◄ WORLD V · SONNY 5DART 197 · a helldive at the net

THE KEY SCHEDULE one master key becomes a different subkey per round

A cipher does not use its master key directly; a key schedule expands it into a distinct subkey for every round, mixing in rotations, S-boxes and round constants so the subkeys look independent. A weak schedule is a back door: if subkeys are too related, a related-key attack can break a cipher whose rounds are individually strong — the schedule is as much a part of the security as the round function.

THE TECHNIQUE master key -> per-round subkeys via rotate + round constant

Expand one master key into three round subkeys by rotating and XORing a round constant each round — the constant is what stops all the subkeys collapsing to rotations of each other. Watch the subkeys diverge: live demo







  
HISTORY & CREDIT DES/AES key schedules; related-key: Knudsen 1992/Biham 1993

  
“The key schedule is just bookkeeping; only the round function matters.” — no. A weak schedule sinks a strong cipher: DES has weak keys (all-zero subkeys) and related-key attacks (Knudsen 1992, named by Biham 1993) exploit predictable subkey relationships; the AES-256 schedule was the entry point for its best-known related-key attack. The schedule is security. cited

  
1977 · DES — a permutation-choice key schedule with four weak keys whose subkeys are all identical (self-inverse encryption).
1992 · Lars Knudsen — introduces related-key cryptanalysis (AUSCRYPT, cryptanalysing LOKI); 1993 · Eli Biham — names and generalises it (“New Types of Cryptanalytic Attacks Using Related Keys”, EUROCRYPT), exploiting known subkey relationships.
2001 · AES/Rijndael — the key expansion (RotWord, SubWord, Rcon round constants) — whose structure enabled the 2009 related-key attacks on AES-192/256.

  
The round constants exist precisely to break symmetry: without a per-round constant the schedule would be a pure rotation, every subkey a shift of the last — exactly the predictability a related-key attack needs. DES 1977 / Biham 1993






  
RECOMMEND FOR I-13 master key expanded, computed

  
On the canonical compiler the master key expands into diverging round subkeys — rotate plus round constant, all bitwise:

  
$ i13 run keysched.i13   # k_i = rotl8(k_{i-1}, 1) xor round_constant
master = 178
k1 = 100   k2 = 202   k3 = 145   -- three distinct subkeys, round constants 1,2,4 breaking symmetry

  
Recommend: the key schedule is LIT and the other half of an I-13 cipher’s security — verified a master key 178 expands to distinct round subkeys 100, 202, 145 via rotl8 and XORed round constants (1, 2, 4), all in <</>>/⊕. It supplies the per-round keys a Feistel (190) or SPN (192) consumes, and the round constants are the load-bearing detail — without them the subkeys are pure rotations, the exact predictability a related-key attack (Biham 1993) exploits. The honest lesson the corpus prizes: a cipher is only as strong as its weakest component, and the schedule is a component, not bookkeeping.