AES: The Advanced Encryption Standard

What Makes AES a Symmetric Block Cipher

AES belongs to a family of algorithms called block ciphers, which encrypt data in fixed-size chunks rather than continuously streaming individual bits. Every block AES processes is exactly 128 bits, or 16 bytes, regardless of the key length chosen. It is also symmetric, meaning the exact same secret key is used both to encrypt the original plaintext and to decrypt the resulting ciphertext back into readable data. This is different from asymmetric or public-key cryptography, where separate public and private keys are used. AES supports three key sizes: 128, 192, and 256 bits, offering a tradeoff between speed and security margin, with larger keys providing more resistance against brute-force attacks at a small performance cost. Internally, the 16 bytes of a block are arranged into a 4x4 grid called the state, and it is this grid that gets transformed repeatedly throughout encryption. Because the same key must be shared secretly between sender and receiver, AES is typically paired with key-exchange protocols in real-world systems, but the cipher itself focuses purely on scrambling data efficiently once both parties already hold the shared secret. This combination of fixed block size, shared-key symmetry, and flexible key length is what makes AES both fast enough for everyday use and strong enough to secure sensitive government, financial, and personal information worldwide.

The Round-Based Structure of AES

AES does not scramble data in a single pass. Instead, it applies a sequence of nearly identical transformation steps, called rounds, repeatedly to the 4x4 state grid. The number of rounds depends directly on the key size: a 128-bit key uses 10 rounds, a 192-bit key uses 12 rounds, and a 256-bit key uses 14 rounds. Longer keys get more rounds because each round only diffuses and confuses the data by a limited amount, so more rounds are needed to maintain an equivalent security margin against the larger space of possible keys. Each round (except the final one) applies four distinct operations in sequence, and every round uses a different subkey generated from the original key. Before the first round even begins, there is an initial step where the plaintext is combined with the original key. The final round is slightly special because it skips one of the four standard operations, a design choice that keeps encryption and decryption symmetric and efficient without weakening security. By the time data has passed through all the rounds, the original patterns and structure of the plaintext have been thoroughly erased, replaced by output that appears statistically indistinguishable from random noise unless you hold the correct key.

The Four Core Operations: SubBytes, ShiftRows, MixColumns, AddRoundKey

Each AES round (with minor exceptions) applies four operations to the state matrix. SubBytes replaces every byte in the state using a fixed lookup table called the S-box, a nonlinear substitution designed to resist mathematical attacks by making the relationship between input and output as unpredictable as possible. ShiftRows then cyclically shifts each row of the 4x4 state to the left by a different amount: row 0 is untouched, row 1 shifts by one byte, row 2 by two bytes, and row 3 by three bytes, spreading byte values across columns. MixColumns treats each column as a small vector and multiplies it by a fixed matrix using arithmetic in a finite field (specifically GF(2^8)), thoroughly blending the bytes within each column so that a single input byte affects multiple output bytes. This step is skipped in the final round. Finally, AddRoundKey combines the state with a round-specific subkey using a simple bitwise XOR operation, injecting the secret key material into the transformation. Together, SubBytes and ShiftRows/MixColumns serve complementary purposes: substitution obscures the relationship between key and ciphertext, while shifting and mixing spread influence across the entire block so that changing a single input bit eventually affects nearly every output bit.

The Key Schedule: Generating Round Keys

AES never reuses the original secret key directly in every round. Instead, a process called the key schedule (or key expansion) derives a unique subkey for each round from the original key, producing what is known as the round key sequence. This expansion process uses operations similar to those in the main cipher, including byte substitution through the S-box and a round-dependent constant, to ensure that each round key looks essentially unrelated to the others even though they all derive from the same source. The purpose of this design is to prevent an attacker who somehow learns one round key from being able to easily reconstruct the original secret key or predict other round keys. The number of round keys generated always equals one more than the number of encryption rounds, since a fresh subkey is also needed for the initial AddRoundKey step performed before round one begins. This careful, deterministic expansion is what allows AES to safely repeat the same four core operations many times while still ensuring every round behaves differently, adding another layer of unpredictability that strengthens the cipher against pattern-based cryptanalysis.

A Substitution-Permutation Network and the Road from DES to AES

AES is classified as a substitution-permutation network, a cipher design built from two alternating types of operations: substitution steps that replace data values according to a fixed rule (SubBytes), and permutation steps that rearrange or diffuse those values across the block (ShiftRows and MixColumns). Repeating substitution and permutation across many rounds, combined with fresh key material each time, creates strong confusion and diffusion, the two properties that Claude Shannon identified decades earlier as essential for secure ciphers. AES's origins trace back to the late 1990s, when the U.S. National Institute of Standards and Technology (NIST) launched an open, public competition to find a successor to the aging Data Encryption Standard (DES), whose short 56-bit key had become vulnerable to brute-force attacks as computing power grew. Fifteen candidate algorithms from cryptographers around the world were submitted and publicly scrutinized for security and performance. In 2000, NIST selected an algorithm called Rijndael, designed by Belgian cryptographers Joan Daemen and Vincent Rijmen, and it was formally adopted as the Advanced Encryption Standard in 2001. Its transparent selection process, strong security track record, and efficiency on both hardware and software have made it the most widely trusted symmetric cipher in the world today.

Frequently asked questions

Try it live

Everything above runs in your browser — open AES: The Advanced Encryption Standard and change the parameters while it is running. Nothing is installed, nothing is uploaded, the whole model lives in one tab.