AES (Advanced Encryption Standard) is a symmetric block cipher that encrypts data in fixed 128-bit blocks with a secret key of 128, 192 or 256 bits, using the same key to encrypt and decrypt. Standardized by NIST as FIPS 197 in 2001 after an open international competition, it is the default bulk-encryption algorithm in modern cryptography and protects TLS connections, VPN tunnels, disk volumes, databases and messaging apps.
In cybersecurity practice, AES itself is almost never the weak point. Real failures come from how it is used: the mode of operation, nonce and IV handling, key management and the side-channel resistance of the implementation decide whether a system that claims to use AES is actually secure.
How AES transforms a block
AES is a substitution-permutation network that processes a 16-byte block arranged as a 4 x 4 byte matrix called the state. It derives from Rijndael, the design by Joan Daemen and Vincent Rijmen that NIST selected in 2000; AES fixes the block size at 128 bits, while Rijndael allowed other block sizes.
After an initial key addition, each round applies four operations in sequence. The final round omits MixColumns, which keeps encryption and decryption structurally symmetric. The table below shows what each operation contributes.
| Operation | What it does | Security purpose |
|---|---|---|
| SubBytes | Replaces each byte through a fixed 8-bit S-box | Nonlinearity (confusion) |
| ShiftRows | Rotates row r of the state left by r bytes | Moves bytes across columns |
| MixColumns | Multiplies each column by a fixed matrix over GF(2^8) | Diffusion within each column |
| AddRoundKey | XORs the state with a 128-bit round key | Injects secret key material |
The S-box is built from the multiplicative inverse in the finite field GF(2^8) followed by an affine transformation, a construction chosen for strong resistance to linear and differential cryptanalysis. ShiftRows and MixColumns together give full diffusion after two rounds, so every output byte depends on every input byte. Decryption applies the inverse operations with the round keys in reverse order.
Key sizes, rounds and security margin
The three AES variants share the block size and round function and differ in key length, number of rounds and the output of the key schedule, which expands the cipher key into one 128-bit round key per round plus one for the initial addition.
| Variant | Key length | Rounds | Round keys | Best known key-recovery attack |
|---|---|---|---|---|
| AES-128 | 128 bits | 10 | 11 | About 2^126.1 operations (biclique) |
| AES-192 | 192 bits | 12 | 13 | About 2^189.7 operations (biclique) |
| AES-256 | 256 bits | 14 | 15 | About 2^254.4 operations (biclique) |
These biclique results remove less than two bits from brute force and have no practical consequence. Related-key attacks on AES-256 exist on paper, but they require encryptions under keys with attacker-chosen relationships, which correctly designed protocols never provide. No practical attack on full AES is known more than two decades after standardization.
Against a large quantum computer, Grover’s algorithm offers at most a quadratic speedup, reducing AES-128 to roughly 64-bit and AES-256 to roughly 128-bit security in idealized terms; Grover’s algorithm also parallelizes poorly, so the real cost is higher. For long-lived secrets and national security systems, guidance such as the NSA CNSA 2.0 suite requires AES-256, while AES-128 remains adequate for most commercial traffic.
Modes of operation
AES on its own encrypts exactly one 16-byte block, so every real use wraps it in a mode of operation that defines how longer messages, initialization vectors and integrity are handled. The mode matters more than the key length: a weak mode with AES-256 is far less secure than a sound mode with AES-128.
| Mode | Type | Integrity | Main requirement or risk | Typical use |
|---|---|---|---|---|
| ECB | Independent blocks | None | Identical blocks leak patterns | Never for application data |
| CBC | Chained blocks | None | Unpredictable IV; padding oracle risk | Legacy TLS and file formats |
| CTR | Counter-based stream | None | Counter block must never repeat | High-speed encryption, basis of GCM |
| GCM | AEAD | 128-bit tag | Nonce reuse breaks confidentiality and integrity | TLS 1.2 and 1.3, IPsec, SSH |
| CCM | AEAD | Configurable tag | Two passes; length known in advance | WPA2 Wi-Fi, Bluetooth LE, IoT |
| XTS | Tweakable, per sector | None | No authentication of stored data | Full-disk encryption |
| GCM-SIV | Misuse-resistant AEAD | 128-bit tag | Repeated nonce reveals only equal messages | Systems with unreliable nonces |
The modern default is an authenticated encryption with associated data (AEAD) mode, normally AES-GCM with a 96-bit nonce and a 128-bit tag. Unauthenticated modes such as CBC and CTR must be combined with a separate MAC in an encrypt-then-MAC construction, a step that many historical protocols implemented incorrectly.
AES compared with related algorithms
AES complements rather than competes with asymmetric algorithms such as RSA and with key exchange protocols: public-key methods agree on or transport a key, and AES then encrypts the bulk data because it is several orders of magnitude faster. A hash function provides integrity fingerprints without confidentiality, and a digital signature proves origin; neither replaces encryption.
| Algorithm | Category | Key or block size | Current role |
|---|---|---|---|
| AES | Symmetric block cipher | 128-bit block; 128-256-bit key | Default bulk encryption |
| 3DES | Symmetric block cipher | 64-bit block; 112-bit effective strength | Disallowed by NIST for encryption after 2023 |
| ChaCha20-Poly1305 | Stream cipher with MAC (AEAD) | 256-bit key | Preferred where AES hardware is absent |
| RSA | Asymmetric algorithm | 2048-4096-bit modulus | Key transport and signatures |
| SHA-256 | Hash function | 256-bit output | Integrity, not confidentiality |
The 64-bit block size is what retired 3DES: after about 2^32 blocks, or 32 GiB, under one key, block collisions become likely, as the Sweet32 attack showed in 2016. The 128-bit AES block moves that birthday bound to about 2^64 blocks, which is why AES is safe for high-volume traffic.
Choosing and deploying AES
Sound deployment rests on hardware support, constant-time code and disciplined key handling. Most x86 processors since 2010 provide AES-NI instructions, and ARMv8 processors offer equivalent cryptography extensions; with them, AES-GCM reaches several gigabytes per second per core and runs without key-dependent timing. The decision table below covers the most common situations.
| Situation | Recommended choice | Reason |
|---|---|---|
| Data in transit | AES-GCM through TLS 1.3 | Standard AEAD with hardware acceleration |
| Files and database records | AES-256-GCM with envelope encryption | Per-object data keys, master key in a KMS or HSM |
| Full-disk or block storage | XTS-AES | Fits fixed sectors without ciphertext expansion |
| Devices without AES hardware | ChaCha20-Poly1305 instead of AES | Faster and constant-time in software |
| Nonce uniqueness hard to guarantee | AES-GCM-SIV | Limits the damage of a repeated nonce |
| Long-term or post-quantum concern | AES-256 | Larger margin against Grover’s algorithm |
Common mistakes when using AES
Most AES-related vulnerabilities in audits and incident reports fall into a short list of recurring errors:
- ECB mode for real data: identical plaintext blocks produce identical ciphertext, so structure such as an image outline stays visible.
- Reusing a GCM nonce under the same key: it exposes the XOR of two plaintexts and lets an attacker recover the authentication subkey and forge messages.
- Unauthenticated CBC: a padding oracle can decrypt messages byte by byte when the receiver reveals padding errors.
- Passwords used directly as keys: a password must pass through a slow key derivation function such as Argon2, scrypt or PBKDF2 first.
- Hard-coded keys in source code or configuration files, which turns encryption into mere obfuscation.
- Table-based software implementations on shared hardware, which can leak key bits through cache-timing side channels.
- Exceeding usage limits: with random 96-bit nonces, one GCM key should encrypt no more than 2^32 messages.
The short version
AES is the lock that most of the digital world uses to keep data private. Anyone with the right key can open it, and anyone without the key sees only random-looking bytes. The same key locks and unlocks, so it has to be shared carefully and kept secret.
The lock itself has never been picked in practice. When encrypted data is exposed, the cause is almost always a mistake around the lock: a key left in plain sight, a setting reused when it should be fresh, or an outdated way of applying it. Using AES correctly matters more than simply using AES.
Where it makes a difference
A regional hospital network sends nightly backups of its patient database, about 4 TB, to cloud object storage. The backup server encrypts each backup with its own AES-256-GCM data key and then encrypts that data key with a master key held in a hardware security module, a pattern called envelope encryption. Only the wrapped data key is stored next to the backup.
Because a single GCM operation is limited to just under 64 GiB of plaintext, the tool splits each backup into 1 GiB chunks, each with a unique counter-derived nonce, which yields about 3,700 chunks per night and stays far below the usage limits. With AES-NI on the servers, the network rather than the cipher sets the backup window.
A year later, a leaked storage credential lets an attacker copy several backup files. Without the HSM-held master key, the files are unreadable, and the organization can show that the exposed data was unusable, which under most health-data breach rules turns a notifiable patient-data breach into a contained credential incident.