NIST FIPS 197 日本語訳

Federal Information Processing Standards Publication

Category: Computer Security

Subcategory: Cryptography

Information Technology Laboratory National Institute of Standards and Technology Gaithersburg, MD 20899-8900

This publication is available free of charge from: https://doi.org/10.6028/NIST.FIPS.197-upd1

Published November 26, 2001; Updated May 9, 2023

U.S. Department of Commerce Donald L. Evans, Secretary

Technology Administration Phillip J. Bond, Under Secretary for Technology

National Institute of Standards and Technology Karen H. Brown, Acting Director

The Federal Information Processing Standards Publication Series of the National Institute of Standards and Technology is the official series of publications relating to standards and guidelines developed under 15 U.S.C. 278g-3, and issued by the Secretary of Commerce under 40 U.S.C. 11331.

Comments concerning this Federal Information Processing Standard publication are welcomed and should be submitted using the contact information in the “Inquiries and comments” clause of the announcement section.

James A. St. Pierre, Acting Director Information Technology Laboratory

In 2000, NIST announced the selection of the Rijndael block cipher family as the winner of the Advanced Encryption Standard (AES) competition. Block ciphers are the foundation for many cryptographic services, especially those that provide assurance of the confidentiality of data.

Three members of the Rijndael family are specified in this Standard: AES-128, AES-192, and AES-256. Each of them transforms data in blocks of 128 bits, and the numerical suffix indicates the bit length of the associated cryptographic keys.

AES; block cipher; confidentiality; cryptography; encryption; Rijndael.

Federal Information

Processing Standards Publication 197

Updated: May 9, 2023

Federal Information Processing Standards Publications (FIPS) are developed by NIST under 15 U.S.C. 278g-3 and issued by the Secretary of Commerce under 40 U.S.C. 11331.

The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits.

This Standard may be used by federal agencies to protect information when they have determined that encryption is appropriate, in accordance with applicable Office of Management and Budget and agency policies. Federal agencies may also use alternative methods that NIST has indicated are appropriate for this purpose.

This Standard may be adopted and used by non-Federal Government organizations.

NIST has developed a validation program to test implementations for conformance to the algorithms in this Standard. Information about the validation program is available at https: //nist.gov/cmvp. Examples for each key size are available at https://csrc.nist.gov/projects/aes.

Both this Standard and possible threats reducing the security provided through the use of this Standard will undergo review by NIST as appropriate, taking into account newly available analysis and technology. In addition, the awareness of any breakthrough in technology or any mathematical weakness of the algorithm will cause NIST to reevaluate this Standard and provide necessary revisions.

National Institute of Standards and Technology (2001) Advanced Encryption Standard (AES). (Department of Commerce, Washington, D.C.), Federal Information Processing Standards Publication (FIPS) NIST FIPS 197-upd1, updated May 9, 2023. https://doi.org/10.6028/NIST.FIPS.197-upd1

A block is a sequence of bits of a given fixed length. A block cipher is a family of permutations of blocks that is parameterized by a sequence of bits called the key.

In 1997, NIST initiated the Advanced Encryption Standard (AES) development effort [1] and called for the public to submit candidate algorithms for block ciphers. Block ciphers are the foundation for many cryptographic services, especially those that provide assurance of the confidentiality of data. In 2000, NIST announced the selection of Rijndael [2, 3] for the AES.

This Standard specifies three instantiations of Rijndael: AES-128, AES-192, and AES-256, where the suffix indicates the bit length of the key. The block size (i.e., the length of the data inputs and outputs) is 128 bits in each case. Rijndael supports additional block sizes and key lengths that are not adopted in this Standard.

This Standard is organized as follows:

The following definitions are used in this Standard:

AES — Advanced Encryption Standard.

Affine transformation — A transformation consisting of multiplication by a matrix, followed by the addition of a vector.

Array — A fixed-size data structure that stores a collection of elements, where each element is identified by its integer index or indices.

Bit — A binary digit: 0 or 1.

Block — A sequence of bits of a given fixed length. In this Standard, blocks consist of 128 bits, sometimes represented as arrays of bytes or words.

Block cipher — A family of permutations of blocks that is parameterized by the key.

Byte — A sequence of eight bits.

Equivalent inverse cipher — An alternative specification of the inverse of CIPHER() with a structure similar to that of CIPHER() and with a modified key schedule as input.

Key — The parameter of a block cipher that determines the selection of a permutation from the block cipher family.

Key schedule — The sequence of round keys that are generated from the key by KEYEXPANSION().

Rijndael — The block cipher that NIST selected as the winner of the AES competition.

Round — A sequence of transformations of the state that is iterated Nr times in the specifications of CIPHER(), INVCIPHER(), and EQINVCIPHER(). The sequence consists of four transformations, except for one iteration, in which one of the transformations is omitted.

Round key — One of the \(Nr + 1\) arrays of four words that are derived from the block cipher key using the key expansion routine; each round key is an input to an instance of ADDROUNDKEY() in the AES block cipher.

State — Intermediate result of the AES block cipher that is represented as a two-dimensional array of bytes with four rows and Nb columns.

S-box — A non-linear substitution table used in SUBBYTES() and KEYEXPANSION() to perform a one-to-one substitution of a byte value.

Word — A group of 32 bits that is treated either as a single entity or as an array of 4 bytes.

The following functions are specified in this Standard:

ADDROUNDKEY() — The transformation of the state in which a round key is combined with the state.

AES-128() — The block cipher specified in this Standard with 128-bit keys.

AES-192() — The block cipher specified in this Standard with 192-bit keys.

AES-256() — The block cipher specified in this Standard with 256-bit keys.

CIPHER() — The transformation of blocks that underlies AES-128, AES-192, and AES-256; the key schedule and the number of rounds are parameters of the transformation.

EQINVCIPHER() — The inverse of CIPHER() in which \(dw\) replaces \(w\) as the key schedule parameter.

INVCIPHER() — The inverse of CIPHER().

INVMIXCOLUMNS() — The inverse of MIXCOLUMNS().

INVSBOX() — The inverse of SBOX().

INVSHIFTROWS() — The inverse of SHIFTROWS().

INVSUBBYTES() — The inverse of SUBBYTES().

KEYEXPANSION() — The routine that generates the round keys from the key.

KEYEXPANSIONEIC() — The routine that generates the modified round keys for the equivalent inverse cipher.

MIXCOLUMNS() — The transformation of the state that takes all of the columns of the state and mixes their data (independently of one another) to produce new columns.

ROTWORD() — The transformation of words in which the four bytes of the word are permuted cyclically.

SBOX() — The transformation of bytes defined by the S-box.

SHIFTROWS() — The transformation of the state in which the last three rows are cyclically shifted by different offsets.

SUBBYTES() — The transformation of the state that applies the S-box independently to each byte of the state.

SUBWORD() — The transformation of words in which the S-box is applied to each of the four bytes of the word.

XTIMES() — The transformation of bytes in which the polynomial representation of the input byte is multiplied by \(x\), modulo \(m(x)\), to produce the polynomial representation of the output byte.

\(b^{-1}\) — The multiplicative inverse of the element \(b\) in \(\mathrm{GF}(2^8)\).

\(\tilde{b}\) — The input to the affine transformation in the AES S-box.

\(dw\) — Word array for the key schedule that is input to the equivalent inverse cipher.

GF(2) — Finite field with two elements.

\(\mathrm{GF}(2^8)\) — Finite field with 256 elements.

\(in\) — The data input to CIPHER() or INVCIPHER(), represented as an array of 16 bytes indexed from 0 to 15.

\(m(x)\) — The modulus specified in this standard for the polynomial representation of bytes as elements of \(\mathrm{GF}(2^8)\).

\(key\) — The array of \(Nk\) words that comprise the key for AES-128, AES-192, or AES-256.

\(Nb\) — The number of columns comprising the state, where each column is a 32-bit word. For this Standard, \(Nb = 4\).

\(Nk\) — The number of 32-bit words comprising the key. \(Nk\) is assigned to 4, 6, and 8 for AES-128, AES-192, and AES-256, respectively. (see Section 6.3).

\(Nr\) — The number of rounds. \(Nr\) is assigned to 10, 12, and 14 for AES-128, AES-192, and AES-256, respectively.

\(out\) — The data output of CIPHER() or INVCIPHER(), represented as an array of 16 bytes indexed from 0 to 15.

\(Rcon\) — Word array for the round constant.

\(state\) — The state, represented as a two-dimensional array of 16 bytes, with rows and columns indexed from 0 to 3.

\(u[i]\) — For a one-dimensional array \(u\) of words or bytes, the element in the array that is indexed by a non-negative integer \(i\).

\(u[i..i+3]\) — For an array \(u\) of words, the sequence \(u[i], u[i+1], u[i+2], u[i+3]\).

\(w\) — Word array for the key schedule.

\(\oplus\) — Either the exclusive-OR operation on bits, the bitwise exclusive-OR operation on bytes, or the bitwise exclusive-OR operation on words.

\(\bullet\) — Multiplication in \(\mathrm{GF}(2^8)\).

\(*\) — Integer multiplication.

\(\leftarrow\) — Assignment of a variable in pseudocode.

\(\{\}\) — Delimiters for a byte in hexadecimal or binary notation.

A bit is a binary digit — 0 or 1. A block is a sequence of 128 bits; the data input and output for the AES block ciphers are blocks. Another input to the AES block ciphers, called the key, is a bit sequence that is typically established beforehand and maintained across many invocations of the block cipher. The lengths of the keys for AES-128, AES-192, and AES-256 are 128 bits, 192 bits, and 256 bits, respectively.

The basic processing unit in the AES algorithms is the byte — a sequence of eight bits.

A byte value is denoted by the concatenation of the eight bits between braces (e.g., {10100011}). When the bits of a byte are denoted by an indexed variable, the convention in this Standard is for the indices to decrease from left to right (i.e., \(\{b_7\, b_6\, b_5\, b_4\, b_3\, b_2\, b_1\, b_0\}\)).

It is also convenient to denote byte values using hexadecimal notation. The 16 hexadecimal characters represent sequences of four bits, as listed in Table 1. A byte is represented by an ordered pair of hexadecimal characters, where the left character in the pair represents the four left-most bits(i.e., \(b_7, b_6, b_5, b_4\)), and the right character in the pair represents the four right-most bits (i.e., \(b_3, b_2, b_1, b_0\)). For example, the hexadecimal form of the byte {10100011} is {a3}.

Table 1. Hexadecimal representation of 4-bit sequences

In order to unambiguously represent the data and key inputs as sequences of bytes, the following indexing convention is adopted in this Standard. Given a sequence of \(8k\) bits,

(for some positive integer \(k\)), the bytes \(a_j\) for \(0 \le j \le k-1\) are defined as follows:

is represented by the byte sequence

where

As described in Section 3.2, the bits within any individual byte are indexed in decreasing order from left to right. This ordering is more natural for the finite field arithmetic on bytes that is described in Section 4. The two types of bit indices for byte sequences are illustrated in Table 2.

Table 2. Indices for bytes and bits

Internally, the algorithms for the AES block ciphers are performed on a two-dimensional (four-by-four) array of bytes called the state. In the state array, denoted by \(s\), each individual byte has two indices: a row index \(r\) in the range \(0 \le r < 4\) and a column index \(c\) in the range \(0 \le c < 4\). An individual byte of the state is denoted by either \(s_{r,c}\) or \(s[r,c]\).

In the specifications for the AES block cipher algorithms in Section 5, the first step is to copy the input array of bytes \(in_0, in_1, \ldots, in_{15}\) to the state array \(s\) as follows:

A sequence of transformations is then applied to the state array, after which its final value is copied to the output array of bytes \(out_0, out_1, \ldots, out_{15}\) as follows:

The correspondence between the indices of the input and output with the indices of the state array is illustrated in Fig. 1.

Figure 1. State array input and output

A word is a sequence of four bytes; a block consists of four words. The four columns of state array \(s\) are interpreted as an array \(v\) of four words as follows, in the notation of Fig. 1:

Thus, the column index \(c\) of \(s\) becomes the index for \(v\), and the row index \(r\) of \(s\) becomes the index for the four bytes in each word.

Given a one-dimensional array \(u\) of words, \(u[i]\) denotes the word that is indexed by \(i\), and the sequence of four words \(u[i], u[i+1], u[i+2], u[i+3]\) is denoted by \(u[i..i+3]\).

For some transformations of the AES algorithms specified in Sec. 5, each byte in the state array is interpreted as one of the 256 elements of a finite field, also known as a Galois Field, denoted by \(\mathrm{GF}(2^8)\). 1

In order to define addition and multiplication in \(\mathrm{GF}(2^8)\), each byte \(\{b_7\, b_6\, b_5\, b_4\, b_3\, b_2\, b_1\, b_0\}\) is interpreted as a polynomial, denoted by \(b(x)\), as follows:

For example, \(\{01100011\}\) is represented by the polynomial \(x^6 + x^5 + x + 1\).

In order to add two elements in the finite field \(\mathrm{GF}(2^8)\), the coefficients of the polynomials that represent the elements are added modulo 2 (i.e., with the exclusive-OR operation, denoted by \(\oplus\)), so that \(1 \oplus 1 = 0\), \(1 \oplus 0 = 1\), and \(0 \oplus 0 = 0\).

Equivalently, two bytes can be added by applying the exclusive-OR operation to each pair of corresponding bits in the bytes. Thus, the sum of \(\{a_7\, a_6\, a_5\, a_4\, a_3\, a_2\, a_1\, a_0\}\) and \(\{b_7\, b_6\, b_5\, b_4\, b_3\, b_2\, b_1\, b_0\}\) is \(\{a_7 \oplus b_7\;\; a_6 \oplus b_6\;\; a_5 \oplus b_5\;\; a_4 \oplus b_4\;\; a_3 \oplus b_3\;\; a_2 \oplus b_2\;\; a_1 \oplus b_1\;\; a_0 \oplus b_0\}\). (In Section 5.1.4, this definition is extended to words.)

For example, the following three representations of addition are equivalent:

Because the coefficients of the polynomials are reduced modulo 2, the coefficient 1 is equivalent to the coefficient –1, so addition is equivalent to subtraction. For example, \(x^4 + x^2\) represents the same finite field element as \(x^4 - x^2\), \(-x^4 + x^2\), and \(-x^4 - x^2\). Similarly, the sum of any element with itself is the zero element.

The symbol \(\bullet\) denotes multiplication in \(\mathrm{GF}\left(2^8\right)\). Conceptually, this multiplication is defined on two bytes in two steps: 1) the two polynomials that represent the bytes are multiplied as polynomials, and 2) the resulting polynomial is reduced modulo the following fixed polynomial:

Within both steps, the individual coefficients of the polynomials are reduced modulo 2.

Thus, if \(b(x)\) and \(c(x)\) represent bytes \(b\) and \(c\), then \(b \bullet c\) is represented by the following modular reduction of their product as polynomials:

The modular reduction by \(m(x)\) may be applied to intermediate steps in the calculation of \(b(x)c(x)\); consequently, it is useful to consider the special case that \(c(x) = x\) (i.e., \(c = \{02\}\)). In particular, the product \(b \bullet \{02\}\) can be expressed as a function of \(b\), denoted by XTIMES(\(b\)), as follows:

Multiplication by higher powers of \(x\) (such as \(\{04\}\), \(\{08\}\), and \(\{10\}\)) can be implemented by the repeated application of XTIMES(). For example, let \(b = \{57\}\):

These products facilitate the computation of any multiple of \(\{57\}\). For example, because \(\{13\} = \{10\} \oplus \{02\} \oplus \{01\}\), it follows that

Two transformations – MIXCOLUMNS() and INVMIXCOLUMNS() – in the algorithms for the AES block ciphers can be expressed in terms of matrix multiplication. In particular, a distinct fixed matrix is specified for each transformation. For both matrices, each of the 16 entries of the matrix is a byte of a single specified word, denoted here by \([a_0, a_1, a_2, a_3]\).

Given an input word \([b_0, b_1, b_2, b_3]\) to the transformation, the output word \([d_0, d_1, d_2, d_3]\) is determined by finite field arithmetic as follows:

The matrix form of Eq. (4.8) is

For a byte \(b \ne \{00\}\), its multiplicative inverse is the unique byte, denoted by \(b^{-1}\), such that

The definition of the SUBBYTES() transformation in the specifications of the AES block cipher involves multiplicative inverses in \(\mathrm{GF}(2^8)\), which can be calculated as follows:

Alternatively, let \(b(x)\) be the polynomial that represents \(b\). The extended Euclidean algorithm [5] can be applied to \(b(x)\) and \(m(x)\) to find polynomials \(a(x)\) and \(c(x)\) such that

It follows that \(a(x)\) is the polynomial that represents \(b^{-1}\).

The general function for executing AES-128, AES-192, or AES-256 is denoted by CIPHER(); its inverse is denoted by INVCIPHER().²

The core of the algorithms for CIPHER() and INVCIPHER() is a sequence of fixed transformations of the state called a round. Each round requires an additional input called the round key; the round key is a block that is usually represented as a sequence of four words (i.e., 16 bytes).

An expansion routine, denoted by KEYEXPANSION(), takes the block cipher key as input and generates the round keys as output. In particular, the input to KEYEXPANSION() is represented as an array of words, denoted by key, and the output is an expanded array of words, denoted by w, called the key schedule.

The block ciphers AES-128, AES-192, and AES-256 differ in three respects: 1) the length of the key; 2) the number of rounds, which determines the size of the required key schedule; and 3) the specification of the recursion within KEYEXPANSION(). For each algorithm, the number of rounds is denoted by Nr, and the number of words of the key is denoted by Nk. (The number of words in the state is denoted by Nb for Rijndael in general; in this Standard, \(Nb = 4\).) The specific values of Nk, Nb, and Nr are given in Table 3. No other configurations of Rijndael conform to this Standard.

For implementation issues relating to the key length, block size, and number of rounds, see Section 6.3.

Table 3. Key-Block-Round Combinations

The three inputs to CIPHER() are: 1) the data input in, which is a block represented as a linear array of 16 bytes; 2) the number of rounds Nr for the instance; and 3) the round keys. Thus,

The inverse permutations are defined by replacing CIPHER() with INVCIPHER() in Eq. 5.1.

The specifications of CIPHER(), KEYEXPANSION(), and INVCIPHER() are given in Sections 5.1, 5.2, and 5.3, respectively.

The rounds in the specification of CIPHER() are composed of the following four byte-oriented transformations on the state:

The four transformations are specified in Sections 5.1.1–5.1.4. In those specifications, the transformed bit, byte, or block is denoted by appending the symbol \({}'\) as a superscript on the original variable \(\big(\)i.e., by \(b'_i\), \(b'\), \(s'_{i,j}\), or \(s'\big)\).

The round keys for ADDROUNDKEY() are generated by KEYEXPANSION(), which is specified in Section 5.2. In particular, the key schedule is represented as an array \(w\) of \(4 * (Nr + 1)\) words.

CIPHER() is specified in the pseudocode in Alg. 1.

The first step (Line 2) is to copy the input into the state array using the conventions from Sec. 3.4. After an initial round key addition (Line 3), the state array is transformed by Nr applications of the round function (Lines 4–12); the final round (Lines 10–12) differs in that the MIXCOLUMNS() transformation is omitted. The final state is then returned as the output (Line 13), as described in Section 3.4.

SUBBYTES() is an invertible, non-linear transformation of the state in which a substitution table, called an S-box, is applied independently to each byte in the state. The AES S-box is denoted by SBOX().

Let \(b\) denote an input byte to SBOX(), and let \(c\) denote the constant byte {01100011}. The output byte \(b' = \mathrm{SBOX}(b)\) is constructed by composing the following two transformations:

The matrix form of Eq. (5.3) is given by Eq. (5.4) below:

Figure 2 illustrates how SUBBYTES() transforms the state.

Figure 2. Illustration of SUBBYTES()

The AES S-box is presented in hexadecimal form in Table 4. For example, if \(s_{r,c} = \{53\}\), then the substitution value would be determined by the intersection of the row with index ‘5’ and the column with index ‘3’ in Table 4, so that \(s'_{r,c} = \{\mathtt{ed}\}\).

Table 4. SBOX(): substitution values for the byte xy (in hexadecimal format)

SHIFTROWS() is a transformation of the state in which the bytes in the last three rows of the state are cyclically shifted. The number of positions by which the bytes are shifted depends on the row index \(r\), as follows:

SHIFTROWS() is illustrated in Figure 3. In that representation of the state, the effect is to move each byte by \(r\) positions to the left in the row, cycling the left-most \(r\) bytes around to the right end of the row. The first row, where \(r = 0\), is unchanged.

Figure 3. Illustration of SHIFTROWS()

MIXCOLUMNS() is a transformation of the state that multiplies each of the four columns of the state by a single fixed matrix, as described in Section 4.3, with its entries taken from the following word:

Thus,

so that the individual output bytes are defined as follows:

Figure 4 illustrates MIXCOLUMNS().

Figure 4. Illustration of MIXCOLUMNS()

ADDROUNDKEY() is a transformation of the state in which a round key is combined with the state by applying the bitwise XOR operation. In particular, each round key consists of four words from the key schedule (described in Section 5.2), each of which is combined with a column of the state as follows:

where \(round\) is a value in the range \(0 \le round \le Nr\), and \(w[i]\) is the array of key schedule words described in Section 5.2. In the specification of CIPHER(), ADDROUNDKEY() is invoked \(Nr+1\) times — once prior to the first application of the round function (see Alg. 1) and once within each of the \(Nr\) rounds, when \(1 \le round \le Nr\).

The action of this transformation is illustrated in Fig. 5, where \(l = 4 \ast round\). The byte address within words of the key schedule was described in Sec. 3.5.

Figure 5. Illustration of ADDROUNDKEY()

KEYEXPANSION() is a routine that is applied to the key to generate 4 ∗ (Nr + 1) words. Thus, four words are generated for each of the Nr + 1 applications of ADDROUNDKEY() within the specification of CIPHER(), as described in Section 5.1.4. The output of the routine consists of a linear array of words, denoted by w[i], where i is in the range 0 ≤ i < 4 ∗ (Nr + 1).

KEYEXPANSION() invokes 10 fixed words denoted by Rcon[j] for 1 ≤ j ≤ 10. These 10 words are called the round constants. For AES-128, a distinct round constant is called in the generation of each of the 10 round keys. For AES-192 and AES-256, the key expansion routine calls the first eight and seven of these same constants, respectively. The values of Rcon[j] are given in hexadecimal notation in Table 5:

Table 5. Round constants

The value of the left-most byte of Rcon[j] in polynomial form is \(x^{j-1}\). Note that for j > 0, these bytes may be generated by successively applying XTIMES() to the byte represented by \(x^{j-1}\) (see Eq. 4.5).

Two transformations on words are called within KEYEXPANSION(): ROTWORD() and SUBWORD(). Given an input word represented as a sequence \([a_0, a_1, a_2, a_3]\) of four bytes,

and

The expansion of the key proceeds according to the pseudocode in Alg. 2. The first Nk words of the expanded key are the key itself. Every subsequent word w[i] is generated recursively from the preceding word, w[i − 1], and the word Nk positions earlier, w[i − Nk], as follows:

Figures 6, 7, and 8 illustrate KEYEXPANSION() for AES-128, AES-192, and AES-256.

To implement INVCIPHER(), the transformations in the specification of CIPHER() (Section 5.1) are inverted and executed in reverse order. The inverted transformations of the state — denoted by INVSHIFTROWS(), INVSUBBYTES(), INVMIXCOLUMNS(), and ADDROUNDKEY() — are described in Sections 5.3.1–5.3.4.

INVCIPHER() is described in the pseudocode in Alg. 3, where the array w denotes the key schedule, as described in Section 5.2.

Figure 6. KEYEXPANSION() of AES-128 to generate the words \(w[i]\) for \(4 \le i < 44\), where \(l\) ranges over the multiples of 4 between 0 and 36

Figure 7. KEYEXPANSION() of AES-192 to generate the words \(w[i]\) for \(6 \le i < 52\), where \(l\) ranges over the multiples of 6 between 0 and 42

Figure 8. KEYEXPANSION() of AES-256 to generate the words \(w[i]\) for \(8 \le i < 60\), where \(l\) ranges over the multiples of 8 between 0 and 48

INVSHIFTROWS() is the inverse of the SHIFTROWS(). In particular, the bytes in the last three rows of the state are cyclically shifted as follows:

INVSHIFTROWS() is illustrated in Figure 9. In that representation of the state, the effect is to move each byte by \(r\) positions to the right in the row, cycling the right-most \(r\) bytes around to the left end of the row. The first row, where \(r = 0\), is unchanged.

Figure 9. Illustration of INVSHIFTROWS()

INVSUBBYTES() is the inverse of SUBBYTES(), in which the inverse of SBOX(), denoted by INVSBOX(), is applied to each byte of the state. INVSBOX() is derived from Table 4 by switching the roles of inputs and outputs, as presented in Table 6:

Table 6. INVSBOX(): substitution values for the byte xy (in hexadecimal format)

INVMIXCOLUMNS() is the inverse of MIXCOLUMNS(). In particular, INVMIXCOLUMNS() multiplies each of the four columns of the state by a single fixed matrix, as described in Section 4.3, with its entries taken from the following word:

Thus,

As a result of this matrix multiplication, the four bytes in a column are replaced by the following:

ADDROUNDKEY(), described in Section 5.1.4, is its own inverse.

Several properties of the AES algorithm allow for an alternative specification of the inverse of CIPHER(), called the equivalent inverse cipher, denoted by EQINVCIPHER(). In the specification of EQINVCIPHER(), the transformations of the round function of the cipher in Alg. 1 are directly replaced by their inverses in EQINVCIPHER(), in the same order. The efficiency of this structure in comparison to the specification of INVCIPHER() in Alg. 3 is explained in the Rijndael proposal document [2].

The pseudocode for the equivalent inverse cipher, given in Alg. 4, uses a modified key schedule, denoted by the word array dw. The routine to generate dw is an extension of KEYEXPANSION(), denoted by KEYEXPANSIONEIC(), whose pseudocode is given in Alg. 5.

The first and last round keys in dw are the same as in w; the modification of the other round keys is described in Lines 19–22. The comment in Line 21 refers to the input to INVMIXCOLUMNS(): the one-dimensional array of words is converted to a two-dimensional array of bytes, as in Fig. 1.

An implementation of the AES algorithm shall support at least one of the three key lengths specified in Sec. 5: 128, 192, or 256 bits (i.e., Nk = 4, 6, or 8, respectively). Implementations may optionally support two or three key lengths, which may promote the interoperability of algorithm implementations.

When a cryptographic key has been generated appropriately (see NIST Special Publication 800-133, Rev. 2 [6] for guidelines), no restriction is imposed when the resulting key is used for the AES algorithm.

In Table 3, this Standard explicitly defines the allowed values for the key length (Nk), block size (Nb), and number of rounds (Nr). However, future revisions of this Standard could include changes or additions to the allowed values for those parameters. Therefore, implementers may choose to design their AES implementations with future flexibility in mind.

Implementation variations are possible that may, in many cases, offer performance or other advantages. Given the same input key and data (plaintext or ciphertext), any implementation that produces the same output (ciphertext or plaintext) as the algorithm specified in this Standard is an equivalent implementation of the AES algorithm.

The AES proposal document [2] and other resources located on the AES page [7] include suggestions on how to efficiently implement the AES algorithm on a variety of platforms. Suggested implementations are intended to explain the inner workings of the AES algorithm but do not provide protection against various implementation attacks.

A physical implementation may leak key-dependent information through side channels, such as the time taken to perform a computation, or when faults are injected into the computation. When such attacks are non-invasive, they can be effective even when there are mechanisms to detect physical tampering of the device. For example, cache-timing attacks may affect AES implementations on software platforms that use a cache to accelerate the access to data from main memory.

Protecting implementations of the AES algorithm against implementation attacks where applicable should be considered. Such considerations are outside of the scope of this document but are taken into account when testing for conformance to the algorithm in this Standard according to the validation program developed by NIST (see https://nist.gov/cmvp).

Block cipher modes of operation are cryptographic functions that feature a block cipher to provide information services, such as confidentiality and authentication. NIST-recommended modes of operation are specified in the 800-38 series of NIST Special Publications. Further information is available at https://csrc.nist.gov/Projects/block-cipher-techniques/BCM.

[1] James Nechvatal, Elaine Barker, Lawrence Bassham, William Burr, Morris Dworkin, James Foti, and Edward Roback. Report on the Development of the Advanced Encryption Standard (AES). Journal of Research of NIST (NIST JRES), May 2001. https://doi.org/10.6028/jres. 106.023.

[2] Joan Daemen and Vincent Rijmen. AES Proposal: Rijndael Document Version 2. AES Algorithm Submission, September 1999. Available at https://csrc.nist.gov/csrc/media/projects/cryptographic-standards-and-guidelines/ documents/aes-development/rijndael-ammended.pdf.

[3] Joan Daemen and Vincent Rijmen. The Design of Rijndael - The Advanced Encryption Standard (AES), Second Edition. Information Security and Cryptography. Springer, 2020. https://doi.org/10.1007/978-3-662-60769-5.

[4] Michael Artin. Algebra. Pearson Modern Classic. Pearson, second edition, 2017.

[5] Alfred J. Menezes, Scott A. Vanstone, and Paul C. Van Oorschot. Handbook of Applied Cryptography. CRC Press, Inc., USA, 1st edition, 1997. https://doi.org/10.1201/9780429466335.

[6] Elaine Barker, Allen Roginsky, and Richard Davis. Recommendation for Cryptographic Key Generation. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Special Publication (SP) 800-133, Rev. 2, June 2020. https://doi.org/10.6028/NIST.SP. 800-133r2.

[7] National Institute of Standards and Technology. AES Development, 2022. Available at https://csrc.nist.gov/projects/aes.

[8] National Institute of Standards and Technology. Cryptographic Standards and Guidelines: Examples with Intermediate Values, 2022. Available at https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines/example-values.

[9] National Institute of Standards and Technology. Crypto Publications Review Board, 2022. Available at https://csrc.nist.gov/projects/crypto-publication-review-project.

[10] Nicky Mouha. Review of the Advanced Encryption Standard. (National Institute of Standards and Technology, Gaithersburg, MD), NIST Interagency Report (IR) 8319. https://doi.org/10.6028/NIST.IR.8319.

This appendix shows the development of the key schedule for each key size. Note that multi-byte values are presented using the notation described in Sec. 3. The intermediate values produced during the development of the key schedule (see Sec. 5.2) are given in the following table (all values are in hexadecimal format with the exception of the index column \(i\)).

This section contains the key expansion of the following key:

Key = 2b 7e 15 16 28 ae d2 a6 ab f7 15 88 09 cf 4f 3c

for \(Nk = 4\), which results in

This section contains the key expansion of the following key:

Key = 8e 73 b0 f7 da 0e 64 52 c8 10 f3 2b 80 90 79 e5 62 f8 ea d2 52 2c 6b 7b

for \(Nk = 6\), which results in

This section contains the key expansion of the following key:

Key = 60 3d eb 10 15 ca 71 be 2b 73 ae f0 85 7d 77 81 1f 35 2c 07 3b 61 08 d7 2d 98 10 a3 09 14 df f4

for \(Nk = 8\), which results in

The following diagram shows the values in the state array as the cipher progresses for a block length and a key length of 16 bytes each (i.e., \(Nb = 4\) and \(Nk = 4\)).

The Round Key values are taken from the Key Expansion example in Appendix A.1.