AES
- •
What it is
- •
AES is a symmetric-key block cipher operating on 128-bit blocks as a keyed permutation. AES-128 runs an initial key addition followed by 10 rounds, each combining SubBytes (S-box substitution for confusion), ShiftRows and MixColumns (permutation/mixing for diffusion), and AddRoundKey (XOR with a round key), with round keys generated from the master key via key expansion.
- •
- •
When to apply
- •
Baseline knowledge for any AES-flavored challenge — most CTF AES attacks target the mode of operation or an implementation bug wrapped around AES, not AES's internals directly, but understanding the round structure matters when a challenge exposes it (implementing steps by hand) or when reasoning about how a mode of operation is built on top of the block cipher.
- •
- •
Math
- •
SubBytes applies the multiplicative inverse in followed by an affine transform, chosen for maximal non-linearity (Shannon's confusion). ShiftRows + MixColumns spread that non-linearity across the whole state within two rounds (Shannon's diffusion).
- •
- •
Encryption / decryption flow
- •
KeyExpansion — derive 11 round keys (128 bits each) from the master key.
- •
Initial AddRoundKey — XOR the plaintext state with round key 0.
- •
9 main rounds, each: SubBytes → ShiftRows → MixColumns → AddRoundKey (with the next round key).
- •
Final round (round 10): SubBytes → ShiftRows → AddRoundKey — identical to a main round but skips MixColumns.
- •
Decryption runs the same round keys in reverse order, using the inverse of each operation (
InvSubBytes,InvShiftRows,InvMixColumns);AddRoundKeyis its own inverse since XOR is self-inverse.
- •
- •
The s-box
- •
A fixed 256-entry lookup table (one output byte per possible input byte) built by taking the multiplicative inverse of each byte in , then applying a fixed affine transformation — chosen to maximize non-linearity (Shannon's "confusion") so ciphertext bytes can't be approximated as a simple/linear function of plaintext and key. The inverse S-box is a separate table that exactly undoes this mapping for decryption.
- •
- •
Python
- •
def add_round_key(state, round_key): return [[s ^ k for s, k in zip(srow, krow)] for srow, krow in zip(state, round_key)]
- •
- •
- •
Cards
- •
What are the four transformations in a full AES round?
- •
SubBytes, ShiftRows, MixColumns, AddRoundKey (the final round skips MixColumns).
- •
- •
Which AES step is the only one that mixes in the key?
- •
Which AES step is the only one that mixes in the key?
- •
- •
How is the AES S-box constructed?
- •
Multiplicative inverse of each byte in GF(2^8), followed by a fixed affine transformation.
- •
- •
- •
- •
Worked example
- •
AES-128 known-answer test: key
000102030405060708090a0b0c0d0e0fand plaintext00112233445566778899aabbccddeeffproduce ciphertext69c4e0d86a7b0430d8cdb78070b4c55. This checks a complete implementation, including state layout and key schedule.
- •
