The Advanced Encryption Standard uses a key schedule to expand a short key into a number of separate round keys. The three AES variants have a different number of rounds. Each variant requires a separate 128-bit round key for each round plus one more. The key schedule produces the needed round keys from the initial key.

The round constant rcon_i for round i of the key expansion is the 32-bit word:

where rc_i is an eight-bit value defined as :

where ${\displaystyle \oplus }$ is the bitwise XOR operator and constants such as 00₁₆ and 11B₁₆ are given in hexadecimal. Equivalently:

where the bits of rc_i are treated as the coefficients of an element of the finite field ${\displaystyle {\rm {{GF}(2^{8})[x]/(x^{8}+x^{4}+x^{3}+x+1)}}}$, so that e.g. ${\displaystyle rc_{10}=36_{16}=00110110_{2}}$ represents the polynomial ${\displaystyle x^{5}+x^{4}+x^{2}+x}$.

AES uses up to rcon₁₀ for AES-128 (as 11 round keys are needed), up to rcon₈ for AES-192, and up to rcon₇ for AES-256.

Define:

Also define RotWord as a one-byte left circular shift: