English
Menu

What is AES (Advanced Encryption Standard)?

A symmetric-key block cipher standardized by the US NIST in 2001 as FIPS 197, and the most widely used cipher today. The block length is 128 bits and the key length 128, 192 or 256 bits, with 10, 12 or 14 rounds depending on the key length. It is based on Rijndael, designed by Belgian researchers. To encrypt long data it is combined with a mode of operation such as GCM or CTR. Many CPUs provide dedicated instructions for it, such as AES-NI.

Japanese name: AES

AES (Advanced Encryption Standard) appears in 10 practice questions across 4 topics, including Applied Cryptography, Hardware Security, Quantum Computing Hardware.

Field: Applied Cryptography

The round function

Each round consists of four steps: a nonlinear byte-by-byte substitution (SubBytes), a shift of each row (ShiftRows), a mixing of each column (MixColumns) and an XOR with the round key (AddRoundKey); the last round omits MixColumns. The round keys are derived from the original key by the key schedule. Repeating the rounds spreads a one-bit difference in the plaintext or key over the whole output.

How secure it is

AES-128 has 2¹²⁸ (about 3.4 × 10³⁸) possible keys, so brute force is not realistic. Even the best known attacks are only slightly faster than brute force. Considering Grover's algorithm on a quantum computer, a simple rule of thumb halves the number of security bits, so AES-256 is sometimes chosen where long-term security is needed.

Implementation pitfalls

In software implementations that look up tables, which entries were read leaves traces in the cache, and a cache-based side-channel attack may then recover the key. Dedicated instructions such as AES-NI or table-free constant-time implementations avoid this problem. And even though AES itself is secure, misuse such as ECB mode or nonce reuse destroys security.

Try it: questions about AES (Advanced Encryption Standard)

Which of the following is the correct combination of block length and key length for AES, the block cipher widely used today?

  1. AA block length of 128 bits and a key length of 128, 192 or 256 bits
  2. BA block length of 64 bits and a key length of 56 bits
  3. CBoth the block length and the key length can be chosen in any combination from 128, 192 and 256 bits
Show answer and explanation

Answer: A. A block length of 128 bits and a key length of 128, 192 or 256 bits

AES is a block cipher standardized by the US NIST in 2001 as FIPS 197; its block length is fixed at 128 bits and its key length is one of three: 128, 192 or 256 bits. Depending on the key length, the number of rounds (repetitions of the transformation) is 10, 12 or 14. Rijndael, on which it is based, was designed to allow different block lengths too, but only the 128-bit block was standardized as AES. A 64-bit block and a 56-bit key are the values of DES, the standard before AES.

Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?

  1. AThe AES key was too short, so some blocks were left as they were without being encrypted
  2. BECB mode automatically generates a different key for each block, and the pattern of those keys appears in the encrypted image
  3. CIn ECB mode identical plaintext blocks always become identical ciphertext blocks, so the patterns of areas of the same color remain
Show answer and explanation

Answer: C. In ECB mode identical plaintext blocks always become identical ciphertext blocks, so the patterns of areas of the same color remain

ECB (electronic codebook) mode simply encrypts each block independently with the same key. So if the plaintext contains blocks with identical contents, identical blocks appear at the same positions in the ciphertext. In an image with long runs of the same color, such as a background, the information about where the same color is remains, and the example of an encrypted penguin image is well known. For this reason ECB mode is not used to encrypt general data; modes that produce a different ciphertext each time even from the same plaintext, such as CBC mode, CTR mode and GCM, are used instead.

FAQ

Is AES-256 twice as secure as AES-128?

In terms of brute-force effort it is not twice but 2¹²⁸ times. However, brute force against AES-128 is already unrealistic on classical computers, so either is sufficient for most purposes. AES-256 is chosen when extra margin against quantum computers is wanted or when regulations require it. The amount of processing is roughly proportional to the number of rounds, so AES-256 costs about 1.4 times (14 ÷ 10) as much as AES-128.

Is AES alone enough to protect data?

AES is a building block that transforms a single 128-bit block; on its own it can neither encrypt long data nor detect tampering. In practice it is used in an authenticated-encryption mode such as GCM, with nonces managed correctly and keys generated and stored securely.

AES (Advanced Encryption Standard) in the explanations

Questions that mention AES (Advanced Encryption Standard) (10)

  1. Which of the following is the correct combination of block length and key length for AES, the block cipher widely used today?
  2. Image data were encrypted with AES in ECB mode, and the outline of the original picture could still be recognized in the encrypted image. Which of the following is the cause?
  3. Which of the following is an appropriate way to handle the initialization vector (IV) when using AES in CBC mode?
  4. AES (block length 16 bytes) is used in CBC mode with PKCS#7 padding. In PKCS#7, if n bytes are missing, n bytes of value n are added, and even when the plaintext length is exactly a multiple of 16, 16 bytes of value 16 are added. Which of the following is the length of the ciphertext (not including the IV) when a 96-byte plaintext is encrypted?
  5. Which of the following is the correct combination of what the TLS 1.3 cipher suite TLS_AES_128_GCM_SHA256 specifies?
  6. Besides speed, what advantage comes from giving CPUs dedicated AES instructions (such as AES-NI)?
  7. Once large fault-tolerant quantum computers are built, which ciphers are expected to have their security seriously undermined by Shor's algorithm?
  8. Which statement correctly describes symmetric-key cryptography?
  9. Which of the following correctly describes the difference between block ciphers and stream ciphers among symmetric-key ciphers?
  10. Let 1 GiB = 2³⁰ bytes and 1 EiB = 2⁶⁰ bytes. A block cipher with a 64-bit block (such as 3DES) is used in CBC mode to encrypt a large amount of data under one key. Treating the ciphertext blocks as random 64-bit values, which of the following is the approximate amount of data at which, by the birthday paradox, the probability that a pair of identical ciphertext blocks appears can no longer be ignored?

Books on Applied Cryptography Ad

As an Amazon Associate I earn from qualifying purchases.

Related terms

Block cipher mode of operation Authenticated encryption (AEAD) Nonce TLS RSA cryptosystem Diffie–Hellman key exchange Hash function HMAC Shor's algorithm Elliptic-curve cryptography

Back to the glossary