The idea in plain English: AES works with data arranged in a 4×4 grid of bytes (16 bytes = 128 bits total). It applies four operations to this grid, one after another, repeated 10, 12, or 14 times (depending on key size). First, each byte is replaced with a different byte via a lookup table (SubBytes). Then the rows of the grid are shifted (ShiftRows). Then the columns are mixed together using algebra (MixColumns). Finally, a round key is XORed into the state (AddRoundKey). The result is a thoroughly scrambled block that's mathematically impossible to unscramble without the key.
Why this really exists: By 1997, DES was clearly obsolete (Deep Crack broke it in 1998), so NIST held an open international competition. 15 ciphers were submitted from 12 countries. In 2000, the Rijndael cipher (by Belgian cryptographers Joan Daemen and Vincent Rijmen) won. AES is now the most widely used symmetric encryption algorithm on Earth — your HTTPS connection, your WiFi password, your phone's disk encryption, and secure messaging apps all use AES. It's fast in both hardware and software, and no practical attack has ever been found on the full 10-round version.
Every AES round (except the last) applies all four operations in sequence:
1. SubBytes — Each of the 16 state bytes is replaced using the AES S-box (a 16×16 lookup table). The S-box is based on the multiplicative inverse in GF(28) followed by an affine transformation. This is the only non-linear step — without it, AES would be solvable with linear algebra.
2. ShiftRows — Row 0 stays put. Row 1 rotates left by 1 byte. Row 2 rotates left by 2 bytes. Row 3 rotates left by 3 bytes. This spreads each column's influence across all columns.
3. MixColumns — Each column (4 bytes) is treated as a polynomial over
GF(28) and multiplied by a fixed polynomial:
3x³ + x² + x + 2. This mixes all four bytes within a column together. The last
round skips MixColumns (it's structurally identical to have it, but skipping
saves computation without reducing security).
4. AddRoundKey — The 128-bit round key (derived from the cipher key via Rijndael's key schedule) is XORed byte-by-byte into the state.
💡 Decryption in AES reverses these operations with their inverses: InvSubBytes, InvShiftRows (rotate right), InvMixColumns, and AddRoundKey (XOR is its own inverse). This is unlike Feistel ciphers (DES) where encryption and decryption are the same structure.
Each byte of the state is replaced by S[byte]. The S-box was designed to be resistant to differential and linear cryptanalysis. Here is the standard 16×16 lookup table (row = high nibble, column = low nibble):
💡 The S-box is computed mathematically, not randomly chosen. It's the multiplicative inverse in GF(2⁸) of the byte (with 0x00 mapping to itself), followed by an affine transformation over GF(2). This design ensures optimal resistance to differential and linear cryptanalysis.
Let's trace a single round of AES-128 with a 4×4 state. Key size: 128 bits (16 bytes). AES-128 = 10 rounds total. The state is shown as bytes arranged column-by-column (standard AES convention):
After all 10 rounds, the 16-byte state is the ciphertext. The key schedule generates all 11 round keys (K0 through K10) from the original 16-byte cipher key using a recursive expansion involving S-box substitutions and round constant XORs.
| Variant | Key Size | Rounds | Block Size | Security Level |
|---|---|---|---|---|
| AES-128 | 128 bits (16 B) | 10 | 128 bits | ✅ Sufficient for all current applications |
| AES-192 | 192 bits (24 B) | 12 | 128 bits | 🟢 Overkill for current threats |
| AES-256 | 256 bits (32 B) | 14 | 128 bits | 🟢 Resistant to quantum attacks (Grover's algorithm halves the security, still 128-bit effective) |
💡 Despite having different round counts, all three variants use the same 128-bit block size. The original Rijndael submission supported variable block sizes (128, 192, 256), but NIST standardized only the 128-bit block version as AES. The key schedule expansions differ between variants — AES-256's key schedule is more complex to derive 14 round keys from 32 bytes.
Jan 1997: NIST announces an open competition to replace DES
Aug 1998: 15 candidate algorithms accepted from 12 countries — Rijndael (Belgium), Serpent (UK/Israel/Denmark), Twofish (USA), RC6 (USA), MARS (USA), and 10 others
Mar 1999: 5 finalists chosen: Rijndael, Serpent, Twofish, RC6, MARS
Oct 2000: Rijndael wins — chosen for its excellent combination of security, performance (fast in both software and hardware), simplicity, and flexibility
Nov 2001: Published as FIPS PUB 197 — becomes the US government standard
2002–present: AES becomes the de facto global encryption standard adopted by NIST, ISO/IEC, and every major technology company
The other finalists were all strong ciphers — Serpent was actually more conservative (more rounds, higher security margin) but 2–3× slower. Twofish (designed by Bruce Schneier, creator of Blowfish) was a close runner-up. Rijndael won because it was elegant, fast, and had an excellent security margin — and 20+ years later, no practical attack breaks full AES.