If a single bit was known through all states in AES, which would cause the most information to leak?
If you are an attacker and could watch one bit of AES-128 for 10 rounds, which bit would you choose to recover the most useful information? I feel it would be a bit in the key schedule.


Actually, I'd expect a leak of one of the internal state bits would give the attacker more information.

The key schedule is static, and so if you leak 10 bits, well, you still have (at best) 118 bits of uncertainty in the key; no where close to small enough to be useful for an attacker.

However, if you leak the internal state, you can look at (say) one of the internal state bits after each round.  The advantage there is that we can look at the bits for a number of known plaintexts/ciphertexts; this yields considerably more information.  After 1 round, an internal bit is a function of the plaintext and 33 key bits; by looking at a number of plaintexts, we can get enough information to deduce those 33 key bits.