Skip to main content

9.2 Symmetric Key Cryptography: DES & Advanced Encryption Standard (AES)

Back to Computer Networks Notes
📚Module 09: Network Security & CryptographyTopic 9.2⏱️16 min read
🎯High-Yield For:Semester Exams (All Universities) • Placement Technical Rounds • Engineering Foundations

💡 Core Intuition: The Bank Safe with Twin Master Keys​

🍳 The Everyday Analogy: Identical Physical Keys​

Imagine two business partners, Alice in New York and Bob in London, who share a physical steel safe deposit box:

  1. The Shared Key (Symmetric Key): A locksmith creates exactly two identical copies of a physical key. Alice holds one copy, and Bob holds the other.
  2. Locking & Unlocking: Alice puts a confidential document in the box, turns her key, and ships the locked safe across the ocean. Anyone intercepting the heavy box cannot open it without the key. When Bob receives it, he inserts his identical key, turns it in reverse, and unlocks the box.
  3. The Key Distribution Problem: How did Alice and Bob safely get identical copies of the key in the first place? If an adversary intercepted the key during initial delivery, the entire security model collapses. Furthermore, if Alice works with 1,000 different partners, she must manage 1,000 distinct physical keys.

💻 Bridging to Computer Science​

In network security:

  • Symmetric Key Cryptography (also called secret-key or shared-key cryptography) uses the exact same mathematical key to both encrypt plaintext and decrypt ciphertext.
  • Because symmetric operations consist of fast bitwise substitutions, rotations, and XOR operations, they are 1,000 to 10,000 times faster than asymmetric cryptography, making symmetric ciphers (like AES) the universal engine for encrypting high-throughput data streams (bulk TLS traffic, VPN tunnels, and encrypted disk drives).
📑Table of Contents

🏛️ Stream Ciphers vs Block Ciphers​

Symmetric ciphers fall into two broad structural classes:

Stream Ciphers vs Block Ciphers

Contrasting continuous bitwise keystream generators against fixed-size block transformation engines

Bit-by-Bit

Stream Ciphers (Keystream XOR)

⚡
Dominant Architecture / DomainChaCha20, RC4 (Deprecated), A5/1 (GSM)
  • •Encrypts data continuously one bit or one byte at a time.
  • •Combines plaintext bits with a pseudorandom keystream using bitwise XOR: C_i = P_i ^ K_i.
  • •Zero latency buffering: ideal for real-time streaming audio and telecommunications.
  • •Critical Flaw: Reusing a keystream (Nonce reuse) destroys confidentiality via C1 ^ C2 = P1 ^ P2.
"Ultra-fast continuous XOR stream requiring strictly unique nonces."
Block-by-Block

Block Ciphers (State Permutation)

🧱
Dominant Architecture / DomainDES (64-bit), 3DES (64-bit), AES (128-bit)
  • •Processes fixed-size blocks of plaintext (e.g. 128 bits) into equal-sized blocks of ciphertext.
  • •Applies multiple rounds of Substitution and Permutation (Diffusion & Confusion).
  • •Requires padding (PKCS#7) if plaintext length is not an exact multiple of the block size.
  • •Governed by operational modes (CBC, CTR, GCM) to handle multi-block messages.
"Structured matrix transformations providing diffusion across fixed blocks."

⚙️ The Feistel Cipher Network Architecture​

Before exploring DES, one must understand the Feistel Network (invented by Horst Feistel at IBM in 1973). The Feistel architecture is a general structure used to build invertible block ciphers out of non-invertible mathematical functions.

The Round Transformation​

A plaintext block of size 2w2w bits is split into two equal halves of ww bits: Left (LL) and Right (RR). For round i=1,2,…,ni = 1, 2, \dots, n with subkey KiK_i:

Li=Ri−1\mathbf{L_i = R_{i-1}}

Ri=Li−1⊕F(Ri−1,  Ki)\mathbf{R_i = L_{i-1} \oplus F(R_{i-1}, \; K_i)}

Where:

  • FF is a round function (which does not need to be invertible!).
  • ⊕\oplus is the bitwise XOR operation.

Why the Feistel Architecture is Brilliant​

Notice the mathematical beauty of decryption: the exact same algorithm and hardware circuit decrypts the ciphertext! To decrypt, the receiver simply runs the Feistel rounds in identical fashion, applying subkeys in reverse order (Kn,Kn−1,…,K1K_n, K_{n-1}, \dots, K_1):

Ri−1=LiR_{i-1} = L_i

Li−1=Ri⊕F(Li,  Ki)L_{i-1} = R_i \oplus F(L_i, \; K_i)

Because X⊕Y⊕Y=XX \oplus Y \oplus Y = X, the round function FF completely cancels itself out, regardless of how complex or irreversible FF is!

📜 The Data Encryption Standard (DES - FIPS 46)​

Adopted by the US National Bureau of Standards in 1977, DES is a classic 16-round Feistel cipher.

Key Specifications​

  • Block Size: 64 bits64\text{ bits}.
  • Nominal Key Size: 64 bits64\text{ bits} (Contains 8 parity bits: bits 8, 16, 24, 32, 40, 48, 56, 64 are parity checks).
  • Effective Key Size: 56 bits56\text{ bits}.
  • Number of Rounds: 16 rounds16\text{ rounds}.

The Internal Round Mechanics of DES​

  1. Initial Permutation (IP): Transposes the 64 bits of plaintext according to a fixed permutation table.
  2. 16 Feistel Rounds: In each round:
    • Right half (32 bits32\text{ bits}) is expanded to 48 bits48\text{ bits} via the Expansion Permutation (E-Box).
    • The 48 bits48\text{ bits} are XORed with the round subkey KiK_i (48 bits48\text{ bits} generated from the 56-bit key).
    • The 8 S-Boxes (Substitution): The 48 bits48\text{ bits} are split into eight 6-bit chunks. Each 6-bit chunk enters an S-Box, which outputs a non-linear 4-bit chunk (8×4=32 bits8 \times 4 = 32\text{ bits}).
    • Permutation (P-Box): The 32 output bits are permuted to diffuse dependencies across the entire block.
    • The result is XORed with the Left half Li−1L_{i-1}.
  3. Final Swap & Inverse Permutation (IP−1\text{IP}^{-1}): The halves are swapped and passed through the inverse permutation IP−1\text{IP}^{-1} to produce the 64-bit ciphertext.

Why DES is Completely Obsolete​

A 56-bit key has a keyspace of:

256≈7.205×1016 possible keys2^{56} \approx 7.205 \times 10^{16} \text{ possible keys}

While 7.2×10167.2 \times 10^{16} seemed vast in 1977, Moore's Law made brute-force attacks trivial:

  • In 1998, the Electronic Frontier Foundation (EFF) built the "Deep Crack" machine for \250,000$, which broke a DES key in 56 hours.
  • Today, a modern consumer GPU cluster can crack any DES key in under 2 hours.
  • Triple DES (3DES) extended the life of DES by applying Encrypt-Decrypt-Encrypt with two or three keys (C=EK1(DK2(EK3(P)))C = E_{K_1}(D_{K_2}(E_{K_3}(P)))), yielding an effective key length of 112 or 168 bits. However, 3DES is computationally slow and retains an insecure 64-bit block size susceptible to the Sweet32 collision attack.

🛡️ The Advanced Encryption Standard (AES - FIPS 197)​

In 2001, NIST selected the Rijndael algorithm (developed by Belgian cryptographers Joan Daemen and Vincent Rijmen) as the Advanced Encryption Standard (AES) to replace DES.

Core Architectural Features of AES​

  • Cipher Family: Substitution-Permutation Network (SPN) (unlike DES, AES does not use a Feistel network).
  • Block Size: Invariant 128 bits128\text{ bits} (16 bytes16\text{ bytes}).
  • Key Lengths & Round Structure:
    • AES-128: 128-bit key   ⟹  \implies 10 rounds
    • AES-192: 192-bit key   ⟹  \implies 12 rounds
    • AES-256: 256-bit key   ⟹  \implies 14 rounds

The 4×44 \times 4 State Matrix​

In AES, the 128-bit block is represented as a 4×44 \times 4 column-major matrix of bytes called the State:

State=(s0,0s0,1s0,2s0,3s1,0s1,1s1,2s1,3s2,0s2,1s2,2s2,3s3,0s3,1s3,2s3,3)\text{State} = \begin{pmatrix} s_{0,0} & s_{0,1} & s_{0,2} & s_{0,3} \\ s_{1,0} & s_{1,1} & s_{1,2} & s_{1,3} \\ s_{2,0} & s_{2,1} & s_{2,2} & s_{2,3} \\ s_{3,0} & s_{3,1} & s_{3,2} & s_{3,3} \end{pmatrix}

The 4 Internal Round Transformations​

Each round of AES (except the final round) executes four sequential mathematical transformations:

Architecture Flow

The 4 AES Round Transformations

How each standard round achieves non-linear confusion, row diffusion, column mixing, and key addition

🔀Confusion

1. SubBytes

Non-linear byte substitution using the 8-bit S-Box (multiplicative inverse in Galois Field GF(2^8)).

→
Shift Rows
🔄Diffusion

2. ShiftRows

Cyclically shifts row 1 by 1 byte, row 2 by 2 bytes, and row 3 by 3 bytes leftward.

→
Mix Columns
⚡Diffusion

3. MixColumns

Linear column mixing via matrix multiplication over GF(2^8). (Omitted in final round).

→
Add Key
🔑Key Injection

4. AddRoundKey

Bitwise XORs the 128-bit State matrix with the corresponding 128-bit Round Key.

1. SubBytes (Non-linear Confusion)​

Every byte in the state is independently replaced by looking up its value in a fixed 256-entry S-box.

  • Mathematically: computes the multiplicative inverse of the byte in the Galois finite field GF(28)GF(2^8), followed by an invertible affine transformation.
  • Provides Shannon Confusion: destroys any linear algebraic relationship between input plaintext and output ciphertext.

2. ShiftRows (Intra-Block Row Diffusion)​

Row 0 of the state is left unchanged.

  • Row 1 is shifted cyclically to the left by 1 byte.
  • Row 2 is shifted cyclically to the left by 2 bytes.
  • Row 3 is shifted cyclically to the left by 3 bytes.
  • Ensures that the 4 bytes in a single column are diffused across 4 different columns in subsequent rounds.

3. MixColumns (Inter-Byte Column Diffusion)​

Each of the 4 columns is treated as a 4-term polynomial over GF(28)GF(2^8) and multiplied modulo (x4+1)(x^4 + 1) by a fixed matrix:

(s0,c′s1,c′s2,c′s3,c′)=(02030101010203010101020303010102)(s0,cs1,cs2,cs3,c)\begin{pmatrix} s'_{0,c} \\ s'_{1,c} \\ s'_{2,c} \\ s'_{3,c} \end{pmatrix} = \begin{pmatrix} 02 & 03 & 01 & 01 \\ 01 & 02 & 03 & 01 \\ 01 & 01 & 02 & 03 \\ 03 & 01 & 01 & 02 \end{pmatrix} \begin{pmatrix} s_{0,c} \\ s_{1,c} \\ s_{2,c} \\ s_{3,c} \end{pmatrix}

  • Guarantees the Strict Avalanche Criterion: altering a single bit in the input state causes an average of 50%50\% of all bits in the entire 128-bit block to flip after just two rounds!
  • (Note: MixColumns is deliberately omitted in the final round to ensure symmetry between encryption and decryption).

4. AddRoundKey (Key Mixing)​

The 16 bytes of the State are bitwise XORed with 16 bytes of the Round Key, which is derived from the master key using the Rijndael Key Expansion Schedule.

🧱 Block Cipher Modes of Operation​

A block cipher encrypts only one 128-bit block (16 bytes16\text{ bytes}). Real network messages span megabytes. Modes of Operation define how to apply a block cipher to multi-block messages.

Mode of OperationSecurity AssessmentOperational MechanicsPros & Cons
ECB (Electronic Codebook)❌ INSECURE (DO NOT USE)Each 128-bit block is encrypted independently with key KK: Ci=EK(Pi)C_i = E_K(P_i).Identical plaintext blocks produce identical ciphertext blocks! Leaks plaintext structure (the famous ECB Tux penguin image leak).
CBC (Cipher Block Chaining)⚠️ Legacy (Padding Risks)Plaintext block is XORed with previous ciphertext block before encryption: Ci=EK(Pi⊕Ci−1)C_i = E_K(P_i \oplus C_{i-1}). Requires random IV (C0C_0).Hides identical patterns. Sequential (cannot parallelize encryption). Vulnerable to Padding Oracle Attacks without MAC.
CTR (Counter Mode)✅ Fast & ModernEncrypts an incrementing counter: Ci=Pi⊕EK(Nonce∥i)C_i = P_i \oplus E_K(\text{Nonce} \parallel i).Turns block cipher into a stream cipher. Fully parallelizable in hardware. Random access decryption. Requires strictly unique nonces.
GCM (Galois/Counter Mode)🏆 Gold Standard (AEAD)Combines CTR mode encryption with Galois field polynomial authentication (GMAC).Provides Confidentiality AND Integrity simultaneously in a single pass. Standard for TLS 1.3 and IPsec.

🏭 Real-World Production Context: Hardware AES-NI, Cloud Envelope Encryption & NVMe Storage​

1. Hardware AES-NI Acceleration & Side-Channel Defense​

In early software implementations of AES, the non-linear SubBytes step was computed using a precalculated 256-byte lookup table (S-Box) in RAM.

  • Cache-Timing Attacks (Bernstein 2005): An attacker sharing the same physical CPU server could measure microsecond fluctuations in memory cache access times, deducing the exact S-Box lookup addresses and extracting the full AES secret key in minutes!
  • Hardware AES-NI: Modern Intel, AMD, and Apple Silicon chips incorporate dedicated silicon micro-ops: AESENC, AESENCLAST, AESDEC.
  • Hardware AES runs directly in CPU registers in constant time (sub-nanosecond execution), completely immunizing systems from cache side-channel attacks while providing over 40 Gigabits per second40\text{ Gigabits per second} of line-rate encryption per CPU core.

2. Cloud Envelope Encryption (AWS KMS & GCP Cloud HSM)​

How do cloud services store petabytes of user data securely without transferring master keys over the network?

  • Envelope Encryption:
    1. To encrypt an object, the application calls AWS KMS or Google Cloud KMS.
    2. The cloud KMS generates an ephemeral Data Encryption Key (DEK - AES-256) and returns two versions: a plaintext DEK and a DEK encrypted by the master Key Encryption Key (KEK) residing inside a hardware security module.
    3. The application encrypts the user's data locally using the plaintext DEK via AES-256-GCM, securely purges the plaintext DEK from RAM, and stores the encrypted DEK alongside the ciphertext in S3 or Cloud Storage.
    4. The master KEK never leaves the physical HSM silicon!

3. Instant Cryptographic Erasure on Self-Encrypting NVMe Drives (SED)​

Modern data centers decommissioning hundreds of SSDs daily cannot wait hours for physical disk overwriting:

  • Enterprise NVMe SSDs implement Self-Encrypting Drives (SED / TCG Opal standard) using hardware AES-XTS 256-bit controllers. Every byte written to flash NAND is continuously encrypted.
  • To perform Cryptographic Erasure (Crypto-Shredding), the server sends a single NVMe sanitize command. The drive controller instantly regenerates a new random Media Encryption Key (MEK) and zeroes the old key. In under 100 milliseconds100\text{ milliseconds}, every gigabyte of stored data on the drive becomes undecipherable mathematical noise, complying with DoD data destruction standards.

📐 Numerical Applications & Worked Examples​

Example 1: PKCS#7 Padding Length Calculation in Block Ciphers​

Problem Statement: An application transmits variable-length messages encrypted with AES-CBC, which requires messages to be padded to multiples of the 16-byte block size (b=16 bytesb = 16\text{ bytes}) using standard PKCS#7.

  1. If the message payload is M1=43 bytesM_1 = 43\text{ bytes}, calculate the number of padding bytes added, state the exact byte values injected, and compute the total ciphertext length.
  2. If the message payload is M2=48 bytesM_2 = 48\text{ bytes} (an exact multiple of 16), calculate the padding added. Why can an exact multiple not omit padding?

Step-by-Step Solution:

  1. Message M1=43 bytesM_1 = 43\text{ bytes}:
    • Calculate remainder: 43(mod16)=11 bytes43 \pmod{16} = 11\text{ bytes} in the final incomplete block.
    • Number of padding bytes needed: P=16−(43(mod16))=16−11=5 padding bytesP = 16 - (43 \pmod{16}) = 16 - 11 = \mathbf{5\text{ padding bytes}}
    • In PKCS#7, each padding byte contains the integer value equal to the total number of padding bytes: Padding injected=0x05 0x05 0x05 0x05 0x05\text{Padding injected} = \mathbf{\text{0x05 0x05 0x05 0x05 0x05}}
    • Total padded plaintext size =43+5=48 bytes= 43 + 5 = 48\text{ bytes} (exactly 3 blocks of 16 bytes).
    • Total ciphertext size (including 16-byte IV) =16 (IV)+48=64 bytes= 16\text{ (IV)} + 48 = \mathbf{64\text{ bytes}}.
  2. Message M2=48 bytesM_2 = 48\text{ bytes}:
    • Because 48(mod16)=048 \pmod{16} = 0, the message aligns with block boundaries.
    • Under PKCS#7, an entire dummy block of 16 padding bytes must be appended: P=16 bytes of value 0x10 (decimal 16)P = 16\text{ bytes of value 0x10 (decimal 16)}
    • Total padded size =48+16=64 bytes= 48 + 16 = \mathbf{64\text{ bytes}} (4 blocks).
    • Why Padding Cannot Be Omitted: If padding were omitted, upon decrypting a message whose final byte happened to legitimately be 0x01 or 0x05, the receiver's unpadding logic would mistakenly strip real data bytes, corrupting the message!

Example 2: Meet-in-the-Middle Attack on Double DES (2DES)​

Problem Statement: To improve security, engineers proposed Double DES (2DES), encrypting plaintext PP twice with two independent 56-bit keys: C=EK2(EK1(P))C = E_{K_2}(E_{K_1}(P)).

  1. What is the total combined key length of 2DES, and what is the naive brute-force key search complexity?
  2. Explain the mathematical mechanics of the Meet-in-the-Middle (MitM) attack on 2DES using a known plaintext-ciphertext pair (P,C)(P, C), and calculate the true time and memory complexity of the attack.

Step-by-Step Solution:

  1. Combined Key Length & Naive Search:
    • Key length =56+56=112 bits= 56 + 56 = \mathbf{112\text{ bits}}.
    • A naive attacker would test all key pairs: Naive Complexity=256×256=2112 operations≈5.19×1033\text{Naive Complexity} = 2^{56} \times 2^{56} = 2^{112}\text{ operations} \approx 5.19 \times 10^{33}
  2. Meet-in-the-Middle Attack Mechanics:
    • From C=EK2(EK1(P))C = E_{K_2}(E_{K_1}(P)), decrypting both sides by K2K_2 yields: EK1(P)=DK2(C)=X(Intermediate value)E_{K_1}(P) = D_{K_2}(C) = X \quad (\text{Intermediate value})
    • Phase 1 (Forward Phase): Compute X=EK(P)X = E_K(P) for all 2562^{56} possible values of KK. Store each (X,K)(X, K) pair in a hash table indexed by XX. Operations=256,Memory Storage=256×16 bytes≈1018 bytes (1 Exabyte)\text{Operations} = 2^{56}, \quad \text{Memory Storage} = 2^{56} \times 16\text{ bytes} \approx 10^{18}\text{ bytes (1 Exabyte)}
    • Phase 2 (Backward Phase): For all 2562^{56} possible values of K′K', compute Y=DK′(C)Y = D_{K'}(C). Check if YY matches any key XX in the hash table. Operations=256 lookups\text{Operations} = 2^{56}\text{ lookups}
  3. Effective Attack Complexity: Total Time Complexity=256+256=2×256=257 operations\text{Total Time Complexity} = 2^{56} + 2^{56} = 2 \times 2^{56} = \mathbf{2^{57}\text{ operations}} Conclusion: Instead of providing 21122^{112} security, 2DES provides only 2572^{57} security (barely stronger than standard 56-bit DES!), completely destroying 2DES and forcing the invention of Triple DES (3DES) with 3 independent keys!

Example 3: AES-GCM Nonce Reuse Catastrophe & Counter Limit​

Problem Statement: An engineer configures AES-GCM using a standard 96-bit random nonce (IV).

  1. Explain mathematically why reusing the same (Key, Nonce) pair on two different plaintexts in AES-GCM is fatal.
  2. If nonces are generated by an incrementing 64-bit integer counter, what is the maximum number of 128-bit blocks that can be safely encrypted under a single key before rekeying must occur?

Step-by-Step Solution:

  1. Nonce Reuse Catastrophe in AES-GCM:
    • In AES-GCM, encryption is CTR mode: C1=P1⊕KeystreamC_1 = P_1 \oplus \text{Keystream} and C2=P2⊕KeystreamC_2 = P_2 \oplus \text{Keystream}.
    • If the nonce is reused, the keystream is identical: C1⊕C2=(P1⊕Keystream)⊕(P2⊕Keystream)=P1⊕P2C_1 \oplus C_2 = (P_1 \oplus \text{Keystream}) \oplus (P_2 \oplus \text{Keystream}) = \mathbf{P_1 \oplus P_2}
    • The XOR of the two ciphertexts equals the XOR of the two plaintexts!
    • Furthermore, in Galois Counter Mode, two messages sharing a nonce allow an attacker to solve the polynomial equation in GF(2128)GF(2^{128}) and recover the secret GHASH authentication hash key (HH), allowing the adversary to forge arbitrary valid authentication tags!
  2. Safe Block Limits in GCM:
    • GCM uses a 32-bit counter initialized to 1 for block encryption (232−22^{32} - 2 available counts).
    • Maximum blocks per single invocation =232−2=4,294,967,294 blocks= 2^{32} - 2 = 4,294,967,294\text{ blocks}.
    • Since each block is 16 bytes16\text{ bytes}: Max Payload Size=(232−2)×16 bytes≈64 Gigabytes\text{Max Payload Size} = (2^{32} - 2) \times 16\text{ bytes} \approx 64\text{ Gigabytes}
    • Per NIST SP 800-38D, when random 96-bit IVs are used, to keep the collision probability below 2−322^{-32} due to the Birthday Paradox, a single key must never encrypt more than 232 invocations2^{32}\text{ invocations} before performing an immediate re-keying handshake.

🎯 Exam & Interview Pitfall Check​

Question 1: Explain the structural architecture of the Feistel Cipher network. Why does the round function FF not need to be invertible in a Feistel cipher?

Answer:

  • Feistel Architecture: A plaintext block of 2w2w bits is split into two halves: Left (L0L_0) and Right (R0R_0). In each round ii (1≤i≤n1 \le i \le n), the transformation applies: Li=Ri−1L_i = R_{i-1} Ri=Li−1⊕F(Ri−1,  Ki)R_i = L_{i-1} \oplus F(R_{i-1}, \; K_i) Where KiK_i is the round subkey and FF is the round function.
  • Why FF Does Not Need to Be Invertible: During decryption, the ciphertext halves are fed in reverse order. Applying the same structure with subkey KiK_i: Ri−1=LiR_{i-1} = L_i Li−1=Ri⊕F(Ri−1,  Ki)=(Li−1⊕F(Ri−1,Ki))⊕F(Ri−1,Ki)L_{i-1} = R_i \oplus F(R_{i-1}, \; K_i) = \big(L_{i-1} \oplus F(R_{i-1}, K_i)\big) \oplus F(R_{i-1}, K_i) Because the XOR operation is its own inverse (A⊕B⊕B=AA \oplus B \oplus B = A), the two instances of F(Ri−1,Ki)F(R_{i-1}, K_i) cancel each other out identically to zero, leaving Li−1L_{i-1}. Because FF is never computed in reverse—it is always evaluated in the forward direction on the right half—the mathematical function FF can be arbitrary, one-way, and non-invertible.

Question 2: Describe the four transformation stages within an AES round. How does AES achieve both Confusion and Diffusion?

Answer:

  • The 4 Transformations:
    1. SubBytes: Byte-by-byte substitution using an S-Box calculated via multiplicative inversion in GF(28)GF(2^8) and an affine mapping.
    2. ShiftRows: Cyclical byte rotation of the 4×44 \times 4 State matrix (row 0 shifted 0 bytes, row 1 shifted 1 byte, row 2 shifted 2 bytes, row 3 shifted 3 bytes).
    3. MixColumns: Multiplies each column of the State matrix by a fixed invertible polynomial matrix in GF(28)GF(2^8).
    4. AddRoundKey: Bitwise XORs the 128-bit State matrix with the round key.
  • Confusion and Diffusion:
    • Confusion is achieved by SubBytes: it introduces non-linear relationships, preventing an attacker from deducing key bits through linear algebraic equations relating plaintext to ciphertext.
    • Diffusion is achieved jointly by ShiftRows and MixColumns: ShiftRows spreads bytes from one column across four distinct columns, and MixColumns diffuses the statistical properties of each individual byte across all 4 bytes of that column. Within two rounds, a single flipped bit in plaintext alters every byte in the entire 128-bit State matrix.
Core Conceptual Questions
  • What is AES-NI?: AES-NI (AES New Instructions) is a hardware instruction set extension added to modern x86 and ARM CPUs. It executes SubBytes, ShiftRows, MixColumns, and AddRoundKey in dedicated silicon hardware registers in a fraction of a clock cycle. Crucially, hardware AES executes in constant time, eliminating cache timing side-channel attacks that plagued early software AES implementations.
  • Why does AES-256 have 14 rounds while AES-128 has only 10?: Longer keys provide a vastly larger keyspace (22562^{256} vs 21282^{128}), but they require a longer key schedule. More rounds are added to ensure that the increased key entropy is completely diffused throughout the State matrix, preventing shortcut attacks (such as boomerang or meet-in-the-middle attacks) from penetrating through fewer rounds.
Common Interview Traps
  • Trap: Believing AES is a Feistel Cipher: DES and Blowfish are Feistel ciphers. AES is NOT a Feistel cipher; it is a Substitution-Permutation Network (SPN). In AES, the entire 128-bit block is transformed in parallel in every round, rather than just one half at a time.
  • Trap: Using ECB Mode Because It is Simpler: Never use Electronic Codebook (ECB) mode for messages larger than 1 block. Because identical plaintext blocks encrypt to identical ciphertext blocks, ECB completely fails to hide message patterns and context. Modern systems should always use AES-GCM (Galois/Counter Mode).
🗺️View Complete Computer Networks Roadmap & Syllabus
← Previous Topic9.1 Network Security Foundations: Confidentiality, Integrity & AvailabilityNext Topic →9.3 Asymmetric Key Cryptography: Diffie-Hellman & RSA Algorithm
💬

Discussion & Doubts