Kolmapäev, juuli 29, 2026

Logi sisse
Ajalugu

TÄNA AJALOOS, 28. juuli ⟩ Hiinas toimus 20. sajandi suurim maavärin

RSS

The Advanced Encryption Standard (AES), also known by its original name Rijndael (Dutch pronunciation: [ˈrɛindaːl], RAIN-dahl),[5] is a specification for the encryption of electronic data established by the US National Institute of Standards and Technology (NIST) in 2001.[6]

AES is a variant of the Rijndael block cipher[5] developed by two Belgian cryptographers, Joan Daemen and Vincent Rijmen, who submitted a proposal[7] to NIST during the AES selection process.[8] Rijndael is a family of ciphers with different key and block sizes. For AES, NIST selected three members of the Rijndael family, each with a block size of 128 bits, but three different key lengths: 128, 192 and 256 bits.

AES has been adopted by the US government. It supersedes the Data Encryption Standard (DES),[9] which was published in 1977. The algorithm described by AES is a symmetric-key algorithm, meaning the same key is used for both encrypting and decrypting the data.

In the United States, AES was announced by the NIST as the US FIPS PUB 197 (FIPS 197) standard on November 26, 2001.[6] This announcement followed a five-year standardization process in which fifteen competing designs were presented and evaluated, before the Rijndael cipher was selected as the most suitable.

AES is included in the ISO/IEC 18033-3 standard. AES became effective as a US federal government standard on May 26, 2002, after approval by US secretary of commerce Donald Evans. AES is available in many different encryption packages, and is the first (and only) publicly accessible cipher approved by the US National Security Agency (NSA) for top secret information when used in an NSA approved cryptographic module.[note 3]

Definitive standards

The Advanced Encryption Standard (AES) is defined in these standards:

  • FIPS PUB 197: Advanced Encryption Standard (AES)[6]
  • ISO/IEC 18033-3: Block ciphers[10]

Description of the ciphers

AES is based on a design principle known as a substitution–permutation network, and is efficient in both software and hardware.[11] Unlike its predecessor DES, AES does not use a Feistel network. AES is a variant of Rijndael, with a fixed block size of 128 bits, and a key size of 128, 192, or 256 bits. By contrast, Rijndael per se is specified with block and key sizes that may be any multiple of 32 bits, with a minimum of 128 and a maximum of 256 bits. Most AES calculations are done in a particular finite field.

AES operates on a 4 × 4 column-major order array of 16 bytes b0, b1, ..., b15 termed the state:[note 4]

The key size used for an AES cipher specifies the number of transformation rounds that convert the input, called the plaintext, into the final output, called the ciphertext. The number of rounds are as follows:

  • 10 rounds for 128-bit keys;
  • 12 rounds for 192-bit keys;
  • 14 rounds for 256-bit keys.

Each round consists of several processing steps, including one that depends on the encryption key itself. A set of reverse rounds are applied to transform ciphertext back into the original plaintext using the same encryption key.

High-level description of the algorithm

  1. KeyExpansion – round keys are derived from the cipher key using the AES key schedule. AES requires a separate 128-bit round key block for each round, plus one more.
  2. Initial round key addition:
    1. AddRoundKey – each byte of the state is combined with a byte of the round key using the bitwise exclusive or.
  3. 9, 11 or 13 rounds:
    1. SubBytes – a non-linear substitution step where each byte is replaced with another according to a lookup table.
    2. ShiftRows – a transposition step where the last three rows of the state are shifted cyclically a certain number of steps.
    3. MixColumns – a linear mixing operation which operates on the columns of the state, combining the four bytes in each column.
    4. AddRoundKey
  4. Final round (making 10, 12 or 14 rounds in total):
    1. SubBytes
    2. ShiftRows
    3. AddRoundKey

The SubBytes step

In the SubBytes step, each byte in the state is replaced with its entry in a fixed 8-bit lookup table, S; bij = S(aij).

In the SubBytes step, each byte ai,j in the state array is replaced with a SubByte S(ai,j) using an 8-bit substitution box. Before round 0, the state array is simply the plaintext/input. This operation provides the non-linearity in the cipher. The S-box used is derived from the multiplicative inverse over GF(28), known to have good non-linearity properties. To avoid attacks based on simple algebraic properties, the S-box is constructed by combining the inverse function with an invertible affine transformation. The S-box is also chosen to avoid any fixed points (and so is a derangement), i.e., S(ai,j) ≠ ai,j, and also any opposite fixed points, i.e., S(ai,j) ⊕ ai,j ≠ FF16. While performing the decryption, the InvSubBytes step (the inverse of SubBytes) is used, which requires first taking the inverse of the affine transformation and then finding the multiplicative inverse.

The ShiftRows step

In the ShiftRows step, bytes in each row of the state are shifted cyclically to the left. The number of places each byte is shifted differs incrementally for each row.

The ShiftRows step operates on the rows of the state; it cyclically shifts the bytes in each row by a certain offset. For AES, the first row is left unchanged. Each byte of the second row is shifted one to the left. Similarly, the third and fourth rows are shifted by offsets of two and three respectively.[note 5] In this way, each column of the output state of the ShiftRows step is composed of bytes from each column of the input state. The importance of this step is to avoid the columns being encrypted independently, in which case AES would degenerate into four independent block ciphers.

The MixColumns step

In the MixColumns step, each column of the state is multiplied with a fixed polynomial c(x).

In the MixColumns step, the four bytes of each column of the state are combined using an invertible linear transformation. The MixColumns function takes four bytes as input and outputs four bytes, where each input byte affects all four output bytes. Together with ShiftRows, MixColumns provides diffusion in the cipher.

During this operation, each column is transformed using a fixed matrix (matrix left-multiplied by column gives new value of column in the state):

Matrix multiplication is composed of multiplication and addition of the entries. Entries are bytes treated as coefficients of polynomial of order x7. Addition is simply XOR. Multiplication is modulo irreducible polynomial x8 + x4 + x3 + x + 1. If processed bit by bit, then, after shifting, a conditional XOR with 1B16 should be performed if the shifted value is larger than FF16 (overflow must be corrected by subtraction of generating polynomial). These are special cases of the usual multiplication in GF(28).

In more general sense, each column is treated as a polynomial over GF(28) and is then multiplied modulo with a fixed polynomial . The coefficients are displayed in their hexadecimal equivalent of the binary representation of bit polynomials from GF(28)[x]. The MixColumns step can also be viewed as a multiplication by the shown particular MDS matrix in the finite field GF(28). This process is described further in the article Rijndael MixColumns.

The AddRoundKey Step

In the AddRoundKey step, each byte of the state is combined with a byte of the round subkey using the XOR operation (⊕).

In the AddRoundKey step, the subkey is combined with the state. For each round, a subkey is derived from the main key using Rijndael's key schedule; each subkey is the same size as the state. The subkey is added by combining of the state with the corresponding byte of the subkey using bitwise XOR.

Optimization of the cipher

On systems with 32-bit or larger words, it is possible to speed up execution of this cipher by combining the SubBytes and ShiftRows steps with the MixColumns step by transforming them into a sequence of table lookups. This requires four 256-entry 32-bit tables (together occupying 4096 bytes). A round can then be performed with 16 table lookup operations and 12 32-bit exclusive-or operations, followed by four 32-bit exclusive-or operations in the AddRoundKey step.[12] Alternatively, the table lookup operation can be performed with a single 256-entry 32-bit table (occupying 1024 bytes) followed by circular rotation operations.

Using a byte-oriented approach, it is possible to combine the SubBytes, ShiftRows, and MixColumns steps into a single round operation.[13]

Security

The National Security Agency (NSA) reviewed all the AES finalists, including Rijndael, and stated that all of them were secure enough for US Government non-classified data. In June 2003, the US Government announced that AES could be used to protect classified information:

NIST/CSEC validation

The Cryptographic Module Validation Program (CMVP) is operated jointly by the United States Government's National Institute of Standards and Technology (NIST) Computer Security Division and the Communications Security Establishment (CSE) of the Government of Canada. The use of cryptographic modules validated to NIST FIPS 140-2 is required by the United States Government for encryption of all data that has a classification of Sensitive but Unclassified (SBU) or above. From NSTISSP #11, National Policy Governing the Acquisition of Information Assurance: "Encryption products for protecting classified information will be certified by NSA, and encryption products intended for protecting sensitive information will be certified in accordance with NIST FIPS 140-2."[42]

The Government of Canada also recommends the use of FIPS 140 validated cryptographic modules in unclassified applications of its departments.

Although NIST publication 197 ("FIPS 197") is the unique document that covers the AES algorithm, vendors typically approach the CMVP under FIPS 140 and ask to have several algorithms (such as Triple DES or SHA1) validated at the same time. Therefore, it is rare to find cryptographic modules that are uniquely FIPS 197 validated and NIST itself does not generally take the time to list FIPS 197 validated modules separately on its public web site. Instead, FIPS 197 validation is typically just listed as an "FIPS approved: AES" notation (with a specific FIPS 197 certificate number) in the current list of FIPS 140 validated cryptographic modules.

The Cryptographic Algorithm Validation Program (CAVP)[43] allows for independent validation of the correct implementation of the AES algorithm. Successful validation results in being listed on the NIST validations page.[44] This testing is a pre-requisite for the FIPS 140-2 module validation. However, successful CAVP validation in no way implies that the cryptographic module implementing the algorithm is secure. A cryptographic module lacking FIPS 140-2 validation or specific approval by the NSA is not deemed secure by the US Government and cannot be used to protect government data.[42]

FIPS 140-2 validation is challenging to achieve both technically and fiscally.[45] There is a standardized battery of tests as well as an element of source code review that must be passed over a period of a few weeks. The cost to perform these tests through an approved laboratory can be significant (e.g., well over US$30,000)[45] and does not include the time it takes to write, test, document and prepare a module for validation. After validation, modules must be re-submitted and re-evaluated if they are changed in any way. This can vary from simple paperwork updates if the security functionality did not change to a more substantial set of re-testing if the security functionality was impacted by the change.

Test vectors

Test vectors are a set of known ciphers for a given input and key. NIST distributes the reference of AES test vectors as AES Known Answer Test (KAT) Vectors.[note 6]

Performance

High speed and low RAM requirements were some of the criteria of the AES selection process. As the chosen algorithm, AES performed well on a wide variety of hardware, from 8-bit smart cards to high-performance computers.

On a Pentium Pro, AES encryption requires 18 clock cycles per byte (cpb),[46] equivalent to a throughput of about 11 MiB/s for a 200 MHz processor.

On Intel Core and AMD Ryzen CPUs supporting AES-NI instruction set extensions, throughput can be multiple GiB/s.[47] On an Intel Westmere CPU, AES encryption using AES-NI takes about 1.3 cpb for AES-128, and 1.8 cpb for AES-256.[48]

Implementations

See also

Notes

  1. ↑ Key sizes of 128, 160, 192, 224, and 256 bits are supported by the Rijndael algorithm, but only the 128, 192, and 256-bit key sizes are specified in the AES standard.
  2. ↑ Block sizes of 128, 160, 192, 224, and 256 bits are supported by the Rijndael algorithm for each key size, but only the 128-bit block size is specified in the AES standard.
  3. ↑ See § Security below
  4. ↑ Large-block variants of Rijndael use an array with additional columns, but always four rows.
  5. ↑ Rijndael variants with a larger block size have slightly different offsets. For blocks of sizes 128 bits and 192 bits, the shifting pattern is the same. Row n is shifted left circular by n−1 bytes. For a 256-bit block, the first row is unchanged and the shifting for the second, third and fourth row is 1 byte, 3 bytes and 4 bytes respectively—this change only applies for the Rijndael cipher when used with a 256-bit block, as AES does not use 256-bit blocks.
  6. ↑ The AES Known Answer Test (KAT) Vectors are available in Zip format within the NIST site here Archived 2009-10-23 at the Wayback Machine

References

  1. ↑ "Biclique Cryptanalysis of the Full AES" (PDF). Archived from the original (PDF) on March 6, 2016. Retrieved May 1, 2019.
  2. 1 2 Alex Biryukov and Dmitry Khovratovich, Related-key Cryptanalysis of the Full AES-192 and AES-256, "Related-key Cryptanalysis of the Full AES-192 and AES-256". Table 1. Archived from the original on 2009-09-28. Retrieved 2010-02-16.
  3. 1 2 Bruce Schneier (2009-07-30). "Another New AES Attack". Schneier on Security, A blog covering security and security technology. Archived from the original on 2009-10-05. Retrieved 2010-03-11.
  4. ↑ Alex Biryukov; Orr Dunkelman; Nathan Keller; Dmitry Khovratovich; Adi Shamir (2009-08-19). "Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds". Archived from the original on 28 January 2010. Retrieved 2010-03-11.
  5. 1 2 Daemen, Joan; Rijmen, Vincent (March 9, 2003). "AES Proposal: Rijndael" (PDF). National Institute of Standards and Technology. p. 1. Archived (PDF) from the original on 5 March 2013. Retrieved 21 February 2013.
  6. 1 2 3 "Announcing the ADVANCED ENCRYPTION STANDARD (AES)" (PDF). Federal Information Processing Standards Publication 197. United States National Institute of Standards and Technology (NIST). November 26, 2001. Archived (PDF) from the original on August 23, 2024. Retrieved August 26, 2024.
  7. ↑ Joan Daemen and Vincent Rijmen (September 3, 1999). "AES Proposal: Rijndael" (PDF). Archived from the original (PDF) on February 3, 2007.
  8. ↑ Schwartz, John (October 3, 2000). "U.S. Selects a New Encryption Technique". The New York Times. Archived from the original on March 28, 2017.
  9. ↑ Westlund, Harold B. (2002). "NIST reports measurable success of Advanced Encryption Standard". Journal of Research of the National Institute of Standards and Technology. Archived from the original on 2007-11-03.
  10. ↑ "ISO/IEC 18033-3: Information technology – Security techniques – Encryption algorithms – Part 3: Block ciphers". Archived from the original on 2013-12-03.
  11. ↑ Bruce Schneier; John Kelsey; Doug Whiting; David Wagner; Chris Hall; Niels Ferguson; Tadayoshi Kohno; et al. (May 2000). "The Twofish Team's Final Comments on AES Selection" (PDF). Archived (PDF) from the original on 2010-01-02.
  12. ↑ Bertoni, Guido; Breveglieri, Luca; Fragneto, Pasqualina; MacChetti, Marco; Marchesin, Stefano (2003). "Efficient Software Implementation of AES on 32-Bit Platforms". Cryptographic Hardware and Embedded Systems - CHES 2002. Lecture Notes in Computer Science. Vol. 2523. pp. 159–171. doi:10.1007/3-540-36400-5_13. ISBN 978-3-540-00409-7.
  13. ↑ "byte-oriented-aes – A public domain byte-oriented implementation of AES in C – Google Project Hosting". Archived from the original on 2013-07-20. Retrieved 2012-12-23.
  14. ↑ Lynn Hathaway (June 2003). "National Policy on the Use of the Advanced Encryption Standard (AES) to Protect National Security Systems and National Security Information" (PDF). Archived (PDF) from the original on 2010-11-06. Retrieved 2011-02-15.
  15. ↑ National Security Agency (September 2022). "Announcing the Commercial National Security Algorithm Suite 2.0" (PDF). Retrieved 2025-04-12.
  16. ↑ Ou, George (April 30, 2006). "Is encryption really crackable?". Ziff-Davis. Archived from the original on August 8, 2010. Retrieved August 7, 2010.
  17. ↑ "Sean Murphy". University of London. Archived from the original on 2009-01-31. Retrieved 2008-11-02.
  18. ↑ Bruce Schneier. "AES News, Crypto-Gram Newsletter, September 15, 2002". Archived from the original on 7 July 2007. Retrieved 2007-07-27.
  19. ↑ Ferguson, Niels; Schroeppel, Richard; Whiting, Doug (2001). "A simple algebraic representation of Rijndael". In Vaudenay, Serge; Youssef, Amr M. (eds.). Proceedings of Selected Areas in Cryptography, 2001. Lecture Notes in Computer Science. Vol. 2259. Springer-Verlag. pp. 103–111. CiteSeerX 10.1.1.28.4921. doi:10.1007/3-540-45537-X_8. ISBN 978-3-540-45537-0. Archived from the original on 4 November 2006.
  20. ↑ Bruce Schneier, AES Announced Archived 2009-02-01 at the Wayback Machine, October 15, 2000
  21. ↑ John Kelsey, Stefan Lucks, Bruce Schneier, Mike Stay, David Wagner, and Doug Whiting, Improved Cryptanalysis of Rijndael, Fast Software Encryption, 2000 pp213–230 "Academic: Improved Cryptanalysis of Rijndael - Schneier on Security". Archived from the original on 2007-02-23. Retrieved 2007-03-06.
  22. ↑ Nikolić, Ivica (2009). "Distinguisher and Related-Key Attack on the Full AES-256". Advances in Cryptology - CRYPTO 2009. Lecture Notes in Computer Science. Vol. 5677. Springer Berlin / Heidelberg. pp. 231–249. doi:10.1007/978-3-642-03356-8_14. ISBN 978-3-642-03355-1.
  23. ↑ Alex Biryukov; Orr Dunkelman; Nathan Keller; Dmitry Khovratovich; Adi Shamir (2009-08-19). "Key Recovery Attacks of Practical Complexity on AES Variants With Up To 10 Rounds". Archived from the original on 28 January 2010. Retrieved 2010-03-11.
  24. ↑ Agren, Martin (2012). On Some Symmetric Lightweight Cryptographic Designs. Dissertation, Lund University. pp. 38–39.
  25. ↑ Vincent Rijmen (2010). "Practical-Titled Attack on AES-128 Using Chosen-Text Relations" (PDF). IACR Cryptology ePrint Archive. Archived (PDF) from the original on 2010-07-02.
  26. ↑ Henri Gilbert; Thomas Peyrin (2009-11-09). "Super-Sbox Cryptanalysis: Improved Attacks for AES-like permutations". IACR Cryptology ePrint Archive. Archived from the original on 2010-06-04. Retrieved 2010-03-11.
  27. ↑ Bogdanov, Andrey; Khovratovich, Dmitry; Rechberger, Christian (2011). "Biclique Cryptanalysis of the Full AES". In Lee, Dong Hoon; Wang, Xiaoyun (eds.). Advances in Cryptology – ASIACRYPT 2011. Lecture Notes in Computer Science. Vol. 7073. pp. 344–371. doi:10.1007/978-3-642-25385-0_19. ISBN 978-3-642-25385-0.
  28. 1 2 Tao, Biaoshuai; Wu, Hongjun (2015). "Improving the Biclique Cryptanalysis of AES". In Foo, Ernest; Stebila, Douglas (eds.). Information Security and Privacy. Lecture Notes in Computer Science. Vol. 9144. pp. 39–56. doi:10.1007/978-3-319-19962-7_3. ISBN 978-3-319-19962-7.
  29. ↑ Jeffrey Goldberg (2011-08-18). "AES Encryption isn't Cracked". Archived from the original on 8 January 2015. Retrieved 30 December 2014.
  30. ↑ "Prying Eyes: Inside the NSA's War on Internet Security". Spiegel Online. Hamburg, Germany. 28 December 2014. Archived from the original on 24 January 2015. Retrieved 4 September 2015.
  31. 1 2 "Index of formal scientific papers". Cr.yp.to. Archived from the original on 2008-09-17. Retrieved 2008-11-02.
  32. ↑ Bruce Schneier (17 May 2005). "AES Timing Attack". Archived from the original on 12 February 2007. Retrieved 2007-03-17.
  33. ↑ Dag Arne Osvik; Adi Shamir; Eran Tromer (2005-11-20). "Cache Attacks and Countermeasures: the Case of AES" (PDF). The Cryptographer's Track at RSA Conference 2006. Lecture Notes in Computer Science. Vol. 3860. pp. 1–20. doi:10.1007/11605805_1. ISBN 978-3-540-31033-4. Archived (PDF) from the original on 2006-06-19. Retrieved 2008-11-02.
  34. ↑ Dhiman Saha; Debdeep Mukhopadhyay; Dipanwita RoyChowdhury. "A Diagonal Fault Attack on the Advanced Encryption Standard" (PDF). IACR Cryptology ePrint Archive. Archived (PDF) from the original on 22 December 2009. Retrieved 2009-12-08.
  35. ↑ Endre Bangerter; David Gullasch & Stephan Krenn (2010). "Cache Games – Bringing Access-Based Cache Attacks on AES to Practice" (PDF). IACR Cryptology ePrint Archive. Archived (PDF) from the original on 2010-12-14.
  36. ↑ "Breaking AES-128 in realtime, no ciphertext required". Hacker News. Archived from the original on 2011-10-03. Retrieved 2012-12-23.
  37. ↑ Ashokkumar, C.; Giri, Ravi Prakash; Menezes, Bernard (12 May 2016). Highly Efficient Algorithms for AES Key Retrieval in Cache Access Attacks. 2016 IEEE European Symposium on Security and Privacy (EuroS&P). Saarbruecken, Germany. pp. 261–275. doi:10.1109/EuroSP.2016.29.
  38. ↑ Mowery, Keaton; Keelveedhi, Sriram; Shacham, Hovav (19 October 2012). Are AES x86 cache timing attacks still feasible? (PDF). CCS'12: the ACM Conference on Computer and Communications Security. Raleigh, North Carolina, USA. pp. 19–24. doi:10.1145/2381913.2381917. Archived from the original (PDF) on 2017-08-09.
  39. ↑ "Securing the Enterprise with Intel AES-NI" (PDF). Intel Corporation. Archived (PDF) from the original on 2013-03-31. Retrieved 2017-07-26.
  40. ↑ Bonnetain, Xavier; Naya-Plasencia, María; Schrottenloher, André (11 June 2019). "Quantum Security Analysis of AES". IACR Transactions on Symmetric Cryptology. 2019 (2): 55–93. doi:10.13154/tosc.v2019.i2.55-93.
  41. ↑ O'Shea, Dan (April 26, 2022). "AES-256 joins the quantum resistance". Fierce Electronics. Retrieved September 26, 2023.
  42. 1 2 "NSTISSP No. 11, Revised Fact Sheet, National Information Assurance Acquisition Policy" (PDF). Archived from the original (PDF) on 2012-04-21. Retrieved 2012-05-29.
  43. ↑ "NIST.gov – Computer Security Division – Computer Security Resource Center". Csrc.nist.gov. Archived from the original on 2013-01-02. Retrieved 2012-12-23.
  44. ↑ "Validated FIPS 140-1 and FIPS 140-2 Cryptographic Modules". Archived from the original on 2014-12-26. Retrieved 2014-06-26.
  45. 1 2 OpenSSL, openssl@openssl.org. "OpenSSL's Notes about FIPS certification". Openssl.org. Archived from the original on 2013-01-02. Retrieved 2012-12-23.
  46. ↑ Schneier, Bruce; Kelsey, John; Whiting, Doug; Wagner, David; Hall, Chris; Ferguson, Niels (1999-02-01). "Performance Comparisons of the AES submissions" (PDF). Archived (PDF) from the original on 2011-06-22. Retrieved 2010-12-28.
  47. ↑ "AMD Ryzen 7 1700X Review".
  48. ↑ "Intel Advanced Encryption Standard (AES) New Instructions Set" (PDF). May 2010.
allikas: https://en.wikipedia.org/wiki/Advanced_Encryption_Standard

Related Posts

TÄNA AJALOOS, 29. juuli ⟩ Briti kuningakojas toimus pulm, mida vaatasid miljonid inimesed

juuli 29, 2026

TÄNA AJALOOS ⟩ Hiinas toimus 20. sajandi suurim maavärin

juuli 28, 2026

Lisa kommentaar

Sinu e-postiaadressi ei avaldata. Nõutavad väljad on tähistatud *-ga

Veel nalja

Copyleft All Rights Reserved 2026 Theme: intimate by Template Sell.