Extending AES-128 Attacks to AES-256 - Revision history

Fheubach: Change header levels

2018-05-01T13:29:59Z

Change header levels

Coflynn at 20:43, 25 March 2017

2017-03-25T20:43:01Z

Gdeon: Removed extra sections.

2016-06-21T13:14:54Z

Removed extra sections.

Gdeon: Added theory on attack

2016-06-21T13:02:00Z

Added theory on attack

Gdeon: Added page

2016-06-21T12:32:08Z

Added page

New page

Many of the tutorials in this wiki discuss attacks on AES-128 encryption. It turns out that its big brother, AES-256, can be attacked by extending the same attacks. This page discusses AES-256 and how to reuse an AES-128 attack to obtain the key.

= The AES-256 Algorithm =
In AES-128, we used the following steps to encrypt 16 bytes of plaintext:
# Use a 16 byte key to generate a key schedule, which is 176 bytes long (11 words made up of 16 bytes).
# Put the 16 bytes of plaintext into a 4x4 state matrix.
# Combine the first word of the key schedule with the state.
# Apply 10 rounds of transformations to the state, involving the key schedule.
# Retrieve 16 bytes of ciphertext from the state matrix.
The transformations involve several functions which mix together the bytes of the state. These functions are <code>SubBytes()</code>, <code>MixColumns()</code>, and <code>ShiftRows()</code>.

AES-'''256''' is not much different from AES-128. The encryption process is:
# Use a '''32''' byte key to generate a key schedule, which is '''240''' bytes long ('''15''' words made up of 16 bytes).
# Put the 16 bytes of plaintext into a 4x4 state matrix.
# Combine the first word of the key schedule with the state.
# Apply '''14''' rounds of transformations to the state, involving the key schedule.
# Retrieve 16 bytes of ciphertext from the state matrix.
Notice that most of this algorithm is the same. Earlier, we could attack a target by examining the output of a substitution box; since AES-256 uses these same S-boxes, we should have no problem finding a sensitive point to attack.

The following code is an example of the AES-256 decryption algorithm, written by [http://www.literatecode.com/ Ilya O. Levin]:

<pre>
aes_addRoundKey_cpy(buf, ctx->deckey, ctx->key);
aes_shiftRows_inv(buf);
aes_subBytes_inv(buf);

for (i = 14, rcon = 0x80; --i;)
{
if( ( i & 1 ) )
{
aes_expandDecKey(ctx->key, &rcon);
aes_addRoundKey(buf, &ctx->key[16]);
}
else aes_addRoundKey(buf, ctx->key);
aes_mixColumns_inv(buf);
aes_shiftRows_inv(buf);
aes_subBytes_inv(buf);
}
aes_addRoundKey( buf, ctx->key);
</pre>
Note that this implementation chooses to expand the key during the decryption process. This order of events isn't a big deal to us - the <code>subBytes()</code> operation will still be visible in a power trace.

= Attacking AES-256 Decryption =
== Attacking Round Key 14 ==
== Attacking Round Key 13 ==
== Recovering the Full Key ==

← Older revision		Revision as of 20:43, 25 March 2017
Line 109:		Line 109:
	# Reverse the 13th and 14th round keys using the AES-256 key schedule to determine the 256 bit secret encryption key.		# Reverse the 13th and 14th round keys using the AES-256 key schedule to determine the 256 bit secret encryption key.
	Once this is done, we have successfully attacked an AES-256 implementation by looking at two separate AES S-boxes.		Once this is done, we have successfully attacked an AES-256 implementation by looking at two separate AES S-boxes.
		+
		+	[[Category:Theory]]

@@ Line 108: / Line 108: @@
 # Transform the hypothetical round key into the actual value of the 13th round key.
 # Reverse the 13th and 14th round keys using the AES-256 key schedule to determine the 256 bit secret encryption key.
+Once this is done, we have successfully attacked an AES-256 implementation by looking at two separate AES S-boxes.
-== Attacking Round Key 14 ==
-== Attacking Round Key 13 ==
-== Recovering the Full Key ==

@@ Line 1: / Line 1: @@
 Many of the tutorials in this wiki discuss attacks on AES-128 encryption. It turns out that its big brother, AES-256, can be attacked by extending the same attacks. This page discusses AES-256 and how to reuse an AES-128 attack to obtain the key.
-= The AES-256 Algorithm =
+== The AES-256 Algorithm ==
 In AES-128, we used the following steps to encrypt 16 bytes of plaintext:
 # Use a 16 byte key to generate a key schedule, which is 176 bytes long (11 words made up of 16 bytes).
@@ Line 41: / Line 41: @@
 Note that this implementation chooses to expand the key during the decryption process. This order of events isn't a big deal to us - the <code>subBytes()</code> operation will still be visible in a power trace.
-= Attacking AES-256 Decryption =
+== Attacking AES-256 Decryption ==
 From our experience with AES-128, we know that the AES substitution boxes are a good attack point. These boxes are non-linear, so we don't have any problems with nearly-correct key guesses. Since there are S-boxes operating on 1 byte each, we should be able to recover 16 bytes from the <code>SubBytes()</code> function. In the decryption code, this part of the algorithm corresponds to the first three lines: