AES

Every time you open a website over HTTPS, send an encrypted message, or store a file on disk with encryption turned on, your data is almost certainly scrambled by AES — the Advanced Encryption Standard. It has been the world's go-to symmetric cipher since 2001, and despite twenty-five years of intense cryptanalysis, no practical attack against a full-round AES exists today.

AES was born from a competition. In 1997 the US National Institute of Standards and Technology (NIST) put out a public call for a replacement to the aging DES cipher. Five finalists were analyzed by researchers worldwide, and in 2001 NIST selected the Belgian algorithm Rijndael, designed by Joan Daemen and Vincent Rijmen, renaming it the Advanced Encryption Standard.

The cipher operates on a 4 × 4 grid of bytes — 128 bits called the state. A secret key schedules a series of round keys, and in each round four operations reshape the state until it looks like random noise. Ten rounds for a 128-bit key, twelve for 192 bits, fourteen for 256 bits. Each operation is individually invertible, so decryption simply runs the steps backward.

What makes AES elegant is how each operation targets a different axis of diffusion: bytes are substituted one by one, rows are shifted, columns are mixed, and a round key is added. Together they guarantee that flipping a single input bit changes roughly half the output — the avalanche effect that every good cipher needs.

Type any 16-character text below. The demo shows your message as a 4 × 4 byte grid (the AES state), then walks you through the four steps of a single AES round one click at a time.

<div class="hint">{{hint}}</div>
<div class="input-row">
  <label for="msg">{{label_plaintext}}</label>
  <input id="msg" type="text" maxlength="16" value="{{input_default}}" autocomplete="off" spellcheck="false"/>
</div>
<div class="step-label" id="step-label">{{step_init_short}}</div>
<div id="grid" class="grid"></div>
<div class="legend" id="legend"></div>
<div class="btns">
  <button id="btn-sub" type="button">{{btn_subbytes}}</button>
  <button id="btn-shift" type="button">{{btn_shiftrows}}</button>
  <button id="btn-mix" type="button">{{btn_mixcolumns}}</button>
  <button id="btn-key" type="button">{{btn_addroundkey}}</button>
  <button id="btn-reset" type="button" class="ghost">{{btn_reset}}</button>
</div>

* { box-sizing: border-box; }
body { font-family: system-ui, sans-serif; color: #222; margin: 0; }
.hint { font-size: .85rem; color: #555; margin: 0 0 .6rem; }
.input-row { display: flex; align-items: center; gap: .5rem; margin-bottom: .7rem; flex-wrap: wrap; }
label { font-size: .9rem; }
input { font: 14px ui-monospace, monospace; padding: .3rem .5rem; border: 1px solid #adb1b8;
        border-radius: 6px; width: 170px; }
.step-label { font-size: .8rem; font-weight: 700; letter-spacing: .06em; text-transform: uppercase;
              color: #5a6a7a; margin-bottom: .35rem; }
.grid { display: grid; grid-template-columns: repeat(4, 52px); gap: 4px; margin-bottom: .6rem; }
.cell { width: 52px; height: 52px; display: flex; flex-direction: column; align-items: center;
        justify-content: center; border-radius: 7px; font: 700 13px ui-monospace, monospace;
        transition: background .35s, color .35s; user-select: none; }
.cell .hex { font-size: 14px; }
.cell .ch { font-size: 10px; color: inherit; opacity: .7; margin-top: 1px; }
.state-init  { background: #e8eef3; color: #1d3557; border: 1px solid #cdd9e3; }
.state-sub   { background: #fde8c0; color: #7a3f00; border: 1px solid #f4c77a; }
.state-shift { background: #d4f0e0; color: #0a4d28; border: 1px solid #74c99a; }
.state-mix   { background: #dce8ff; color: #1a3584; border: 1px solid #7fa6f4; }
.state-key   { background: #f0d4f0; color: #4d0a5e; border: 1px solid #c97fcc; }
.legend { font-size: .8rem; color: #555; margin-bottom: .5rem; min-height: 1.3em; }
.btns { display: flex; gap: .45rem; flex-wrap: wrap; }
button { font: 600 13px system-ui; padding: .4rem .85rem; border: 1px solid #1d3557;
         background: #1d3557; color: #fff; border-radius: 7px; cursor: pointer; }
button:disabled { opacity: .38; cursor: default; }
button.ghost { background: #fff; color: #1d3557; }
button.ghost:disabled { opacity: .38; }

// Code not found

Notice how each step attacks the data differently. SubBytes changes every byte independently using a fixed lookup table (the S-box). ShiftRows slides the rows left by 0, 1, 2, or 3 positions, spreading bytes across columns. MixColumns blends the four bytes of each column with a polynomial in GF($2^{8}$), so a change in one byte ripples into all four. AddRoundKey XORs the column round key in — the only step that uses the secret. After just one round, your original text is nearly unrecognizable.

AES is not a Millennium Problem and it is not NP-complete — it is proven secure in a practical, empirical sense after twenty-five years of public cryptanalysis by thousands of researchers.

• Brute force is hopeless. A 128-bit key has $2^{128}$ ≈ 3.4 × $10^{38}$ possibilities. Even a computer testing a billion keys per second would need longer than the age of the universe.
• The best known attack is a 2011 biclique attack by Bogdanov et al. that reduces the effective key length by about two bits — from $2^{128}$ to roughly $2^{126}$. This is a theoretical result; no hardware can exploit it.
• Related-key attacks exist on AES-256 in artificial settings where the attacker controls key relationships. Real-world protocols never expose that surface.
• Side-channel attacks (timing, power, electromagnetic) can break implementations, not the algorithm itself. Hardware AES-NI instructions on modern CPUs execute in constant time, closing most practical channels.
• Quantum threat. Grover's algorithm on a quantum computer would halve the effective key length — reducing AES-128 to the equivalent of a 64-bit classical key. NIST's response is to use AES-256 for post-quantum workloads, which Grover reduces to only 128 effective bits — still infeasible.

The security argument is not a mathematical proof from first principles (we do not have a proof that P ≠ NP, which would underpin it), but decades of failed attacks by the world's best cryptanalysts constitute extremely strong evidence. See P vs NP for why absolute proof remains elusive.

AES is everywhere — usually invisible:

• HTTPS / TLS: every encrypted web connection negotiates an AES session key (typically AES-128-GCM or AES-256-GCM) to protect the data stream after the handshake.
• Disk and file encryption: BitLocker, FileVault, LUKS, and VeraCrypt all use AES-XTS or AES-CBC to encrypt storage at rest.
• Secure messaging: Signal, WhatsApp, and iMessage rely on AES as part of their Double Ratchet or similar protocols.
• Wi-Fi: WPA2 and WPA3 use AES-CCMP to protect wireless frames.
• VPNs: IPsec, WireGuard, and OpenVPN all encrypt traffic with AES.
• Hardware security: TPM chips, payment terminals, and smart cards run AES in silicon to guard keys and sign transactions.
• Hardware acceleration: Intel, AMD, and ARM processors ship AES-NI instructions that execute a round in a single clock cycle, making AES faster in software than many unencrypted alternatives.

Understanding AES means understanding how factoring and discrete logarithms underpin the key exchange that delivers the AES key — AES itself handles the bulk data, while asymmetric crypto handles the handshake.

AES is a masterpiece of applied mathematics. Four simple operations — substitute, shift, mix, key-add — each address a different weakness, and together they create an avalanche so complete that after ten rounds, no known technique can reverse the scramble without the key.

It is not proven unbreakable in the mathematical sense that would satisfy a complexity theorist. But it is as close to unbreakable as anything humanity has built: a public algorithm, scrutinized for decades, powering encryption for billions of devices every second.

The next time your browser shows a padlock, remember that behind it is a 4 × 4 grid of bytes being scrambled and re-scrambled — ten times, one round at a time — by the same elegant design that two Belgian cryptographers proposed in 1998.