---
{
  "title": "AES",
  "summary": "A symmetric block cipher whose safe use depends on its mode and implementation.",
  "topic": "foundations",
  "level": "Intermediate",
  "updated": "2026-10-12",
  "units": [
    6
  ],
  "aliases": [],
  "sources": [
    {
      "title": "NIST: Cryptographic Standards and Guidelines",
      "url": "https://csrc.nist.gov/projects/cryptographic-standards-and-guidelines"
    },
    {
      "title": "NIST FIPS 197: Advanced Encryption Standard",
      "url": "https://csrc.nist.gov/pubs/fips/197/final"
    },
    {
      "title": "NIST SP 800-38D: GCM and GMAC",
      "url": "https://csrc.nist.gov/pubs/sp/800/38/d/final"
    }
  ],
  "published": "2026-10-02",
  "editorialVersion": 2
}
---

## The idea

The Advanced Encryption Standard is a widely used symmetric block cipher with a 128-bit block size and key sizes of 128, 192, or 256 bits. A complete encryption scheme needs a mode or construction, key generation, parameter handling, and appropriate integrity protection. AES-GCM is an authenticated-encryption construction; using it requires correct nonce handling. Prefer maintained cryptographic libraries and reviewed protocols over implementing the cipher yourself.

## In practice

An application uses a library’s authenticated-encryption API, generates keys securely, and ensures a nonce is not reused with the same GCM key.

## A common misunderstanding

“AES-256” alone does not describe a secure system. Unsafe key storage or nonce reuse can undermine protection.

## Check your understanding

What else should an encryption design specify besides key size?

**Think it through:** The construction, key lifecycle, nonce requirements, authentication, and error handling.

## The cipher is one component of a design

A fictional archival service encrypts stored documents. Choosing AES identifies a block-cipher primitive, but the service still needs to define how arbitrary documents are processed, how tampering is detected, and how keys are recovered when an authorized user needs an old record. These are system decisions rather than properties implied by the algorithm's name.

Block size and key size describe different things. AES always operates on 128-bit blocks, while the supported key lengths differ. A larger key does not make each block larger or repair a flawed mode of operation. Compare complete supported constructions and their requirements rather than treating the largest number as the entire security decision.

Authenticated encryption should produce a clear success or failure when protected content is opened. The application must handle failed verification without using unauthenticated plaintext as if it were valid. Nonce management, associated data, and key rotation need to follow the chosen API and construction exactly.

## Specify an archive record

For a paper exercise, list the information a document record needs: the encrypted content, required public parameters, authentication information, and an identifier for the key version. State which values are secret and which must remain correctly associated with the record. Use fictional content and avoid designing a new cipher.

Then consider a lost key and an accidentally reused nonce. These failures have different consequences and recovery options. A useful encryption design documents prevention and operational response for both. Use a maintained high-level cryptographic library, verify its supported parameters, and test restoration of older records before retiring a key. Strong mathematics cannot recover content from an unavailable key or compensate for violating the construction's requirements.

## Keep exploring

- [[symmetric-encryption]]
- [[key-management]]
- [[legacy-cryptography]]