If data is encrypted today, there is a good chance that AES, the Advanced Encryption Standard, is involved. It is used by encrypted disks, HTTPS connections, protected Wi-Fi networks, password-protected archives and countless applications. It is worth understanding, without formulas, how it works and why it is considered trustworthy.
Where AES comes from
At the end of the 1990s the old DES standard, with its 56-bit key, was no longer adequate. The US standards body NIST therefore organised an open, public competition: anyone could submit an algorithm, and anyone could try to attack the others.
The winner was Rijndael, designed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen. It was published as a standard in 2001 under the name AES. The fact that the choice was made transparently, after years of analysis by the international community, is one of the main reasons it is so widely trusted.
A block cipher
AES is a symmetric block cipher: it takes data in blocks of 128 bits (16 bytes) and, using a secret key, transforms each block into an encrypted block of the same size. The same key is used to reverse the process.
The key can have three lengths:
| Variant | Key length | Number of rounds |
|---|---|---|
| AES-128 | 128 bits | 10 |
| AES-192 | 192 bits | 12 |
| AES-256 | 256 bits | 14 |
A "round" is a complete pass of transformations. The longer the key, the more rounds are performed.
What happens inside a round
Picture the 16 bytes of the block arranged in a grid of 4 rows by 4 columns, called the state. Each round applies four operations, each with a specific purpose.
- SubBytes (substitution): each byte is replaced with another according to a fixed table called the S-box. This is the non-linear part of the algorithm, the part that prevents it from being described with simple equations.
- ShiftRows: the rows of the grid are shifted by a different number of positions. This way the bytes of one column are mixed with those of the others.
- MixColumns: each column is transformed with a mathematical operation that makes each byte depend on all four bytes in the column.
- AddRoundKey: the state is combined with a round subkey using the XOR operation.
The subkeys are derived from the main key through a procedure called key expansion, which produces a different one for each round.
Confusion and diffusion
These operations implement two principles formulated by Claude Shannon in the mid-twentieth century:
- confusion: the relationship between the key and the ciphertext must be as complicated as possible;
- diffusion: changing a single bit of plaintext must alter roughly half the bits of the ciphertext.
After a few rounds, every output bit depends on every input bit and every key bit. This "avalanche effect" is what makes it pointless to look for patterns in the ciphertext.
AES alone is not enough: the mode of operation
AES encrypts a single 16-byte block. To encrypt a file, a message or a network stream, you need a mode of operation, which defines how blocks are chained together. This aspect is often overlooked, but it is essential.
- ECB mode, which encrypts each block independently, should be avoided: identical blocks produce identical ciphertext blocks and let the structure of the data show through.
- Modern modes such as GCM encrypt and authenticate the data at the same time, which means you can detect whether someone has tampered with it.
Whenever you hear "encrypted with AES-256", also ask which mode is used and how the key is managed.
AES-128 or AES-256?
Both variants are considered secure. Trying every 128-bit key is beyond the reach of any existing or foreseeable technology. AES-256 offers an extra margin and is the common choice when you want to account for possible future quantum computers: Grover's algorithm would in theory reduce the effort of brute force, but with 256 bits the margin remains wide.
There is currently no practical attack that breaks full AES. Successful real-world attacks target something else: weak passwords from which the key is derived, keys left in memory or in unprotected files, implementations that leak information through execution timing, misused modes of operation.
Fast thanks to hardware too
Most modern processors, for PCs and smartphones, include dedicated AES instructions. This means that encrypting an entire disk has an almost imperceptible impact on performance, and there is no longer any excuse for leaving data unencrypted. On devices without these instructions, ChaCha20 is often used instead, an alternative algorithm designed to be fast even in software alone.
In short
- AES is a symmetric block cipher chosen in 2001 at the end of a public competition.
- It works on 128-bit blocks, with 128, 192 or 256-bit keys and 10, 12 or 14 rounds.
- Each round combines substitution, shifting, mixing and key addition to achieve confusion and diffusion.
- Real-world security also depends on the mode of operation and on key management.
- There are no practical attacks on full AES: the weak points are almost always around the algorithm.
