The State

ShiftRows

ShiftRows permutes the substituted bytes by row. The grid shows exactly where the bytes move.

highlighted = computed this step

Why rows shift

ShiftRows rotates each row left by its row index. That spreads byte positions before the column mixing step.

row r shifts by r\text{row r shifts by r}
ShiftRowsAES state bytes shown as a column-major grid.ShiftRows - shiftrowsrowc0c1c2c3r00xd40xe00xb80x1er10xbf0xb40x410x27r20x5d0x520x110x98r30x300xae0xf10xe5

Read the ShiftRows state

The recomputed state is 0xd4bf5d30e0b452aeb84111f11e2798e5.

0xd4bf5d30e0b452aeb84111f11e2798e50xd4bf5d30e0b452aeb84111f11e2798e5
ShiftRowsAES state bytes shown as a column-major grid.ShiftRows - shiftrowsrowc0c1c2c3r00xd40xe00xb80x1er10xbf0xb40x410x27r20x5d0x520x110x98r30x300xae0xf10xe5

Why this follows SubBytes

The same bytes from SubBytes are still present, but their row positions changed. The transform is a permutation, not an arithmetic mix.

permutation only\text{permutation only}
ShiftRowsAES state bytes shown as a column-major grid.ShiftRows - shiftrowsrowc0c1c2c3r00xd40xe00xb80x1er10xbf0xb40x410x27r20x5d0x520x110x98r30x300xae0xf10xe5

Summary

ShiftRows permutes the substituted bytes. NOTE: no-padding; no-side-channel; no-production; never-roll-your-own. Exact byte transforms of ONE AES round over GF(2^8); real AES with 128 runs 10 rounds with a key schedule inside a reviewed mode such as CBC or GCM.

ShiftRows recomputed\text{ShiftRows recomputed}
ShiftRowsAES state bytes shown as a column-major grid.ShiftRows - shiftrowsrowc0c1c2c3r00xd40xe00xb80x1er10xbf0xb40x410x27r20x5d0x520x110x98r30x300xae0xf10xe5