The Advanced Encryption Standard

AES is a symmetric block cipher, selected by the U.S. National Institute of Standards and Technology (NIST) through an open competition and published as FIPS 197 in 2001, that encrypts data in 128-bit blocks under a 128-, 192-, or 256-bit key.

Unpack the sentence and you have the whole page. Symmetric: the same key encrypts and decrypts, as covered in Foundations. Block cipher: it processes plaintext sixteen bytes at a time. Selected through an open competition: the algorithm was never a secret; it won precisely because the entire world was invited to break it and could not. FIPS 197: it is a published federal standard anyone can download, read, and implement.

The algorithm itself has a name of its own: Rijndael, designed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen. "AES" is the title the standard bestowed on it. In casual use the two names are interchangeable, though strictly speaking AES is the specific configuration of Rijndael that the standard fixed: a 128-bit block with the three approved key lengths.

By the mid-1990s, the incumbent U.S. standard, DES, was dying in public. Its 56-bit key had become brute-forceable by determined hobbyists, never mind governments. NIST needed a replacement, and the way it ran the search shaped modern cryptography as much as the winner did.

In 1997, NIST announced an open, worldwide competition. Anyone, from any country, could submit a cipher. Every submission had to be fully specified, published, and free of royalties. Fifteen candidates arrived from around the globe. For three years, academic and industrial cryptographers attacked them all in the open: conferences, papers, public comment rounds. Five finalists emerged (MARS, RC6, Rijndael, Serpent, Twofish), each strong, each scrutinized without mercy.

Notice what the process was not: it was not a government agency designing a cipher in a vault and instructing everyone to trust it. The winner was chosen after years of adversarial public review, and two decades later that review has never stopped. That is not an accident of history. It is the entire philosophy of modern cryptography, and it has a name: Kerckhoffs's Principle, covered in depth on its own page.

From the outside, AES is a box with three properties you should know cold:

The block size never changes: sixteen bytes in, sixteen bytes out, always. Only the key length and the number of rounds vary. Each round is a fixed sequence of four operations (byte substitution, row shifting, column mixing, and key addition) that repeatedly scramble the block until every output bit depends on every input bit and every key bit.

The internals are a genuinely beautiful piece of engineering, and they get the full treatment on Block Ciphers and AES: the state matrix, the S-box, and each of the four round operations, step by step. This page stays outside the box on purpose. For day-to-day security work, the three rows of that table plus the ideas on this page are what you will actually use.

Here is the part that surprises newcomers: every mathematical step of AES (every constant, every table, every line of the specification) is freely available to anyone, including every attacker on the planet. And that openness is not a weakness AES survives despite. It is the reason AES is trustworthy at all.

AES is the principle's flagship demonstration. Because the design is public, twenty-plus years of the world's best cryptanalysts have attacked it from every angle, and the fact that they have found no practical break is evidence, the kind no secret algorithm can ever offer. Because the only secret is the key, security rests on something small, easy to generate, easy to protect, and (crucially) easy to replace. A leaked key is an incident; you rotate it and move on. A leaked algorithm baked into millions of devices is a catastrophe you cannot patch with a config change.

The full story (Kerckhoffs's original 1883 rules, Shannon's maxim, and the graveyard of "secret" ciphers like GSM's A5/2 that collapsed the moment they were reverse engineered) lives on the Kerckhoffs's Principle page. Read it next; AES will make more sense for it.

AES is likely protecting you dozens of times before breakfast. A non-exhaustive tour:

Why it is everywhere: hardware

Since around 2010, mainstream CPUs ship with dedicated AES instructions (AES-NI on x86, the Cryptography Extensions on ARM). A single core can push multiple gigabytes per second, which means full-disk encryption and encrypted-by-default traffic cost almost nothing. Ubiquity bred acceleration, and acceleration bred more ubiquity. Standards create flywheels.

After more than two decades of open, motivated, well-funded attack, the scoreboard is remarkably boring, and boring is exactly what you want from a cipher.

• No practical break exists. The best published attack on full AES (the 2011 biclique technique) shaves the effort to roughly 2¹²⁶ operations for AES-128, a "win" of about a factor of four over brute force. That is still a computation the universe does not have the resources to run.
• Academic dents, not holes. Related-key attacks against AES-192 and AES-256 exist on paper, but they require attacker control over key relationships that no sane protocol permits.
• Real-world failures are implementation failures. When AES deployments break, the cause is cache-timing side channels, bad modes (ECB), reused IVs and nonces, or mishandled keys, not the cipher's math. The lesson repeats across the whole symmetric track: the algorithm is the easy part.
• Quantum computers change sizes, not verdicts. Grover's algorithm would halve the effective key strength, making AES-128 behave like a 64-bit cipher against a large quantum adversary. The standard response is simply AES-256, which retains 128 bits of post-quantum margin. The upheaval quantum computing causes for asymmetric cryptography is a different story, told in Post-Quantum Cryptography.

AES encrypts exactly one sixteen-byte block. Everything else that makes it useful in practice is scaffolding built around it, and each piece has its own page in this track:

• Encrypting data longer than one block requires a mode of operation: Modes of Operation.
• Fitting arbitrary-length data into blocks requires padding and IVs, and getting them wrong is a classic exploit class: Padding and Initialization Vectors.
• Encryption without integrity is an invitation to tampering; modern deployments use authenticated encryption such as AES-GCM: Authenticated Encryption (AEAD).
• And the key itself must be generated, stored, rotated, and destroyed properly: Key Management.

Before leaving this page, confirm you can answer the following without looking:

1. What kind of cipher is AES, and what are its block size and three key lengths?
2. How was AES selected, and why does the openness of that process matter for trust?
3. What is the only secret in a properly deployed AES system, and why is that a feature?
4. Name four places AES protects your data in an ordinary day.
5. When AES deployments fail in the real world, where does the failure almost always live?

If all five are solid, continue to Kerckhoffs's Principle for the idea that explains why AES is built the way it is, or descend into the round-by-round machinery in Block Ciphers and AES.