Take the 2-minute tour ×

Looking at the first step of AES encryption I see that we XOR the key with the plaintext block. Why is the actual key involved at all, why not just use the round keys derived from the key schedule?

share|improve this question
I've updated my answer to reflect the changes in the question. –  mikeazo Apr 21 '13 at 14:22

1 Answer 1

up vote 1 down vote accepted

Update to answer new question

Technically the question is a little confused. The key schedule is defines the first round key as the encryption key. So when you say "why not use the round keys derived from the key schedule", the answer is that you are using the round keys derived from the key schedule. The first round key is defined as the encryption key. So they are using the key schedule to derive all round keys.

Clearly this does not weaken security at all or we wouldn't be using AES. Even when using a key such as all 0's the fact that there are multiple rounds mitigates any problems.

Looking at section 5.8 of The Design of Rijndael (which is written by the designers of the cipher) doesn't give much insight as to why they choose to design the key schedule this way. They do say they wanted a recursive process, so starting with the original cipher key seems natural. Using the cipher key directly as the first round key eliminates one call to the key schedule generation code. This will make encrypting a small number of blocks on resource constrained devices (i.e., devices where the entire key schedule cannot be cached) faster.

Old answer to old question

Note: this answer was for a previous version of the question.

Recall the structure of AES:

Initial Round (AddRoundKey)
Rounds (SubBytes, ShiftRow, MixColumn, AddRoundKey)
Final Round (SubBytes, ShiftRow, AddRoundKey)


So the last operation of the last round is AddRoundKey so it makes sense that AddRoundKey would be the first operation of decryption.

share|improve this answer

Your Answer

