Protecting Against Eavesdroppers with Symmetric Cryptography - Implementing SSL/TLS Using Cryptography and PKI - page 75

Do everything in exactly the inverse order that you did it when encrypting.
This means that the loops occur in different orders. Look at the expanded set
of operations for an encryption:
1. AddRound Key
2. SubBytes
3. ShiftRows
4. MixColumns
5. AddRoundKey
6. SubBytes
7. ShiftRows
8. MixColumns
9. AddRoundKey
…
42. SubBytes
43. ShiftRows
44. AddRoundKey
This means that the decrypt loop won't be the same as the encrypt loop. It
starts with an AddRoundKey and is then followed by invShiftRows , invSubBytes ,
addRoundKey , and invMixColumns :
1. AddRound Key
2. SubBytes
3. ShiftRows
4. MixColumns
5. AddRoundKey
6. SubBytes
7. ShiftRows
8. MixColumns
9. AddRoundKey
…
42. SubBytes
43. ShiftRows
44. AddRoundKey
And then, a fi nal invShiftRows , invSubBytes and addRoundKey . Notice that
shiftRows , subBytes and mixColumns all need specifi c inversion routines whereas
addRoundKey is its own inverse, because it's just applying the XOR operation.
This is shown in Listing 2-40.