Cybersecurity glossary
What is the Advanced Encryption Standard (AES)?
Learn what AES is, how 128/192/256-bit keys and block modes work, why AES-GCM is preferred, and which operational mistakes weaken AES in real systems.
Definition
The Advanced Encryption Standard (AES) is a symmetric block cipher standardized by NIST that encrypts 128-bit blocks with 128-, 192-, or 256-bit keys and underpins most modern disk, database, and TLS record encryption.
Why AES matters
Almost every modern stack that claims “encrypted by default” ultimately relies on the Advanced Encryption Standard (AES). Disk encryption, cloud KMS envelopes, database transparent encryption, JWTs with content encryption, and TLS record protection all lean on this NIST-standardized block cipher.
Choosing AES is rarely the hard part. The hard part is choosing a safe mode, generating unique IVs or nonces, protecting keys, and verifying integrity so ciphertext cannot be silently altered.
What AES actually is
AES is a symmetric block cipher: the same secret key encrypts and decrypts. It always operates on 128-bit blocks. Key length may be 128, 192, or 256 bits, which changes the number of rounds and the key schedule—not the block size.
Shared secret key
Sender and receiver (or storage system) must already share or unwrap the AES key through a secure channel or KMS.
Fixed 128-bit blocks
Plaintext is processed in 16-byte blocks; modes define how longer messages and integrity tags are handled.
Standardized algorithm
FIPS 197 defines the cipher formerly known as Rijndael, enabling interoperable hardware and software implementations.
Mode decides safety
Raw AES is not enough. GCM, CCM, or carefully designed CBC+MAC constructions determine real security properties.
How AES protects a message
Obtain or derive a key
A KMS, HSM, or key-exchange step produces a high-entropy AES key never hard-coded in source.
Choose a mode and IV/nonce
AEAD modes such as GCM need a unique nonce per key; CBC needs an unpredictable IV.
Encrypt the plaintext
AES transforms blocks under the key and mode, producing ciphertext of comparable length plus any authentication tag.
Bind associated data when needed
Headers, version fields, or AAD are authenticated so attackers cannot swap metadata without detection.
Store or transmit ciphertext
Only ciphertext, IV/nonce, and tag leave the trust boundary; the key stays in a vault or memory-protected enclave.
Decrypt and verify
The receiver checks the tag (for AEAD) before releasing plaintext, rejecting tampered messages.
Common AES modes compared
Teams often say “we use AES” when they mean a specific mode. The mode choice drives failure modes.
| Mode | Provides | Main caution |
|---|---|---|
| AES-GCM | Confidentiality + integrity (AEAD) | Nonce reuse with the same key is catastrophic |
| AES-CCM | AEAD suited to constrained devices | Strict nonce and length handling requirements |
| AES-CBC + HMAC | Encryption plus separate MAC if designed correctly | Easy to get order/padding wrong; prefer AEAD libraries |
| AES-CTR alone | Confidentiality only | No integrity; bit-flips map predictably to plaintext |
| AES-ECB | Almost never appropriate | Identical blocks leak patterns; avoid for real data |
Operational checklist for AES deployments
- Prefer library AEAD APIs (AES-GCM or AES-CCM) over hand-rolled CBC and MAC combinations.
- Enforce unique nonces or IVs per key; fail closed if a nonce generator cannot guarantee uniqueness.
- Store keys in a KMS or HSM and use envelope encryption for bulk data.
- Separate keys by purpose: TLS session keys, disk volume keys, and application field keys should not be shared.
- Rotate keys on a schedule and after any suspected exposure; keep decrypt capability for old ciphertext during migration.
- Disable ECB and legacy weak constructions in scanners and crypto policy baselines.
- Size keys to policy: AES-128 is strong; AES-256 is common for long retention or regulated workloads.
- Test that authentication failures reject ciphertext instead of returning partial plaintext.
Where AES shows up in security reviews
During assessments, “AES configured” is not a green light by itself. Reviewers look for nonce management, key custody, missing authentication tags, static IVs in mobile apps, and custom crypto wrappers that bypass vetted libraries.
In TLS, AES-GCM cipher suites remain a workhorse alongside ChaCha20-Poly1305. At rest, volume encryption and application-level field encryption both commonly use AES, but only application-level schemes can differentiate records or tenants if the disk is mounted by an attacker with OS access.
The practical takeaway
AES is the standard symmetric block cipher for modern confidentiality. Pair it with an authenticated mode, unique nonces, and serious key management—and treat “we encrypt with AES” as incomplete until those controls are proven.
Related security terms
Authenticated Encryption with Associated Data (AEAD)
Cipher constructions that combine confidentiality and integrity, including AES-GCM.
Symmetric Cryptography
The broader family of shared-key algorithms where AES is the dominant block cipher.
Initialization Vector (IV)
Per-message randomness required by many AES modes to avoid ciphertext patterns.
ChaCha20-Poly1305
A widely used stream-cipher AEAD alternative often chosen alongside AES-GCM.
Encryption at Rest
How AES is commonly applied to disks, volumes, and stored application data.
Frequently asked questions
What is AES in simple terms?
AES is a standardized shared-key cipher that turns readable data into ciphertext so only someone with the correct key can recover it. It is the default encryption algorithm in most operating systems, databases, and TLS stacks.
What is the difference between AES-128 and AES-256?
Both encrypt 128-bit blocks. AES-128 uses a 128-bit key; AES-256 uses a 256-bit key and more rounds. AES-128 remains strong for most uses; AES-256 is often chosen for long-term or high-assurance data protection policies.
Is AES the same as AES-GCM?
No. AES is the block cipher. AES-GCM is a mode of operation that uses AES to provide encryption plus an authentication tag so tampering is detected.
Why is AES-CBC alone considered risky?
CBC without a separate MAC can allow padding-oracle and ciphertext-modification attacks. Prefer AEAD modes such as AES-GCM or AES-CCM, or pair CBC with a strong encrypt-then-MAC design if you must.
Does AES protect data in transit by itself?
AES is only the cipher. Transport security also needs authenticated key exchange, certificate validation, integrity protection, and a correct protocol such as TLS.
Can reused IVs break AES?
Yes for several modes. Reusing a nonce or IV with the same key in GCM is catastrophic. Unique nonces per key are mandatory operational controls.
Is AES quantum-safe?
Grover’s algorithm roughly halves the effective key search space, which is why some policies prefer AES-256 for long-lived secrets. AES remains part of post-quantum hybrid designs rather than being replaced outright.
References
Explore authoritative guidance and frameworks related to advanced encryption standard (aes).
Explore every security definition
Return to the glossary to search by term, alias, starting letter, or security category.