NIST public full text Public Domain

NIST FIPS 197: Advanced Encryption Standard (AES)

National Institute of Standards and Technology · National Institute of Standards and Technology (NIST)

NIST · Standards · License: Public Domain

Conceptio Open Archive

Analyze & explore related research in Conceptio

Connect this record directly into your research workflow or AI agent. Explore citations across open repositories, query full text, and export structured proof bundles.

Explore in Search →Connect via MCP / API ↗

FIPS 197 Federal Information Processing Standards Publication

Advanced Encryption Standard (AES) Category: Computer Security

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8900 This publication is available free of charge from: https://doi.org/10.6028/NIST.FIPS.197-upd1 Published November 26, 2001; Updated May 9, 2023

U.S. Department of Commerce Donald L. Evans, Secretary Technology Administration Phillip J. Bond, Under Secretary for Technology National Institute of Standards and Technology Karen H. Brown, Acting Director

Subcategory: Cryptography

Foreword The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology is the offcial series of publications relating to standards and guidelines developed under 15 U.S.C. 278g-3, and issued by the Secretary of Commerce under 40 U.S.C. 11331. Comments concerning this Federal Information Processing Standard publication are welcomed and should be submitted using the contact information in the “Inquiries and comments” clause of the announcement section. James A. St. Pierre, Acting Director Information Technology Laboratory

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Abstract In 2000, NIST announced the selection of the Rijndael block cipher family as the winner of the Advanced Encryption Standard (AES) competition. Block ciphers are the foundation for many cryptographic services, especially those that provide assurance of the confdentiality of data. Three members of the Rijndael family are specifed in this Standard: AES-128, AES-192, and AES-256. Each of them transforms data in blocks of 128 bits, and the numerical suffx indicates the bit length of the associated cryptographic keys. Keywords: AES; block cipher; confdentiality; cryptography; encryption; Rijndael.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Federal Information Processing Standards Publication 197 Published: November 26, 2001 Updated: May 9, 2023

Announcing the ADVANCED ENCRYPTION STANDARD (AES) Federal Information Processing Standards Publications (FIPS) are developed by NIST under 15 U.S.C. 278g-3 and issued by the Secretary of Commerce under 40 U.S.C. 11331. 1. Name of Standard. Advanced Encryption Standard (AES) (FIPS 197). 2. Category of Standard. Computer Security Standard, Cryptography. 3. Explanation. The Advanced Encryption Standard (AES) specifes a FIPS-approved cryptographic algorithm that can be used to protect electronic data. The AES algorithm is a symmetric block cipher that can encrypt (encipher) and decrypt (decipher) digital information. The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits. 4. Approving Authority. Secretary of Commerce. 5. Maintenance Agency. Department of Commerce, National Institute of Standards and Technology, Information Technology Laboratory (ITL). 6. Applicability. Federal Information Processing Standards apply to information systems used or operated by federal agencies, a contractor of an agency, or other organization on behalf of an agency. They do not apply to national security systems as defned in 44 U.S.C. 3552. This Standard may be used by federal agencies to protect information when they have determined that encryption is appropriate, in accordance with applicable Offce of Management and Budget and agency policies. Federal agencies may also use alternative methods that NIST has indicated are appropriate for this purpose. This Standard may be adopted and used by non-Federal Government organizations. 7. Specifcations. Federal Information Processing Standard (FIPS) 197, Advanced Encryption Standard (AES) (affxed). 8. Implementations. The algorithm specifed in this Standard may be implemented in software, frmware, hardware, or any combination thereof. The specifc implementation may depend on several factors, such as the application, the environment, the technology used, etc. The algorithm shall be used in conjunction with a FIPS-approved or NIST-recommended mode of operation. Object Identifers (OIDs) and any associated parameters for AES used in iii

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

these modes are available at the Computer Security Objects Register (CSOR), located at https://csrc.nist.gov/projects/csor. NIST has developed a validation program to test implementations for conformance to the algorithms in this Standard. Information about the validation program is available at https: //nist.gov/cmvp. Examples for each key size are available at https://csrc.nist.gov/projects/aes. 9. Implementation Schedule. This Standard became effective on May 26, 2002. 10. Patents. Implementations of the algorithm specifed in this Standard may be covered by U.S. and foreign patents. 11. Export Control. Certain cryptographic devices and technical data regarding them are subject to federal export controls. Exports of cryptographic modules implementing this Standard and technical data regarding them must comply with all federal laws and regulations and must be licensed by the Bureau of Industry and Security of the U.S. Department of Commerce. Information about export regulations is available at https://www.bis.doc.gov. 12. Qualifcations. NIST will continue to follow developments in the analysis of the AES algorithm. As with its other cryptographic algorithm standards, NIST will formally reevaluate this Standard every fve years. Both this Standard and possible threats reducing the security provided through the use of this Standard will undergo review by NIST as appropriate, taking into account newly available analysis and technology. In addition, the awareness of any breakthrough in technology or any mathematical weakness of the algorithm will cause NIST to reevaluate this Standard and provide necessary revisions. 13. Where to Obtain Copies. This publication is available by accessing https://csrc.nist.gov/ publications. Other computer security publications are available at the same website. 14. Inquiries and Comments. Inquiries and comments about this FIPS may be submitted to fps-197-comments@nist.gov. 15. How to Cite This Publication. NIST has assigned NIST FIPS 197-upd1 as the publication identifer for this FIPS, per the NIST Technical Series Publication Identifer Syntax. NIST recommends that it be cited as follows: National Institute of Standards and Technology (2001) Advanced Encryption Standard (AES). (Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) NIST FIPS 197-upd1, updated May 9, 2023. https://doi.org/10.6028/NIST.FIPS.197-upd1

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Federal Information Processing Standards Publication 197

Specifcation for the ADVANCED ENCRYPTION STANDARD (AES) Table of Contents 1 Introduction

2 Defnitions

2.1

Terms and Acronyms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.2

List of Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

2.3

Algorithm Parameters and Symbols . . . . . . . . . . . . . . . . . . . . . .

3 Notation and Conventions

3.1

Inputs and Outputs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.2

Bytes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.3

Indexing of Byte Sequences . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.4

The State . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

3.5

Arrays of Words . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4 Mathematical Preliminaries

4.1

Addition in GF(28 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4.2

Multiplication in GF(28 ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

4.3

Multiplication of Words by a Fixed Matrix . . . . . . . . . . . . . . . . . .

4.4

Multiplicative Inverses in GF(28 ) . . . . . . . . . . . . . . . . . . . . . . . .

5 Algorithm Specifcations 5.1

5.2

C IPHER() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1.1 S UB B YTES() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1.2 S HIFT ROWS() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1.3 M IX C OLUMNS() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1.4 A DD ROUND K EY() . . . . . . . . . . . . . . . . . . . . . . . . . . . . K EY E XPANSION() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . v

12 13 14 15 16 17

FIPS 197

5.3

A DVANCED E NCRYPTION S TANDARD (AES)

I NV C IPHER() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.1 I NV S HIFT ROWS() . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.2 I NV S UB B YTES() . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.3 I NV M IX C OLUMNS() . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.4 Inverse of A DD ROUND K EY() . . . . . . . . . . . . . . . . . . . . . . 5.3.5 E Q I NV C IPHER() . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6 Implementation Considerations

18 22 23 24 24 24 26

6.1

Key Length Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6.2

Keying Restrictions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6.3

Parameter Extensions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

6.4

Implementation Suggestions Regarding Various Platforms . . . . . . . . .

6.5

Modes of Operation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

References

Appendix A — Key Expansion Examples

A.1 Expansion of a 128-bit Key . . . . . . . . . . . . . . . . . . . . . . . . . . .

A.2 Expansion of a 192-bit Key . . . . . . . . . . . . . . . . . . . . . . . . . . .

A.3 Expansion of a 256-bit Key . . . . . . . . . . . . . . . . . . . . . . . . . . .

Appendix B — Cipher Example

Appendix C — Example Vectors

Appendix D — Change Log (Informative)

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

List of Tables Table 1 Table 2 Table 3 Table 4 Table 5 Table 6

Hexadecimal representation of 4-bit sequences . . . . . . . . . . . . . . Indices for bytes and bits . . . . . . . . . . . . . . . . . . . . . . . . . . Key-Block-Round Combinations . . . . . . . . . . . . . . . . . . . . . . . SB OX(): substitution values for the byte xy (in hexadecimal format) . . . Round constants . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I NV SB OX(): substitution values for the byte xy (in hexadecimal format)

5 6 11 14 17 23

List of Figures Figure 1 State array input and output . . . . . . . . . . . . . . . . . . . . . . . . Figure 2 Illustration of S UB B YTES() . . . . . . . . . . . . . . . . . . . . . . . . Figure 3 Illustration of S HIFT ROWS() . . . . . . . . . . . . . . . . . . . . . . . Figure 4 Illustration of M IX C OLUMNS() . . . . . . . . . . . . . . . . . . . . . . Figure 5 Illustration of A DD ROUND K EY() . . . . . . . . . . . . . . . . . . . . . Figure 6 K EY E XPANSION() of AES-128 to generate the words w[i] for 4 ≤ i < 44, where l ranges over the multiples of 4 between 0 and 36 . . . . . . . . . . . . . Figure 7 K EY E XPANSION() of AES-192 to generate the words w[i] for 6 ≤ i < 52, where l ranges over the multiples of 6 between 0 and 42 . . . . . . . . . . . . . Figure 8 K EY E XPANSION() of AES-256 to generate the words w[i] for 8 ≤ i < 60, where l ranges over the multiples of 8 between 0 and 48 . . . . . . . . . . . . . . Figure 9 Illustration of I NV S HIFT ROWS() . . . . . . . . . . . . . . . . . . . . .

7 13 15 16 16 19 20 21 23

List of Algorithms Algorithm 1 Algorithm 2 Algorithm 3 Algorithm 4 Algorithm 5

Pseudocode for C IPHER() . . . . . . . . . . . . . . . . . . . . . . . Pseudocode for K EY E XPANSION() . . . . . . . . . . . . . . . . . . Pseudocode for I NV C IPHER() . . . . . . . . . . . . . . . . . . . . . Pseudocode for E Q I NV C IPHER() . . . . . . . . . . . . . . . . . . . Pseudocode for K EY E XPANSION EIC() . . . . . . . . . . . . . . .

vii

12 18 22 25 25

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Introduction

A block is a sequence of bits of a given fxed length. A block cipher is a family of permutations of blocks that is parameterized by a sequence of bits called the key. In 1997, NIST initiated the Advanced Encryption Standard (AES) development effort [1] and called for the public to submit candidate algorithms for block ciphers. Block ciphers are the foundation for many cryptographic services, especially those that provide assurance of the confdentiality of data. In 2000, NIST announced the selection of Rijndael [2, 3] for the AES. This Standard specifes three instantiations of Rijndael: AES-128, AES-192, and AES-256, where the suffx indicates the bit length of the key. The block size (i.e., the length of the data inputs and outputs) is 128 bits in each case. Rijndael supports additional block sizes and key lengths that are not adopted in this Standard. This Standard is organized as follows: • Section 2 defnes the terms, acronyms, algorithm parameters, symbols, and functions in this Standard. • Section 3 describes the notation and conventions for the ordering and indexing of bits, bytes, and words. • Section 4 explains some mathematical components of the AES specifcations: fnite feld arithmetic and multiplication by a fxed matrix of fnite feld elements. • Section 5 specifes AES-128, AES-192, and AES-256. • Section 6 provides implementation guidelines on key length requirements, keying restrictions, parameter extensions, and implementation suggestions regarding various platforms. • Appendix A gives examples of the key expansion routines for AES-128, AES-192, and AES-256. • Appendix B gives a step-by-step example of an invocation of AES-128. • Appendix C gives a reference to the NIST website for extensive example vectors for AES-128, AES-192, and AES-256. • Appendix D summarizes the updates to the original version of this publication.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Defnitions

2.1

Terms and Acronyms

The following defnitions are used in this Standard: AES

Advanced Encryption Standard.

Affne transformation

A transformation consisting of multiplication by a matrix, followed by the addition of a vector.

Array

A fxed-size data structure that stores a collection of elements, where each element is identifed by its integer index or indices.

Bit

A binary digit: 0 or 1.

Block

A sequence of bits of a given fxed length. In this Standard, blocks consist of 128 bits, sometimes represented as arrays of bytes or words.

Block cipher

A family of permutations of blocks that is parameterized by the key.

Byte

A sequence of eight bits.

Equivalent inverse cipher

An alternative specifcation of the inverse of C IPHER() with a structure similar to that of C IPHER() and with a modifed key schedule as input.

Key

The parameter of a block cipher that determines the selection of a permutation from the block cipher family.

Key schedule

The sequence of round keys that are generated from the key by K EY E XPANSION().

Rijndael

The block cipher that NIST selected as the winner of the AES competition.

Round

A sequence of transformations of the state that is iterated Nr times in the specifcations of C IPHER(), I NV C IPHER(), and E Q I NV C IPHER(). The sequence consists of four transformations, except for one iteration, in which one of the transformations is omitted.

Round key

One of the Nr + 1 arrays of four words that are derived from the block cipher key using the key expansion routine; each round key is an input to an instance of A DD ROUND K EY() in the AES block cipher.

State

Intermediate result of the AES block cipher that is represented as a two-dimensional array of bytes with four rows and Nb columns.

S-box

A non-linear substitution table used in S UB B YTES() and K EY E X PANSION () to perform a one-to-one substitution of a byte value.

Word

A group of 32 bits that is treated either as a single entity or as an array of 4 bytes. 2

FIPS 197

2.2

A DVANCED E NCRYPTION S TANDARD (AES)

List of Functions

The following functions are specifed in this Standard: A DD ROUND K EY() AES-128()

The transformation of the state in which a round key is combined with the state. The block cipher specifed in this Standard with 128-bit keys.

AES-192()

The block cipher specifed in this Standard with 192-bit keys.

AES-256()

The block cipher specifed in this Standard with 256-bit keys.

C IPHER()

The transformation of blocks that underlies AES-128, AES-192, and AES-256; the key schedule and the number of rounds are parameters of the transformation.

E Q I NV C IPHER()

The inverse of C IPHER() in which dw replaces w as the key schedule parameter.

I NV C IPHER()

The inverse of C IPHER().

I NV M IX C OLUMNS()

The inverse of M IX C OLUMNS().

I NV SB OX()

The inverse of SB OX().

I NV S HIFT ROWS()

The inverse of S HIFT ROWS().

I NV S UB B YTES()

The inverse of S UB B YTES().

K EY E XPANSION()

The routine that generates the round keys from the key.

K EY E XPANSION EIC()

The routine that generates the modifed round keys for the equivalent inverse cipher.

M IX C OLUMNS()

The transformation of the state that takes all of the columns of the state and mixes their data (independently of one another) to produce new columns. The transformation of words in which the four bytes of the word are permuted cyclically.

ROT W ORD() SB OX()

The transformation of bytes defned by the S-box.

S HIFT ROWS()

The transformation of the state in which the last three rows are cyclically shifted by different offsets.

S UB B YTES()

The transformation of the state that applies the S-box independently to each byte of the state.

S UB W ORD()

The transformation of words in which the S-box is applied to each of the four bytes of the word.

X T IMES()

The transformation of bytes in which the polynomial representation of the input byte is multiplied by x, modulo m(x), to produce the polynomial representation of the output byte.

FIPS 197

2.3

A DVANCED E NCRYPTION S TANDARD (AES)

Algorithm Parameters and Symbols

b−1

The multiplicative inverse of the element b in GF(28 ).

b̃ dw

The input to the affne transformation in the AES S-box. Word array for the key schedule that is input to the equivalent inverse cipher.

GF(2)

Finite feld with two elements.

GF(28 )

Finite feld with 256 elements.

The data input to C IPHER() or I NV C IPHER(), represented as an array of 16 bytes indexed from 0 to 15.

m(x)

The modulus specifed in this standard for the polynomial representation of bytes as elements of GF(28 ).

key

The array of Nk words that comprise the key for AES-128, AES192, or AES-256.

The number of columns comprising the state, where each column is a 32-bit word. For this Standard, Nb = 4.

The number of 32-bit words comprising the key. Nk is assigned to 4, 6, and 8 for AES-128, AES-192, and AES-256, respectively. (see Section 6.3).

The number of rounds. Nr is assigned to 10, 12, and 14 for AES128, AES-192, and AES-256, respectively.

out

The data output of C IPHER() or I NV C IPHER(), represented as an array of 16 bytes indexed from 0 to 15.

Rcon state

Word array for the round constant.

u[i]

The state, represented as a two-dimensional array of 16 bytes, with rows and columns indexed from 0 to 3. For a one-dimensional array u of words or bytes, the element in the array that is indexed by a non-negative integer i.

u[i..i + 3]

For an array u of words, the sequence u[i], u[i + 1], u[i + 2], u[i + 3].

Word array for the key schedule.

⊕

Either the exclusive-OR operation on bits, the bitwise exclusive-OR operation on bytes, or the bitwise exclusive-OR operation on words.

•

� Multiplication in GF 28 .

∗

Integer multiplication.

←

Assignment of a variable in pseudocode.

{}

Delimiters for a byte in hexadecimal or binary notation. 4

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Notation and Conventions

3.1

Inputs and Outputs

A bit is a binary digit — 0 or 1. A block is a sequence of 128 bits; the data input and output for the AES block ciphers are blocks. Another input to the AES block ciphers, called the key, is a bit sequence that is typically established beforehand and maintained across many invocations of the block cipher. The lengths of the keys for AES-128, AES-192, and AES-256 are 128 bits, 192 bits, and 256 bits, respectively.

3.2

Bytes

The basic processing unit in the AES algorithms is the byte — a sequence of eight bits. � A byte value is denoted by the concatenation of the eight bits between braces e.g., {10100011} . When the bits of a byte are denoted by an�indexed variable, the convention in this Standard is for the indices to decrease from left to right i.e., {b7 b6 b5 b4 b3 b2 b1 b0 } . It is also convenient to denote byte values using hexadecimal notation. The 16 hexadecimal characters represent sequences of four bits, as listed in Table 1. A byte is represented by an ordered pair of hexadecimal characters, where the left character in the pair represents the four left-most bits(i.e., b7 , b6 , b5 , b4 ), and the right character in the pair represents the four right-most bits (i.e., b3 , b2 , b1 , b0 ). For example, the hexadecimal form of the byte {10100011} is {a3}. Table 1. Hexadecimal representation of 4-bit sequences Sequence Character Sequence Character

3.3

0000 0 1000 8

0001 1 1001 9

0010 2 1010 a

0011 3 1011 b

0100 4 1100 c

0101 5 1101 d

0110 6 1110 e

0111 7 1111 f

Indexing of Byte Sequences

In order to unambiguously represent the data and key inputs as sequences of bytes, the following indexing convention is adopted in this Standard. Given a sequence of 8k bits, r0 r1 r2 . . . r(8k−3) r(8k−2) r(8k−1)

(3.1)

(for some positive integer k), the bytes a j for 0 ≤ j ≤ k − 1 are defned as follows: a j = {r8 j r(8 j+1) . . . r(8 j+7) }.

(3.2)

Thus, for example, the data block r0 r1 r2 . . . r125 r126 r127

(3.3)

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

is represented by the byte sequence a0 a1 a2 . . . a13 a14 a15 ,

(3.4)

a0 ={r0 r1 . . . r7 }; a1 ={r8 r9 . . . r15 }; .. . a15 ={r120 r121 . . . r127 }.

(3.5)

where

As described in Section 3.2, the bits within any individual byte are indexed in decreasing order from left to right. This ordering is more natural for the fnite feld arithmetic on bytes that is described in Section 4. The two types of bit indices for byte sequences are illustrated in Table 2. Table 2. Indices for bytes and bits Bit index in sequence

Byte index Bit index in byte

3.4

0 7

1 3

... ...

...

The State

Internally, the algorithms for the AES block ciphers are performed on a two-dimensional (fourby-four) array of bytes called the state. In the state array, denoted by s, each individual byte has two indices: a row index r in the range 0 ≤ r < 4 and a column index c in the range 0 ≤ c < 4. An individual byte of the state is denoted by either sr,c or s[r, c]. In the specifcations for the AES block cipher algorithms in Section 5, the frst step is to copy the input array of bytes in0 , in1 , . . . , in15 to the state array s as follows: s[r, c] = in[r + 4c]

for 0 ≤ r < 4 and 0 ≤ c < 4.

(3.6)

A sequence of transformations is then applied to the state array, after which its fnal value is copied to the output array of bytes out0 , out1 , . . . , out15 as follows: out[r + 4c] = s[r, c]

for 0 ≤ r < 4 and 0 ≤ c < 4.

(3.7)

The correspondence between the indices of the input and output with the indices of the state array is illustrated in Fig. 1.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

input bytes in0 in1 in2 in3

in4 in5 in6 in7

in8 in9 in10 in11

state array in12 in13 in14 in15

→

s0,0 s1,0 s2,0 s3,0

s0,1 s1,1 s2,1 s3,1

s0,2 s1,2 s2,2 s3,2

output bytes s0,3 s1,3 s2,3 s3,3

→

out0 out1 out2 out3

out4 out5 out6 out7

out8 out9 out10 out11

out12 out13 out14 out15

Figure 1. State array input and output

3.5

Arrays of Words

A word is a sequence of four bytes; a block consists of four words. The four columns of state array s are interpreted as an array v of four words as follows, in the notation of Fig. 1: ⎛

⎞ ⎛ ⎞ ⎛ ⎞ ⎛ ⎞ s0,0 s0,1 s0,2 s0,3 ⎜s1,0 ⎟ ⎜s1,1 ⎟ ⎜s1,2 ⎟ ⎜s1,3 ⎟ ⎟ ⎜ ⎟ ⎜ ⎟ ⎜ ⎟ v0 = ⎜ ⎝s2,0 ⎠ , v1 = ⎝s2,1 ⎠ , v2 = ⎝s2,2 ⎠ , v3 = ⎝s2,3 ⎠ . s3,0 s3,1 s3,2 s3,3

(3.8)

Thus, the column index c of s becomes the index for v, and the row index r of s becomes the index for the four bytes in each word. Given a one-dimensional array u of words, u[i] denotes the word that is indexed by i, and the sequence of four words u[i], u[i + 1], u[i + 2], u[i + 3] is denoted by u[i..i + 3].

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Mathematical Preliminaries

For some transformations of the AES algorithms specifed in Sec. 5, each byte in the state array is interpreted as one of the 256 elements of a fnite feld, also known as a Galois Field, denoted by GF(28 ). 1 In order to defne addition and multiplication in GF(28 ), each byte {b7 b6 b5 b4 b3 b2 b1 b0 } is interpreted as a polynomial, denoted by b(x), as follows: b(x) = b7 x7 + b6 x6 + b5 x5 + b4 x4 + b3 x3 + b2 x2 + b1 x + b0 .

(4.1)

For example, {01100011} is represented by the polynomial x6 + x5 + x + 1.

4.1

Addition in GF(28 )

In order to add two elements in the fnite feld GF(28 ), the coeffcients of the polynomials that represent the elements are added modulo 2 (i.e., with the exclusive-OR operation, denoted by ⊕), so that 1 ⊕ 1 = 0, 1 ⊕ 0 = 1, and 0 ⊕ 0 = 0. Equivalently, two bytes can be added by applying the exclusive-OR operation to each pair of corresponding bits in the bytes. Thus, the sum of {a7 a6 a5 a4 a3 a2 a1 a0 } and {b7 b6 b5 b4 b3 b2 b1 b0 } is {a7 ⊕ b7 a6 ⊕ b6 a5 ⊕ b5 a4 ⊕ b4 a3 ⊕ b3 a2 ⊕ b2 a1 ⊕ b1 a0 ⊕ b0 }. (In Section 5.1.4, this defnition is extended to words.) For example, the following three representations of addition are equivalent:

(x6 + x4 + x2 + x + 1) + (x7 + x + 1) = x7 + x6 + x4 + x2 {01010111} ⊕ {10000011} = {11010100} {57} ⊕ {83} = {d4}

(polynomial) (binary) (hexadecimal).

(4.2)

Because the coeffcients of the polynomials are reduced modulo 2, the coeffcient 1 is equivalent to the coeffcient –1, so addition is equivalent to subtraction. For example, x4 + x2 represents the same fnite feld element as x4 − x2 , −x4 + x2 , and −x4 − x2 . Similarly, the sum of any element with itself is the zero element.

4.2

Multiplication in GF(28 )

� The symbol • denotes multiplication in GF 28 . Conceptually, this multiplication is defned on two bytes in two steps: 1) the two polynomials that represent the bytes are multiplied as polynomials, and 2) the resulting polynomial is reduced modulo the following fxed polynomial: m(x) = x8 + x4 + x3 + x + 1.

(4.3)

Within both steps, the individual coeffcients of the polynomials are reduced modulo 2. 1 Information about the properties of fnite felds can be found in textbooks, such as Michael Artin’s Algebra [4].

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Thus, if b(x) and c(x) represent bytes b and c, then b • c is represented by the following modular reduction of their product as polynomials: b(x)c(x)

mod m(x).

(4.4)

The modular reduction by m(x) may be applied to intermediate steps in the calculation of b(x)c(x); consequently, it is useful to consider the special case that c(x) = x (i.e., c = {02}). In particular, the product b • {02} can be expressed as a function of b, denoted by X T IMES(b), as follows:

( {b6 b5 b4 b3 b2 b1 b0 0} X T IMES (b) = {b6 b5 b4 b3 b2 b1 b0 0} ⊕ {0 0 0 1 1 0 1 1}

if b7 = 0 if b7 = 1.

(4.5)

Multiplication by higher powers of x (such as {04}, {08}, and {10}) can be implemented by the repeated application of X T IMES(). For example, let b = {57}:

{57} • {01} = {57} {57} • {02} = X T IMES({57}) = {ae} {57} • {04} = X T IMES({ae}) = {47} {57} • {08} = X T IMES({47}) = {8e} {57} • {10} = X T IMES({8e}) = {07} {57} • {20} = X T IMES({07}) = {0e} {57} • {40} = X T IMES({0e}) = {1c} {57} • {80} = X T IMES({1c}) = {38}.

(4.6)

These products facilitate the computation of any multiple of {57}. For example, because {13} = {10} ⊕ {02} ⊕ {01}, it follows that {57} • {13} = {57} • ({01} ⊕ {02} ⊕ {10}) = {57} ⊕ {ae} ⊕ {07} = {fe}.

4.3

(4.7)

Multiplication of Words by a Fixed Matrix

Two transformations – M IX C OLUMNS() and I NV M IX C OLUMNS() – in the algorithms for the AES block ciphers can be expressed in terms of matrix multiplication. In particular, a distinct fxed matrix is specifed for each transformation. For both matrices, each of the 16 entries of the matrix is a byte of a single specifed word, denoted here by [a0 , a1 , a2 , a3 ]. Given an input word [b0 , b1 , b2 , b3 ] to the transformation, the output word [d0 , d1 , d2 , d3 ] is determined by fnite feld arithmetic as follows: 9

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

d0 = (a0 • b0 ) ⊕ (a3 • b1 ) ⊕ (a2 • b2 ) ⊕ (a1 • b3 ) d1 = (a1 • b0 ) ⊕ (a0 • b1 ) ⊕ (a3 • b2 ) ⊕ (a2 • b3 ) d2 = (a2 • b0 ) ⊕ (a1 • b1 ) ⊕ (a0 • b2 ) ⊕ (a3 • b3 ) d3 = (a3 • b0 ) ⊕ (a2 • b1 ) ⊕ (a1 • b2 ) ⊕ (a0 • b3 ).

(4.8)

The matrix form of Eq. (4.8) is

⎡ ⎤ ⎡ a0 d0 ⎢d1 ⎥ ⎢a1 ⎢ ⎥=⎢ ⎣d2 ⎦ ⎣a2 d3 a3

4.4

a3 a0 a1 a2

a2 a3 a0 a1

⎤⎡ ⎤ a1 b0 ⎢ ⎥ a2 ⎥ ⎥ ⎢b1 ⎥ . ⎦ a3 ⎣b2 ⎦ a0 b3

(4.9)

Multiplicative Inverses in GF(28 )

For a byte b 6= {00}, its multiplicative inverse is the unique byte, denoted by b−1 , such that b • b−1 = {01}.

(4.10)

The defnition of the S UB B YTES() transformation in the specifcations of the AES block cipher involves multiplicative inverses in GF(28 ), which can be calculated as follows: b−1 = b254 .

(4.11)

Alternatively, let b(x) be the polynomial that represents b. The extended Euclidean algorithm [5] can be applied to b(x) and m(x) to fnd polynomials a(x) and c(x) such that b(x)a(x) + m(x)c(x) = 1. It follows that a(x) is the polynomial that represents b−1 .

(4.12)

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Algorithm Specifcations

The general function for executing AES-128, AES-192, or AES-256 is denoted by C IPHER(); its inverse is denoted by I NV C IPHER().2 The core of the algorithms for C IPHER() and I NV C IPHER() is a sequence of fxed transformations of the state called a round. Each round requires an additional input called the round key; the round key is a block that is usually represented as a sequence of four words (i.e., 16 bytes). An expansion routine, denoted by K EY E XPANSION(), takes the block cipher key as input and generates the round keys as output. In particular, the input to K EY E XPANSION() is represented as an array of words, denoted by key, and the output is an expanded array of words, denoted by w, called the key schedule. The block ciphers AES-128, AES-192, and AES-256 differ in three respects: 1) the length of the key; 2) the number of rounds, which determines the size of the required key schedule; and 3) the specifcation of the recursion within K EY E XPANSION(). For each algorithm, the number of rounds is denoted by Nr, and the number of words of the key is denoted by Nk. (The number of words in the state is denoted by Nb for Rijndael in general; in this Standard, Nb = 4.) The specifc values of Nk, Nb, and Nr are given in Table 3. No other confgurations of Rijndael conform to this Standard. For implementation issues relating to the key length, block size, and number of rounds, see Section 6.3. Table 3. Key-Block-Round Combinations Key length

Block size

Number of rounds

(in bits)

AES-128

128

AES-192

192

128

AES-256

256

128

The three inputs to C IPHER() are: 1) the data input in, which is a block represented as a linear array of 16 bytes; 2) the number of rounds Nr for the instance; and 3) the round keys. Thus, AES-128(in, key) = C IPHER(in, 10, K EY E XPANSION(key)) AES-192(in, key) = C IPHER(in, 12, K EY E XPANSION(key)) AES-256(in, key) = C IPHER(in, 14, K EY E XPANSION(key)).

(5.1)

The inverse permutations are defned by replacing C IPHER() with I NV C IPHER() in Eq. 5.1.

2 Informally, these functions are sometimes called “encryption” and “decryption,” but neutral terminology is appro-

priate because there are other applications of block ciphers besides encryption.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

The specifcations of C IPHER(), K EY E XPANSION(), and I NV C IPHER() are given in Sections 5.1, 5.2, and 5.3, respectively.

5.1

C IPHER()

The rounds in the specifcation of C IPHER() are composed of the following four byte-oriented transformations on the state: • S UB B YTES() applies a substitution table (S-box) to each byte. • S HIFT ROWS() shifts rows of the state array by different offsets. • M IX C OLUMNS() mixes the data within each column of the state array. • A DD ROUND K EY() combines a round key with the state. The four transformations are specifed in Sections 5.1.1–5.1.4. In those specifcations, the transformed bit, �byte, or block is denoted by appending the symbol 0 as a superscript on the 0 0 0 0 original variable i.e., by bi , b , si, j , or s . The round keys for A DD ROUND K EY() are generated by K EY E XPANSION(), which is specifed in Section 5.2. In particular, the key schedule is represented as an array w of 4 ∗ (Nr + 1) words. C IPHER() is specifed in the pseudocode in Alg. 1. Algorithm 1 Pseudocode for C IPHER() 1: procedure C IPHER(in, Nr, w) 2: state ← in . See Sec. 3.4 3: state ← A DD ROUND K EY(state, w[0..3]) . See Sec. 5.1.4 4: for round from 1 to Nr − 1 do 5: state ← S UB B YTES(state) . See Sec. 5.1.1 6: state ← S HIFT ROWS(state) . See Sec. 5.1.2 7: state ← M IX C OLUMNS(state) . See Sec. 5.1.3 8: state ← A DD ROUND K EY(state, w[4 ∗ round..4 ∗ round + 3]) 9: end for 10: state ← S UB B YTES(state) 11: state ← S HIFT ROWS(state) 12: state ← A DD ROUND K EY(state, w[4 ∗ Nr..4 ∗ Nr + 3]) 13: return state . See Sec. 3.4 14: end procedure The frst step (Line 2) is to copy the input into the state array using the conventions from Sec. 3.4. After an initial round key addition (Line 3), the state array is transformed by Nr applications of the round function (Lines 4–12); the fnal round (Lines 10–12) differs in that the M IX C OLUMNS() transformation is omitted. The fnal state is then returned as the output (Line 13), as described in Section 3.4.

FIPS 197

5.1.1

A DVANCED E NCRYPTION S TANDARD (AES)

S UB B YTES()

S UB B YTES() is an invertible, non-linear transformation of the state in which a substitution table, called an S-box, is applied independently to each byte in the state. The AES S-box is denoted by SB OX(). Let b denote an input byte to SB OX(), and let c denote the constant byte {01100011}. The 0 output byte b = SB OX(b) is constructed by composing the following two transformations: 1. Defne an intermediate value b̃, as follows, where b−1 is the multiplicative inverse of b, as described in Section 4.4: ( {00} if b = {00} b̃ = (5.2) −1 if b = 6 {00}. b 0

2. Apply the following affne transformation of the bits of b̃ to produce the bits of b : b0i = b˜ i ⊕ b̃(i+4) mod 8 ⊕ b̃(i+5) mod 8 ⊕ b̃(i+6) mod 8 ⊕ b̃(i+7) mod 8 ⊕ ci .

(5.3)

The matrix form of Eq. (5.3) is given by Eq. (5.4) below:

⎡ 0⎤ ⎡ b0 1 0 ⎢b1 ⎥ ⎢1 ⎢ 0⎥ ⎢ ⎢b2 ⎥ ⎢1 ⎢ 0⎥ ⎢ ⎢b3 ⎥ ⎢1 ⎢ 0⎥=⎢ ⎢b4 ⎥ ⎢1 ⎢b0 ⎥ ⎢0 ⎢ 5⎥ ⎢ ⎣b0 ⎦ ⎣0 6 b07 0

0 1 1 1 1 1 0 0

0 0 1 1 1 1 1 0

0 0 0 1 1 1 1 1

1 0 0 0 1 1 1 1

1 1 0 0 0 1 1 1

1 1 1 0 0 0 1 1

⎤⎡ ⎤ ⎡ ⎤ 1 b̃0 1 ⎢ ⎥ 1⎥ ⎢b̃1 ⎥ ⎢1⎥ ⎥ ⎢ ⎥ b̃2 ⎥ 0⎥ 1⎥ ⎢ ⎥ ⎢ ⎥⎢ ⎢ ⎥ ⎢ ⎥ 1⎥ ⎢b̃3 ⎥ ⎢0⎥ +⎢ ⎥. ⎥ 0⎥ ⎢ b̃4 ⎥ ⎢0⎥ ⎢ ⎥ ⎢1⎥ ⎥ 0⎥ b̃ ⎥⎢ ⎥ ⎢ 5⎥ ⎢ ⎦ ⎣ ⎣ ⎦ 1⎦ 0 b̃6 1 b˜ 7 0

(5.4)

Figure 2 illustrates how S UB B YTES() transforms the state.

Figure 2. Illustration of S UB B YTES() The AES S-box is presented in hexadecimal form in Table 4. For example, if sr,c = {53}, then 13

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Table 4. SB OX(): substitution values for the byte xy (in hexadecimal format) y

0 1 2 3 4 5 6 7 8 9 a b c d e f

0 63 ca b7 04 09 53 d0 51 cd 60 e0 e7 ba 70 e1 8c

1 7c 82 fd c7 83 d1 ef a3 0c 81 32 c8 78 3e f8 a1

2 77 c9 93 23 2c 00 aa 40 13 4f 3a 37 25 b5 98 89

3 7b 7d 26 c3 1a ed fb 8f ec dc 0a 6d 2e 66 11 0d

4 f2 fa 36 18 1b 20 43 92 5f 22 49 8d 1c 48 69 bf

5 6b 59 3f 96 6e fc 4d 9d 97 2a 06 d5 a6 03 d9 e6

6 6f 47 f7 05 5a b1 33 38 44 90 24 4e b4 f6 8e 42

7 c5 f0 cc 9a a0 5b 85 f5 17 88 5c a9 c6 0e 94 68

8 30 ad 34 07 52 6a 45 bc c4 46 c2 6c e8 61 9b 41

9 01 d4 a5 12 3b cb f9 b6 a7 ee d3 56 dd 35 1e 99

a 67 a2 e5 80 d6 be 02 da 7e b8 ac f4 74 57 87 2d

b 2b af f1 e2 b3 39 7f 21 3d 14 62 ea 1f b9 e9 0f

c fe 9c 71 eb 29 4a 50 10 64 de 91 65 4b 86 ce b0

d d7 a4 d8 27 e3 4c 3c ff 5d 5e 95 7a bd c1 55 54

e ab 72 31 b2 2f 58 9f f3 19 0b e4 ae 8b 1d 28 bb

f 76 c0 15 75 84 cf a8 d2 73 db 79 08 8a 9e df 16

the substitution value would be determined by the intersection of the row with index ‘5’ and the column with index ‘3’ in Table 4, so that s0r,c = {ed}. 5.1.2

S HIFT R OWS()

S HIFT ROWS() is a transformation of the state in which the bytes in the last three rows of the state are cyclically shifted. The number of positions by which the bytes are shifted depends on the row index r, as follows: s0r,c = sr,(c+r) mod 4

for 0 ≤ r < 4 and 0 ≤ c < 4.

(5.5)

S HIFT ROWS() is illustrated in Figure 3. In that representation of the state, the effect is to move each byte by r positions to the left in the row, cycling the left-most r bytes around to the right end of the row. The frst row, where r = 0, is unchanged.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Figure 3. Illustration of S HIFT ROWS() 5.1.3

M IX C OLUMNS()

M IX C OLUMNS() is a transformation of the state that multiplies each of the four columns of the state by a single fxed matrix, as described in Section 4.3, with its entries taken from the following word: [a0 , a1 , a2 , a3 ] = [{02}, {01}, {01}, {03}]. (5.6) Thus, ⎡0 ⎤ ⎡ s0,c 02 ⎢s0 ⎥ ⎢ ⎢ 1,c ⎥ ⎢01 ⎢ 0 ⎥=⎣ 01 ⎣s2,c ⎦ 0 03 s3,c

03 02 01 01

01 03 02 01

⎤⎡ ⎤ 01 s0,c ⎢ ⎥ 01⎥ ⎥ ⎢s1,c ⎥ 03⎦ ⎣s2,c ⎦ 02 s3,c

for 0 ≤ c < 4,

(5.7)

so that the individual output bytes are defned as follows: s00,c = ({02} • s0,c ) ⊕ ({03} • s1,c ) ⊕ s2,c ⊕ s3,c s01,c = s0,c ⊕ ({02} • s1,c ) ⊕ ({03} • s2,c ) ⊕ s3,c 0 s2,c = s0,c ⊕ s1,c ⊕ ({02} • s2,c ) ⊕ ({03} • s3,c )

s03,c = ({03} • s0,c ) ⊕ s1,c ⊕ s2,c ⊕ ({02} • s3,c ). Figure 4 illustrates M IX C OLUMNS().

(5.8)

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Figure 4. Illustration of M IX C OLUMNS() 5.1.4

A DD R OUND K EY()

A DD ROUND K EY() is a transformation of the state in which a round key is combined with the state by applying the bitwise XOR operation. In particular, each round key consists of four words from the key schedule (described in Section 5.2), each of which is combined with a column of the state as follows: 0 [s00,c , s01,c , s2,c , s03,c ] = [s0,c , s1,c , s2,c , s3,c ] ⊕ [w(4∗round+c) ] for 0 ≤ c < 4

(5.9)

where round is a value in the range 0 ≤ round ≤ Nr, and w[i] is the array of key schedule words described in Section 5.2. In the specifcation of C IPHER(), A DD ROUND K EY() is invoked Nr + 1 times — once prior to the frst application of the round function (see Alg. 1) and once within each of the Nr rounds, when 1 ≤ round ≤ Nr. The action of this transformation is illustrated in Fig. 5, where l = 4 ∗ round. The byte address within words of the key schedule was described in Sec. 3.5.

Figure 5. Illustration of A DD ROUND K EY()

FIPS 197

5.2

A DVANCED E NCRYPTION S TANDARD (AES)

K EY E XPANSION()

K EY E XPANSION() is a routine that is applied to the key to generate 4 ∗ (Nr + 1) words. Thus, four words are generated for each of the Nr + 1 applications of A DD ROUND K EY() within the specifcation of C IPHER(), as described in Section 5.1.4. The output of the routine consists of a linear array of words, denoted by w[i], where i is in the range 0 ≤ i < 4 ∗ (Nr + 1). K EY E XPANSION() invokes 10 fxed words denoted by Rcon[ j] for 1 ≤ j ≤ 10. These 10 words are called the round constants. For AES-128, a distinct round constant is called in the generation of each of the 10 round keys. For AES-192 and AES-256, the key expansion routine calls the frst eight and seven of these same constants, respectively. The values of Rcon[ j] are given in hexadecimal notation in Table 5: Table 5. Round constants j

Rcon[ j]

1 2 3 4 5

[01,00,00,00] [02,00,00,00] [04,00,00,00] [08,00,00,00] [10,00,00,00]

6 7 8 9 10

[20,00,00,00] [40,00,00,00] [80,00,00,00] [1b,00,00,00] [36,00,00,00]

The value of the left-most byte of Rcon[ j] in polynomial form is x j−1 . Note that for j > 0, these bytes may be generated by successively applying X T IMES() to the byte represented by x j−1 (see Eq. 4.5). Two transformations on words are called within K EY E XPANSION(): ROT W ORD() and S UB W ORD(). Given an input word represented as a sequence [a0 , a1 , a2 , a3 ] of four bytes,

ROT W ORD([a0 , a1 , a2 , a3 ]) = [a1 , a2 , a3 , a0 ],

(5.10)

and S UB W ORD([a0 , . . . , a3 ]) = [SB OX(a0 ), SB OX(a1 ), SB OX(a2 ), SB OX(a3 )].

(5.11)

The expansion of the key proceeds according to the pseudocode in Alg. 2. The frst Nk words of the expanded key are the key itself. Every subsequent word w[i] is generated recursively from the preceding word, w[i − 1], and the word Nk positions earlier, w[i − Nk], as follows: • If i is a multiple of Nk, then w[i] = w[i − Nk] ⊕ S UB W ORD(ROT W ORD(w[i − 1])) ⊕ Rcon[i/Nk]. • For AES-256, if i + 4 is a multiple of 8, then w[i] = w[i − Nk] ⊕ S UB W ORD(w[i − 1]). • For all other cases, w[i] = w[i − Nk] ⊕ w[i − 1].

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Algorithm 2 Pseudocode for K EY E XPANSION() 1: procedure K EY E XPANSION(key) 2: i←0 3: while i ≤ Nk − 1 do 4: w[i] ← key[4 ∗ i..4 ∗ i + 3] 5: i ← i+1 6: end while . When the loop concludes, i = Nk. 7: while i ≤ 4 ∗ Nr + 3 do 8: temp ← w[i − 1] 9: if i mod Nk = 0 then 10: temp ← S UB W ORD(ROT W ORD(temp)) ⊕ Rcon[i/Nk] 11: else if Nk > 6 and i mod Nk = 4 then 12: temp ← S UB W ORD(temp) 13: end if 14: w[i] ← w[i − Nk] ⊕ temp 15: i ← i+1 16: end while 17: return w 18: end procedure Figures 6, 7, and 8 illustrate K EY E XPANSION() for AES-128, AES-192, and AES-256.

5.3

I NV C IPHER()

To implement I NV C IPHER(), the transformations in the specifcation of C IPHER() (Section 5.1) are inverted and executed in reverse order. The inverted transformations of the state — denoted by I NV S HIFT ROWS(), I NV S UB B YTES(), I NV M IX C OLUMNS(), and A DD ROUND K EY() — are described in Sections 5.3.1–5.3.4. I NV C IPHER() is described in the pseudocode in Alg. 3, where the array w denotes the key schedule, as described in Section 5.2.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Figure 6. K EY E XPANSION() of AES-128 to generate the words w[i] for 4 ≤ i < 44, where l ranges over the multiples of 4 between 0 and 36

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Figure 7. K EY E XPANSION() of AES-192 to generate the words w[i] for 6 ≤ i < 52, where l ranges over the multiples of 6 between 0 and 42

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Figure 8. K EY E XPANSION() of AES-256 to generate the words w[i] for 8 ≤ i < 60, where l ranges over the multiples of 8 between 0 and 48

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Algorithm 3 Pseudocode for I NV C IPHER() 1: procedure I NV C IPHER(in, Nr, w) 2: state ← in . See Sec. 3.4 3: state ← A DD ROUND K EY(state, w[4 ∗ Nr..4 ∗ Nr + 3]) . See Sec. 5.1.4 4: for round from Nr − 1 downto 1 do 5: state ← I NV S HIFT ROWS(state) . See Sec. 5.3.1 6: state ← I NV S UB B YTES(state) . See Sec. 5.3.2 7: state ← A DD ROUND K EY(state, w[4 ∗ round..4 ∗ round + 3]) 8: state ← I NV M IX C OLUMNS(state) . See Sec. 5.3.3 9: end for 10: state ← I NV S HIFT ROWS(state) 11: state ← I NV S UB B YTES(state) 12: state ← A DD ROUND K EY(state, w[0..3]) 13: return state 14: end procedure 5.3.1

I NV S HIFT R OWS()

I NV S HIFT ROWS() is the inverse of the S HIFT ROWS(). In particular, the bytes in the last three rows of the state are cyclically shifted as follows: s0r,c = sr,(c−r) mod 4

for 0 ≤ r < 4 and 0 ≤ c < 4.

(5.12)

I NV S HIFT ROWS() is illustrated in Figure 9. In that representation of the state, the effect is to move each byte by r positions to the right in the row, cycling the right-most r bytes around to the left end of the row. The frst row, where r = 0, is unchanged.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Figure 9. Illustration of I NV S HIFT ROWS() 5.3.2

I NV S UB B YTES()

I NV S UB B YTES() is the inverse of S UB B YTES(), in which the inverse of SB OX(), denoted by I NV SB OX(), is applied to each byte of the state. I NV SB OX() is derived from Table 4 by switching the roles of inputs and outputs, as presented in Table 6: Table 6. I NV SB OX(): substitution values for the byte xy (in hexadecimal format) y

0 1 2 3 4 5 6 7 8 9 a b c d e f

52 7c 54 08 72 6c 90 d0 3a 96 47 fc 1f 60 a0 17

09 e3 7b 2e f8 70 d8 2c 91 ac f1 56 dd 51 e0 2b

6a 39 94 a1 f6 48 ab 1e 11 74 1a 3e a8 7f 3b 04

d5 82 32 66 64 50 00 8f 41 22 71 4b 33 a9 4d 7e

30 9b a6 28 86 fd 8c ca 4f e7 1d c6 88 19 ae ba

36 2f c2 d9 68 ed bc 3f 67 ad 29 d2 07 b5 2a 77

a5 ff 23 24 98 b9 d3 0f dc 35 c5 79 c7 4a f5 d6

38 87 3d b2 16 da 0a 02 ea 85 89 20 31 0d b0 26

bf 34 ee 76 d4 5e f7 c1 97 e2 6f 9a b1 2d c8 e1

40 8e 4c 5b a4 15 e4 af f2 f9 b7 db 12 e5 eb 69

a3 43 95 a2 5c 46 58 bd cf 37 62 c0 10 7a bb 14

9e 44 0b 49 cc 57 05 03 ce e8 0e fe 59 9f 3c 63

81 c4 42 6d 5d a7 b8 01 f0 1c aa 78 27 93 83 55

f3 de fa 8b 65 8d b3 13 b4 75 18 cd 80 c9 53 21

d7 e9 c3 d1 b6 9d 45 8a e6 df be 5a ec 9c 99 0c

fb cb 4e 25 92 84 06 6b 73 6e 1b f4 5f ef 61 7d

FIPS 197

5.3.3

A DVANCED E NCRYPTION S TANDARD (AES)

I NV M IX C OLUMNS()

I NV M IX C OLUMNS() is the inverse of M IX C OLUMNS(). In particular, I NV M IX C OLUMNS() multiplies each of the four columns of the state by a single fxed matrix, as described in Section 4.3, with its entries taken from the following word: [a0 , a1 , a2 , a3 ] = [{0e}, {09}, {0d}, {0b}]. Thus,

⎡0 ⎤ ⎡ s0,c 0e ⎢s01,c ⎥ ⎢09 ⎢ 0 ⎥=⎢ ⎣s2,c ⎦ ⎣0d 0b s03,c

0b 0e 09 0d

0d 0b 0e 09

⎤⎡ ⎤ 09 s0,c ⎢ ⎥ 0d⎥ ⎥ ⎢s1,c ⎥ 0b⎦ ⎣s2,c ⎦ 0e s3,c

for 0 ≤ c < 4.

(5.13)

(5.14)

As a result of this matrix multiplication, the four bytes in a column are replaced by the following: s00,c = ({0e} • s0,c ) ⊕ ({0b} • s1,c ) ⊕ ({0d} • s2,c ) ⊕ ({09} • s3,c ) s01,c = ({09} • s0,c ) ⊕ ({0e} • s1,c ) ⊕ ({0b} • s2,c ) ⊕ ({0d} • s3,c ) s02,c = ({0d} • s0,c ) ⊕ ({09} • s1,c ) ⊕ ({0e} • s2,c ) ⊕ ({0b} • s3,c )

(5.15)

s03,c = ({0b} • s0,c ) ⊕ ({0d} • s1,c ) ⊕ ({09} • s2,c ) ⊕ ({0e} • s3,c ). 5.3.4

Inverse of A DD R OUND K EY()

A DD ROUND K EY(), described in Section 5.1.4, is its own inverse. 5.3.5

E Q I NV C IPHER()

Several properties of the AES algorithm allow for an alternative specifcation of the inverse of C IPHER(), called the equivalent inverse cipher, denoted by E Q I NV C IPHER(). In the specifcation of E Q I NV C IPHER(), the transformations of the round function of the cipher in Alg. 1 are directly replaced by their inverses in E Q I NV C IPHER(), in the same order. The effciency of this structure in comparison to the specifcation of I NV C IPHER() in Alg. 3 is explained in the Rijndael proposal document [2]. The pseudocode for the equivalent inverse cipher, given in Alg. 4, uses a modifed key schedule, denoted by the word array dw. The routine to generate dw is an extension of K EY E XPANSION(), denoted by K EY E XPANSION EIC(), whose pseudocode is given in Alg. 5.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Algorithm 4 Pseudocode for E Q I NV C IPHER() 1: procedure E Q I NV C IPHER(in, Nr, dw) 2: state ← in 3: state ← A DD ROUND K EY(state, dw[4 ∗ Nr..4 ∗ Nr + 3]) 4: for round from Nr − 1 downto 1 do 5: state ← I NV S UB B YTES(state) 6: state ← I NV S HIFT ROWS(state) 7: state ← I NV M IX C OLUMNS(state) 8: state ← A DD ROUND K EY(state, dw[4 ∗ round..4 ∗ round + 3]) 9: end for 10: state ← I NV S UB B YTES(state) 11: state ← I NV S HIFT ROWS(state) 12: state ← A DD ROUND K EY(state, dw[0..3]) 13: return state 14: end procedure Algorithm 5 Pseudocode for K EY E XPANSION EIC() 1: procedure K EY E XPANSION EIC(key) 2: i←0 3: while i ≤ Nk − 1 do 4: w[i] ← key[4i..4i + 3] 5: dw[i] ← w[i] 6: i ← i+1 7: end while . When the loop concludes, i = Nk. 8: while i ≤ 4 ∗ Nr + 3 do 9: temp ← w[i − 1] 10: if i mod Nk = 0 then 11: temp ← S UB W ORD(ROT W ORD(temp)) ⊕ Rcon[i/Nk] 12: else if Nk > 6 and i mod Nk = 4 then 13: temp ← S UB W ORD(temp) 14: end if 15: w[i] ← w[i − Nk] ⊕ temp 16: dw[i] ← w[i] 17: i ← i+1 18: end while 19: for round from 1 to Nr − 1 do 20: i ← 4 ∗ round 21: dw[i..i + 3] ← I NV M IX C OLUMNS(dw[i..i + 3]) . Note change of type. 22: end for 23: return dw 24: end procedure The frst and last round keys in dw are the same as in w; the modifcation of the other round keys is described in Lines 19–22. The comment in Line 21 refers to the input to I NV M IX C OLUMNS(): the one-dimensional array of words is converted to a two-dimensional array of bytes, as in Fig. 1. 25

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Implementation Considerations

6.1

Key Length Requirements

An implementation of the AES algorithm shall support at least one of the three key lengths specifed in Sec. 5: 128, 192, or 256 bits (i.e., Nk = 4, 6, or 8, respectively). Implementations may optionally support two or three key lengths, which may promote the interoperability of algorithm implementations.

6.2

Keying Restrictions

When a cryptographic key has been generated appropriately (see NIST Special Publication 800133, Rev. 2 [6] for guidelines), no restriction is imposed when the resulting key is used for the AES algorithm.

6.3

Parameter Extensions

In Table 3, this Standard explicitly defnes the allowed values for the key length (Nk), block size (Nb), and number of rounds (Nr). However, future revisions of this Standard could include changes or additions to the allowed values for those parameters. Therefore, implementers may choose to design their AES implementations with future fexibility in mind.

6.4

Implementation Suggestions Regarding Various Platforms

Implementation variations are possible that may, in many cases, offer performance or other advantages. Given the same input key and data (plaintext or ciphertext), any implementation that produces the same output (ciphertext or plaintext) as the algorithm specifed in this Standard is an equivalent implementation of the AES algorithm. The AES proposal document [2] and other resources located on the AES page [7] include suggestions on how to effciently implement the AES algorithm on a variety of platforms. Suggested implementations are intended to explain the inner workings of the AES algorithm but do not provide protection against various implementation attacks. A physical implementation may leak key-dependent information through side channels, such as the time taken to perform a computation, or when faults are injected into the computation. When such attacks are non-invasive, they can be effective even when there are mechanisms to detect physical tampering of the device. For example, cache-timing attacks may affect AES implementations on software platforms that use a cache to accelerate the access to data from main memory. Protecting implementations of the AES algorithm against implementation attacks where applicable should be considered. Such considerations are outside of the scope of this document but are taken into account when testing for conformance to the algorithm in this Standard according to the validation program developed by NIST (see https://nist.gov/cmvp).

FIPS 197

6.5

A DVANCED E NCRYPTION S TANDARD (AES)

Modes of Operation

Block cipher modes of operation are cryptographic functions that feature a block cipher to provide information services, such as confdentiality and authentication. NIST-recommended modes of operation are specifed in the 800-38 series of NIST Special Publications. Further information is available at https://csrc.nist.gov/Projects/block-cipher-techniques/BCM.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

References [1] James Nechvatal, Elaine Barker, Lawrence Bassham, William Burr, Morris Dworkin, James Foti, and Edward Roback. Report on the Development of the Advanced Encryption Standard (AES). Journal of Research of NIST (NIST JRES), May 2001. https://doi.org/10.6028/jres. 106.023. [2] Joan Daemen and Vincent Rijmen. AES Proposal: Rijndael Document Version 2. AES Algorithm Submission, September 1999. Available at https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/ documents/aes-development/rijndael-ammended.pdf. [3] Joan Daemen and Vincent Rijmen. The Design of Rijndael - The Advanced Encryption Standard (AES), Second Edition. Information Security and Cryptography. Springer, 2020. https://doi.org/10.1007/978-3-662-60769-5. [4] Michael Artin. Algebra. Pearson Modern Classic. Pearson, second edition, 2017. [5] Alfred J. Menezes, Scott A. Vanstone, and Paul C. Van Oorschot. Handbook of Applied Cryptography. CRC Press, Inc., USA, 1st edition, 1997. https://doi.org/10.1201/9780429466335. [6] Elaine Barker, Allen Roginsky, and Richard Davis. Recommendation for Cryptographic Key Generation. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-133, Rev. 2, June 2020. https://doi.org/10.6028/NIST.SP. 800-133r2. [7] National Institute of Standards and Technology. AES Development, 2022. Available at https://csrc.nist.gov/projects/aes. [8] National Institute of Standards and Technology. Cryptographic Standards and Guidelines: Examples with Intermediate Values, 2022. Available at https://csrc.nist.gov/projects/ cryptographic-standards-and-guidelines/example-values. [9] National Institute of Standards and Technology. Crypto Publications Review Board, 2022. Available at https://csrc.nist.gov/projects/crypto-publication-review-project. [10] Nicky Mouha. Review of the Advanced Encryption Standard. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency Report (IR) 8319. https: //doi.org/10.6028/NIST.IR.8319.

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Appendix A — Key Expansion Examples This appendix shows the development of the key schedule for each key size. Note that multi-byte values are presented using the notation described in Sec. 3. The intermediate values produced during the development of the key schedule (see Sec. 5.2) are given in the following table (all values are in hexadecimal format with the exception of the index column (i)).

A.1

Expansion of a 128-bit Key

This section contains the key expansion of the following key: Key = 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c for Nk = 4, which results in w0 = 2b7e1516

w1 = 28aed2a6

w2 = abf71588

w3 = 09cf4f3c

w[i] = temp ⊕ w[i − Nk]

i (dec)

temp

09cf4f3c

a0fafe17

28aed2a6 88542cb1

88542cb1

abf71588 23a33939

23a33939

09cf4f3c 2a6c7605

2a6c7605

f2c295f2

88542cb1 7a96b943

7a96b943

23a33939 5935807a

5935807a

2a6c7605 7359f67f

7359f67f

3d80477d

7a96b943 4716fe3e

4716fe3e

5935807a 1e237e44

1e237e44

7359f67f 6d7a883b

6d7a883b

ef44a541

4716fe3e a8525b7f

a8525b7f

1e237e44 b671253b

b671253b

6d7a883b db0bad00

db0bad00

d4d1c6f8

a8525b7f 7c839d87

7c839d87

b671253b caf2b8bc

caf2b8bc

db0bad00 11f915bc

After After Rcon[i/Nk] After XOR with Rcon R O T W O R D () S U B W O R D ()

w[i − Nk]

cf4f3c09

2b7e1516 a0fafe17

6c76052a

59f67f73

7a883b6d

0bad00db

8a84eb01

50386be5

cb42d28f

dac4e23c

2b9563b9

01000000

02000000

04000000

08000000

10000000

8b84eb01

52386be5

cf42d28f

d2c4e23c

3b9563b9

a0fafe17 f2c295f2

f2c295f2 3d80477d

3d80477d ef44a541

ef44a541 d4d1c6f8

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

11f915bc

6d88a37a

7c839d87 110b3efd

110b3efd

caf2b8bc dbf98641

dbf98641

11f915bc ca0093fd

ca0093fd

4e54f70e

110b3efd 5f5fc9f3

5f5fc9f3

dbf98641 84a64fb2

84a64fb2

ca0093fd 4ea6dc4f

4ea6dc4f

ead27321

5f5fc9f3 b58dbad2

b58dbad2

84a64fb2 312bf560

312bf560

4ea6dc4f 7f8d292f

7f8d292f

ac7766f3

b58dbad2 19fadc21

19fadc21

312bf560 28d12941

28d12941

7f8d292f 575c006e

575c006e

d014f9a8

19fadc21 c9ee2589

c9ee2589

28d12941 e13f0cc8

e13f0cc8

575c006e b6630ca6

A.2

f915bc11

0093fdca

a6dc4f4e

8d292f7f

5c006e57

99596582

63dc5474

2486842f

5da515d2

4a639f5b

20000000

40000000

80000000

1b000000

36000000

b9596582

23dc5474

a486842f

46a515d2

7c639f5b

d4d1c6f8 6d88a37a

6d88a37a 4e54f70e

4e54f70e ead27321

ead27321 ac7766f3

ac7766f3 d014f9a8

Expansion of a 192-bit Key

This section contains the key expansion of the following key: Key =

8e 73 b0 f7 da 0e 64 52 c8 10 f3 2b 80 90 79 e5 62 f8 ea d2 52 2c 6b 7b

for Nk = 6, which results in w0 = 8e73b0f7 w3 = 809079e5

w1 = da0e6452 w4 = 62f8ead2

w2 = c810f32b w5 = 522c6b7b w[i] = temp ⊕ w[i − Nk]

i (dec)

temp

522c6b7b

fe0c91f7

da0e6452 2402f5a5

2402f5a5

c810f32b ec12068e

After After Rcon[i/Nk] After XOR R O T W O R D () S U B W O R D () with Rcon

w[i − Nk]

2c6b7b52

8e73b0f7 fe0c91f7

717f2100

01000000

707f2100

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

ec12068e

809079e5 6c827f6b

6c827f6b

62f8ead2 0e7a95b9

0e7a95b9

522c6b7b 5c56fec2

5c56fec2

4db7b4bd

2402f5a5 69b54118

69b54118

ec12068e 85a74796

85a74796

6c827f6b e92538fd

e92538fd

0e7a95b9 e75fad44

e75fad44

5c56fec2 bb095386

bb095386

485af057

69b54118 21efb14f

21efb14f

85a74796 a448f6d9

a448f6d9

e92538fd 4d6dce24

4d6dce24

e75fad44 aa326360

aa326360

bb095386 113b30e6

113b30e6

a25e7ed5

21efb14f 83b1cf9a

83b1cf9a

a448f6d9 27f93943

27f93943

4d6dce24 6a94f767

6a94f767

aa326360 c0a69407

c0a69407

113b30e6 d19da4e1

d19da4e1

ec1786eb

83b1cf9a 6fa64971

6fa64971

27f93943 485f7032

485f7032

6a94f767 22cb8755

22cb8755

c0a69407 e26d1352

e26d1352

d19da4e1 33f0b7b3

33f0b7b3

40beeb28

6fa64971 2f18a259

2f18a259

485f7032 6747d26b

6747d26b

22cb8755 458c553e

458c553e

e26d1352 a7e1466c

a7e1466c

33f0b7b3 9411f1df

9411f1df

821f750a

56fec25c

095386bb

3b30e611

9da4e1d1

f0b7b333

11f1df94

b1bb254a

01ed44ea

e2048e82

5e49f83e

8ca96dc3

82a19e22

02000000

04000000

08000000

10000000

20000000

40000000

b3bb254a

05ed44ea

ea048e82

4e49f83e

aca96dc3

c2a19e22

fe0c91f7 4db7b4bd

4db7b4bd 485af057

485af057 a25e7ed5

a25e7ed5 ec1786eb

ec1786eb 40beeb28

40beeb28 821f750a 2f18a259 ad07d753

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

ad07d753

6747d26b ca400538

ca400538

458c553e 8fcc5006

8fcc5006

a7e1466c 282d166a

282d166a

9411f1df bc3ce7b5

bc3ce7b5

e98ba06f

ad07d753 448c773c

448c773c

ca400538 8ecc7204

8ecc7204

8fcc5006 01002202

A.3

3ce7b5bc

eb94d565

80000000

6b94d565

821f750a e98ba06f

Expansion of a 256-bit Key

This section contains the key expansion of the following key: Key =

60 3d eb 10 15 ca 71 be 2b 73 ae f0 85 7d 77 81 1f 35 2c 07 3b 61 08 d7 2d 98 10 a3 09 14 df f4

for Nk = 8, which results in w0 = 603deb10 w4 = 1f352c07

w1 = 15ca71be w5 = 3b6108d7

w2 = 2b73aef0 w6 = 2d9810a3

w3 = 857d7781 w7 = 0914dff4 w[i] = temp ⊕ w[i − Nk]

i (dec)

temp

0914dff4

9ba35411

15ca71be 8e6925af

8e6925af

2b73aef0 a51a8b5f

a51a8b5f

857d7781 2067fcde

2067fcde

a8b09c1a

3b6108d7 93d194cd

93d194cd

2d9810a3 be49846e

be49846e

0914dff4 b75d5b9a

b75d5b9a

d59aecb8

8e6925af 5bf3c917

5bf3c917

a51a8b5f fee94248

fee94248

2067fcde de8ebe96

de8ebe96

b5a9328a

93d194cd 2678a647

2678a647

be49846e 98312229

After After Rcon[i/Nk] After XOR with Rcon R O T W O R D () S U B W O R D ()

w[i − Nk]

14dff409

603deb10 9ba35411

fa9ebf01

01000000

fb9ebf01

b785b01d

5d5b9ab7

4c39b8a9

1f352c07 a8b09c1a

02000000

1d19ae90

4e39b8a9

9ba35411 d59aecb8

a8b09c1a b5a9328a

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

98312229

b75d5b9a 2f6c79b3

2f6c79b3

812c81ad

5bf3c917 dadf48ba

dadf48ba

fee94248 24360af2

24360af2

de8ebe96 fab8b464

fab8b464

98c5bfc9

2678a647 bebd198e

bebd198e

98312229 268c3ba7

268c3ba7

2f6c79b3 09e04214

09e04214

68007bac

dadf48ba b2df3316

b2df3316

24360af2 96e939e4

96e939e4

fab8b464 6c518d80

6c518d80

c814e204

bebd198e 76a9fb8a

76a9fb8a

268c3ba7 5025c02d

5025c02d

09e04214 59c58239

59c58239

de136967

b2df3316 6ccc5a71

6ccc5a71

96e939e4 fa256395

fa256395

6c518d80 9674ee15

9674ee15

5886ca5d

76a9fb8a 2e2f31d7

2e2f31d7

5025c02d 7e0af1fa

7e0af1fa

59c58239 27cf73c3

27cf73c3

749c47ab

6ccc5a71 18501dda

18501dda

fa256395 e2757e4f

e2757e4f

9674ee15 7401905a

7401905a

cafaaae3

2e2f31d7 e4d59b34

e4d59b34

7e0af1fa 9adf6ace

9adf6ace

27cf73c3 bd10190d

bd10190d

fe4890d1

18501dda e6188d0b

e6188d0b

e2757e4f 046df344

046df344

7401905a 706c631e

6c79b32f

50b66d15

04000000

54b66d15

2d6c8d43

e0421409

e12cfa01

b5a9328a 98c5bfc9

08000000

e92cfa01

50d15dcd

c5823959

a61312cb

8a8f2ecc

10000000

b61312cb

cad4d77a

68007bac de136967

c814e204 5886ca5d

20000000

aa8f2ecc

927c60be

10190dbd

812c81ad 68007bac

98c5bfc9 c814e204

90922859

cf73c327

d59aecb8 812c81ad

de136967 749c47ab

5886ca5d cafaaae3

40000000

8ad4d77a

749c47ab fe4890d1

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Appendix B — Cipher Example The following diagram shows the values in the state array as the cipher progresses for a block length and a key length of 16 bytes each (i.e., Nb = 4 and Nk = 4). Input Key

= 32 43 f6 a8 88 5a 30 8d 31 31 98 a2 e0 37 07 34 = 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

The Round Key values are taken from the Key Expansion example in Appendix A.1. Round Number

Start of Round

After SubBytes

After ShiftRows

After MixColumns

input

32 43 f6 a8

88 5a 30 8d

31 31 98 a2

e0 37 07 34

19 3d e3 be

a0 f4 e2 2b

9a c6 8d 2a

e9 f8 48 08

d4 27 11 ae

e0 bf 98 f1

b8 b4 5d e5

1e 41 52 30

d4 bf 5d 30

e0 b4 52 ae

b8 41 11 f1

1e 27 98 e5

04 66 81 e5

e0 cb 19 9a

48 f8 d3 7a

a4 68 6b 02 9c 9f 5b 6a 7f 35 ea 50 f2 2b 43 49

49 de d2 89

45 db 96 f1

7f 39 87 1a

77 02 53 3b

49 db 87 3b

45 39 53 89

7f 02 d2 f1

77 de 96 1a

58 4d ca f1

1b 4b 5a ac

aa 8f 5f 03

61 dd e3 ef

82 d2 4a d2

68 32 46 9a

ac 73 cf 7b

ef c1 11 df

13 b5 d6 b5

45 23 5a b8

ac c1 d6 b8

ef b5 5a 7b

13 23 cf df

45 73 11 b5

75 ec 09 93

48 6c 4e ee

67 1d 9d 0d

4d e3 b1 38

d6 5f 58 e7

52 50 2f 28

85 a4 5e d7

e3 11 c8 07

f6 cf 6a 94

52 a4 c8 94

85 11 6a 28

e3 cf 2f d7

f6 50 5e 07

e0 92 7f e8

c8 63 63 c0

d9 b1 35 50

85 b8 be 01

e1 4f d2 9b

e8 fb fb ba

35 c8 96 53

97 6c ae 7c

e1 e8 35 97 fb c8 6c 4f 96 ae d2 fb 7c 9b ba 53

Round Key Value 2b 7e 15 16

28 ae d2 a6

ab f7 15 88

09 cf 4f 3c

28 06 26 4c

a0 fa fe 17

88 54 2c b1

23 a3 39 39

2a 6c 76 05

db e7 ca a8

1b 6b b0 e5

f2 c2 95 f2

7a 96 b9 43

59 35 80 7a

73 59 f6 7f

20 0b 63 33

53 c0 cf 7c

bb 25 d0 dc

3d 80 47 7d

47 16 fe 3e

1e 23 7e 44

6d 7a 88 3b

0f d6 da a9

60 31 38 bf

6f c0 10 6b

5e b3 13 01

ef 44 a5 41

a8 52 5b 7f

b6 71 25 3b

db 0b ad 00

25 d1 a9 ad

bd 11 d1 68

b6 3a 33 8e

4c 4c c0 b0

d4 d1 c6 f8

7c 83 9d 87

ca f2 b8 bc

11 f9 15 bc

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

f1 00 6f 55

c1 92 4c ef

7c c8 8b 32

5d b5 d5 0c

a1 63 a8 fc

78 4f 29 df

10 e8 3d 23

4c d5 03 fe

a1 4f 3d fe

78 e8 03 fc

10 d5 a8 df

4c 63 29 23

4b 86 8d 6d

2c 4a 89 80

33 9d f4 e8

37 d2 18 d8

6d 88 a3 7a

11 0b 3e fd

db f9 86 41

ca 00 93 fd

26 0e 2e 17

3d 41 b7 7d

e8 64 72 a9

fd d2 8b 25

f7 ab 31 f0

27 83 a9 ff

9b 43 40 d3

54 b5 3d 3f

f7 83 40 3f

27 43 3d f0

9b 54 b5 ab 31 a9 ff d3

14 15 b5 bf

46 16 15 ec

27 46 56 d7

34 2a d8 43

4e 54 f7 0e

5f 5f c9 f3

84 a6 4f b2

4e a6 dc 4f

5a 41 42 b1

19 49 dc 1f

a3 e0 19 65

7a 8c 04 0c

be 83 2c c8

d4 3b 86 c0

0a e1 d4 4d

da 64 f2 fe

be 3b d4 fe

d4 e1 f2 c8

0a 64 2c c0

da 83 86 4d

00 51 2f d1

b1 c8 89 ff

54 76 6d cd

fa 1b 99 ea

ea d2 73 21

b5 8d ba d2

31 2b f5 60

7f 8d 29 2f

ea 83 5c f0

04 45 33 2d

65 5d 98 ad

85 96 b0 c5

87 f2 4d 97 ec 6e 4c 90 4a c3 46 e7 8c d8 95 a6

87 6e 46 a6

f2 4c e7 8c

4d 90 4a d8

97 ec c3 95

47 37 94 ed

40 d4 e4 a5

a3 70 3a a6

4c 9f 42 bc

ac 77 66 f3

19 fa dc 21

28 d1 29 41

57 5c 00 6e

eb 40 f2 1e

59 2e 38 84

8b a1 13 e7

1b c3 42 d2

e9 09 89 72

e9 31 7d b5

cb 32 2c 72

3d 2e 89 5f

af 09 07 94

d0 14 f9 a8

c9 ee 25 89

e1 3f 0c c8

b6 63 0c a6

output

cb 31 07 5f

3d 32 7d 94

af 2e 2c b5

39 02 dc 19 25 dc 11 6a 84 09 85 0b 1d fb 97 32

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Appendix C — Example Vectors The NIST Computer Security Resource Center provides a website with “examples with intermediate values” for AES [8].

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

Appendix D — Change Log (Informative) The original FIPS 197 (November 26, 2001) was reviewed and updated under the auspices of NIST’s Crypto Publication Review Board [9]. Public comments and analyses of the security of the AES that are described in NIST IR 8319 [10] were the basis for the decision to maintain the technical specifcations of the Standard. The following is a summary of the editorial changes to the original FIPS 197 in the May 9, 2023 update, NIST FIPS 197-upd1: 1. The formatting of many elements of the publication was improved, and the text was revised for clarity. 2. The following items were added to the front matter: title page, foreword, abstract, and keywords. Offcials’ names and affliations on the title page refect the original publication. 3. The announcement sections were updated to refect current statutes, regulations, standards, guidelines, and validation programs. 4. Section 1 was revised to 1) add and update references to the AES development effort and 2) explicitly name AES-128, AES-192, and AES-256. 5. The material in the previous Section 2.2 (Algorithm Parameters, Symbols and Functions) was split into two new sections: 2.2 (List of Functions) and 2.3 (Algorithm Parameters and Symbols). 6. The terms, functions, and symbols from the specifcations are comprehensively included in the lists in Sections 2.1–2.3. 7. The description of the indexing convention was removed from Section 3.1. 8. Table 1 was revised, and the text in the previous Section 3.2 on the polynomial interpretation of bytes was revised and moved to Section 4. 9. A general defnition of the indexing of byte sequences was added to Section 3.3 before specializing to the example of a block, and Table 2 was revised. 10. The heading for Section 3.5 was changed to focus on word arrays, and notation for them was included in the text. The column words of the state were presented in a vertical format, with an improved description of the indices. 11. A reference for additional information on fnite felds [4] was included in a footnote within Section 4, and the headings for Sections 4.1 and 4.2 were revised to explicitly mention GF(28 ). 12. Section 4.2 was revised to provide an explicit, general description of fnite feld multiplication. The previous Section 4.2.1 was incorporated into the revised Section 4.2 by replacing the original example of modular polynomial reduction with an illustration of fnite feld multiplication using xtime. 13. The heading of Section 4.3 was revised to focus on multiplication by a fxed matrix, and the text of the section was simplifed by removing the secondary interpretation as polynomial 37

FIPS 197

A DVANCED E NCRYPTION S TANDARD (AES)

reduction. The descriptions of M IX C OLUMNS() and I NV M IX C OLUMNS() in Sections 5.1.3 and 5.3.3 were revised accordingly, to refer back to this construction. 14. The text on multiplicative inverses in GF(28 ) from the previous Section 4.2 was revised and moved to the new Section 4.4. 15. The discussion of the algorithm specifcations in Section 5 was expanded to elaborate on the relationships among its components. A new brief explanation of Nb as a Rijndael parameter enabled the replacement of Nb with its constant value 4 in the rest of the Standard. 16. The pseudocode for the cipher, the key expansion routine, and the inverse cipher in Sections 5.1, 5.2, and 5.3 was reformatted, and some of the text in these sections was revised for clarity. 17. The descriptions of S HIFT ROWS() in Section 5.1.2 and I NV S HIFT ROWS() in Section 5.3.2 were improved, and a mistake in the latter was corrected. 18. Illustrations of the three instances of K EY E XPANSION() in the new Figs. 6, 7, and 8 were added to Section 5.2. The text in the section was also revised, including an explicit display of the round constants in the new Fig. 5. 19. A separate algorithm for the modifed key expansion routine for the equivalent inverse cipher was added to Section 5.3.5 instead of only the supplementary lines. The description of the equivalent inverse cipher was simplifed in favor of the citation of an updated reference [3]. 20. Section 6.2 was revised to include a reference to NIST Special Publication 800-133, Rev. 2 [6]. 21. Section 6.4 was revised to expand the discussion of implementation attacks. 22. The References section is no longer labeled as an appendix. The references were updated to replace withdrawn publications and correct citation information and URLs. 23. The examples in Appendix C were removed in favor of a reference to the detailed example vectors that are now maintained at [8]. 24. Appendix D was created to summarize the changes in this update to FIPS 197.

NIST FIPS 197: Advanced Encryption Standard (AES)

Analyze & explore related research in Conceptio

Related documents