find master key given all but last decryption round keys I have all but the last round key in AES-256 CBC decryption, and would like to build the master key, but I am unsure how to go about it.
I have read I can convert decryption roundkeys to encryption roundkeys via forward MixColumns. Then perhaps xor key n-3, n-2 to get n-1 (one i need). Does S-box substitution come into play here?
Or is there a keyschedule generator based on decryption roundkeys rather than encryption... thank you for the help.
Unless you have a non-standard version of AES decryption, the decryption round keys should just be the encryption round keys in reverse order. In the notation of the wikipedia article, it sounds like you have $W_4,\ldots,W_{59}$ and you want to know $W_0,\ldots, W_7$ ($W_4,\ldots W_7$ represent the penultimate decryption round key; $W_8,\ldots W_{11}$ represent the antepenultimate decryption round key and so forth).
$W_4,\ldots W_7$ can be read off directly and (per the linked article) we have
$$W_8=W_0\oplus S(\mathrm{LeftShift}(W_7)\oplus 1\iff W_0=W_8\oplus S(\mathrm{LeftShift}(W_7))\oplus 1$$
and
$$W_9=W_1\oplus W_8\iff W_1=W_9\oplus W_8$$
$$W_{10}=W_2\oplus W_9\iff W_2=W_{10}\oplus W_9$$
$$W_{11}=W_3\oplus W_{10}\iff W_3=W_{11}\oplus W_{10}$$
which allows us to recover $W_0,\ldots,W_7$ which is the same as $K_0,\ldots, K_7$.
Note that the LeftShift function rotates the 32-bit word left by 8 bits and that the $S$-box is the same as used in AES encryption.
ETA if you are using the &quot;T-table&quot; implementation of AES (which is suggested by your MixCol remark), then yes, you will need to apply MixCol to the 32-bit words to get the $W_i$. If you use the standard AES MixCol() then no S-box adjustment is needed; if you use the T-table combined MixCol(Subbytes()) then you'll also need to apply the Inverse S-box as well.