The Advanced Encryption Standard uses a key schedule to expand a short key into a number of separate round keys. The three AES variants have a different number of rounds. Each variant requires a separate 128-bit round key for each round plus one more. The key schedule produces the needed round keys from the initial key.

Round constants

The round constant for round of the key expansion is the 32-bit word:

where is an eight-bit value defined as :

is the bitwise XOR operator and constants such as and are given in hexadecimal. Equivalently:

where the bits of are treated as the coefficients of an element of the finite field.

AES uses up to for AES-128 (as 11 round keys are needed), up to for AES-192, and up to for AES-256.

The key schedule

Define:

• as the length of the key in 32-bit words: 4 words for AES-128, 6 words for AES-192, and 8 words for AES-256

• , , ... as the 32-bit words of the original key

• as the number of round keys needed: 11 round keys for AES-128, 13 keys for AES-192, and 15 keys for AES-256

• , , ... as the 32-bit words of the expanded key

Also define as a one-byte left circular shift:

and as an application of the AES S-box to each of the four bytes of the word:

:

Notes

References

• FIPS PUB 197: the official AES standard (PDF file)

External links

• Description of Rijndael's key schedule

• schematic view of the key schedule for 128 and 256 bit keys for 160-bit keys on Cryptography Stack Exchange