What is AES? How does it work?

Table of Contents

• Why was AES developed?
• Choosing the Rjindael cipher
• Understanding AES key size differences
• Attacks on AES
• Who and what uses AES?

The Advanced Encryption Standard, or AES, is an?encryption algorithm?created by the?National Institute of Science and Technology (NIST)?in 2001. The cipher utilized in AES is a block cipher from the Rjindael cipher family. When AES was created, three different Rjindael block ciphers were selected for use, to make AES even more secure. All three ciphers used were 128 bits, but the keys they each used were of different sizes: 128, 192, and 256 bits. This is considered a symmetric block cipher, as only one key is used in the?encryption?process.

Symmetric encryption?is a form of encryption that uses a single key for both encryption and decryption. Its counterpart, asymmetric encryption, uses two keys during the encryption and?decryption?process. One key is kept secret from everyone but the key’s creator, while the other key is a public key that can be viewed and utilized by anyone. Initially, AES was only used by the United States, but it has now been adopted worldwide as one of the most secure encryption algorithms.

Why was AES developed?

The Advanced Encryption Standard was created as a replacement for the Data Encryption Standard, or DES. DES was found to be increasingly more vulnerable to brute-force attackers, and thus needed to be phased out. AES’ original creation was to protect sensitive government information, but the security and ease of implementation provided by AES caused the majority of organizations to utilize AES in their encryption processes. Both public and private sector companies use AES now, as it protects against cyber-attacks, like brute force. AES does present an issue when exporting products encrypted with this encryption algorithm.

The Bureau of Industry and Security (BIS) has a number of controls and regulations in place that make it difficult export encryption products encrypted with AES. Commercial encryption products are required by the BIS to gain a license for their product that allows the organization to export their product to several destinations, without needing to acquire a separate license for each destination. Certain embargoed countries cannot receive commercial encryption products from the United States at all. These countries are: Cuba, Iran, Iraq, Libya, North Korea, Sudan and Syria.

Choosing the Rjindael cipher

To create the AES algorithm, a competition was held, which initially had 15 different encryption algorithms in the running. It was eventually narrowed down to just 5 algorithms:

• MARS
• Rivest Cipher 6 (RC6)
• Rjindael
• Serpent
• Twofish?

These encryption algorithms were extensively analyzed by both the NIST and the National Security Agency (NSA), to determine the most secure one to use in the Advanced Encryption Standard. After rigorous testing of these algorithms, the Rjindael cipher was selected to be used in AES. The use of a 256 bit key gives the Rjindael cipher strong security, while maintaining its interoperability with existing hardware and software. Stronger ciphers exist, but they do not have the ability to be implemented into existing systems easily, like the Rjindael cipher can.

Understanding AES key size differences

The way a block cipher works is the plaintext of the data being encrypted is broken down into blocks of equal size, which for AES is 128 bits. Using a series of bitwise operations, the blocks of data are encrypted using keys of a specific length as well. AES allows 128, 192, and 256 bit keys for use, and the bigger the key size, the more secure the encryption. If a 128 bit key is used, the encryption on the block is done 10 times. With 192, the encryption is done 12 times, and with 256, 14 times. Thus, 256 bit keys are the most secure, but for most encryption cases, 128 bit keys are sufficient. The higher the security level of the data, however, the higher the size of the key should be.

To give an example on the security of AES, let’s take a look at how long it would take someone to crack one password encrypted with an AES-256 bit key. To break one 16-byte section of data encrypted with an AES-256 bit key, it would take centuries using a brute force method. The total amount of permutations that are possible with a 256 bit key are 2256, which makes cracking an AES-256 encrypted message virtually impossible. Even using a 128 bit key, the smallest size, there are still 2128 different permutations available, which would still take decades to brute force.

Attacks on AES

Researchers continually attempt to break AES with methods that are viable. The reason researchers are attempting to crack AES is to be one step ahead of attackers. If an attacker were to crack AES, and keep it a secret, then the world would continue to use AES believing it is completely secure. So far, a few different, theoretical attacks have been proposed, including:

• Related-key attack: A related-key attack involves identifying how a cipher works under different keys. This cryptanalysis technique involves feeding a cipher, used to encrypt data, several different keys with the same plaintext. The process that occurs between the key and cipher can help identify a mathematical relationship between the cipher and key, thus helping identify the actual key’s value. This attack method is, however, not considered a big threat to AES, as it is useless as long as the protocols were implemented correctly.
• Distinguished key attack: An attack that used a known key to find out the inner workings of an 8 round AES-128 algorithm was successfully used. As this was done on an 8 round algorithm, as opposed to the official 10 round algorithm, this is an attack that should not cause issues with any official AES algorithms.
• Side channel attack: A side channel attack involves the leaking of information from an organization’s infrastructure. The data is leaked through locations, and the attacker listens at in to the sound, timing information, electromagnetic information or the power consumption in order to gather inferences from the algorithm which can then be used to break it. This can be stopped, however, by fixing the source of the leak or ensuring no pattern exists in the leaking information.
• Key compromise: Though not a direct attack on the AES algorithm, the compromise of the key used for encryption cripples the entire AES algorithm. This is why proper key management and security are vital to the IT infrastructure of any organization.
• Quantum computing: Quantum computing is the successor to classical computing, which we do now, that is still in the process of being created and understood. Though it has not been fully realized yet, the creation of quantum computers will make all classical computing cryptography irrelevant, as quantum computing could crack any classical cryptography algorithm in potentially seconds.

?

Who and what uses AES?

The majority of products, services, and organizations using symmetric encryption utilize AES. Most agencies and organizations in the United States government, including the NSA, use AES as well. The proven strength of AES and the inability to crack it mean the majority of companies looking for an encryption algorithm will use AES. A number of file transfer methods use AES for encryption as well. HTTPS is just one example of this.