AES Anatomy
FIPS 197 · GF(2⁸) · Key Expansion · Inverse Cipher
Build AES from byte arithmetic up — S-box, ShiftRows, MixColumns, key expansion and decryption — then break deliberately weakened variants and run a bounded AES-128 differential fault recovery, then show how accepted-output selection can still leak under a statistical ineffective-fault model.
Inspectable teaching code, not production cryptography or a constant-time implementation. Deliberately broken variants are opt-in and affect only the data path.
Where this lesson stops
- Modes of operation: AES Modes.
- Side channels and simulated power attacks: Power Trace; masking: Masked Core; timing: Timing Oracle.
- White-box implementations and key-schedule inversion: Glass Box.
- Why this S-box construction: Sleeve Check.
- Reduced-round real-AES cryptanalysis (integral, impossible differential, biclique and related-key) is not implemented. The DFA act is an implementation-fault model, not ordinary differential cryptanalysis.
- Act 9 is a bounded one-byte IFA/SIFA mechanism model that executes real faulted AES-128, not a physical injection measurement or a full multi-byte AES SIFA reproduction.
- AES-NI, bitslicing and performance engineering are outside this lab.
- EqInvCipher is described in one disclosure; this page steps InvCipher.
Sources: FIPS 197-upd1 (2023), §§3–5, Tables 4 and 6, Appendices A and B; FIPS 197 (2001) Appendix C vectors. The latter is the historical edition; the algorithm is unchanged by the 2023 editorial update. Fault-analysis sources: Dobraunig et al., SIFA (2018/071) and Daemen et al., Protecting against SIFA (2019/536).