Not a standard.Open for review.

XAES-512 builds on Protectstar Extended AES, first released in 2007. It uses a 4×16 state matrix (512 bits) instead of the 4×4 matrix (128 bits) used by standard AES, and retains Rijndael’s AddRoundKey, MixColumns, and SubBytes S-box unchanged; the ShiftRows offsets, number of rounds, and key expansion are extended.

Today, the name stands for “Extended Algorithm, Enhanced Security.” XAES-512 is not AES as defined by FIPS 197 and is not a replacement for it.

XAES-512 provides a single authenticated construction — not several freely selectable modes of operation. Confidentiality is provided by Counter mode (CTR); integrity and authenticity are provided by HMAC-SHA-512 following the Encrypt-then-MAC scheme (generic composition according to Bellare–Namprempre). The authentication tag is verified before every decryption.

The message format is defined as Wire Format v1 (Profile 0x02). Associated data is included in the authentication.

A key is derived from the password using PBKDF2-HMAC-SHA-512 — with a random salt for each message and 220,000 iterations (Profile 0x02). HKDF-SHA-512 then separates the keys for encryption and authentication. Passwords are UTF-8 encoded and Unicode NFC-normalized so that identical inputs produce the same key across platforms.

The iteration field transmitted in the header is capped (implementation limit) so that a message cannot force excessive computation before tag verification.

The number of rounds follows the Rijndael-derived derivation described in the document: the larger word count from block size and key size is decisive. For a 512-bit block, this is 16 words → 22 rounds; Profile 0x02 adds two further rounds in connection with the extended ShiftRows structure, resulting in 24 rounds in total.

Extended KeyExpansion process based on the Rijndael specification:

KeyExpansion(byte Key[4*Nk], word W[Nb*(Nr+1)])
{
  for (i = 0; i < Nk; i++)
    W[i] = (Key[4*i], Key[4*i+1], Key[4*i+2], Key[4*i+3]);

  for (i = Nk; i < Nb*(Nr+1); i++) {
    temp = W[i-1];
    if (i % Nk == 0 || (i % Nk == 4 && Nk > 6))
      temp = SubByte(RotByte(temp)) ^ Rcon[i / Nk];
    else if ((i % Nk == 8 || i % Nk == 12) && Nk > 6)
      temp = SubByte(temp);
    W[i] = W[i-Nk] ^ temp;
  }
}

With the standard offsets {0,1,2,3}, the 512-bit variant reaches full diffusion in the included structural diffusion measurement only after 6 rounds. The selected offsets {0,1,4,5} reach it in this measurement after 4 rounds.

The diffusion statement can be reproduced using the diffusion_check.py tool in the bundle. The core-kats.json file contains additional known-answer tests for the core cipher.