AES Encryption Explained: How the Advanced Encryption Standard Works

The Advanced Encryption Standard (AES) is the most widely deployed symmetric-key cipher in the world, protecting everything from disk encryption and TLS traffic to Wi-Fi and messaging apps. Standardized by the U.S. National Institute of Standards and Technology (NIST) as FIPS 197, AES is a block cipher: it transforms fixed-size blocks of data using a secret key that both sender and receiver share. Understanding how AES works is foundational for anyone studying applied cryptography or building secure systems.

What AES Is and Where It Came From

AES is based on the Rijndael cipher designed by Belgian cryptographers Joan Daemen and Vincent Rijmen, which won a multi-year public competition to replace the aging Data Encryption Standard (DES). Its selection was driven by a combination of strong security margins, efficiency in both hardware and software, and a clean mathematical design that resists known cryptanalytic attacks.

AES operates on 128-bit blocks (16 bytes) and supports three key sizes:

• AES-128 with a 128-bit key and 10 rounds
• AES-192 with a 192-bit key and 12 rounds
• AES-256 with a 256-bit key and 14 rounds

Larger keys and more rounds increase the security margin at a modest performance cost. All three variants share the same core structure.

The AES State and Round Structure

Internally, AES arranges each 16-byte block into a 4x4 matrix of bytes called the state. Every operation transforms this state until the final round produces the ciphertext. AES is a substitution-permutation network (SPN), meaning each round mixes substitution steps (which create confusion) with permutation steps (which create diffusion).

Each full round applies four transformations:

1. SubBytes replaces each byte using a fixed lookup table called the S-box, a nonlinear substitution derived from the multiplicative inverse in the finite field GF(2^8). This provides resistance to linear and differential cryptanalysis.
2. ShiftRows cyclically shifts the bytes in each row of the state by different offsets, spreading data across columns.
3. MixColumns treats each column as a polynomial over GF(2^8) and multiplies it by a fixed matrix, diffusing each byte's influence across the whole column.
4. AddRoundKey combines the state with a round-specific subkey using bitwise XOR.

The final round omits MixColumns. Before the first round, an initial AddRoundKey step is applied.

The Key Schedule

AES does not use the raw key directly in every round. Instead, a key expansion (or key schedule) algorithm derives a unique round key for each round from the original key. It uses the S-box, a rotation, and round constants (Rcon) to generate enough key material for all rounds plus the initial whitening step. A well-designed key schedule ensures that related-key patterns do not weaken the cipher.

A Simplified View in Pseudocode

The overall encryption flow can be summarized concisely:

state = plaintext_block XOR roundKey[0]
for round = 1 to (Nr - 1):
    SubBytes(state)
    ShiftRows(state)
    MixColumns(state)
    state = state XOR roundKey[round]
# final round (no MixColumns)
SubBytes(state)
ShiftRows(state)
state = state XOR roundKey[Nr]
ciphertext_block = state

Decryption runs the inverse transformations (InvSubBytes, InvShiftRows, InvMixColumns) with the round keys applied in reverse order.

Why AES Is Considered Secure

No practical attack breaks full-round AES faster than brute force for any of its key sizes. The best known cryptanalytic results shave only a tiny fraction off the theoretical key search, leaving enormous security margins. A brute-force search of even a 128-bit key space is far beyond the reach of any foreseeable computing capability.

Security in practice, however, depends on correct implementation:

• Side-channel attacks such as cache-timing attacks can leak key bits if the software uses secret-dependent table lookups. Constant-time implementations and the hardware AES-NI instruction set mitigate this.
• Key management matters more than the cipher itself. A strong cipher with a weak or reused key offers little protection.
• AES alone only encrypts a single block. Real systems need a secure mode of operation and, ideally, authentication.

AES Needs a Mode of Operation

A raw block cipher encrypts exactly one 16-byte block. To encrypt arbitrary-length messages safely, AES is combined with a block cipher mode of operation. Choosing the right mode is as important as the cipher itself:

• Never use ECB mode, which encrypts identical blocks identically and leaks structure.
• CBC and CTR provide confidentiality but not integrity on their own.
• GCM provides authenticated encryption, combining confidentiality with an integrity tag so tampering is detected. AES-GCM is the recommended default for most modern protocols.

For an authenticated alternative that performs well without hardware acceleration, see ChaCha20-Poly1305.

Key Takeaways

• AES is a symmetric block cipher operating on 128-bit blocks with 128-, 192-, or 256-bit keys and 10, 12, or 14 rounds respectively.
• Each round applies SubBytes, ShiftRows, MixColumns, and AddRoundKey in a substitution-permutation network that combines confusion and diffusion.
• The key schedule expands the master key into distinct round keys using the S-box and round constants.
• Full-round AES has no practical break; real-world risk comes from side channels, weak key management, and poor mode selection.
• Always pair AES with a secure, ideally authenticated mode like GCM, and prefer constant-time or hardware-accelerated (AES-NI) implementations.