Symmetric ciphersRecommended
Advanced Encryption Standard
Symmetric block cipher
How it works
AES is the Rijndael cipher, selected by NIST in a public competition and published as FIPS 197 in 2001. It encrypts fixed 128-bit blocks through repeated rounds of substitution, row shifting, column mixing and key addition. On its own it only encrypts one block, so it is always used inside a mode of operation such as GCM, CTR, CBC or XTS.
Sizes: 128-bit block; 128, 192 or 256-bit keys (10, 12 or 14 rounds)
Strengths
- No practical attack on the full cipher when used correctly; it is the default symmetric algorithm worldwide.
- Hardware acceleration (AES-NI and similar instructions) on most modern CPUs makes it very fast.
- FIPS-approved, so it satisfies government and regulated-industry requirements.
Weaknesses and known attacks
- Security depends on the mode: AES in ECB mode still leaks patterns.
- Software implementations without constant-time code can leak keys through cache-timing side channels.
- Grover's algorithm would reduce the effective strength of AES-128 against a large quantum computer, which is why AES-256 is preferred for long-term secrets.
Use it for
- Bulk data encryption at rest and in transit
- Disk, file and database encryption
- TLS, IPsec, SSH and Wi-Fi (WPA2/WPA3) traffic
Don't use it for
- ECB mode for anything larger than one block
- Situations needing integrity unless paired with an AEAD mode (GCM) or a MAC
Exam tip
AES is symmetric, block-based, 128-bit block, and the key lengths are 128, 192 and 256. If an answer lists a 64-bit block or a 56-bit key, it is describing DES or 3DES, not AES.