatar
  • 106
3 votes
1 answer
747 views

S-AES RC[i] Generation. Can someone explain how to generate the RC[i]s for these two problems I have?

I don't know exactly how to find the RC[ 1 ] of 80, or the RC[2] of 30. Can someone explain how to find them? Here is a picture of the problem I am having with two questions.
user avatar
0 votes
0 answers
160 views

How secure would AES be with all round keys equal? [duplicate]

In effect the same 128 bit key is XORed at every round and before and after as whitening. Would it be 2^128? What are the dangers of such a naive key schedule and does AES suffer from them? Edit: ...
user avatar
0 votes
1 answer
856 views

How many rounds of encryption is ideal?

I am a newbie to the cryptography world. I am working on a custom algorithm that encrypts the data multiple times and results in a cipher text. It uses a different key in each round to encrypt it. I ...
Lock Smith's user avatar
0 votes
1 answer
298 views

What happens at this part in the key schedule of a Speck...?

I am trying to figure out the process behind the Speck block cipher. I understand how XOR works (Exclusive-or) when you take 2 strings of bits and you want to XOR them together. However, in the key ...
Marc Hughes's user avatar
5 votes
1 answer
378 views

Why do block ciphers use key schedules instead of round constants? (Even-Mansour)

Let's take AES as an example. What would be wrong with just having a 256 bit key that you XOR into your input and then XOR into your output? No key expansion at all. I believe it's even known as the ...
Jack Maluniv's user avatar
3 votes
0 answers
192 views

Optimizing the AES key schedule when round keys cannot be cached

I have an implementation of AES which can cache at most a 256-bit value between encryptions. Currently, the master key is cached and the key schedule is re-computed for each and every block. Is there ...
forest's user avatar
  • 14.9k
5 votes
1 answer
163 views

Implications of identical round keys in AES (Rijndael)

When reading up on the Rijndael key schedule, I learned that the master key itself is used as a round key directly before the key schedule generates additional round keys. When a 256-bit key is used, ...
forest's user avatar
  • 14.9k
1 vote
0 answers
66 views

Programming Interface: Preparing Key Schedule for Both Encryption and Decryption

Quick question (01): what is the uniform interface for a symmetric block cipher? Is it $(f:k \to k', enc_{k'}:c \to p, dec_{k'}:p \to c)$ or $(f:k \to k_e, g:k \to k_d, enc_{k_e}:c \to p, dec_{k_d}:...
DannyNiu's user avatar
  • 8,283
0 votes
1 answer
498 views

What are the subsequent inputs to the DES key schedule after round 1?

I've just been studying the DES crypto algorithm as presented by Christof Paar in his book entitled, Understanding Cryptography as well as his lecture. There is a diagram on page 68 of the text where ...
the_endian's user avatar
1 vote
1 answer
287 views

Using round constants to thwart slide attacks

I'm partly unclear as to how the use of round constants in an iterated cipher makes it immune to slide attacks. I mean, I can see how it does from one perspective, but if the solution to slide attacks ...
Melab's user avatar
  • 3,487
1 vote
1 answer
242 views

How should k2 be produced in the RC4A stream cipher (A modification of RC4)?

RC4A is a slight modification of the simple RC4 stream cipher designed to strengthen it against a number of attacks. Here's that paper. However in the paper, the second key ...
bryc's user avatar
  • 292
3 votes
2 answers
194 views

Security of key schedule that only XORs a key with constants

Suppose that: $MK \in \{0, 1\}^{n}$ and the main key of a block cipher. $RK_{r} \in \{0, 1\}^{n}$ and is the $r$th round key. $RC_{r} \in \{0, 1\}^{n}$ and is the $r$th round constant. $RK_{r} = MK \...
Melab's user avatar
  • 3,487
0 votes
1 answer
72 views

Crafting secure block ciphers that lack key expansion

There was some article published by on the IACR's website that outlined a block cipher that only used the "master" key and no round keys. I can't recall the cipher's name, not that it matters, nor do ...
Melab's user avatar
  • 3,487
1 vote
1 answer
7k views

AES key expansion for 192-bit

In AES-192 key expansion there are 12 rounds and 52 keys. I am not sure why 52 keys are derived since each block consist of 4 rows and 6 columns (192 bit keys). So if the block is 4 x 4 then we ...
Johnny's user avatar
  • 113
0 votes
1 answer
262 views

What is the role of the round counter in the key schedule of PRESENT?

Currently I am working on PRESENT block cipher implementation (Hardware) and I am unable to understand the role of round counter in key scheduling part of cipher. Can some share some insight on round ...
kedar Dahivale's user avatar
1 vote
0 answers
133 views

Attack on Cipher with Highly Related RoundKeys

Consider a variation of AES with modified Key-Schedule and following observation on the Key Schedule. If there exists a relation d between two Master keys, the key schedule is so weak that all sub-...
crypt's user avatar
  • 2,377
6 votes
1 answer
3k views

In AES Keyschedule : Infer all round keys and cipher key from last round key

I am given the last round key in AES and I want to infer all round keys and the first round key which is the cipherkey. Can anyone provide an algorithm to do that?
SebMa's user avatar
  • 163
1 vote
0 answers
252 views

Triple DES: Does knowing the plaintext limit my keyspace for brute force?

My goal is to try and decrypt a single 8 byte block of a Triple DES encrypted data block and in doing so discovering the 8 byte keys that were used. This is mostly an academic exercise but could ...
maple_shaft's user avatar
15 votes
3 answers
3k views

Why do Feistel ciphers need round keys?

Looking at the design for Feistel ciphers, they use a list of round keys which are generated from the main key using the key schedule of the associated block cipher. Some block ciphers need this as to ...
Daffy's user avatar
  • 2,369
0 votes
0 answers
44 views

Amount of key expansion rounds in AES [duplicate]

I am currently in the process of learning how AES actually works and that works great as of now but when it comes to the Rijndael's key schedule I have a question. From what I have read, I have to ...
user avatar
1 vote
0 answers
35 views

Why do we need key scheduling? [duplicate]

I've seen papers saying toy ciphers can be improved with powerful key scheduling, but was wondering if there is evidence they are needed in reasonable ciphers? for instance AES. Is there any ...
Meir Maor's user avatar
  • 11.6k
7 votes
2 answers
713 views

Security importance of Key Schedule in Block Cipher

For example block cipher AES-128, Key size is 128bit and it is used to make a 10 round key which is total 320bit. Question 1. If i use another Key schedule algorithm in AES, then security decreased ...
Seonghwan Cho's user avatar
8 votes
1 answer
492 views

Why are multiple rounds with generated subkeys used?

In AES-128, 10 rounds are used with subkeys generated from the 128-bit key. In DES, 48-bit subkeys are generated from a 56-bit key. This seems to be common in symmetric encryption. I ask this because ...
Doddy's user avatar
  • 183
3 votes
0 answers
1k views

How can I find or reverse engineer the whitening in an AES algorithm?

I am working with this black box cryptography scheme. I know the plain text, cipher text, and everything else except how they whiten the data (or key?). Everything is 128 bit, 16 bytes. I have two ...
John's user avatar
  • 31
2 votes
2 answers
421 views

Camellia Key Schedule

Camellia is widely used, an international standard now. Its key schedule seems to be too simple compared to other famous ciphers like Twofish and CAST-256. What are the prerequisites for the key ...
crypt's user avatar
  • 2,377
4 votes
1 answer
92 views

Security of randomized data dependant key schedules?

An example to demonstrate the point with two Feistel networks: Cipher A: \begin{align} roundkey = hash(key || counter)\\ roundkey = hash(key || roundkey)\\ left = left\oplus hash(roundkey || right)\\...
Ella Rose's user avatar
  • 19.4k
13 votes
1 answer
3k views

What are the requirements of a key schedule?

In the first block cipher I designed I used a CSPRNG to generate the round keys. The purpose was to at least have a chance of creating a (hopefully!) secure cipher on the first try (but please don't ...
Demi's user avatar
  • 4,763
3 votes
1 answer
3k views

Compression in key generation of DES algorithm

Does anyone have a pseudo-code or an algorithm or even a diagram of the compression (pc2) of the DES algorithm? I can't find a relation between the bits that are dropped, even when I do it manually ...
Balkis's user avatar
  • 55