# Advanced Encryption Standard (AES)

- AES superseded DES as a standard in 2002

  ![1646490755.png](img/1646490755.png)

- Uses rounds of 4 layers and a final round of 3
- Bytes are represented as a 4x4 block called the *state*

![1646491291.png](img/1646491291.png)

**Sub-Bytes** - similar to s-boxes in DES

**Shift Rows** - diffusion and permutation round

![1646491556.png](img/1646491556.png)

First row doesn’t move, second row is shifted to the left by 1, the third row is shifted two places to the left etc

Then, when the columns are mixed, this means the overall diffusion is extremely good

The last round doesn’t have a **mix column** step as its reversible and wouldn’t add additional security.

#### S-Box

- The AES s-box is based around the multiplicative inverse of 8-bit values in $GF(2^8)$
- This is strongly *non-linear* mapping

$$
A_i \cdot A_i^{-1} \equiv 1 \space (mod \space P(x)) \\
B'_i = \begin{cases}
0 \quad\quad\quad i=0 \\
A_i^{-1} \quad\space\space\space i > 0
\end{cases}
$$

![1646491900.png](img/1646491900.png)

- Note: 0 maps to 0
- The inverses $B'_i$ then  undergo an **affine transformation** to produce the final s-box
- This destroys any remaining mathematical structure

![1646491995.png](img/1646491995.png)

Remember an affine transformation is a multiplication and addition by two constants (think of the affine cipher)

##### S-box Properties

- The s-box simply described, and is bijective, an invertible 1:1 mapping
- It has no fixed points
  - i.e. no $A_i$ for which $S(A_i) = A_i$
- No inverse fixed points
  - i.e. no $A_i$ for which $S(A_i) \oplus A_i = FF$
- Minimisation of the largest non-trivial correlation between linear combinations of input bits and linear combinations of output bits
  - 0 is a non-trivial combination
- Minimisation of the largest non-trivial value in the `EXOR` table
  - This stops differential cryptanalysis

#### AES Diffusion

Diffusion in AES consists of two layers:

1. Shift rows
2. Mix columns

Shift rows simply moves bytes around the block

![1646492564.png](img/1646492564.png)

##### Mix Columns

- Performs a linear mixing of bytes within each column
- All the input bytes in a column influence all the output bytes

![1646492734.png](img/1646492734.png)

- Multiplying by `01` does not change the result 

When multiplying by $x$, there’s a shortcut we can implement. We can set the equation equal to 0, and `xor` by $x^4 - x^3 - x - 1$

![1646493181.png](img/1646493181.png)

### Key Schedule

![1646493375.png](img/1646493375.png)

- The first round key used is just the key
- We then take $W[3]$ and put it through the $g$ function which just permutes it
  - $g$ takes the word, shifts it one to the right and then passes it through the s-boxes
  - We then `xor` it with $RC[i]$ which is just a constant value to ensure *something* changes
    - Like for example if we had a bit stream of all 0s

### Implementation

1. All addition and subtractions are `xor`

2. Multiply by `01` has no effect

3. Multiplying by `02` (which is $x$) is simply a left shift followed by modular reduction

   - Left shift multiplies by $x$

   - If the original $x^7$ bit was set, then we must `xor` with `0x1B`

   - ```java
     // xtime
     if ((a & 0x80) > 0) {
     	a = (a << 1) ^ 0x1b;
     } else {
     	a <<= 1;
     }
     ```

4. Multiply by `03` ($x+1$) is simply `xtime(a) ^ a`

- Inverse multiplications are by `09`, `11`, `13`, `14`. these require either a more general function or lookup tables

- Consider the sum: 

  - $$
    a = x^6 + x^4 + x^2 + 1 \\
    b = x^7 + x^4 + x^2 + x \\
    \therefore a\cdot b = a\cdot x^7 + a\cdot x^4 + a\cdot x^2 + a\cdot x
    $$

  - $$
    a\curvearrowright a\cdot x \curvearrowright a\cdot x^2 \curvearrowright a\cdot x^3 \curvearrowright a\cdot x^4 \curvearrowright a\cdot x^5 
    $$

  - Here in $a\cdot b$, $a$ is just being multiplied by various powers of $x$. This can be easily calculated by repeated multiplying $a$ by $x$. 

- AES is very **fast in software** and pretty **fast in hardware**

- CPU instructions in AES-NI make AES much faster

- Much of the algorithm can be converted into a series of lookup tables

  - **Trade off** between **speed** and **space**

- There are numerous cache-timing and other attacks possible

  - Implementation must be constant time
  - CPU instructions help mitigate this

- In general AES is much harder to implement safely than `ChaCha20`