Advanced Encryption Standard

How was AES created?

AES competition

Started in January 1997 by NIST 4-year cooperation between

U.S. Government Private Industry Academia

Why?

Replace 3DES Provide an unclassified, publicly disclosed encryption algorithm, available royalty-free, worldwide

The Finalists

MARS

IBM RSA Laboratories Joan Daemen (Proton World International) and Vincent Rijmen (Katholieke Universiteit Leuven) Ross Anderson (University of Cambridge), Eli Biham (Technion), and Lars Knudsen (University of California San Diego) Bruce Schneier, John Kelsey, and Niels Ferguson (Counterpane, Inc.), Doug Whiting (Hi/fn, Inc.), David Wagner (University of California Berkeley), and Chris Hall (Princeton University)

RC6

Rijndael

Serpent

Twofish

Evaluation Criteria (in order of importance)

Security

Resistance to cryptanalysis, soundness of math, randomness of output, etc. Computational efficiency (speed) Memory requirements Flexibility, hardware and software suitability, algorithm simplicity

Cost

Algorithm / Implementation Characteristics

Results

The winner: Rijndael AES adopted a subset of Rijndael

Finite Fields

AES uses the finite field GF(28)

b7x7 + b6x6 + b5x5 + b4x4 + b3x3 + b2x2 + b1x + b0

{b7, b6, b5, b4, b3, b2, b1, b0}

Byte notation for the element: x6 + x5 + x + 1

{01100011} binary {63} hex Addition Multiplication

Has its own arithmetic operations

Finite Field Arithmetic

Addition (XOR)

(x6 + x4 + x2 + x + 1) + (x7 + x + 1) = x7 + x6 + x4 + x2 {01010111} {10000011} = {11010100} {57} {83} = {d4}

Multiplication is tricky Book Example

Finite Field Multiplication ()

(x6 + x4 + x2 + x +1) (x7 + x +1) = x13 + x11 + x9 + x8 + x7 + x7 + x5 + x3 + x2 + x + x6 + x4 + x2 + x +1 These cancel and x13 + x11 + x9 + x8 + x6 + x5 + x4 + x3 +1 modulo ( x8 + x4 + x3 + x +1) = x7 + x6 +1. Irreducible Polynomial = x13 + x11 + x9 + x8 + x6 + x5 + x4 + x3 +1

The Basic Algorithm

AES Parameters
Key Size Block Size Number of Rounds Round Key 128 128 10 192 128 12 256 128 14

128

128 208

128 240

Expanded Key 176 Size

For simplicity, we restrict to 128 bits

There a four basic step:

(1) The ByteSub (SB) Transformation: This non-linear layer is for resistance to differential and linear cryptanalysis attacks. (2) The ShiftRow (SR) Transformation: This linear mixing step causes diffusion of the bits over multiple rounds.

(3) The MixColumn (MC) Transformation: This layer has a purpose similar to ShiftRow. (4) AddRoundKey (ARK) Transformation: The round key is XORed with the result of the above layer.

A round is then
ByteSub ShiftRow

MixColumn

AddRoundKey

Encryption (1) ARK, by using the 0th round key. (2) Nine rounds of BS, SR, MC, ARK, using round keys 1 to 9. (3) A final round: BS, SR, ARK, using the 10th round key. # The final round omits Mixcolumn layer.

AES methods

Convert to state array Transformations (and their inverses)

AddRoundKey SubBytes ShiftRows MixColumns

Key Expansion

Convert to State Array

Input block: 0 1 3 0 4 5 8 12 9 13 1 2 2 6 310 414 5 7 11 15

=
7

S0,0 S0,1 S0,2 S0,3 8 S1,0 S1,1 S1,2 S1,3 9 10 11 12 13 14 15 S2,0 S2,1 S2,2 S2,3 S3,0 S3,1 S3,2 S3,3

AddRoundKey

XOR each byte of the round key with its corresponding byte in the state array XOR
S0,1 S0,0 S0,1 S0,2 S0,3 S S1,1 S S S
1,0 1,1 1,2 1,3

S0,0 S1,0

S0,1 S0,1 S0,2 S0,3 S1,1 S1,1 S1,2 S1,3 R0,0 R1,0

S2,0 S2,1 S2,2 S2,3 S2,1 S3,0 S3,1 S3,2 S3,3 S3,1

R0,1 R0,1 R0,2 R0,3 R1,1 R1,1 R1,2 R1,3

R2,0 R2,1 R2,2 R2,3 R2,1 R3,0 R3,1 R3,2 R3,3 R3,1

S2,0 S2,1 S2,2 S2,3 S2,1 S3,0 S3,1 S3,2 S3,3 S3,1

SubBytes

Replace each byte in the state array with its corresponding value from the S-Box

00 44 88 CC 11 55 99 DD 55 22 66 AA EE 33 77 BB FF

ShiftRows

Last three rows are cyclically shifted

S0,0 S1,0 S2,0 S2,1 S3,2 S1,0 S2,0 S3,0 S0,1 S1,1 S2,1 S3,1 S0,2 S1,2 S2,2 S3,2 S0,3 S1,3 S2,3 S3,3

S3,0

S3,1

MixColumns

Apply MixColumn transformation to each column

S0,c = ({02} S0,c) ({03} S1,c) S2,c S3,c MixColumns() S0,1 S S1,c = S0,c ({02} S1,c) ({03} S2,c) S0,1 S S S0,1 S0,2 S0,3 S0,0 S0,1 0,2 0,3 3,c S1,1 S S S1,1 S 1,2 = S S ({02} S ) ({03}1,0S1,1 ) S1,2 S1,3 S S1,1 1,3 S3,c 2,c 0,c 1,c 2,c S2,1 S2,2 S2,3 S2,0 S2,1 S2,2 S2,3 S2,1 S S3,c = ({03} S0,c) S1,c S2,c ({02} S2,1 S3,1 S3,2 S3,3 S3,0 S3,c S3,2 S3,3 3,1 S3,1 S3,1

S0,0 S1,0 S2,0 S3,0

Key Expansion

Expands the key material so that each round uses a unique round key

Encrypt and Decrypt

Encryption AddRoundKey SubBytes ShiftRows MixColumns AddRoundKey SubBytes ShiftRows AddRoundKey Decryption AddRoundKey InvShiftRows InvSubBytes AddRoundKey InvMixColumns InvShiftRows InvSubBytes AddRoundKey