The article

The machine

the whole run · AES-128 · 40 stepsChapter 8 · the round, ten times
the state · step 1 of 40Chapters 1–2 · the fold, the mask

before round 1 · AddRoundKey

round key 0 · w0–w3Chapter 2 · the mask2b7e1516 28aed2a6 abf71588 09cf4f3c
Before round 1, step 1 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 0. All sixteen bytes changed. Byte 0 (row 0, column 0) went 32 to 19 and byte 1 (row 1, column 0) went 43 to 3d, and so on.
40 steps · every step of this run as text
  1. Before round 1, step 1 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 0. All sixteen bytes changed. Byte 0 (row 0, column 0) went 32 to 19 and byte 1 (row 1, column 0) went 43 to 3d, and so on.
  2. Round 1 of 10, step 2 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went 19 to d4 and byte 1 (row 1, column 0) went 3d to 27, and so on.
  3. Round 1 of 10, step 3 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 27 to bf and byte 2 (row 2, column 0) went 11 to 5d, and so on.
  4. Round 1 of 10, step 4 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. Fifteen of the sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went d4 to 04 and byte 1 (row 1, column 0) went bf to 66, and so on.
  5. Round 1 of 10, step 5 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 1. All sixteen bytes changed. Byte 0 (row 0, column 0) went 04 to a4 and byte 1 (row 1, column 0) went 66 to 9c, and so on.
  6. Round 2 of 10, step 6 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went a4 to 49 and byte 1 (row 1, column 0) went 9c to de, and so on.
  7. Round 2 of 10, step 7 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went de to db and byte 2 (row 2, column 0) went d2 to 87, and so on.
  8. Round 2 of 10, step 8 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went 49 to 58 and byte 1 (row 1, column 0) went db to 4d, and so on.
  9. Round 2 of 10, step 9 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 2. All sixteen bytes changed. Byte 0 (row 0, column 0) went 58 to aa and byte 1 (row 1, column 0) went 4d to 8f, and so on.
  10. Round 3 of 10, step 10 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went aa to ac and byte 1 (row 1, column 0) went 8f to 73, and so on.
  11. Round 3 of 10, step 11 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 73 to c1 and byte 2 (row 2, column 0) went cf to d6, and so on.
  12. Round 3 of 10, step 12 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. Fifteen of the sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went ac to 75 and byte 1 (row 1, column 0) went c1 to ec, and so on.
  13. Round 3 of 10, step 13 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 3. All sixteen bytes changed. Byte 0 (row 0, column 0) went 75 to 48 and byte 1 (row 1, column 0) went ec to 6c, and so on.
  14. Round 4 of 10, step 14 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went 48 to 52 and byte 1 (row 1, column 0) went 6c to 50, and so on.
  15. Round 4 of 10, step 15 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 50 to a4 and byte 2 (row 2, column 0) went 2f to c8, and so on.
  16. Round 4 of 10, step 16 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went 52 to 0f and byte 1 (row 1, column 0) went a4 to d6, and so on.
  17. Round 4 of 10, step 17 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 4. Fifteen of the sixteen bytes changed; a byte is left alone wherever its key byte is zero. Byte 0 (row 0, column 0) went 0f to e0 and byte 1 (row 1, column 0) went d6 to 92, and so on.
  18. Round 5 of 10, step 18 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went e0 to e1 and byte 1 (row 1, column 0) went 92 to 4f, and so on.
  19. Round 5 of 10, step 19 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 4f to fb and byte 2 (row 2, column 0) went d2 to 96, and so on.
  20. Round 5 of 10, step 20 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went e1 to 25 and byte 1 (row 1, column 0) went fb to d1, and so on.
  21. Round 5 of 10, step 21 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 5. All sixteen bytes changed. Byte 0 (row 0, column 0) went 25 to f1 and byte 1 (row 1, column 0) went d1 to 00, and so on.
  22. Round 6 of 10, step 22 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went f1 to a1 and byte 1 (row 1, column 0) went 00 to 63, and so on.
  23. Round 6 of 10, step 23 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 63 to 4f and byte 2 (row 2, column 0) went a8 to 3d, and so on.
  24. Round 6 of 10, step 24 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went a1 to 4b and byte 1 (row 1, column 0) went 4f to 86, and so on.
  25. Round 6 of 10, step 25 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 6. Fifteen of the sixteen bytes changed; a byte is left alone wherever its key byte is zero. Byte 0 (row 0, column 0) went 4b to 26 and byte 1 (row 1, column 0) went 86 to 0e, and so on.
  26. Round 7 of 10, step 26 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went 26 to f7 and byte 1 (row 1, column 0) went 0e to ab, and so on.
  27. Round 7 of 10, step 27 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went ab to 83 and byte 2 (row 2, column 0) went 31 to 40, and so on.
  28. Round 7 of 10, step 28 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went f7 to 14 and byte 1 (row 1, column 0) went 83 to 15, and so on.
  29. Round 7 of 10, step 29 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 7. All sixteen bytes changed. Byte 0 (row 0, column 0) went 14 to 5a and byte 1 (row 1, column 0) went 15 to 41, and so on.
  30. Round 8 of 10, step 30 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went 5a to be and byte 1 (row 1, column 0) went 41 to 83, and so on.
  31. Round 8 of 10, step 31 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 83 to 3b and byte 2 (row 2, column 0) went 2c to d4, and so on.
  32. Round 8 of 10, step 32 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went be to 00 and byte 1 (row 1, column 0) went 3b to 51, and so on.
  33. Round 8 of 10, step 33 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 8. All sixteen bytes changed. Byte 0 (row 0, column 0) went 00 to ea and byte 1 (row 1, column 0) went 51 to 83, and so on.
  34. Round 9 of 10, step 34 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went ea to 87 and byte 1 (row 1, column 0) went 83 to ec, and so on.
  35. Round 9 of 10, step 35 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went ec to 6e and byte 2 (row 2, column 0) went 4a to 46, and so on.
  36. Round 9 of 10, step 36 of 40: column mixing (MixColumns). Each column is multiplied by a fixed matrix in the byte field, so every byte of the new column depends on all four bytes of the old one. All sixteen cells now hold a different byte. Byte 0 (row 0, column 0) went 87 to 47 and byte 1 (row 1, column 0) went 6e to 37, and so on.
  37. Round 9 of 10, step 37 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 9. Fifteen of the sixteen bytes changed; a byte is left alone wherever its key byte is zero. Byte 0 (row 0, column 0) went 47 to eb and byte 1 (row 1, column 0) went 37 to 40, and so on.
  38. Round 10 of 10, the final round, step 38 of 40: byte substitution (SubBytes). Every byte is replaced by its entry in the S-box, independently of where it sits. All sixteen bytes changed, as they always do: the table maps no byte to itself. Byte 0 (row 0, column 0) went eb to e9 and byte 1 (row 1, column 0) went 40 to 09, and so on.
  39. Round 10 of 10, the final round, step 39 of 40: row shift (ShiftRows). Row 0 stands still while rows 1, 2 and 3 rotate left by one, two and three bytes. Twelve of the sixteen cells now hold a different byte, in rows 1, 2 and 3; row 0 is untouched. Byte 1 (row 1, column 0) went 09 to 31 and byte 2 (row 2, column 0) went 89 to 7d, and so on.
  40. Round 10 of 10, the final round, step 40 of 40: adding the round key (AddRoundKey). Every byte of the state is exclusive-ored with the matching byte of the round key. The key added here is the one for round 10. All sixteen bytes changed. Byte 0 (row 0, column 0) went e9 to 39 and byte 1 (row 1, column 0) went 31 to 25, and so on.