The history of AES

The history of AES is the story of how the world's most widely used cipher got chosen in public, by competition, after its predecessor was chosen largely in private. DES, the standard from 1977, was designed at IBM, modified with help from the National Security Agency, and attacked for twenty years over a key that was too short. AES was picked between 1997 and 2000 from fifteen candidates, with the whole world free to break them, and two Belgian cryptographers designed the winner. We'll follow both stories with their dates, and say where a date or claim rests on a single account.

Before AES: a standard for everyone, 1972 to 1977

In the early 1970s the US government had no standard way to protect sensitive but unclassified data, and banks and businesses were starting to need one. In 1972 the National Bureau of Standards (NBS, later NIST) identified the need. On May 15, 1973, it asked the public for cipher proposals, and none was suitable. A second request on August 27, 1974, brought a candidate from IBM, based on Horst Feistel's Lucifer cipher, which the NBS judged acceptable. The proposed standard was published in the Federal Register on March 17, 1975, for public comment, there were two open workshops in 1976, and DES was approved as a federal standard in November 1976 and published as FIPS PUB 46 on January 15, 1977 (the DES page explains the cipher itself).

The suspicions: a short key and mysterious S-boxes

DES drew criticism from the start on two counts. At the 1976 workshops Whitfield Diffie and Martin Hellman objected that the key had been cut to 56 bits, a space of about 7.2 × 10¹⁶ keys, and in 1977 they argued that a government or large company could build a machine to break DES by brute force. The second suspicion was about the eight S-boxes, the lookup tables that give DES its non-linearity. Their design criteria were never published, and people wondered whether the NSA, which had advised IBM, had planted a weakness only it could exploit. A US Senate committee reviewing the matter found in 1978 that the NSA "did not tamper with the design of the algorithm in any way", having earlier "indirectly assisted in the development of the S-box structures", and the public was left to judge.

The S-boxes, vindicated

Outsiders answered the question, in part. In the late 1980s Eli Biham and Adi Shamir publicly discovered differential cryptanalysis, a method that follows how a chosen difference between two plaintexts spreads through a cipher. They found DES surprisingly resistant to it. Breaking the full 16 rounds still takes about 2⁴⁷ chosen plaintexts, and small changes to the S-boxes would have made it much weaker. In 1994 Don Coppersmith, who had been on the IBM team, wrote that IBM had known the technique as early as 1974, had made defending against it a design goal, and had kept quiet after discussions with the NSA, because publishing the criteria would have revealed the method. Steven Levy's book Crypto (2001) tells the same story from outside, adding that the NSA already knew the technique. These are Coppersmith's and Levy's accounts, and we can't check them against a primary document, but they fit what Biham and Shamir found: the S-boxes were stronger than random ones, not weaker. The key length was the real problem.

Cracking DES: 1998

In July 1998 the Electronic Frontier Foundation (EFF) built a machine to settle the argument with a demonstration. Deep Crack, designed by Paul Kocher's Cryptography Research and Advanced Wireless Technologies for the EFF, held 1,856 custom chips on 29 circuit boards and tested over 90 billion keys per second. It cost less than $250,000. In July 1998 it found the key of RSA Laboratories' DES Challenge II-2 in 56 hours. In January 1999, working with the volunteer network distributed.net, it took 22 hours and 15 minutes. The EFF then published the design, with its chip source code, as a book, Cracking DES (O'Reilly, 1998), in print because of US export rules on electronic cryptography. The point was made: anyone with a few hundred thousand dollars could search all of DES's keys.

The interim fix was Triple DES, three DES operations in a row (Triple DES). NIST's FIPS 46-3 of October 25, 1999, made it the preferred form and allowed single DES only in legacy systems. NIST withdrew the DES standard itself on May 19, 2005.

The contest: 1997 to 2000

NIST had already decided to replace DES. It announced the start of the AES development effort on January 2, 1997, and issued the formal call for algorithms on September 12, 1997. The rules were new. The algorithm had to be a block cipher with 128-bit blocks and keys of 128, 192 and 256 bits, it had to be royalty-free worldwide, and every candidate and every attack would be published. At the first AES conference on August 20, 1998, NIST announced fifteen candidates from several countries: CAST-256, CRYPTON, DEAL, DFC, E2, FROG, HPC, LOKI97, MAGENTA, MARS, RC6, Rijndael, SAFER+, Serpent and Twofish.

Cryptographers around the world spent a year attacking them, and the second conference followed in March 1999. Some designs fell to cryptanalysis, from minor flaws to significant attacks, and some lost ground on speed or had little to offer over the others. In August 1999 NIST named five finalists: MARS, RC6, Rijndael, Serpent and Twofish (Serpent and Twofish have their own pages here). A third conference, in New York on April 13 and 14, 2000, ended with an informal straw poll of the attendees:

NIST wasn't bound by the poll, but on October 2, 2000, it announced it had chosen Rijndael, by the Belgian cryptographers Joan Daemen and Vincent Rijmen. It combined a good security margin with excellent speed in both software and hardware, and it fit in very small devices. Serpent had the larger security margin and was slower, and NIST's report on the process gives the reasoning. A draft standard followed on February 28, 2001, and the final one, FIPS 197, was published on November 26, 2001, and took effect on May 26, 2002. Rijndael itself allows block and key sizes from 128 to 256 bits in steps of 32. The standard fixes the block at 128 bits and uses 10, 12 or 14 rounds for 128-, 192- and 256-bit keys (how AES works, one round at a time).

After the standard

• June 2003: the US government announced that AES could be used to protect classified information.
• 2008 onwards: Intel proposed a set of processor instructions for AES in March 2008 (AES-NI), and similar instructions followed in other processors, including those of the ARMv8 architecture announced in 2011. They make AES fast, and they also resist the cache-timing attacks that plague table-based software implementations.
• May 9, 2023: NIST published an updated FIPS 197 (FIPS 197-upd1). It changes nothing technical in the algorithm. It modernizes the front matter, defines terms more consistently, and adds diagrams of the three key schedules.

As of this page, nobody has published a practical attack on full AES. The best published attacks, such as the biclique attack of 2011, shave only a few bits off the work of exhaustive search (see the AES page).

Why the contest worked

Three things set it apart from the DES process. Everything was public: anyone could read the candidates, the analyses, the conference papers and NIST's reports. The cost of failure was visible: a broken design was out, and designers had every reason to attack each other's work. And the designers weren't the standard-setter: nobody had to take NIST's word that the winner had no hidden weakness, because the field had spent a year trying to find one. It became the model for the SHA-3 hash competition (2007 to 2012) and for the post-quantum process that produced ML-KEM and ML-DSA (post-quantum cryptography). The principle underneath, that a cipher should stay secure even if the enemy knows everything except the key, is Kerckhoffs's, and we follow it by publishing the code that seals your messages (the code).

How cipher.ink uses this

Every message sealed here uses AES-256-GCM: AES with a 256-bit key, in a mode the AES standard didn't itself define (AES-GCM, explained), which the browser's Web Crypto API provides natively (the Web Crypto API). The cipher at the heart of it is the one chosen on October 2, 2000. The AES round explorer lets you step through the algorithm round by round.