2

Lets assume we know the last-round key of AES.

For AES-128, the whole key can be reconstructed using the last-round key since every WORD in the key schedule is based on the previous 128-bit entry.

For AES-256, it cannot be reconstructed, as we only know 128-bits. However, the reconstruction of the 4 WORDS would take us $2^{128}$ steps (bruteforce).

Now the question comes for AES-192, since we do not know either 64 or 96 bits of (2 to 3 WORDS), can we still bruteforce it?

Maarten Bodewes
  • 96,351
  • 14
  • 169
  • 323
hooujki
  • 41
  • 2

0 Answers0