![](https://csdnimg.cn/release/download_crawler_static/4833017/bga.jpg)
7KH 5LMQGDHO %ORFN &LSKHU
7KH 5LMQGDHO %ORFN &LSKHU7KH 5LMQGDHO %ORFN &LSKHU
7KH 5LMQGDHO %ORFN &LSKHU
$(6 3URSRVDO
Document version 2, Date: 03/09/99 Page: 8
/
45
3. Design rationale
The three criteria taken into account in the design of Rijndael are the following:
• Resistance against all known attacks;
• Speed and code compactness on a wide range of platforms;
• Design simplicity.
In most ciphers, the round transformation has the Feistel Structure. In this structure typically
part of the bits of the intermediate State are simply transposed unchanged to another position.
The round transformation of Rijndael does
not
have the Feistel structure. Instead, the round
transformation is composed of three distinct invertible uniform transformations, called
layers
.
By “uniform”, we mean that every bit of the State is treated in a similar way.
The specific choices for the different layers are for a large part based on the application of the
Wide Trail Strategy [Da95] (see Annex ), a design method to provide resistance against linear
and differential cryptanalysis (see Section 8.2). In the Wide Trail Strategy, every layer has its
own function:
The linear mixing layer
:
guarantees high diffusion over multiple rounds.
The non-linear layer
:
parallel application of S-boxes that have optimum worst-case
nonlinearity properties.
The key addition layer
:
A simple EXOR of the Round Key to the intermediate State.
Before the first round, a key addition layer is applied. The motivation for this initial key addition
is the following. Any layer after the last key addition in the cipher (or before the first in the
context of known-plaintext attacks) can be simply peeled off without knowledge of the key and
therefore does not contribute to the security of the cipher. (e.g., the initial and final permutation
in the DES). Initial or terminal key addition is applied in several designs, e.g., IDEA, SAFER
and Blowfish.
In order to make the cipher and its inverse more similar in structure, the linear mixing layer of
the last round is different from the mixing layer in the other rounds. It can be shown that this
does not improve or reduce the security of the cipher in any way. This is similar to the absence
of the swap operation in the last round of the DES.
4. Specification
Rijndael is an iterated block cipher with a variable block length and a variable key length. The
block length and the key length can be independently specified to 128, 192 or 256 bits.
Note:
this section is intended to explain the cipher structure and not as an implementation
guideline. For implementation aspects, we refer to Section 5.
4.1 The State, the Cipher Key and the number of rounds
The different transformations operate on the intermediate result, called the
State
:
Definition:
the intermediate cipher result is called the
State.
The State can be pictured as a rectangular array of bytes. This array has four rows, the
number of columns is denoted by Nb and is equal to the block length divided by 32.