AES key schedule

The Advanced Encryption Standard uses a key schedule to expand a short key into a number of separate round keys. The three AES variants have a different number of rounds. Each variant requires a separate 128-bit round key for each round plus one more.^{note 1} The key schedule produces the needed round keys from the initial key.

The round constant rcon_i for round i of the key expansion is the 32-bit word:^{note 2}

${\displaystyle rcon_{i}={\begin{bmatrix}rc_{i}&00_{16}&00_{16}&00_{16}\end{bmatrix}}}$

where rc_i is an eight-bit value defined as :

${\displaystyle rc_{i}={\begin{cases}1&{\text{if }}i=1\\2\cdot rc_{i-1}&{\text{if }}i>1{\text{ and }}rc_{i-1}<80_{16}\\(((2\cdot rc_{i-1})\oplus {\text{11B}}_{16}){\text{ mod }}{\text{100}}_{16})&{\text{if }}i>1{\text{ and }}rc_{i-1}\geq 80_{16}\end{cases}}}$

where ${\displaystyle \oplus }$ is the bitwise XOR operator and constants such as 00₁₆ and 11B₁₆ are given in hexadecimal. Equivalently:

${\displaystyle rc_{i}=x^{i-1}}$

where the bits of rc_i are treated as the coefficients of an element of the finite field ${\displaystyle {\rm {{GF}(2^{8})[x]/(x^{8}+x^{4}+x^{3}+x+1)}}}$, so that e.g. ${\displaystyle rc_{10}=36_{16}=00110110_{2}}$ represents the polynomial ${\displaystyle x^{5}+x^{4}+x^{2}+x}$.

AES uses up to rcon₁₀ for AES-128 (as 11 round keys are needed), up to rcon₈ for AES-192, and up to rcon₇ for AES-256.^{note 3}

Define:

• N as the length of the key in 32-bit words: 4 words for AES-128, 6 words for AES-192, and 8 words for AES-256
• K₀, K₁, ... K_N-1 as the 32-bit words of the original key
• R as the number of round keys needed: 11 round keys for AES-128, 13 keys for AES-192, and 15 keys for AES-256^{note 4}
• W₀, W₁, ... W_4R-1 as the 32-bit words of the expanded key^{note 5}

Also define RotWord as a one-byte left circular shift:^{note 6}

${\displaystyle \operatorname {RotWord} ({\begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}\end{bmatrix}})={\begin{bmatrix}b_{1}&b_{2}&b_{3}&b_{0}\end{bmatrix}}}$

and SubWord as an application of the AES S-box to each of the four bytes of the word:

${\displaystyle \operatorname {SubWord} ({\begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}\end{bmatrix}})={\begin{bmatrix}\operatorname {S} (b_{0})&\operatorname {S} (b_{1})&\operatorname {S} (b_{2})&\operatorname {S} (b_{3})\end{bmatrix}}}$

Then for ${\displaystyle i=0\ldots 4R-1}$:

${\displaystyle W_{i}={\begin{cases}K_{i}&{\text{if }}i<N\\W_{i-N}\oplus \operatorname {SubWord} (\operatorname {RotWord} (W_{i-1}))\oplus rcon_{i/N}&{\text{if }}i\geq N{\text{ and }}i\equiv 0{\pmod {N}}\\W_{i-N}\oplus \operatorname {SubWord} (W_{i-1})&{\text{if }}i\geq N{\text{, }}N>6{\text{, and }}i\equiv 4{\pmod {N}}\\W_{i-N}\oplus W_{i-1}&{\text{otherwise.}}\\\end{cases}}}$