AES (Rijndael) uses a key schedule to expand a short key into a number of separate round keys. This is known as the Rijndael key schedule. The three AES variants have a different number of rounds. Each variant requires a separate 128bit round key for each round plus one more. The key schedule produces the needed round keys from the initial key.
Round constants
Values of rc_{i} in hexadecimal
i

1 
2 
3 
4 
5 
6 
7 
8 
9 
10

rc_{i}

01 
02 
04 
08 
10 
20 
40 
80 
1B 
36

The round constant rcon_{i} for round i of the key expansion is the 32bit word:
 $rcon_{i}={\begin{bmatrix}rc_{i}&00_{16}&00_{16}&00_{16}\end{bmatrix}}$
where rc_{i} is an eightbit value defined as:
 $rc_{i}={\begin{cases}1&{\text{if }}i=1\\2\cdot rc_{i1}&{\text{if }}i>1{\text{ and }}rc_{i1}<80_{16}\\(2\cdot rc_{i1})\oplus {\text{11B}}_{16}&{\text{if }}i>1{\text{ and }}rc_{i1}\geq 80_{16}\end{cases}}$
where $\oplus$ is the bitwise XOR operator and constants such as 00_{16} and 11B_{16} are given in hexadecimal. Equivalently:
 $rc_{i}=x^{i1}$
where the bits of rc_{i} are treated as the coefficients of an element of the finite field ${\rm {{GF}(2)[x]/(x^{8}+x^{4}+x^{3}+x+1)}}$, so that e.g. $rc_{10}=36_{16}=00110110_{2}$ represents the polynomial $x^{5}+x^{4}+x^{2}+x$.
AES uses up to rcon_{10} for AES128 (as 11 round keys are needed), up to rcon_{8} for AES192, and up to rcon_{7} for AES256.^{[note 1]}
The key schedule
AES key schedule for a 128bit key
Define:
 N as the length of the key in 32bit words: 4 words for AES128, 6 words for AES192, and 8 words for AES256
 K_{0}, K_{1}, ... K_{N1} as the 32bit words of the original key
 R as the number of round keys needed: 11 round keys for AES128, 13 keys for AES192, and 15 keys for AES256^{[note 2]}
 W_{0}, W_{1}, ... W_{4R1} as the 32bit words of the expanded key^{[note 3]}
Also define RotWord as a onebyte left circular shift:
 $\operatorname {RotWord} ({\begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}\end{bmatrix}})={\begin{bmatrix}b_{1}&b_{2}&b_{3}&b_{0}\end{bmatrix}}$
and SubWord as an application of the AES Sbox to each of the four bytes of the word:
 $\operatorname {SubWord} ({\begin{bmatrix}b_{0}&b_{1}&b_{2}&b_{3}\end{bmatrix}})={\begin{bmatrix}\operatorname {S} (b_{0})&\operatorname {S} (b_{1})&\operatorname {S} (b_{2})&\operatorname {S} (b_{3})\end{bmatrix}}$
Then for $i=0\ldots 4R1$:
 $W_{i}={\begin{cases}K_{i}&{\text{if }}i<N\\W_{iN}\oplus \operatorname {SubWord} (\operatorname {RotWord} (W_{i1}))\oplus rcon_{i/N}&{\text{if }}i\geq N{\text{ and }}i\equiv 0{\pmod {N}}\\W_{iN}\oplus \operatorname {SubWord} (W_{i1})&{\text{if }}i\geq N{\text{, }}N>6{\text{, and }}i\equiv 4{\pmod {N}}\\W_{iN}\oplus W_{i1}&{\text{otherwise.}}\\\end{cases}}$
Notes
 ^
The Rijndael variants with larger block sizes use more of these constants, up to rcon_{29} for Rijndael with 128bit keys and 256 bit blocks (needs 15 round keys of each 256 bit, which means 30 full rounds of key expansion, which means 29 calls to the key schedule core using the round constants). The remaining constants for i ≥ 11 are: 6C, D8, AB, 4D, 9A, 2F, 5E, BC, 63, C6, 97, 35, 6A, D4, B3, 7D, FA, EF and C5
 ^ Other Rijndael variants require max(N, B) + 7 round keys, where B is the block size in words
 ^ Other Rijndael variants require BR words of expanded key
References
External links