Advanced Encryption Standard (AES) And: Finite Fields

Advanced Encryption
Standard (AES)
and
Finite Fields
Shervin Erfani
Fall 2015
9/30/2015
88-590-02 E-Commerce, S. Erfani

University of Windsor
Outline
1. A Bit of History
2. Basic Structure
3. Evaluation Criteria
4. AES Data Units
5. High-Level Description
6. AES Key Expansion
7. Algebraic Structures
8. Rings
9. Fields
10.Summary
9/30/2015

A Bit of History
On January 2, 1997, the U.S. National
Institute od Standards and Technology
(NIST) began the process of choosing a
replacement for DES. The replacement
would be called Advanced Encryption
Standard (AES).
AES is required to have block length 128
bits, and supports three different key
lengths of 128, 192, and 256 bits.
AES should be available to the public
worldwide on a royalty-free basis.
Submission deadline
9/30/2015
was June 15,3 1998. 21
A Bit of History
(Contd
)
On August 2, 1998,
NIST announced
fifteen
AES candidate algorithms at the first AES

candidate conference (AES1).
A second AES candidate conference (AES2)
was held in March 1999 to discuss the
results of the analysis that was conducted
by the international cryptographic
community on the candidate algorithms.
The five selected algorithms were MARS,
RC6, Rijndael, Serpent and Twofish.
Rijndael (Pronounced like Rain Doll) was
selected to be the AES on October 2, 2000
9/30/2015
4
at the end of a very
Universitylong
of Windsorand complex
Evaluation Criteria
Implementations of all of the above
were tested extensively inANSI,C
andJava languages for speed and
reliability in encryption and
decryption,keyand algorithm
setup time, and resistance to
various attacks, both in hardwareand software-centric systems.
Members of the global
cryptographic community
9/30/2015 conducted detailed analyses
5
AES Evaluation Criteria

Security
Security Strength
Randomness
Soundness
Resistance to Cryptanalysis
Cost
Licensing Requirements
Computational Efficiency
Memory Requirements
Algorithm and Implementation

Characteristic
Flexibility
Hardware and Software Suitability
Simplicity
9/30/2015

AES Evaluation Criteria Grade

Sheet
9/30/2015

AES Background
Rijdael cipher was developed by two Belgian
cryptographers
Joan Daemen of Proton World International, and
Vincent Rijmen of Katholieke Universiteit Leuven in
Belgium.
A draft of the Federal Information

Processing Standard (FIPS) was announced
by NIST in February 2001.
AES was published as U.S. FIPS PUB 197
(FIPS 197) on November 26, 2001; became
effective as a federal government standard
on May 26, 2002 after approval by the
secretary of Commerce. It is also approved
9/30/2015
8
by the National Security
Agency (NSA)
for
AES Basic Structure
Has a simple structure

An iterative rather than Feistel cipher
4 different stages are used as shown
inal round has only 3 stages
Each stage is easily reversible
Decryption does recover plaintext
Decryption uses keys in reverse order
9/30/2015

AES Basic Structure

(Contd)
AES is a non-Feistel
cipher that
encrypts/decrypts data
blocks of 128 bits.
Uses 10, 12, or 14
rounds depending on
the key size.
Uses key sizes of 128,
192, or 256 bits.
There are three
different versions:
AES-128, AES-192, and
The General Structure of
AES-256
AES for the case of 128-bit
Uses a round key
encryption key
E-Commerce, S. Erfani
obtained through88-590-02
a
9/30/2015
10
AES Data Units

To appreciate steps used in a single round of
transformations, AES uses five units for data sizes: Bits,
Bytes, Words, Blocks, and State
State is a data block of 16 bytes, which is treated as
matrices of 4 X 4 bytes
Block is a group of 128 bits
Word is a group of 32 bits
Key size
4/16/12
6/24/192
8/32/256
Byte
is
a
group
of
8
bits
(Words/Bytes/Bits)
Plaintext Block
Size
(words/bytes/bits)
4/16/128
4/16/128
4/16/128
Number of Rounds
10
12
14
Round Key Size

(words/bytes/bits)
4/16/128
4/16/128
4/16/128
44/176
52/208
Expanded Key Size

9/30/2015
(words/bytes)

11
60/240
AES Data Units (Contd)

Byt
e
Block
Wor
d
State
B
A
A
A
9/30/2015
byte is a row matrix (1 x 8) of eight bits.

word is a row matrix of four bytes.
block is a row matrix of 16 bytes.
state is treated as a row matrix ( 1 x 4 ) of words.
12
AES One Round of Encryption and

Decryption
9/30/2015

13
1.
High-Level Description of
Key Expansions Round keys are derived from the cipher key
usingAES
Rijndael's key schedule. AES requires a separate 128-bit
round key block for each round plus one more.

2. Initial Round:
1. AddRoundKey Each byte of the state is combined with a block of
the round key using bitwise XOR.
3. Rounds:
1.
2.
3.
4.
SubBytes A non-linear substitution step where each byte is

replaced with another according to a lookup table.
ShiftRows A transposition step where the last three rows of the
state are shifted cyclically a certain number of steps.
MixColumns A mixing operation which operates on the columns
of the state, combining the four bytes in each column.
AddRoundKey.
4. Final Round (no MixColumns):

1. SubBytes
2. ShiftRows
3. AddRoundKey.
9/30/2015

14
Structure of Each AES

AES usesRound
a substitution-permutation network in a
general sense. Each round involves:
Byte-level substitution, followed by
Word-level permutation.
A round function constitutes of the following four

operations or steps:
Substitution (Substitute Bytes)

Permutation (Shift Rows)
Mixing (Mix Columns)
Key Adding (Add Round Key)
A data block is partitioned into 4 x 4 bytes, and the

round operations are byte-oriented.
Assuming a 128-bit key, the key is arranged as a
matrix of 4 x 4 bytes.
As with the input block, the first word from the key fills the first
column of the matrix and so on.
The four column words
of the key matrix are expanded into a
9/30/2015
15
schedule of 44 words.
AES Plaintext State
uses a number of rounds:

AES
Each round is made of several stages.
All operations in AES are byte-oriented.

Data block is transformed from one stage to another.
The data block is arranged as a state.
The input data block, so-called the plaintext is 16
bytes, denoted as , and represented as a 4 X 4 array of bytes;
i.e. a state.
Sta
te
9/30/2015

16
Changing Plaintext to State
Assume the text block is AES uses a matrix.
Add to bogus characters ZZ at the end to get a 16-character data block.

Replace each character with an integer between 00 and 25.
Each byte as an integer is now represented with hexadecimal

digits.
The state matrix is then filled up, column-by-column as shown.
Tex
A E S U S E S A M A T R I X Z Z
t
Hexadeci
00
mal
04 12 14 12 04 12 00 0C 00 13 11 08 23
Sta
te
9/30/2015

17
SubBytes Transformation

The 1st transformation for encryption is SubBytes

substitution.
Each of the bytes in the state matrix is changed to
another byte using either
A table look up process (S-box) or
Mathematical calculation in finite fields (Galois Fields)
Each byte can be represented in 2 hexadecimal digits :

Digit A defines the row, and B defines the column of the
substitution table (S-box).
Replace
The output
of SubBytes
is the byte , which is at the
each
byte with
a
junction
of the row and the column of the table (Smatrix of bytes.
box).
In the SubBytes step, each

byte in the state is
replaced with its entry in a
fixed 8-bit lookup table, .
9/30/2015

18
AES S-Box Lookup Table for

During encryption each value of the state is replaced
Substitute Bytes
with the corresponding s-box value.
For example, hexadecimal 19 would be replaced
with D4
9/30/2015

19
Inverse S-Box Lookup Table for

The SubBytes and InvSubBytes operations are inverses of each
InvSubBytes
other.
During decryption each value in the state is replaced with the
corresponding inverse s-box value.
For example, hexadecimal D4 would be replaced with 19.
9/30/2015

20
Round Permutation and Shift

Permutation
in a round is done by shifting, which
Row
permutes the bytes, and is called Shift Rows:
The shift is to the left.

The number of shifts depends on the row number of the
state matrix.
9/30/2015
ta
S e
t
ta
S e
t
21
Shift Row Illustrated
9/30/2015

22
Round Mixing and Mix

Mixing
operation takes four bytes at a time and combines
Columns
them to create four new bytes:
The step first multiplies each byte with a different constant and
then mixes them.
The mixing can be provided by matrix multiplication.

AES defines the MixColumns to achieve this goal.
The constant matrix C used for this transformation is:
C=
=
=C
Inverse
Multiplication of bytes is done in with modulus 100011011 or
irreducible polynomial .
Addition is the same as XORing of 8-bit words.
The coefficients are displayed in their hexadecimal equivalent of
the binary representation of bit polynomials from .
The inverse transformation is called InvMixColumns.

9/30/2015

23
AES Round Mixing

(Contd)
In the MixColumns step, the four bytes of each

column of the state are combined using an invertible
linear transformation.
Each column of the state is multiplied with a fixed
polynomial c(x).
Together with ShiftRows, MixColumns provides

diffusion in the cipher.
The coefficients88-590-02
E-Commerce,
S. Erfani
of the
multiplication
matrix are
9/30/2015
24
Mix Column
Illustrated
Each column is processed separately.

Each byte is replaced by a value dependent on all 4
bytes in the column.
Effectively a matrix multiplication in using modulus
prime polynomial .
9/30/2015

25
Mix Column Illustrated

(Contd)
9/30/2015

26
Key Adding and Add-Round-Key

Step
AddRoundKey is similar
to MixColumns
operation:
Is a matrix addition
operation
Adds (XORing) a round
subkey with each state
column matrix.
Sub Keys For each

round, a subkey is
derived from the main
key using Rijndael's key
schedule.
Each subkey is the same
size as the state; i.e.,
128 bits long.
9/30/2015
27
Key Expansion Rationale
Designed to resist known

attacks
Design criteria included:
Knowing part key insufficient to

find many more
Invertible transformation
Fast on wide range of CPUs
Use round constants to break
symmetry
Diffuse key bits into round keys
Enough non-linearity to hinder
analysis
Simplicity of description
9/30/2015

28
Key Expansion Process

AES uses a key-expansion process for
rounds:
o ( +1) 128-bit round keys created from one single

128-bit cipher key.
o The first round key is for pre-round operation.
o The remaining keys are used for the
AddRoundKey operation at the end of each round.
o Each round key is four words, where a word is an
array of four bytes.
The round keys are created word-byword:

o AES-128 with 10 rounds and 44 words
9/30/2015

29
Key Expansion in AES-128
The cipher key consists of 128 bits

and arranged in 4 word columns,
each column is an array of 4 bytes.
The key-expansion process will
create 40 more columns from :
The first 4 words are made
from the original cipher key ;
first 4 bytes becomes , and so
on.
The rest of the words are
made using the formula:
where is a transformation of
resulting of applying two
operations of SubWord and rotate
word on and XORing the result
with a round constant (Rcon).
The round key for the i-th round
consists of :
9/30/2015

30
Key Expansion in AES-128 (Contd)
Roun
d
Constant
(RCon)
Rou
nd
Constant
(RCon)
(01 00 00
00)16
(20 00 00
00)16
(02 00 00
00)16
(40 00 00
00)16
3
(04 00 00
8
(80 00 00
00)16 is similar to the00)
The RotWord transformation
ShiftRows;
takes a
16
word and shifts4 each byte
to00
the left9with wrapping.
(08 00
(1B 00 00
The SubWord is similar to
SubBytes;
takes
each
byte in the word
00)16
00)16
and substitutes another byte for it.
00 in
00which
10
(36 00 00three bytes
Each RCon is a 54-byte(10
value
the rightmost
00)16
00)16 of AES-128
are always zero. The RCon
constants for 10 rounds
are given in the above table.
The key-expansion process can either use this table or use field
to calculate the leftmost byte dynamically.
Key-expansion in AES-192
and AES-256 versions are similar to
9/30/2015
31
Universityslight
of Windsor differences.
the one for AES-128 with
AES Decryption
The nature of
substitutions and
permutations in AES
allows for a fast
software
implementation of the
algorithm.
AES decryption is not
identical to encryption.
But each step in the
encryption process has
E-Commerce, S. Erfani
an inverse in 88-590-02
9/30/2015
32
Attacks on AES
For cryptographers, a cryptographic "break" is anything faster than a brute force.
AES has a fairly simple algebraic description. In 2002, a theoretical attack,
termed the "XSL attack", was announced by Nicolas Courtois and Josef Pieprzyk,
purporting to show a weakness in the AES algorithm due to its simple description.
On July 1, 2009, Bruce Schneier reported about a related-key attack on the 192bit and 256-bit versions of AES, discovered by Alex Biryukov and Dmitry
Khovratovich, which exploits AES's somewhat simple key schedule.
However, related-key attacks are not of concern in any properly designed cryptographic
protocol, as properly designed software will not use related-keys.
In November 2009, the first known-key distinguishing attack against a reduced 8round version of AES-128 was released as a preprint.
In July 2010 Vincent Rijmen published an ironic paper on "chosen-key-relations-inthe-middle" attacks on AES-128.
The first key-recovery attacks on full AES were due to Andrey Bogdanov, Dmitry
Khovratovich, and Christian Rechberger, and were published in 2011. The attack
is a biclique attack and is faster than brute force by a factor of about four.
As for now, there are no known practical attacks that would allow anyone to read
correctly implemented AES encrypted data.
According to the Snowden documents, the NSA is doing research on whether a
cryptographic attack based on tau statistic may help to break AES.
9/30/2015

33
Summary of AES
The AES is a symmetric-key block cipher published by NIST as FIPS 197. AES is based on
the Rindael algorithm.
AES is a non-Feistel cipher that encrypts/decrypts a data block of 128 bits. It uses 10, 12,
or 14 number of rounds.
The key size, which can be 128, 192, or 256 bits depends on the number of rounds.
AES is byte-oriented. The 128-bit plaintext or ciphertext is considered as sixteen 8-bit
bytes. A state is a 4 X 4 matrix in which each entry is a byte.
AES uses four types of transformations: Substitution, permutation, mixing, and key-adding.
Each round has 4 steps of SubBytes, ShiftRows, MixColumns, and AddRoundKey. Last
round has only 3 steps; no MixColumns.
Substitution is defined by either a table lookup process or mathematical calculation in the
field.
Decryption is not the same as encryption (as in DES). Decryption consists of inverse steps.
Most of the known attacks on DES were already tested on AES, and none of them has
broken the security of AES so far. There are no effective differential and linear
cryptanalysis attacks on AES as yet.
AES can be implemented in software, hardware, and firmware.
The algorithms used in AES are so simple that they can be easily implemented using cheap
processors and a minimum amount of memory.
In the byte-oriented version, the whole algorithm can use an 8-bit processor; in the wordoriented version, it can use a 32-bit processor.
9/30/2015

34
AES Arithmetic
AES
uses arithmetic in the finite field

(Galois Field) with modulus irreducible
prime polynomial m(x) = x8 + x4 + x3 + x + 1
which is (100011011) or hexadecimal
{11B}.
Example of an operation in field
{02} {87} mod {11B} = (1 0000
1110) mod {11B}
= (1 0000 1110)
(1 0001 1011)
= (0001 0101)
Algebraic Structures: The combination of
the set of integers and the operations that
S. Erfani
9/30/2015
35
are applied to 88-590-02
the E-Commerce,
elements
of the set is
Galois Fields: Motivation

variste Galois (French: [evaist a
lwa]; 25 October 1811 31 May 1832)
was a French mathematician born in
Bourg-la-Reine. While still in his teens,
he was able to determine a
necessary and sufficient condition for a
polynomial to be solvable by radicals,
thereby solving a problem standing for
350 years. His work laid the foundations
for Galois theory and group theory, two
major branches of abstract algebra, and
the subfield of Galois connections. He
died at age 20 from wounds suffered in a
duel.
9/30/2015

An example of
Galois rather
undisciplined
notes
36
Finite Fields or Galois Fields

Finite fields were first studied by Galois.
A field is more than just a set of elements:
It is a set of elements under two operations, called
addition (denoted by ) and multiplication (denoted by
),
Along with a set of properties (or axioms) governing
these operations.
The addition and multiplication operations also imply
inverse operations called subtraction and division.
The examples of fields are the real field , the

complex field C, the field of rational numbers Q,
and the binary field F2.
9/30/2015

37
Algebraic Structure: A Field

Definition - A field is a set of elements F = {a,b,c,...}
and two operations and for which the following
axioms hold:
Closure: for any a F, b F, the element a b is in F.
Associative law: for any a, b, c F, (a b) c = a (b c).
Commutative law: for all a, b F, (a b) = (b a).
Distributive law: for all a, b, c F, (a b) c = (a c) (b
c).
Identity: there is an identity element 0 in F for which
a 0 = 0 a = a for all a F.
Inverse: for each a F, there is an inverse (-a) such that a (a)=0.
The set F forms an abelian group (whose identity is called 0)
under the operation .
The set F = F {0} = {a F, a 0} forms an abelian group
(whose identity is called 1) under the operation .
9/30/2015

38
Finite Field GF(p)

Definition - Given a prime p, the finite field of order

p, denoted as , is defined as the set of of integers ,
together with addition and multiplication
arithmetic operations modulo .
The residue set is closed to addition and
multiplication operations.
For any a - {0}, we can always find an element b
, such that a b = 1 . Denote , and called it invers
of a - {0}.
It is important to note that the set of integers does
not form a field if is not prime.
In cryptography, we often need to use four
operations of addition, subtraction, multiplication,
and division. In other words, we need to use fields.
9/30/2015

39
Extension of a Prime Field:

n
GF(p
) GF(p) is called
An extension of a prime field
an extended finite field GF(pn ), with n a
positive integer number.
This extended field is also a Galois field.
Particular cases of practical interest are the
finite fields of the form GF(2n ), with n a
positive integer number.
We are also interested in GF(pn ) fields in
cryptography.
We have shown that GF(28 ) plays the central
role in operations of AES encryption
algorithm.
9/30/2015

40
Galois field of order 2n

Finite fields of order 2n are called binary fields or

characteristic-two finite fields.
One way to construct GF(2n ) is to use a polynomial basis
representation.
Here, the elements of GF(2n ) are the binary polynomials
(polynomials whose coefficients are in the field F(2) =
{0,1}) of degree at most n -1:
In cryptography, we often need to define the rules for
addition and multiplication operations on n-bit words that
satisfy the properties in GF(2 n ).
The polynomial 0, which may be considered to have no
terms at all, is called the zero polynomial.
The zero polynomial is also unique in that it is the only
polynomial having an infinite number of roots.
9/30/2015

41
Polynomials Over a Field

To represent an n-bit word by a polynomial we

introduce the following rules:
The power of indeterminate defines the position of the bit in
the n-bit word. This means the left-most bit is at position
zero (related to ), the rightmost bit is at position (related to
).
The coefficients of the terms define the value of the bits.
Because a bit can have only a value of 0 or 1, the polynomial
coefficients can be either 0 or 1.
An element of a field F is a root of a nonzero

polynomial over that field if and only if is a factor of
.
If has degree , then at most field elements are
roots of .
9/30/2015

42
Polynomials Over a Field
(Contd)
Polynomials - A polynomial p(X)

Irreducible
defined over GF(2), of degree m, is said to be

irreducible, if p(X) has no factor polynomials of
degree higher than zero and lower than m.
A polynomial of degree 2 is irreducible if it has no
factor polynomials of degree 1.
For example, the polynomial 1+X+X2 is an irreducible
polynomial, since neither X nor X+1 are its factors.
In fact all the finite fields GF(pn ) can be

generated from an irreducible polynomial of
degree n over GF(p) field.
In GF(pn ), multiplication of field elements is
performed modulo the irreducible polynomial .
9/30/2015

43
Examples of Operations in
4
GF(2
The following are some examples of )
arithmetic operations in

with
reduction polynomial .
Addition:
Subtraction:. We use the symbol to show
subtraction of two polynomials.
Multiplication: . Since
.
Inversion: , since
The finite field can be viewed as a vector space over its

subfield .
9/30/2015

44
Summary of Finite Fields

The most popular and widely used application of Galois Field is in
Cryptography.
The finite field GF(28 ) can be used to define four operations of
addition, subtraction, multiplication and division over n-bit words.
(No division by 0!)
Each n-bit word can also be represented as a polynomial of degree
with coefficients in GF(2). Operations on n-bit words are the same as
the operations on this polynomial.
To make it modular, we need to define an irreducible polynomial of
degree when we multiply two polynomials.
The extended Euclidean algorithm can be applied to polynomials to
find the multiplicative inverses.
Although, tables can be used to find the substitution for each byte in
this encryption standard, AES defines transformations algebraically
using GF(28 ) field with the irreducible polynomial (x8+x4+x3+x+1).
Each element can be expressed as a group of 8-bit.
9/30/2015
88-590-02 E-Commerce, S. Erfani University

of Windsor
45
References
The AES standard is described in the following official document:
http://csrc.nist.gov/publications/fips/fips197/fips-197.pdf
B. Forouzan, Cryptography and Network Security, Chap. 7, pp. 191 224.
New York, NY: McGraw Hill, 2008.
C. Paar, J. Pelzl, "The Advanced Encryption Standard", Chapter 4 of
"Understanding Cryptography, A Textbook for Students and Practitioners".
(companion web site contains online lectures on AES), Springer, 2009:
http://wiki.crypto.rub.de/Buch/sample_chapters.php
W. Stallings, Cryptography and Network Security, 5th ed. Upper Saddle
River, NJ: Prentice Hall, 2011.
Cryptography and Network Security Chapter 5, 5 th edition, by William
Stallings, Lecture slides by Lawrie Brown Advanced Encryption Standard:
www.cise.ufl.edu/~ nemo/security/slides/AES.ppt
W. Stallings, Network Security Essentials: Applications and Standards, 5th
Edition, Chap. 2, pp. 30-36. Upper Saddle River, NJ: Prentice Hall, 2014.
Avi Kak, Lecture 8, AES: The Advanced Encryption Standard, Purdue
University, May 2015:
https://engineering.purdue.edu/kak/compsec/NewLectures/Lecture8.pdf
B. Schneier, Another new AES attack, July 30, 2009.
9/30/2015

46
Questions & Answers?
9/30/2015

47

Advanced Encryption Standard (AES) And: Finite Fields

Uploaded by

Document Information

Original Description:

Original Title

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Advanced Encryption Standard (AES) And: Finite Fields

Uploaded by

Copyright:

Available Formats

Advanced Encryption

88-590-02 E-Commerce, S. Erfani

88-590-02 E-Commerce, S. Erfani

AES candidate algorithms at the first AES

AES Evaluation Criteria

Algorithm and Implementation

88-590-02 E-Commerce, S. Erfani

AES Evaluation Criteria Grade

88-590-02 E-Commerce, S. Erfani

A draft of the Federal Information

AES Basic Structure

Has a simple structure

88-590-02 E-Commerce, S. Erfani

AES Basic Structure

AES Data Units

Round Key Size

Expanded Key Size

88-590-02 E-Commerce, S. Erfani

AES Data Units (Contd)

byte is a row matrix (1 x 8) of eight bits.

AES One Round of Encryption and

88-590-02 E-Commerce, S. Erfani

round key block for each round plus one more.

SubBytes A non-linear substitution step where each byte is

4. Final Round (no MixColumns):

88-590-02 E-Commerce, S. Erfani

Structure of Each AES

A round function constitutes of the following four

Substitution (Substitute Bytes)

A data block is partitioned into 4 x 4 bytes, and the

AES Plaintext State

uses a number of rounds:

Each round is made of several stages.

All operations in AES are byte-oriented.

88-590-02 E-Commerce, S. Erfani

Changing Plaintext to State

Assume the text block is AES uses a matrix.

Add to bogus characters ZZ at the end to get a 16-character data block.

Each byte as an integer is now represented with hexadecimal

88-590-02 E-Commerce, S. Erfani

The 1st transformation for encryption is SubBytes

Each byte can be represented in 2 hexadecimal digits :

In the SubBytes step, each

88-590-02 E-Commerce, S. Erfani

AES S-Box Lookup Table for

88-590-02 E-Commerce, S. Erfani

Inverse S-Box Lookup Table for

88-590-02 E-Commerce, S. Erfani

Round Permutation and Shift

The shift is to the left.

Shift Row Illustrated

88-590-02 E-Commerce, S. Erfani

Round Mixing and Mix

The mixing can be provided by matrix multiplication.

The inverse transformation is called InvMixColumns.

88-590-02 E-Commerce, S. Erfani

AES Round Mixing

In the MixColumns step, the four bytes of each

Together with ShiftRows, MixColumns provides

Each column is processed separately.

88-590-02 E-Commerce, S. Erfani

Mix Column Illustrated