I am preparing for my Information Security state exam. There is a question in preparation sheet that asks about order of operations to generate subkey for AES algorithm.

Operations listed:

  1. XOR with constant
  2. XOR with first 4 bytes of subkey
  3. s-box
  4. Circular left shift

I tried to google this question, but didn't find the answer. What is the right order?

  • 1
    Did you take a look at section 5.2 "Key Expansion" in the standard?
    – efie
    May 25, 2015 at 15:20

1 Answer 1


The "key expansion" or subkey generation in AES is an iterative process. Due to some work I am doing about this block cipher I have prepared an figure that may help you:

Rijndael's key expansion

The algorithm is checking if the iterator of the generator is in congruent with 0 modulo #columns to proceed with 3 operations or only with one if is not.

The rotWord() is a circular shift (I think is to the right), the call to subBytes() uses the SBox and RCon in the bottom is an operation in the polynomial field.

I hope this will help to find out yourself the answer for your test, without giving you the answer directly.

  • Thanks for your help! I think that I got idea how it works. May 25, 2015 at 15:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .