1. The Shared Secret: Symmetric vs Asymmetric Cryptography

1.1 Speed and Scaling Boundaries

Asymmetric cryptography (like RSA or Elliptic Curves) uses a key pair: a public key for encryption and a private key for decryption. While excellent for key exchange, asymmetric math relies on modular exponentiation of massive numbers, which is computationally expensive. In contrast, symmetric cryptography uses a single shared secret key, relying on bitwise XORs and byte substitutions. This makes symmetric ciphers like AES thousands of times faster, making them the only practical choice for encrypting bulk data (such as files, video streams, or databases).

In modern security protocols (like HTTPS/TLS), the two endpoints first use asymmetric cryptography to securely agree on a shared session key, and then switch to AES for high-speed bulk data encryption.

1.2 Symmetric Key Distribution vs Asymmetric Key Distribution

Symmetric keys must be shared out-of-band securely before communication begins. Asymmetric keys allow public keys to be distributed openly without compromising the matching private decryption key.

Common Misconception — Larger keys always make encryption algorithm execution slower: A common developer misconception is that choosing AES-256 instead of AES-128 will noticeably slow down their application. In reality, because modern CPUs include hardware-level instructions for AES (AES-NI), the CPU cost of encryption rounds is negligible. AES-256 uses 14 rounds compared to AES-128's 10 rounds, resulting in less than a 5% latency difference, while providing vastly superior resistance against quantum attacks.

2. The Anatomy of the Advanced Encryption Standard (AES)

2.1 The Block Matrix

Unlike stream ciphers that encrypt bytes sequentially, AES is a block cipher. It operates on a fixed block size of 128 bits (16 bytes), regardless of whether the key size is 128, 192, or 256 bits. The 16 bytes of plaintext are arranged in a 2D $4 \times 4$ column-major matrix called the **State Matrix**. All cryptographic operations inside AES are executed as matrix transformations on this state.

AES uses a Substitution-Permutation Network (SPN) architecture. In each encryption round, the algorithm applies non-linear byte substitutions (confusion) followed by byte shuffles and matrix multiplications (diffusion), rendering the ciphertext mathematically unrecognizable.

Mermaid Diagram: The structural pipeline of AES encryption, converting plaintext blocks into state matrices for round processing.

3. The Four Steps of an AES Round

3.1 Round Transformations

In each intermediate round, AES applies four distinct mathematical operations to the state matrix:

• **SubBytes**: A non-linear substitution step where each byte in the state is replaced with a corresponding byte from a lookup table called the S-Box. This provides confusion.
• **ShiftRows**: A transposition step where the bytes in the last three rows of the state matrix are cyclically shifted to the left by 1, 2, and 3 byte offsets.
• **MixColumns**: A linear diffusion step where the columns of the state matrix are multiplied by a fixed polynomial matrix using Galois Field mathematics.
• **AddRoundKey**: A bitwise XOR step where the state matrix is XORed with a subkey derived from the main secret key via the Rijndael key schedule.

4. The Fall of ECB Mode: The Penguin Problem

4.1 Electronic Codebook Leaks

Because block ciphers require inputs of exactly 128 bits, encrypting larger payloads requires splitting the data into consecutive blocks. The choice of how we chain these blocks is the **Cipher Mode of Operation**. The simplest mode is **Electronic Codebook (ECB)**, where each block is encrypted independently using the secret key.

ECB mode is insecure because identical plaintext blocks always encrypt into identical ciphertext blocks. If a file (such as a bitmap image) contains large repeating patterns of identical bytes, these patterns remain visible in the ciphertext. This is famously illustrated by encrypting a bitmap image of the Linux Tux penguin: the colors are scrambled, but the outline of the penguin remains completely visible, leaking data structure.

5. Cipher Block Chaining (CBC) Mode and Initialization Vectors

5.1 Chaining Feedback Loops

To eliminate the pattern leaks of ECB, **Cipher Block Chaining (CBC)** mode introduces feedback. Before encrypting block $i$, the plaintext block is XORed with the ciphertext of the previous block $i-1$. This ensures that even if blocks $i$ and $j$ contain identical plaintext, their resulting ciphertexts will be completely different.

For the first block, we do not have a previous ciphertext block to XOR. We solve this by introducing an **Initialization Vector (IV)**. The IV is a 128-bit block of random data. The IV must be cryptographically random and must never be reused with the same key. Reusing an IV allows attackers to detect if two different messages share the same initial plaintext prefix.

6. Galois/Counter Mode (GCM): Authenticated Encryption

6.1 Confidentiality and Integrity

While CBC mode provides confidentiality, it does not guarantee integrity. If an attacker intercepting network packets alters bits in a CBC ciphertext block, the decrypted plaintext will be corrupted, but the system may not detect the tampering. In padding oracle attacks, this allows attackers to reconstruct the plaintext block-by-block.

To prevent tampering, modern systems use **Authenticated Encryption with Associated Data (AEAD)** cipher modes, with **Galois/Counter Mode (GCM)** being the industry standard. GCM combines counter-mode encryption (which turns the block cipher into a stream cipher) with a Galois field MAC (message authentication code) tag. If any bits in the ciphertext are modified in transit, GCM decryption will fail the tag verification step, discarding the message.

6.2 GCM and GHASH Mathematical Tag Accumulation

The integrity of GCM mode is enforced using a high-speed polynomial hash function called **GHASH**, operating over the finite field $GF(2^{128})$. During initialization, the encryption engine derives the authentication hash key $H$ by encrypting a block of 128 zero bits with the secret AES key $K$:

Let $C_1, C_2, \dots, C_n$ represent the ciphertext blocks, and let $A$ be the Associated Data (such as packet headers that must be authenticated but remain unencrypted). The GHASH function computes intermediate variables $X_i$ by XORing the current block with the previous hash state, and then multiplying by the hash key $H$ using modular multiplication modulo the irreducible $GF(2^{128})$ polynomial $x^{128} + x^7 + x^2 + x + 1$:

After accumulating all ciphertext blocks and associated data lengths, the final output is encrypted using the counter keystream to construct the 128-bit **Authentication Tag ($T$)**:

Where $J_0$ represents the initial counter block derived from the initialization vector (IV). During decryption, the receiver computes the matching tag $T'$ from the received ciphertext. If $T' \neq T$, the receiver discards the entire payload. Below is a comparison table of GCM operational parameters:

Pitfall — Byte truncation of GCM tags: Standard GCM tags are 128 bits. While the GCM spec allows truncating tags to 64 or 32 bits to save packet bandwidth, doing so reduces the collision resistance of the MAC. An attacker can forge packets by brute-forcing a small 32-bit tag field within $2^{32}$ attempts, bypassing security checks entirely.

7. Advanced: The Mathematics of the AES S-Box and Galois Field GF(2^8)

7.1 Galois Fields

To provide resistance against linear cryptanalysis, the AES S-Box substitution step must be highly non-linear. AES achieves this by modeling each byte as an element of the finite Galois Field $GF(2^8)$. Addition in this field corresponds to a bitwise XOR operation, while multiplication is defined modulo an irreducible polynomial $x^8 + x^4 + x^3 + x + 1$.

The S-Box mapping of a byte $x$ is calculated by first finding its multiplicative inverse $x^{-1}$ in $GF(2^8)$ (where $0^{-1} = 0$), and then applying an affine transformation. This mathematical mapping guarantees that there are no simple linear relations between input and output bits, frustrating algebraic attacks.

7.2 Galois Field GF(2^8) Multiplication and S-Box Affine Matrices

In Galois Field $GF(2^8)$, bytes are represented as polynomials of degree less than 8, with binary coefficients $\{0, 1\}$. For example, the byte 0x53 (binary 01010011) represents the polynomial $x^6 + x^4 + x + 1$. Addition of two polynomials is performed by adding matching coefficients modulo 2, which corresponds directly to the bitwise **XOR** operator:

Multiplication in $GF(2^8)$ is defined as polynomial multiplication modulo the irreducible Rijndael polynomial $P(x) = x^8 + x^4 + x^3 + x + 1$. In hex representation, $P(x)$ is represented as the 9-bit value 0x11B. For any two elements $A(x)$ and $B(x)$, the product is:

To compute this product in software, we utilize **xtime** multiplication. The function xtime(a) multiplies a byte by $x$, which is a left-shift by 1 bit, followed by a conditional XOR with 0x1B (the lower 8 bits of 0x11B) if the most significant bit (MSB) of $a$ before the shift was 1:

Once the multiplicative inverse $x^{-1}$ is calculated using the Extended Euclidean Algorithm in $GF(2^8)$, the final S-Box output byte $y = (y_7 y_6 \dots y_0)^T$ is mapped using an **Affine Transformation**. This step mixes the bits of the inverse to destroy simple algebraic representations. The transformation is defined as a matrix multiplication over $GF(2)$:

This affine mapping adds a constant offset byte 0x63, ensuring that the input byte 0x00 (which has no inverse and maps to itself) is mapped to S-Box output 0x63, eliminating zero value vulnerabilities. Below is a comparison table of finite field operations:

Pitfall — Cache side-channel S-Box lookups: Implementing the S-Box as a simple 256-byte array lookup table creates cache timing vulnerabilities. The latency of memory lookups depends on whether the table address is in the L1 CPU cache. Attackers can trace timing variations to reconstruct the secret key. Modern cryptotools use bitsliced boolean algebraic operations to execute the S-Box in constant time.

8. Advanced: Comparison of Cipher Modes of Operation

8.1 Cipher Mode Profiles

The table below compares the security properties, parallelizability, and error propagation characteristics of key cipher modes:

Pitfall — Reusing GCM IVs: Reusing an Initialization Vector (nonce) in GCM mode is a catastrophic security failure. Because GCM uses counter-mode encryption, reusing the key-IV pair generates the identical keystream. An attacker can XOR two ciphertexts to cancel out the encryption, exposing the plaintexts. Never reuse GCM IVs.

9. Complete AES-CBC Encryption Helper in JavaScript

9.1 Web Crypto API Helper

The following JavaScript code implements secure AES-CBC encryption using the browser's native Web Crypto API, handling key derivation and initialization vector attachment:

10. Interactive: AES ShiftRows and MixColumns Simulator

Click "ShiftRows" to shuffle state rows. Click "MixColumns" to diffuse the bytes across columns:

Encryption Throughput of Cipher Modes

The chart below compares the raw encryption speed (in MB/s) of different block cipher modes, showing how parallelizable modes (CTR, GCM) outperform sequential chaining modes (CBC):

12. Frequently Asked Questions