Symmetric Encryption & AES
Symmetric encryption is the workhorse of modern cryptography. It's fast, secure, and encrypts the majority of the world's data — from WhatsApp messages to hard drives to HTTPS connections. Let's see how it actually works.
What is Symmetric Encryption?
Symmetric encryption uses a single key to both encrypt and decrypt data. The same key that locks the message unlocks it.
Analogy: Think of a lockbox. You lock it with a key, hand it to a courier, and the recipient unlocks it with an identical copy of the same key. Whoever has the key can open the box.
AES: The Global Standard
AES (Advanced Encryption Standard) is the symmetric cipher used everywhere — the US government, banks, encrypted hard drives, HTTPS, WhatsApp, iMessage, Signal, Wi-Fi (WPA2/3), and more. It was selected by NIST in 2001 after a 5-year competition.
Key facts about AES:
- Block cipher: Operates on fixed-size chunks of data (128 bits / 16 bytes at a time)
- Key sizes: 128, 192, or 256 bits (AES-128, AES-192, AES-256)
- Rounds: 10 rounds (AES-128), 12 (AES-192), 14 (AES-256) of mathematical transformations
- Speed: Extremely fast, especially with hardware acceleration (modern CPUs have AES-NI instructions)
- Security: No known practical attack against properly implemented AES. The best known attack reduces the security of AES-128 by a trivial amount — it's still computationally infeasible to break.
What happens inside each AES round?
Each of the 10–14 rounds performs four operations on the data block (visualized as a 4×4 grid of bytes):
- SubBytes: Each byte is replaced with a different byte via a lookup table (S-box). This provides non-linearity — making the cipher resistant to mathematical analysis.
- ShiftRows: The rows of the 4×4 grid are shifted cyclically. Row 0 stays put, row 1 shifts left by 1, row 2 by 2, row 3 by 3.
- MixColumns: Each column is multiplied by a fixed polynomial in a special mathematical field. Spreads data across columns for diffusion.
- AddRoundKey: Each byte is XOR'd with the round key (derived from the original key). This is the only step that actually uses the key.
Together, these operations create confusion (hiding the relationship between key and ciphertext) and diffusion (spreading each bit's influence across the entire output).
Modes of Operation: How AES Handles Real Data
AES encrypts 128-bit blocks. But real data is longer than 128 bits. Modes of operation define how AES encrypts multiple blocks:
- ECB (Electronic Codebook): Each block encrypted independently. Never use this. Identical plaintext blocks produce identical ciphertext blocks — patterns in the original data remain visible.
- CBC (Cipher Block Chaining): Each block is XOR'd with the previous ciphertext block before encryption. Much better, but requires a random IV (initialization vector) and is vulnerable to padding oracle attacks.
- GCM (Galois/Counter Mode): The gold standard. Provides both encryption AND authentication (AEAD — Authenticated Encryption with Associated Data). Used in TLS 1.3, AES-GCM-SIV, and most modern protocols. Parallelizable and fast.
- CTR (Counter Mode): Turns AES into a stream cipher by encrypting sequential counter values. Fast and parallelizable, but no built-in authentication.
AES-128 vs AES-256: Does Key Size Matter?
For classical computers, AES-128 is already unbreakable — there's no known attack. So why use AES-256?
Quantum computers and Grover's algorithm (covered in Phase 3) effectively halve the security of symmetric ciphers. AES-128 with a quantum computer provides only 64 bits of effective security — too weak for the future. AES-256 provides 128 bits of effective security even against quantum attacks — still strong.
Interactive: Visualizing Block Cipher Properties
AES has two key properties: confusion and diffusion. The "avalanche effect" means changing one bit of input completely scrambles the output. Use the button to see how a one-bit change propagates.
This demonstrates the avalanche effect — a hallmark of good ciphers. One changed input bit causes roughly 50% of output bits to flip.
Frequently Asked Questions
Has AES ever been broken?
No practical break of AES has ever been demonstrated. The best known theoretical attacks (biclique attacks) reduce AES-128's effective security from 128 bits to about 126.2 bits — still requiring an astronomical amount of computation. In practice, attacks against systems using AES target the implementation (side-channel attacks, padding oracles) rather than the algorithm itself.
Is AES quantum-safe?
Partially. Grover's algorithm gives a quadratic speedup for brute-force search, effectively halving the key security in bits. AES-128 drops to ~64 bits of quantum security (too weak). AES-256 drops to ~128 bits — still considered secure. So AES-256 is considered quantum-resistant for symmetric encryption. The bigger quantum threat is to asymmetric algorithms like RSA.
What's ChaCha20 and how does it compare to AES?
ChaCha20 is another modern stream cipher paired with the Poly1305 MAC (ChaCha20-Poly1305). It's used in TLS 1.3, WireGuard, and Signal as an alternative to AES-GCM. On devices without AES hardware acceleration (older phones, IoT), ChaCha20 is faster than AES. On modern CPUs with AES-NI, AES-GCM wins on speed. Both are considered equally secure.
Frequently Asked Questions
What will I learn here?
This page covers the core concepts and techniques you need to understand the topic and progress confidently to the next lesson.
How should I use this page?
Start with the overview, then follow the section links to deepen your understanding. Use the table of contents on the right to jump to specific sections.
What should I read next?
Use the navigation below to continue to the next lesson or explore related topics.