07B — Symmetric Deep-Dive
AES Round 1 — Every Step Expanded
FIPS-197 vector, byte by byte: S-box coordinates, ShiftRows index map, MixColumns binary longhand with intermediate XORs, AddRoundKey per byte. Companion to 07.
Step 0 · State layout + Round 0 (every byte)
State is column-major. Byte index = row + 4×col. Plaintext and K₀ are laid column-wise, then XORed.
# Byte indices (col-major) for reference:
idx: 0 4 8 12 # col0 = idx 0..3, col1 = 4..7, ...
1 5 9 13
2 6 10 14
3 7 11 15
P (cols): 32 88 31 e0 | 43 5a 31 37 | f6 30 98 07 | a8 8d a2 34
K0 (cols): 2b 28 ab 09 | 7e ae f7 cf | 15 d2 15 4f | 16 a6 88 3c
XOR per byte, e.g. col0:
idx0: 0x32⊕0x2b = 00110010⊕00101011 = 00011001 = 0x19
idx1: 0x88⊕0x28 = 10001000⊕00101000 = 10100000 = 0xa0
idx2: 0x31⊕0xab = 00110001⊕10101011 = 10011010 = 0x9a
idx3: 0xe0⊕0x09 = 11100000⊕00001001 = 11101001 = 0xe9
# ... same for cols 1–3 ...
State0:
19 a0 9a e9 | 3d f4 c6 f8 | e3 e2 8d 48 | be 2b 2a 08
Step 1 · SubBytes — every byte with S-box coordinates
S-box index: high nibble = row, low nibble = column. E.g. 0x19 → row 1, col 9 → 0xd4.
# col0:
0x19 (r1,c9)→d4 0xa0 (rA,c0)→e0 0x9a (r9,cA)→b8 0xe9 (rE,c9)→1e
# col1:
0x3d (r3,cD)→27 0xf4 (rF,c4)→bf 0xc6 (rC,c6)→b4 0xf8 (rF,c8)→41
# col2:
0xe3 (rE,c3)→11 0xe2 (rE,c2)→98 0x8d (r8,cD)→5d 0x48 (r4,c8)→52
# col3:
0xbe (rB,cE)→ae 0x2b (r2,cB)→f1 0x2a (r2,cA)→e5 0x08 (r0,c8)→30
State after SubBytes
d4 e0 b8 1e
27 bf b4 41
11 98 5d 52
ae f1 e5 30
Step 2 · ShiftRows — index map (every row)
# Row r shifts left by r. Showing (idx before → idx after):
Row0 (r=0): [d4 e0 b8 1e] → [d4 e0 b8 1e] # idx 0,4,8,12 stay
Row1 (r=1): [27 bf b4 41] → [bf b4 41 27] # idx 1←5, 5←9, 9←13, 13←1
Row2 (r=2): [11 98 5d 52] → [5d 52 11 98] # idx 2←10, 6←14, 10←2, 14←6
Row3 (r=3): [ae f1 e5 30] → [30 ae f1 e5] # idx 3←15, 7←3, 11←7, 15←11
State after ShiftRows
d4 e0 b8 1e
bf b4 41 27
5d 52 11 98
30 ae f1 e5
Step 3 · MixColumns — binary longhand + intermediate XORs
Rule: 2·x = left-shift, XOR 0x1B (00011011) iff MSB=1. 3·x = 2·x ⊕ x. Each output = XOR of 4 terms; intermediates shown so every nibble is checkable.
[s'0,s'1,s'2,s'3]ᵀ = [2 3 1 1; 1 2 3 1; 1 1 2 3; 3 1 1 2]·[s0,s1,s2,s3]ᵀ (GF(2⁸)/0x11B)
Column 0 — [d4, bf, 5d, 30]ᵀ
# 2· longhand:
2·d4: 11010100 MSB1 → 10101000⊕00011011 = 10110011=b3; 3·d4=b3⊕d4=01100111=67
2·bf: 10111111 MSB1 → 01111110⊕00011011 = 01100101=65; 3·bf=65⊕bf=11011010=da
2·5d: 01011101 MSB0 → 10111010=ba; 3·5d=ba⊕5d=11100111=e7
2·30: 00110000 MSB0 → 01100000=60; 3·30=60⊕30=01010000=50
s'0 = b3⊕da⊕5d⊕30: b3⊕da=01101001=69; 5d⊕30=01101101=6d; 69⊕6d=04
s'1 = d4⊕65⊕e7⊕30: d4⊕65=10110001=b1; e7⊕30=11010111=d7; b1⊕d7=66
s'2 = d4⊕bf⊕ba⊕50: d4⊕bf=01101011=6b; ba⊕50=11101010=ea; 6b⊕ea=81
s'3 = 67⊕bf⊕5d⊕60: 67⊕bf=11011000=d8; 5d⊕60=00111101=3d; d8⊕3d=e5
→ 04 66 81 e5
Column 1 — [e0, b4, 52, ae]ᵀ
2·e0: 11100000→11000000⊕00011011=db; 3·e0=3b 2·b4: 10110100→01101000⊕00011011=73; 3·b4=c7
2·52: 01010010→a4; 3·52=f6 2·ae: 10101110→01011100⊕00011011=47; 3·ae=e9
s'0=db⊕c7⊕52⊕ae: db⊕c7=00011100=1c; 52⊕ae=11111100=fc; →e0
s'1=e0⊕73⊕f6⊕ae: e0⊕73=10010011=93; f6⊕ae=01011000=58; →cb
s'2=e0⊕b4⊕a4⊕e9: e0⊕b4=01010100=54; a4⊕e9=01001101=4d; →19
s'3=3b⊕b4⊕52⊕47: 3b⊕b4=10001111=8f; 52⊕47=00010101=15; →9a
→ e0 cb 19 9a
Column 2 — [b8, 41, 11, f1]ᵀ
2·b8: 10111000→01110000⊕00011011=6b; 3·b8=d3 2·41: 01000001→82; 3·41=c3
2·11: 00010001→22; 3·11=33 2·f1: 11110001→11100010⊕00011011=f9; 3·f1=08
s'0=6b⊕c3⊕11⊕f1: 6b⊕c3=10101000=a8; 11⊕f1=11100000=e0; →48
s'1=b8⊕82⊕33⊕f1: b8⊕82=00111010=3a; 33⊕f1=11000010=c2; →f8
s'2=b8⊕41⊕22⊕08: b8⊕41=11111001=f9; 22⊕08=00101010=2a; →d3
s'3=d3⊕41⊕11⊕f9: d3⊕41=10010010=92; 11⊕f9=11101000=e8; →7a
→ 48 f8 d3 7a
Column 3 — [1e, 27, 98, e5]ᵀ
2·1e: 00011110→3c; 3·1e=22 2·27: 00100111→4e; 3·27=69
2·98: 10011000→00110000⊕00011011=2b; 3·98=b3 2·e5: 11100101→11001010⊕00011011=d1; 3·e5=34
s'0=3c⊕69⊕98⊕e5: 3c⊕69=01010101=55; 98⊕e5=01111101=7d; →28
s'1=1e⊕4e⊕b3⊕e5: 1e⊕4e=01010000=50; b3⊕e5=01010110=56; →06
s'2=1e⊕27⊕2b⊕34: 1e⊕27=00111001=39; 2b⊕34=00011111=1f; →26
s'3=22⊕27⊕98⊕d1: 22⊕27=00000101=05; 98⊕d1=01001001=49; →4c
→ 28 06 26 4c
State after MixColumns
04 e0 48 28
66 cb f8 06
81 19 d3 26
e5 9a 7a 4c
Step 4 · AddRoundKey — K₁ columns built step-by-step, then every byte
# K1 = W4 ‖ W5 ‖ W6 ‖ W7 (4 words → 4 columns, column-major):
col0 = W4 = a0 fa fe 17 # a0=2b⊕8b fa=7e⊕84 fe=15⊕eb 17=16⊕01
col1 = W5 = 88 54 2c b1 # 88=28⊕a0 54=ae⊕fa 2c=d2⊕fe b1=a6⊕17
col2 = W6 = 23 a3 39 39 # 23=ab⊕88 a3=f7⊕54 39=15⊕2c 39=88⊕b1
col3 = W7 = 2a 6c 76 05 # 2a=09⊕23 6c=cf⊕a3 76=4f⊕39 05=3c⊕39
# As 4x4 (rows): a0 88 23 2a / fa 54 a3 6c / fe 2c 39 76 / 17 b1 39 05
# XOR state ⊕ K1, byte by byte:
col0: 04⊕a0=a4 (00000100⊕10100000=10100100) 66⊕fa=9c 81⊕fe=7f e5⊕17=f2
col1: e0⊕88=68 cb⊕54=9f 19⊕2c=35 9a⊕b1=2b
col2: 48⊕23=6b f8⊕a3=5b d3⊕39=ea 7a⊕39=43
col3: 28⊕2a=02 06⊕6c=6a 26⊕76=50 4c⊕05=49
State after Round 1 — FIPS-197 ✓
a4 68 6b 02
9c 9f 5b 6a
7f 35 ea 50
f2 2b 43 49
Exam one-liner: Quote any intermediate (e.g.
b3⊕da=69, db⊕c7=1c) to prove binary-level working — then final state a4 68 6b 02….