Key Schedule

AES expands the input key into a sequence of round keys, one per round (plus one initial). For AES-128 (10 rounds): 11 round keys × 16 bytes = 176 bytes.

Algorithm (AES-128):

Helpers:

• rot_word([a, b, c, d]) -> [b, c, d, a] (cyclic shift)
• sub_word(w) -> apply S-box to each byte
• rcon(i) -> [2^(i-1) in GF(2^8), 0, 0, 0]

The first 4 words ARE the key. Each subsequent word XORs the previous with either:

• The plain previous word, OR
• A transformed version (every Nk words: rot, sub, XOR with round constant)

Output: 11 round keys, each 16 bytes (4 words). Used in AddRoundKey.