AES (Advanced Encryption Standard)
A widely deployed block cipher, chosen through an open competition and studied for decades.
Why This Matters
AES protects data in many network, storage and messaging systems. It is one component of a secure construction: the mode of operation, authentication, nonce handling and key management matter too. Other algorithms, including ChaCha20-Poly1305, also protect modern communications. No practical key-recovery attack is known against correctly used full-round AES.
By 1997 NIST knew DES was finished and ran an open international competition to replace it. Fifteen submissions from twelve countries; five finalists (MARS, RC6, Rijndael, Serpent, Twofish) survived to round two. After three years of public cryptanalysis NIST chose Rijndael by Joan Daemen and Vincent Rijmen of Belgium. The choice was driven by speed, hardware-friendliness, and design clarity. FIPS 197 was published 26 November 2001.
AES is a substitution-permutation network operating on a 4×4 byte state. After an initial AddRoundKey step, the rounds use four operations:
- SubBytes — replace each byte via a non-linear S-box (inversion in GF(28), with a defined value for zero, followed by an affine transformation)
- ShiftRows — cyclically shift each row by 0/1/2/3 positions
- MixColumns — multiply each column by a fixed polynomial (skipped in the final round)
- AddRoundKey — XOR with the round-specific subkey
AES-128 runs 10 rounds, AES-192 runs 12, AES-256 runs 14. The key schedule expands the master key into all round keys. The four-operation round delivers Shannon's confusion (S-box) and diffusion (ShiftRows + MixColumns). Repeated rounds spread changes through the state; diffusion alone is not a proof of security.
Cryptanalysis studies reduced-round variants and theoretical improvements over exhaustive key search, but these do not provide a practical break of full-round AES. Systems can still fail through cache-timing leakage, unauthenticated encryption, weak mode choices or nonce reuse in GCM. BEAST concerned TLS CBC initialization vectors, CRIME exploited compression, and Lucky Thirteen exploited CBC authentication timing; they were not three cache attacks on AES. Hardware AES instructions can improve speed and reduce some software timing risks, but do not repair a flawed protocol.
| Where | How AES is Used |
|---|---|
| HTTPS (TLS 1.2/1.3) | AES-GCM is widely supported; TLS 1.3 also specifies ChaCha20-Poly1305 |
| Full-disk encryption | AES-based storage encryption is common; the supported mode and default depend on the product and configuration |
| Wi-Fi WPA2 / WPA3 | AES-CCMP is common; WPA3-Enterprise 192-bit mode uses GCMP-256. WPA3 does not universally mean AES-256 |
| Messaging apps | Modes vary by protocol. The Signal ratchet specification describes AES-CBC with HMAC or a suitable SIV construction, not a universal AES-GCM requirement |
| US government | CNSA 2.0 specifies AES-256 for National Security Systems |
| Era | Modern · 2001 |
| Status | FIPS 197 standard; CNSA 2.0 specifies AES-256 for National Security Systems |
| Origin | Joan Daemen & Vincent Rijmen (Belgium, 1998); standardised as FIPS 197 in 2001 |
| Year | 2001 |
| Type | Symmetric block cipher (substitution-permutation network, 128-bit block, 128/192/256-bit key) |
| Modern Role | HTTPS, full-disk encryption (BitLocker, FileVault, LUKS), Wi-Fi WPA2/3, VPNs, messaging apps, cloud storage |