AES Encryption: How the World's Most-Used Cipher Works

Background

The Advanced Encryption Standard (AES) was selected by NIST in 2001 after a five-year public competition. The winning algorithm, Rijndael (designed by Belgian cryptographers Joan Daemen and Vincent Rijmen), replaced DES and 3DES as the standard for symmetric encryption.

AES is a symmetric block cipher: the same key encrypts and decrypts, and data is processed in fixed-size blocks of 128 bits (16 bytes).

Key Sizes

AES comes in three variants, differentiated by key length:

• AES-128 — 128-bit key, 10 rounds
• AES-192 — 192-bit key, 12 rounds
• AES-256 — 256-bit key, 14 rounds

Longer keys mean more rounds and more security. AES-256 is the most commonly recommended for new applications, though AES-128 remains unbroken and is perfectly adequate for most uses.

How the Rounds Work

Each round consists of four operations applied to a 4×4 matrix of bytes (the "state"):

1. SubBytes — each byte is substituted using a lookup table (S-box), providing non-linearity
2. ShiftRows — rows of the state are cyclically shifted
3. MixColumns — columns are mixed using a linear transformation (omitted in the final round)
4. AddRoundKey — the state is XORed with the round key derived from the original key

This combination of substitution and permutation provides confusion and diffusion — the two properties Shannon identified as necessary for a strong cipher.

Modes of Operation

A block cipher by itself only encrypts one 16-byte block. For longer data, you need a mode of operation:

ECB (Electronic Codebook) — each block is encrypted independently with the same key. This is insecure: identical plaintext blocks produce identical ciphertext blocks, leaking patterns. Never use ECB.

CBC (Cipher Block Chaining) — each block is XORed with the previous ciphertext block before encryption. Requires an Initialization Vector (IV) — a random block used for the first iteration. The IV must be random and unique for each encryption but does not need to be secret.

CTR (Counter) — turns the block cipher into a stream cipher by encrypting a counter value and XORing the result with plaintext. Highly parallelisable and does not require padding.

GCM (Galois/Counter Mode) — CTR mode with an authentication tag. Provides authenticated encryption: you can detect if the ciphertext was tampered with. AES-GCM is the recommended mode for most modern applications.

The IV and Why It Matters

An IV (or nonce in GCM) must be:

• Random — generated with a cryptographically secure random number generator
• Unique — never reused with the same key

Reusing an IV with the same key in GCM completely breaks confidentiality and authentication. This is the most common mistake in AES implementations.

Common Pitfalls

Using ECB mode. Use CBC or GCM instead.

Reusing IVs. Generate a fresh random IV for every encryption operation.

Hardcoding keys. Keys must be stored securely — in a key management service, an environment variable, or a secrets manager. Never commit a key to version control.

Using a password directly as a key. Passwords are not random enough to be used directly as AES keys. Use a key derivation function (KDF) like PBKDF2, bcrypt, or Argon2 to derive a key from a password.

Try It

The AES tool on Syntaxly implements AES encryption and decryption in the browser. All processing is local — your data and key never leave the page.