# AES key schedule

AES uses a key schedule to expand a short key into a number of separate round keys. The three AES variants have a different number of rounds. Each variant requires a separate 128-bit round key for each round plus one more.[note 1] The key schedule produces the needed round keys from the initial key.

## Round constants

 i rci 1 2 3 4 5 6 7 8 9 10 01 02 04 08 10 20 40 80 1B 36

The round constant rconi for round i of the key expansion is the 32-bit word:[note 2]

$rcon_{i}={\begin{bmatrix}rc_{i}&00_{16}&00_{16}&00_{16}\end{bmatrix}}$ where rci is an eight-bit value defined as :

$rc_{i}={\begin{cases}1&{\text{if }}i=1\\2\cdot rc_{i-1}&{\text{if }}i>1{\text{ and }}rc_{i-1}<80_{16}\\(2\cdot rc_{i-1})\oplus {\text{11B}}_{16}&{\text{if }}i>1{\text{ and }}rc_{i-1}\geq 80_{16}\end{cases}}$ where $\oplus$ is the bitwise XOR operator and constants such as 0016 and 11B16 are given in hexadecimal. Equivalently:

$rc_{i}=x^{i-1}$ where the bits of rci are treated as the coefficients of an element of the finite field ${\rm {{GF}(2)[x]/(x^{8}+x^{4}+x^{3}+x+1)}}$ , so that e.g. $rc_{10}=36_{16}=00110110_{2}$ represents the polynomial $x^{8}+x^{4}+x^{2}+x$ .

AES uses up to rcon10 for AES-128 (as 11 round keys are needed), up to rcon8 for AES-192, and up to rcon7 for AES-256.[note 3]

## The key schedule

Define:

• N as the length of the key in 32-bit words: 4 words for AES-128, 6 words for AES-192, and 8 words for AES-256
• K0, K1, ... KN-1 as the 32-bit words of the original key
• R as the number of round keys needed: 11 round keys for AES-128, 13 keys for AES-192, and 15 keys for AES-256[note 4]
• W0, W1, ... W4R-1 as the 32-bit words of the expanded key[note 5]

Also define RotWord as a one-byte left circular shift:[note 6]

$\operatorname {RotWord} ({\begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}\end{bmatrix}})={\begin{bmatrix}b_{1}&b_{2}&b_{3}&b_{0}\end{bmatrix}}$ and SubWord as an application of the AES S-box to each of the four bytes of the word:

$\operatorname {SubWord} ({\begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}\end{bmatrix}})={\begin{bmatrix}\operatorname {S} (b_{0})&\operatorname {S} (b_{1})&\operatorname {S} (b_{2})&\operatorname {S} (b_{3})\end{bmatrix}}$ Then for $i=0\ldots 4R-1$ :

$W_{i}={\begin{cases}K_{i}&{\text{if }}i6{\text{, and }}i\equiv 4{\pmod {N}}\\W_{i-N}\oplus W_{i-1}&{\text{otherwise.}}\\\end{cases}}$ 