Advanced Encryption Standard (AES)

The Advanced Encryption Standard (AES), originally known as Rijndael, is a specification for the electronic encryption of data established by the U.S. National Institute of Standards and Technology (NIST) in 2001 (FIPS PUB 197). It is a symmetric-key block cipher, meaning the identical secret cryptographic key is used for both encrypting plaintext into ciphertext and decrypting ciphertext back into plaintext.

AES has superseded the legacy Data Encryption Standard (DES) and Triple DES (3DES), becoming the worldwide gold standard for securing sensitive data at rest and in transit across enterprise databases, file systems, VPNs, and HTTPS protocols (TLS 1.3).

---

Technical Specifications at a Glance

Specification	AES-128	AES-192	AES-256
Key Size (bits / bytes)	128 bits (16 bytes)	192 bits (24 bytes)	256 bits (32 bytes)
Block Size	128 bits (16 bytes)	128 bits (16 bytes)	128 bits (16 bytes)
Transformation Rounds	10 rounds	12 rounds	14 rounds
Round Key Size	128 bits	128 bits	128 bits
Expanded Key Material	176 bytes	208 bytes	240 bytes
Quantum Resistance	~64 bits (Grover's)	~96 bits	128 bits (Recommended)
Standard Specification	NIST FIPS 197	NIST FIPS 197	NIST FIPS 197 / NSA Suite B

---

How AES Works Under the Hood

AES operates on fixed-size blocks of 128 bits (16 bytes) arranged in a 4×4 column-major order matrix of bytes called the State.

State Matrix (4x4 bytes = 16 bytes = 128 bits):
[ S0,0   S0,1   S0,2   S0,3 ]
[ S1,0   S1,1   S1,2   S1,3 ]
[ S2,0   S2,1   S2,2   S2,3 ]
[ S3,0   S3,1   S3,2   S3,3 ]

Before processing begins, the original cipher key undergoes Key Expansion via the Rijndael key schedule to generate individual subkeys for each round. The encryption routine then executes an initial round, followed by multiple main transformation rounds (10, 12, or 14 rounds depending on key length), and completes with a modified final round:

The 4 Core Transformation Steps

1. SubBytes (Non-linear Substitution): Each byte in the State matrix is independently replaced with another byte using an 8-bit substitution box called the S-box. This step provides non-linearity (confusion), thwarting differential and linear cryptanalysis.
2. ShiftRows (Permutation): The rows of the State are cyclically shifted to the left by varying offsets: row 0 shifts by 0 bytes, row 1 shifts by 1 byte, row 2 shifts by 2 bytes, and row 3 shifts by 3 bytes. This diffuses byte values across different columns.
3. MixColumns (Linear Transformation): Each column of 4 bytes is multiplied by a fixed polynomial matrix modulo $x^4 + 1$ in the Galois Field $\text{GF}(2^8)$. This mixes the bits thoroughly across columns. (Note: MixColumns is omitted in the final round).
4. AddRoundKey: The State matrix is combined with the corresponding round key using a bitwise XOR ($\oplus$) operation.

---

Block Cipher Modes: ECB vs CBC vs GCM

Because AES natively encrypts only 128 bits (16 bytes) at a time, processing arbitrary lengths of data requires an operational mode. Selecting the correct mode is critical for application security:

Mode	Authenticated?	Parallelizable?	Initialization Vector (IV)?	Security Verdict
ECB (Electronic Codebook)	No	Yes	None	Insecure: Identical plaintext blocks produce identical ciphertext, exposing data patterns.
CBC (Cipher Block Chaining)	No	Decryption only	Required (Random 16 bytes)	Legacy: Prone to padding oracle attacks unless combined with an HMAC.
CTR (Counter Mode)	No	Yes (Fast)	Required (Unique Nonce)	Secure: Turns block cipher into a stream cipher; requires strict nonce uniqueness.
GCM (Galois/Counter Mode)	Yes (AEAD)	Yes (Hardware Accelerated)	Required (96-bit Nonce)	Industry Standard: Provides both confidentiality and tamper-proof data authenticity.

[!WARNING] Never use ECB mode in production. Even though data is technically encrypted, repeating patterns remain visible in the ciphertext (often demonstrated using the famous pixelated "ECB Penguin"). Always prefer an AEAD (Authenticated Encryption with Associated Data) mode such as AES-GCM.

---

Code Example: AES-GCM in JavaScript (Web Crypto API)

Modern web browsers and Node.js environments support hardware-accelerated AES-GCM directly through the native standard crypto.subtle API:

// Encrypt text using native Web Crypto API (AES-GCM 256-bit)
async function encryptAesGcm(plaintext, rawKey) {
  const enc = new TextEncoder();
  const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit standard IV

  const cryptoKey = await crypto.subtle.importKey(
    "raw",
    rawKey,
    { name: "AES-GCM" },
    false,
    ["encrypt"]
  );

  const ciphertext = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv },
    cryptoKey,
    enc.encode(plaintext)
  );

  return {
    iv: Array.from(iv),
    ciphertext: Array.from(new Uint8Array(ciphertext))
  };
}

---

Security Best Practices & Developer Pitfalls

1. Never Reuse Nonces/IVs in AES-GCM: In Galois/Counter Mode, reusing the same Initialization Vector (IV) with the identical secret key catastrophically reveals the authentication subkey (GHASH), allowing attackers to forge messages and recover plaintext. Always generate a cryptographically secure, random 96-bit (12-byte) nonce for every single encryption operation.
2. Derive Keys with KDFs: Never use raw user passwords directly as AES keys. Passwords must be run through a memory-hard Key Derivation Function such as Argon2id or PBKDF2 with a unique salt to generate the required 256 bits of entropy. You can use our Password Generator to inspect high-entropy keys.
3. Verify Integrity (AEAD): Unauthenticated modes (like CBC or CTR without an HMAC) allow attackers to manipulate ciphertext bits in transit. Always use an authenticated mode like AES-256-GCM or AES-256-CCM.
4. Side-Channel Attacks: Software-only implementations can leak secret keys through CPU cache latency and timing variances. Always use platform crypto primitives (e.g., OpenSSL, Web Crypto API, or AES-NI CPU instructions) that feature constant-time execution.

---

Frequently Asked Questions

Is AES-256 crackable by brute force?

No. An AES-256 key has $2^{256}$ possible combinations ($\approx 1.15 \times 10^{77}$). Even if every supercomputer on Earth could test trillions of keys per second, exhausting the search space would require billions of years—longer than the age of the known universe.

What is the difference between AES-128 and AES-256?

AES-128 uses a 128-bit key over 10 transformation rounds, whereas AES-256 uses a 256-bit key over 14 rounds. While AES-128 is computationally secure against all known conventional attacks and runs slightly faster, AES-256 is universally mandated for top-secret government classifications and provides robust post-quantum security against Grover's algorithm.

Can AES encrypt arbitrary-length files?

Yes. Although the AES block size is strictly fixed at 16 bytes, operational modes like GCM or CTR turn the block cipher into a stream cipher, enabling encryption of any file size or continuous network stream without requiring block padding.

How does AES differ from hashing algorithms like SHA-256?

AES is a two-way encryption algorithm intended to protect confidentiality so authorized users with the secret key can decrypt the data. In contrast, SHA-256 is a one-way cryptographic hash function designed to generate a fixed digest that can never be reversed or decrypted. You can test one-way hashing with our Hash Generator tool.