AES, the Advanced Encryption Standard

AES (the Advanced Encryption Standard, a variant of the Rijndael cipher) is a block cipher with a 128-bit block and a key of 128, 192 or 256 bits. It's the world's default symmetric cipher. NIST standardized it in 2001, the US government approved it for protecting secrets, nearly every processor has it built in, and it's the cipher behind every message sealed on cipher.ink. This page is the reference card. For how the rounds work, with a worked example, read AES explained.

Try it

Three tools use AES, each from a different angle.

• The round explorer steps through every round of AES on any block, with the intermediate state of each step.
• The playground encrypts and decrypts text with AES-GCM, CBC and CTR using your browser's Web Crypto, and shows the tag and what tampering does.
• The ECB picture demo encrypts a picture two ways to show why the mode matters as much as the cipher.

Specifications

Rijndael, the original design by Joan Daemen and Vincent Rijmen, allowed block sizes of 128, 192 and 256 bits. AES is the subset with a fixed 128-bit block. Each round applies SubBytes (an S-box on every byte), ShiftRows, MixColumns and AddRoundKey, and the last round skips MixColumns. The explainer takes each in turn.

Where AES is standardized and used

• FIPS 197, published by NIST on 26 November 2001 and in force from 26 May 2002.
• US classified information. In June 2003 the US government said AES with any of the three key lengths could protect information up to SECRET, and that TOP SECRET needed 192 or 256-bit keys. Later NSA guidance allows classified information only with 256-bit keys.
• Everyday protocols. TLS 1.3 requires every implementation to support an AES-GCM cipher suite (TLS_AES_128_GCM_SHA256). SSH, IPsec and Wi-Fi's WPA2 (as AES-CCMP) use it, and disk encryption such as BitLocker and FileVault uses AES in XTS mode.
• Hardware. Intel, AMD and ARM processors have AES instructions (AES-NI on x86). With them AES-128 runs at about 1.3 cycles per byte and AES-256 at about 1.8, many times faster than software and in constant time.

What it has going for it

• No practical attack. The best published attack on the full cipher (biclique, Bogdanov, Khovratovich and Rechberger, 2011) is only 2 to 4 times faster than brute force, which makes no difference to anyone. Attacks on reduced-round versions exist, with a wide margin left.
• Brute force is out of reach. 2¹²⁸ keys, searched at 10¹⁸ a second, take about 10¹³ years, some 780 times the age of the universe.
• Quantum computers matter little. Grover's algorithm halves the key length in bits, so AES-256 still has an effective 128 bits. That's why the cipher.ink key is 256 bits.

Where it's weaker

• Related-key attacks. In 2009 researchers found attacks on AES-192 and AES-256 costing about 2^99.5 (192) and 2¹⁷⁶ (256) work when the attacker can get ciphertexts under keys related in a chosen way. A well-designed protocol never lets an attacker choose related keys, but the results suggest AES-256's key schedule is no better than AES-128's.
• Side channels. Software that looks values up in tables takes slightly different times depending on the key, and the processor's cache shows it. Bernstein (2005) and Osvik, Shamir and Tromer (2005) demonstrated attacks, the second recovering a key after 800 encryptions. Hardware AES instructions and bitsliced software avoid the problem.
• The mode is up to you. AES alone encrypts one 16-byte block. Use it with an authenticated mode, as in AES-GCM. ECB mode, which encrypts each block separately, leaks patterns, as the picture demo shows.
• Nonce reuse. In GCM and CTR modes, one repeated nonce under the same key is a disaster.

How it compares

The code

// AES-GCM with the browser's Web Crypto: the same calls cipher.ink makes. `key` is 16, 24 or 32 bytes, `nonce` 12 bytes that are never reused with this key.
async function seal(key, nonce, plaintext) {
  var k = await crypto.subtle.importKey('raw', key, 'AES-GCM', false, ['encrypt', 'decrypt']);
  var ct = await crypto.subtle.encrypt({ name: 'AES-GCM', iv: nonce, tagLength: 128 }, k, plaintext);   // ciphertext with the 16-byte tag at the end
  return new Uint8Array(ct);
}

// Decryption refuses (rejects) if a single bit of the ciphertext, tag or nonce is wrong.
async function open(key, nonce, sealed) {
  var k = await crypto.subtle.importKey('raw', key, 'AES-GCM', false, ['decrypt']);
  return new Uint8Array(await crypto.subtle.decrypt({ name: 'AES-GCM', iv: nonce, tagLength: 128 }, k, sealed));
}

Common questions