From One AES Block to Message Behavior

Build AES-128 → CBC with padding → CTR → CBC bit flipping.

Trace bytes before coding; compare stages before comparing only the final ciphertext.

1 / 10

Column-Major State

state[r+4*c]

00 44 88 cc
11 55 99 dd
22 66 aa ee
33 77 bb ff

Row 2, column 1 is flat index 6, value 66.

2 / 10

First-Round Transformations

SubBytes replaces each byte.

ShiftRows rotates row r left by r columns.

MixColumns combines each column using field coefficients.

AddRoundKey XORs the corresponding key bytes.

3 / 10

Derive Field Multiplication

xtime(83) = 106 XOR 11b = 1d (hex).

3*a = xtime(a) XOR a.

For column [63,53,e0,8c], first output:

c6 XOR f5 XOR e0 XOR 8c = 5f.

4 / 10

Derive the First Expanded Key Word

Original last word: 0c0d0e0f.

Rotate → 0d0e0f0c; substitute → d7ab76fe.

XOR Rcon → d6ab76fe.

XOR original first word 00010203 → d6aa74fd.

Only every fourth new word uses the special transform.

5 / 10

Debug at a Stage Boundary

Running example, first column:

Stage	Bytes
Initial key XOR	`00102030`
SubBytes	`63cab704`
ShiftRows	`6353e08c`
MixColumns	`5f726415`
Round-key XOR	`89d810e8`

The full-state lesson table shows where shifted bytes came from.

6 / 10

Round Boundaries and Inverse Order

Initial key XOR, nine full rounds, then a final round without MixColumns.

Decrypt interior round:

InvShiftRows → InvSubBytes → AddRoundKey → InvMixColumns.

Use known vectors and an independent oracle; round trips can hide paired mistakes.

7 / 10

CBC Padding and CTR Lengths

CBC: Ci=E(Pi XOR Cprev); pad a full 16-byte message with 16 bytes.

CTR: encrypt nonce || counter, then XOR; 17 bytes from counter 7 consume counters 7 and 8.

CBC needs unpredictable IVs. CTR needs unique counter blocks across messages.

8 / 10

Derive the Integrity Failure

CTR reused stream: (P XOR S) XOR (Q XOR S) = P XOR Q.

CBC target byte 30→31 needs delta 01 in the previous ciphertext byte.

That edit also corrupts the previous plaintext block. Encryption alone does not authenticate messages.

9 / 10

Independent Practice

Label a state 00…0f; shift its rows and undo the shift.

Derive CBC delta 61→7a. Test mode lengths 0,15,16,17.

Use each quiz review link to retrace the missed concept with different bytes.

10 / 10

←/→ or click edges to navigate · ? help · N notes · F fullscreen