Table 5.

1 AES Parameters
Key Size (words/bytes/bits)

4/16/128

6/24/192

8/32/256

Plaintext Block Size (words/bytes/bits)

4/16/128

4/16/128

4/16/128

10

12

14

Round Key Size (words/bytes/bits)

4/16/128

4/16/128

4/16/128

Expanded Key Size (words/bytes)

44/176

52/208

60/240

Number of Rounds

Table 5.2

AES S-Boxes

(a) S-box
y

0
1
2
3
4
5
6
7
8
9
A
B
C
D
E
F

0
63
CA
B7
04
09
53
D0
51
CD
60
E0
E7
BA
70
E1
8C

1
7C
82
FD
C7
83
D1
EF
A3
0C
81
32
C8
78
3E
F8
A1

2
77
C9
93
23
2C
00
AA
40
13
4F
3A
37
25
B5
98
89

3
7B
7D
26
C3
1A
ED
FB
8F
EC
DC
0A
6D
2E
66
11
0D

4
F2
FA
36
18
1B
20
43
92
5F
22
49
8D
1C
48
69
BF

5
6B
59
3F
96
6E
FC
4D
9D
97
2A
06
D5
A6
03
D9
E6

6
6F
47
F7
05
5A
B1
33
38
44
90
24
4E
B4
F6
8E
42

7
C5
F0
CC
9A
A0
5B
85
F5
17
88
5C
A9
C6
0E
94
68

8
30
AD
34
07
52
6A
45
BC
C4
46
C2
6C
E8
61
9B
41

9
01
D4
A5
12
3B
CB
F9
B6
A7
EE
D3
56
DD
35
1E
99

A
67
A2
E5
80
D6
BE
02
DA
7E
B8
AC
F4
74
57
87
2D

B
2B
AF
F1
E2
B3
39
7F
21
3D
14
62
EA
1F
B9
E9
0F

C
FE
9C
71
EB
29
4A
50
10
64
DE
91
65
4B
86
CE
B0

D
D7
A4
D8
27
E3
4C
3C
FF
5D
5E
95
7A
BD
C1
55
54

E
AB
72
31
B2
2F
58
9F
F3
19
0B
E4
AE
8B
1D
28
BB

F
76
C0
15
75
84
CF
A8
D2
73
DB
79
08
8A
9E
DF
16

9
40
8E
4C
5B
A4
15
E4
AF
F2
F9
B7
DB
12
E5
EB
69

A
A3
43
95
A2
5C
46
58
BD
CF
37
62
C0
10
7A
BB
14

B
9E
44
0B
49
CC
57
05
03
CE
E8
0E
FE
59
9F
3C
63

C
81
C4
42
6D
5D
A7
B8
01
F0
1C
AA
78
27
93
83
55

D
F3
DE
FA
8B
65
8D
B3
13
B4
75
18
CD
80
C9
53
21

E
D7
E9
C3
D1
B6
9D
45
8A
E6
DF
BE
5A
EC
9C
99
0C

F
FB
CB
4E
25
92
84
06
6B
73
6E
1B
F4
5F
EF
61
7D

(b) Inverse S-box

y

0
1
2
3
4
5
6
7
8
9
A
B
C
D
E
F

0
52
7C
54
08
72
6C
90
D0
3A
96
47
FC
1F
60
A0
17

1
09
E3
7B
2E
F8
70
D8
2C
91
AC
F1
56
DD
51
E0
2B

2
6A
39
94
A1
F6
48
AB
1E
11
74
1A
3E
A8
7F
3B
04

3
D5
82
32
66
64
50
00
8F
41
22
71
4B
33
A9
4D
7E

4
30
9B
A6
28
86
FD
8C
CA
4F
E7
1D
C6
88
19
AE
BA

5
36
2F
C2
D9
68
ED
BC
3F
67
AD
29
D2
07
B5
2A
77

6
A5
FF
23
24
98
B9
D3
0F
DC
35
C5
79
C7
4A
F5
D6

7
38
87
3D
B2
16
DA
0A
02
EA
85
89
20
31
0D
B0
26

8
BF
34
EE
76
D4
5E
F7
C1
97
E2
6F
9A
B1
2D
C8
E1

Table 5.3 Key Expansion for AES Example

Key Words
w0 = 0f 15 71 c9
w1 = 47 d9 e8 59
w2 = 0c b7 ad
w3 = af 7f 67 98
w4 = w0 z1 = dc 90 37 b0
w5 = w4 w1 = 9b 49 df e9
w6 = w5 w2 = 97 fe 72 3f
w7 = w6 w3 = 38 81 15 a7
w8 = w4 z2 = d2 c9 6b b7
w9 = w8 w5 = 49 80 b4 5e
w10 = w9 w6 = de 7e c6 61
w11 = w10 w7 = e6 ff d3 c6
w12 = w8 z3 = c0 af df 39
w13 = w12 w9 = 89 2f 6b 67
w14 = w13 w10 = 57 51 ad 06
w15 = w14 w11 = b1 ae 7e c0
w16 = w12 z4 = 2c 5c 65 f1
w17 = w16 w13 = a5 73 0e 96
w18 = w17 w14 = f2 22 a3 90
w19 = w18 w15 = 43 8c dd 50
w20 = w16 z5 = 58 9d 36 eb
w21 = w20 w17 = fd ee 38 7d
w22 = w21 w18 = 0f cc 9b ed
w23 = w22 w19 = 4c 40 46 bd
w24 = w20 z6 = 71 c7 4c c2
w25 = w24 w21 = 8c 29 74 bf
w26 = w25 w22 = 83 e5 ef 52
w27 = w26 w23 = cf a5 a9 ef
w28 = w24 z7 = 37 14 93 48
w29 = w28 w25 = bb 3d e7 f7
w30 = w29 w26 = 38 d8 08 a5
w31 = w30 w27 = f7 7d a1 4a
w32 = w28 z8 = 48 26 45 20
w33 = w32 w29 = f3 1b a2 d7
w34 = w33 w30 = cb c3 aa 72
w35 = w34 w32 = 3c be 0b 38
w36 = w32 z9 = fd 0d 42 cb
w37 = w36 w33 = 0e 16 e0 1c
w38 = w37 w34 = c5 d5 4a 6e
w39 = w38 w35 = f9 6b 41 56
w40 = w36 z10 = b4 8e f3 52
w41 = w40 w37 = ba 98 13 4e
w42 = w41 w38 = 7f 4d 59 20
w43 = w42 w39 = 86 26 18 76

Auxiliary Function
RotWord(w3)= 7f 67 98 af = x1
SubWord(x1)= d2 85 46 79 = y1
Rcon(1)= 01 00 00 00
y1 Rcon(1)= d3 85 46 79 = z1
RotWord(w7)= 81 15 a7 38 = x2
SubWord(x4)= 0c 59 5c 07 = y2
Rcon(2)= 02 00 00 00
y2 Rcon(2)= 0e 59 5c 07 = z2
RotWord(w11)= ff d3 c6 e6 = x3
SubWord(x2)= 16 66 b4 8e = y3
Rcon(3)= 04 00 00 00
y3 Rcon(3)= 12 66 b4 8e = z3
RotWord(w15)= ae 7e c0 b1 = x4
SubWord(x3)= e4 f3 ba c8 = y4
Rcon(4)= 08 00 00 00
y4 Rcon(4)= ec f3 ba c8 = 4
RotWord(w19)= 8c dd 50 43 = x5
SubWord(x4)= 64 c1 53 1a = y5
Rcon(5)= 10 00 00 00
y5 Rcon(5)= 74 c1 53 1a = z5
RotWord(w23)= 40 46 bd 4c = x6
SubWord(x5)= 09 5a 7a 29 = y6
Rcon(6)= 20 00 00 00
y6 Rcon(6)= 29 5a 7a 29 = z6
RotWord(w27)= a5 a9 ef cf = x7
SubWord(x6)= 06 d3 df 8a = y7
Rcon(7)= 40 00 00 00
y7 Rcon(7)= 46 d3 df 8a = z7
RotWord(w31)= 7d a1 4a f7 = x8
SubWord(x7)= ff 32 d6 68 = y8
Rcon(8)= 80 00 00 00
y8 Rcon(8)= 7f 32 d6 68 = z8
RotWord(w35)= be 0b 38 3c = x9
SubWord(x8)= ae 2b 07 eb = y9
Rcon(9)= 1B 00 00 00
y9 Rcon(9)= b5 2b 07 eb = z9
RotWord(w39)= 6b 41 56 f9 = x10
SubWord(x9)= 7f 83 b1 99 = y10
Rcon(10)= 36 00 00 00
y10 Rcon(10)= 49 83 b1 99 = z10

Table 5.4 AES Example

Start of round
01
23
45
67
0e
36
34
ae
65
74
70
75
5c
7b
b4
9a
71
15
26
24
f8
67
ae
e8
72
1e
b2
00
0a
d9
d8
56
db
18
a8
ff
f9
1b
4f
bf
cc
a1
04
a1
ff
0b
84
4a

89
ab
cd
ef
ce
72
25
b6
0f
c7
ff
3f
6b
72
34
9b
48
dc
74
7e
b4
37
a5
21
ba
06
20
6d
89
f9
f7
7b
a1
6d
30
d5
e9
34
c9
bf
3e
67
85
00
08
53
bf
7c

fe
dc
ba
98
f2
6b
17
4e
c0
e8
e8
ca
05
a2
31
7f
5c
da
c7
22
0c
24
c1
97
cb
d4
bc
e7
c1
c5
f7
11
f8
8b
08
d7
8f
2f
85
81
ff
59
02
5f
69
34
ab
43

76
54
32
10
d9
2b
55
88
4d
d0
2a
9c
f4
6d
12
94
7d
a9
bd
9c
4c
ff
ea
bc
04
fa
65
4e
85
e5
fb
14
77
ba
4e
aa
2b
08
49
89
3b
af
aa
34
64
14
8f
b9

After
SubBytes

ab
05
18
e4
4d
92
51
9d
4a
21
8d
b8
a3
59
f7
36
41
85
e4
9b
40
72
37
63
67
35
61
b1
b9
ad
c2
16
99
af
84
08
4b
32
f2
32

8b
40
3f
4e
76
c6
16
75
7f
40
18
14
52
86
92
f3
8d
9a
06
fd
f4
6f
b7
3c
a7
99
68
21
32
3c
04
03
1e
18
dd
08
b2
85
97
63

89
7f
f0
2f
ba
9b
9b
74
6b
3a
c7
d2
4a
57
c6
93
fe
36
78
88
1f
48
65
94
78
a6
68
82
41
3d
30
0e
73
15
97
0c
16
cb
77
cf

35
f1
fc
c4
e3
70
e5
de
bf
3c
c9
22
ff
d3
7a
de
29
16
87
65
f2
2d
4d
2f
97
d9
0f
fa
f5
f4
2f
ac
f1
30
3b
a7
e2
79
ac
18

After
ShiftRows

ab
40
f0
c4
4d
c6
9b
de
4a
40
c7
22
a3
86
c6
de
41
9a
78
65
40
6f
65
2f
67
99
68
fa
b9
3c
30
ac
99
18
97
a7
4b
85
77
18

8b
7f
fc
e4
76
9b
e5
9d
7f
3a
c9
b8
52
57
7a
36
8d
36
87
9b
f4
48
4d
63
a7
a6
0f
b1
32
3d
2f
16
1e
15
3b
08
b2
cb
ac
32

89
f1
18
4e
ba
70
51
75
6b
3c
8d
14
4a
d3
f7
f3
fe
16
e4
fd
1f
2d
37
3c
78
d9
61
21
41
f4
c2
03
73
30
84
08
16
79
f2
63

35
05
3f
2f
e3
92
16
74
bf
21
18
d2
ff
59
92
93
29
85
06
88
f2
72
b7
94
97
35
68
82
f5
ad
04
0e
f1
af
dd
0c
e2
32
97
cf

After
MixColumns

b9
e4
47
c5
8e
b2
df
2d
b1
ba
f9
1d
d4
3b
cb
19
2a
83
84
eb
7b
1e
94
94
ec
0c
3b
b7
b1
3d
0a
9f
31
ac
46
6a
4b
b1
fb
cc

94
8e
20
d6
22
f2
80
c5
c1
f3
1f
19
11
44
ab
b7
47
e8
18
10
05
d0
83
c4
1a
50
d7
22
1a
2f
6b
68
30
71
65
1c
86
cb
f2
5a

57
16
9a
f5
db
dc
f7
1e
0b
8b
6a
24
fe
06
62
07
c4
18
27
0a
42
20
18
43
c0
53
00
72
44
ec
2f
f3
3a
8c
48
31
8a
27
f2
5b

75
51
3f
3b
12
92
c1
52
cc
07
c3
5c
0f
73
37
ec
48
ba
23
f3
4a
40
52
fb
80
c7
ef
e0
17
b6
42
b1
c2
c4
eb
62
36
5a
af
cf

Round Key
0f
15
71
c9
dc
90
37
b0
d2
c9
6b
b7
c0
af
df
39
2c
5c
65
f1
58
9d
36
eb
71
c7
4c
c2
37
14
93
48
48
26
45
20
fd
0d
42
cb
b4
ba
7f
86

47
d9
e8
59
9b
49
df
e9
49
80
b4
5e
89
2f
6b
67
a5
73
0e
96
fd
ee
38
7d
8c
29
74
bf
bb
3d
e7
f7
f3
1b
a2
d7
0e
16
e0
1c
8e
98
4d
26

0c
b7
ad
d6
97
fe
72
3f
de
7e
c6
61
57
51
ad
06
f2
22
a3
90
0f
cc
9b
ed
83
e5
ef
52
38
d8
08
a5
cb
c3
aa
72
c5
d5
4a
6e
f3
13
59
18

af
7f
67
98
38
81
15
a7
e6
ff
d3
c6
b1
ae
7e
c0
43
8c
dd
50
4c
40
46
bd
cf
a5
a9
ef
f7
7d
a1
4a
3c
be
0b
38
f9
6b
41
56
52
4e
20
76

Table 5.5 Avalanche Effect in AES: Change in Plaintext

Number of Bits
that Differ

Round
0123456789abcdeffedcba9876543210
0023456789abcdeffedcba9876543210
0
1
2
3
4
5
6
7
8
9
10

0e3634aece7225b6f26b174ed92b5588
0f3634aece7225b6f26b174ed92b5588
657470750fc7ff3fc0e8e8ca4dd02a9c
c4a9ad090fc7ff3fc0e8e8ca4dd02a9c
5c7bb49a6b72349b05a2317ff46d1294
fe2ae569f7ee8bb8c1f5a2bb37ef53d5
7115262448dc747e5cdac7227da9bd9c
ec093dfb7c45343d689017507d485e62
f867aee8b437a5210c24c1974cffeabc
43efdb697244df808e8d9364ee0ae6f5
721eb200ba06206dcbd4bce704fa654e
7b28a5d5ed643287e006c099bb375302
0ad9d85689f9f77bc1c5f71185e5fb14
3bc2d8b6798d8ac4fe36a1d891ac181a
db18a8ffa16d30d5f88b08d777ba4eaa
9fb8b5452023c70280e5c4bb9e555a4b
f91b4fbfe934c9bf8f2f85812b084989
20264e1126b219aef7feb3f9b2d6de40
cca104a13e678500ff59025f3bafaa34
b56a0341b2290ba7dfdfbddcd8578205
ff0b844a0853bf7c6934ab4364148fb9
612b89398d0600cde116227ce72433f0

1
1
20
58
59
61
68
64
67
65
61
58

Table 5.6 Avalanche Effect in AES: Change in Key

Number of Bits
that Differ

Round
0123456789abcdeffedcba9876543210
0123456789abcdeffedcba9876543210
0
1
2
3
4
5
6
7
8
9
10

0e3634aece7225b6f26b174ed92b5588
0f3634aece7225b6f26b174ed92b5588
657470750fc7ff3fc0e8e8ca4dd02a9c
c5a9ad090ec7ff3fc1e8e8ca4cd02a9c
5c7bb49a6b72349b05a2317ff46d1294
90905fa9563356d15f3760f3b8259985
7115262448dc747e5cdac7227da9bd9c
18aeb7aa794b3b66629448d575c7cebf
f867aee8b437a5210c24c1974cffeabc
f81015f993c978a876ae017cb49e7eec
721eb200ba06206dcbd4bce704fa654e
5955c91b4e769f3cb4a94768e98d5267
0ad9d85689f9f77bc1c5f71185e5fb14
dc60a24d137662181e45b8d3726b2920
db18a8ffa16d30d5f88b08d777ba4eaa
fe8343b8f88bef66cab7e977d005a03c
f91b4fbfe934c9bf8f2f85812b084989
da7dad581d1725c5b72fa0f9d9d1366a
cca104a13e678500ff59025f3bafaa34
0ccb4c66bbfd912f4b511d72996345e0
ff0b844a0853bf7c6934ab4364148fb9
fc8923ee501a7d207ab670686839996b

0
1
22
58
67
63
81
70
74
67
59
53

Table 5.7 S-AES S-Boxes

j

00

01

10

11

00

01

10

11

(a) S-Box

00

01

10

11

00

01

10

11

(b) Inverse S-Box

Note: hexadecimal numbers in shaded boxes; binary numbers in unshaded boxes.