The four operations of a round

Inside AES, each round applies the same succession of four operations to the state matrix. To understand these four steps is to understand the entire cipher.

Overview of a round

A complete round chains, in order:

  starting state
       |
   [ SubBytes ]     byte-by-byte substitution      -> confusion
       |
   [ ShiftRows ]    shifting of the rows            -> permutation
       |
   [ MixColumns ]   mixing of the columns           -> diffusion
       |
   [ AddRoundKey ]  XOR with the round key          -> adding the key
       |
  transformed state

SubBytes: the substitution

Each byte of the state is replaced by another, by looking it up in a fixed table called the S-box. This table associates with each of the 256 possible values another value, in a non-linear way: it is the only step of AES that is not a simple linear combination, and it is what brings the confusion, that is, an opaque relationship between the key and the ciphertext.

byte 0x53  --[ S-box ]-->  0xED

The same S-box is used for the 16 bytes; it is public and identical for everyone.

ShiftRows: the permutation

The bytes are moved by shifting each row of the state to the left, by a number of positions equal to its row number: row 0 does not move, row 1 shifts by 1, row 2 by 2, row 3 by 3.

before ShiftRows           after ShiftRows
[ a0 a1 a2 a3 ]            [ a0 a1 a2 a3 ]   (0 positions)
[ b0 b1 b2 b3 ]    -->     [ b1 b2 b3 b0 ]   (1 position)
[ c0 c1 c2 c3 ]            [ c2 c3 c0 c1 ]   (2 positions)
[ d0 d1 d2 d3 ]            [ d3 d0 d1 d2 ]   (3 positions)

This mixing scatters the bytes across the columns, so that the next step mixes them with new neighbors.

MixColumns: the diffusion

Each column of the state is treated as a whole: its 4 bytes are combined with each other by an algebraic operation. A single byte modified in the input column changes all four bytes of the output column. It is this step that ensures the diffusion: the influence of one byte spreads quickly over the whole block.

AddRoundKey: adding the key

Finally, the state is combined by a bitwise XOR with the round key (a different key for each round, derived from the master key). This is the only place where the key enters the computation.

An exception: the last round

The very first AddRoundKey takes place before the first round, and above all the last round omits MixColumns. This absence is intentional: it makes decryption symmetric with encryption, without weakening security.

In summary

• Each round applies four steps: SubBytes, ShiftRows, MixColumns, AddRoundKey.
• SubBytes (S-box, non-linear) brings the confusion; MixColumns brings the diffusion.
• ShiftRows permutes the bytes; AddRoundKey injects the round key through a XOR.
• The last round omits MixColumns, which simplifies decryption.