Advanced Encryption Standard

AES is a symmetric encryption algorithm that uses the same key for both encryption and decryption. It was selected by NIST from 15 candidates, with the winning design, Rijndael, submitted by Belgian cryptographers Joan Daemen and Vincent Rijmen.¹ The standard is defined in FIPS PUB 197 and is widely used in protocols such as TLS, IPsec, and Wi-Fi Protected Access 2 (WPA2).² AES replaced DES, which had become vulnerable to brute-force attacks, and has since become the most widely deployed block cipher globally.

AES is a substitution-permutation network (SPN) that processes data in a 4×4 array of bytes. Each round consists of four steps: SubBytes (nonlinear byte substitution using an S-box), ShiftRows (cyclic shift of rows), MixColumns (mixing the columns via Galois Field multiplication), and AddRoundKey (XOR with the round key).³ The key schedule expands the cipher key into round keys. The number of rounds depends on key length: 10 rounds for 128-bit keys, 12 for 192-bit, and 14 for 256-bit. The final round omits MixColumns.

As of 2025, no practical attack on the full AES has been published that is faster than brute-force. The best known attacks are on reduced-round versions or related-key scenarios, and none threaten the standard usage.⁴ AES is used in cloud storage encryption, secure messaging (e.g., Signal), and hardware security modules. It is also a required component in many government and financial systems. The U.S. National Security Agency (NSA) approved AES for protecting classified information up to Top Secret level when used with 256-bit keys.⁵

The winning algorithm, Rijndael, supports block sizes of 128, 192, and 256 bits, but AES only standardizes the 128-bit block size. The original Rijndael specification also allowed varying block sizes, which were excluded from the final standard. The S-box used in AES was designed to be resistant to linear and differential cryptanalysis, and its algebraic structure has been a subject of mathematical study. Side-channel attacks, such as timing and power analysis, can leak AES keys from implementations that ignore countermeasures; constant-time implementations are widely recommended.⁶ AES is also used in some post-quantum cryptographic schemes as a building block, though it is not itself quantum-resistant.

block cipher

A symmetric encryption algorithm that encrypts fixed-size blocks of plaintext (e.g., 128 bits) into ciphertext of the same size.

key schedule

The algorithm that derives round keys from the original cipher key for each round of the cipher.

S-box

A substitution box used in the SubBytes step, a nonlinear lookup table that provides confusion.