Advanced Encryption Standard

Lore & Background

AES operates on a 4×4 column-major order array of 16 bytes called the state. The number of transformation rounds depends on key size: 10 rounds for 128-bit keys, 12 for 192-bit keys, and 14 for 256-bit keys. Each round includes steps such as SubBytes (non-linear substitution), ShiftRows (cyclical shifting of rows), MixColumns (linear mixing of columns), and AddRoundKey (bitwise XOR with round keys). The algorithm is based on a substitution–permuation network and is efficient in both software and hardware.

Reader's Guide

AES is significant as the first (and only) publicly accessible cipher approved by the US National Security Agency (NSA) for top secret information when used in an NSA-approved cryptographic module. It supersedes the Data Encryption Standard (DES) and is included in the ISO/IEC 18033-3 standard. Its adoption by the US government and availability in many encryption packages have made it a cornerstone of modern data security. The standardization process, which involved evaluating fifteen competing designs, ensured a robust and well-vetted algorithm. AES's design, based on a substitution–permuation network rather than a Feistel network, provides strong diffusion and non-linearity, making it resistant to many cryptographic attacks. Its legacy endures as a trusted encryption standard for both government and commercial use.

Did You Know?

• AES is a variant of the Rijndael block cipher developed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen.
• AES uses 10, 12, or 14 rounds depending on key size (128, 192, or 256 bits).

The Road to Standardization

The journey from competing cipher proposals to a single national standard was neither quick nor simple. In the late 1990s, the US National Institute of Standards and Technology opened a public selection process to find a successor to the aging Data Encryption Standard. Over a span of five years, fifteen different encryption designs were submitted, scrutinized, and evaluated by the cryptographic community. From among those contenders, a proposal put forward by two Belgian cryptographers, Joan Daemen and Vincent Rijmen, emerged as the most suitable candidate. Their design, originally called Rijndael, was a flexible family of block ciphers supporting various key and block sizes. NIST distilled this family into a more constrained specification, fixing the block size at 128 bits while retaining three key-length options. On November 26, 2001, NIST formally announced the result as Federal Information Processing Standard 197. The standard did not take full legal effect until May 26, 2002, when US Secretary of Commerce Donald Evans signed off on its adoption as a binding federal requirement.

Architectural Design and Round Structure

Rather than relying on the Feistel structure that defined its predecessor, AES is built around a substitution–permutation network, a design philosophy that lends itself to efficient implementation in both software and hardware. The algorithm treats the data as a 4 × 4 column-major array of sixteen bytes, collectively called the state. Most arithmetic within the cipher takes place in a specific finite field, giving the transformations their algebraic rigor. The number of transformation rounds scales with the key length: ten rounds for a 128-bit key, twelve for 192 bits, and fourteen for 256 bits. Each round weaves together several operations. A key-dependent step, AddRoundKey, combines every state byte with a corresponding round-key byte through bitwise exclusive-or. A non-linear SubBytes step replaces each byte according to a fixed lookup table, while a ShiftRows transposition shuffles bytes across rows. Before the first round, a KeyExpansion procedure derives a separate 128-bit round-key block for every round plus one additional block, all from the original cipher key. Decryption simply applies the inverse sequence of rounds using the same key.

Superseding DES and Government Adoption

For more than two decades, the Data Encryption Standard, published in 1977, served as the backbone of American data protection. AES was designed to retire that legacy and replace it with a cipher that could withstand modern cryptanalytic pressure. As a symmetric-key algorithm, AES uses a single shared secret for both encryption and decryption, a model that keeps the protocol straightforward for implementers. The US government formally adopted the new standard, and its reach extended well beyond routine commercial use. In a particularly notable endorsement, the National Security Agency approved AES as the first—and to date the only—publicly accessible cipher cleared for classifying top-secret information, provided it runs inside an NSA-approved cryptographic module. This distinction placed a publicly documented algorithm on equal footing with previously classified ciphers for the most sensitive government data, a milestone that underscored both the algorithm's perceived strength and the transparency of the standardization process behind it.

Global Standards and Practical Accessibility

AES did not arrive as a single monolithic specification but as a carefully scoped member of a broader cipher family. The original Rijndael design, as conceived by Daemen and Rijmen, allowed both block and key sizes to be any multiple of 32 bits, ranging from 128 to 256 bits. NIST narrowed this flexibility, locking the block size at 128 bits and offering three key lengths—128, 192, and 256 bits—to balance security margin against processing speed. The resulting standard was codified in FIPS PUB 197 and simultaneously incorporated into the international ISO/IEC 18033-3 standard for block ciphers, giving it a dual domestic-and-global normative footing. Because the specification is publicly available, AES has been integrated into a wide array of encryption packages and toolkits worldwide. Its presence in both US federal regulations and an ISO framework means that a single algorithm can satisfy compliance requirements across borders, reducing the need for organizations to maintain multiple cipher implementations.

Gallery