UPI Study › Courses › Ethics in Technology › Free lessons › Lesson 13.11 Free with a free account
The Current Gold Standard in Encryption — How AES Protects Data Worldwide
Ethics in Technology · Chapter 13: Digital Espionage, Online Threats, and the Science of EncryptionSection 13.11 · lesson 88 of 11614 min · free with a free account
Free preview
Create a free account to keep watching
It takes a minute and costs nothing. Your free account unlocks all of Chapter 1 and 3 more lessons of Ethics in Technology.
Lesson complete
Earn the 3 college credits for Ethics in Technology
Enrolling adds a quiz after each lesson, the graded work and the official transcript. Recommended for credit by NCCRS.
Next lesson: Looking Back at DES — The Encryption Method That Dominated for Decades Before Being Replaced →← The Mathematical Building Blocks Behind Symmetric and Asymmetric Encryption MethodsNext lesson: Looking Back at DES — The Encryption Method That Dominated for Decades Before Being Replaced →
In this lesson
An open selection process, a fixed block size, and repeated transformations.
- Explain the public competition that selected AES to replace DES.
- Describe the four transformations and the final-round exception.
- Compare the three key sizes and their round counts.
- Identify everyday applications and the limits of their protection.
Free study notes
Get this lesson's notes by email
The key points and 4 practice questions with answers, in your inbox. One email, free.
One email. Unsubscribe in one click.
Transcript
Everything said in the video, section by section (1,753 words). Read along, or search it.
Chapter 13
How AES Protects Data
AES protects information inside many everyday systems. Users often receive that protection without understanding its internal mathematics. This lesson explains how it was selected, then follows the transformations applied to each data block. We will connect its public evaluation process with the evidence supporting confidence in its design. You will also distinguish the fixed block size from the three available encryption key sizes. The state holds sixteen bytes. The algorithm repeatedly substitutes, moves, combines, and mixes them with keys. An initial key addition comes first; the final round has an important exception to the usual sequence. Everyday examples include browsing, wireless networks, stored files, messaging systems, and encrypted network tunnels. Their protection depends on the surrounding configuration, rather than the cipher name appearing somewhere in a product. By the end, explain both the algorithm’s structure and the practical boundaries of its protection.
Replacing DES
A Public Competition Addressed an Aging Standard
During the nineteen nineties, the older Data Encryption Standard had become inadequate for many security needs. Its fifty-six-bit key had become too small. Well-funded attackers could search possible values in practical time. NIST therefore sought a replacement, beginning an open international selection process in nineteen ninety-seven. Cryptographers could submit candidates, study other submissions, and publicly challenge the designs for possible weaknesses. Fifteen candidates were evaluated before the process narrowed toward a final choice for the new standard. In two thousand, NIST selected Rijndael. Belgian cryptographers Joan Daemen and Vincent Rijmen designed the winning cipher. The selected configuration was formally standardized as AES in two thousand one, replacing the aging design. It retained a publicly describable algorithm, with security depending on protected keys rather than secret operating instructions. This history explains why scrutiny and standards development matter alongside the mathematical operations themselves.
Why the Process Matters
Open Analysis Builds Evidence for Trust
The competition opened the proposed designs to examination by cryptographers internationally, instead of restricting analysis to one agency. Researchers could study weaknesses, compare performance, and evaluate suitability for different implementations before selection. That adversarial examination provided stronger evidence than an unsupported assurance that a hidden design should be trusted. Surviving sustained public scrutiny is an important reason the resulting standard gained widespread confidence. This scrutiny does not establish that every implementation is safe. Future discoveries could also change the evidence. A publicly available algorithm can still protect information because unauthorized observers lack the necessary secret key. Correct configuration and sound software or hardware remain essential. Careful key handling is also necessary for practical protection. Think of the process as building an evidence base that can be examined and challenged by others. Trust in the design should therefore accompany operational safeguards, rather than replace them in deployed systems.
The State
AES Processes 16 Bytes in a Four-by-Four Arrangement
AES is a block cipher, which means it operates on fixed-size chunks of data at a time. Each AES block contains sixteen bytes, and each byte contains eight bits. That gives one hundred twenty-eight bits. The algorithm represents those sixteen bytes as a state arranged into four rows and four columns. That arrangement provides a convenient way to describe the substitutions, shifts, and column mixing that follow. A state is the changing internal collection of bytes. It is not a separate secret key or password. The block size remains one hundred twenty-eight bits for all three standardized AES key sizes. A longer key changes the key expansion and specified number of rounds, rather than increasing that block. Distinguishing these quantities avoids confusing a two-hundred-fifty-six-bit key with a two-hundred-fifty-six-bit AES data block. The cipher’s arrangement is fixed, while its state values change as encryption proceeds through successive transformations.
Complete Encryption Order
Initial Key Mixing Comes Before the Repeated Rounds
The complete sequence begins with AddRoundKey. It combines the plaintext state with an initial round key. That initial AddRoundKey operation occurs before the repeating sequence shown for the main rounds. A main round applies SubBytes, then ShiftRows, then MixColumns, and finally the corresponding AddRoundKey operation. The algorithm repeats these stages according to the selected variant’s required number of encryption rounds. The final round applies SubBytes, ShiftRows, and AddRoundKey. It deliberately omits MixColumns, unlike the preceding main rounds. Consequently, saying that every AES round contains all four transformations would miss an important design detail. AES uses ten, twelve, or fourteen rounds, with the initial key addition preceding that count. After the final operation, the transformed state provides the ciphertext block for that encryption operation. Remember the initial addition and final exception alongside the usual four-step sequence when explaining the design.
Four Main-Round Transformations
Substitute, Reposition, Mix, Then Add the Round Key
Follow the main-round sequence from left to right, beginning with the substitution performed by SubBytes. SubBytes uses a fixed, nonlinear substitution table to replace each byte. Its effect changes values, rather than merely positions. ShiftRows then cyclically repositions bytes within rows, with a different leftward offset for each row. MixColumns combines the four bytes within each column through the cipher’s defined mathematical operations. AddRoundKey follows, combining the current state with its corresponding derived round key through exclusive OR. Exclusive OR is commonly called XOR. It operates byte by byte on the matching state and key values. These operations contribute different effects, so none should be treated as the whole encryption algorithm by itself. Repeated substitution, repositioning, mixing, and key addition together form the structure analyzed for the AES design. The initial key addition and final-round exception remain part of the complete process surrounding this main sequence.
Read the Byte Positions
ShiftRows Changes Position, While Preserving Byte Values
The row example uses letter-and-number labels so we can track byte positions without changing their values. Row zero stays in place, leaving its four labeled bytes in their original left-to-right order. Row one shifts left by one position. Its original first byte wraps around to the final position. Row two shifts left by two positions, wrapping its first two bytes around to the row’s end. Row three shifts left by three positions, so its original final byte becomes the first byte shown. These movements are cyclic shifts. A byte leaving the left side reappears at the right side. No byte value changes during ShiftRows; its contribution is to rearrange which columns contain particular bytes. The subsequent column mixing can then combine information that was located in different columns before the shift. This interaction explains why a simple positional operation becomes useful within the repeated, combined cipher structure.
Diffusion and Key Dependence
The Operations Work Together Across Repeated Rounds
Diffusion describes how a change in input spreads its effect across multiple output bytes during encryption. MixColumns contributes by combining all four input bytes of a column into its resulting output bytes. Across repeated rounds, row movement and column mixing help those effects reach more of the state. AddRoundKey introduces the corresponding round key directly, through the byte-by-byte exclusive-OR operation described earlier. The round keys come from expanding the original secret key. They are not independent secrets chosen for every round. Of the four named transformations, AddRoundKey is the operation that directly takes the round key as input. SubBytes, ShiftRows, and MixColumns follow fixed rules, but the state they receive already reflects earlier key additions. Those operations receive a previously transformed input state. Their resulting values can therefore still depend on the secret. The security explanation concerns the repeated combination, rather than claiming that one isolated operation supplies complete protection.
Three AES Variants
Longer Keys Change the Round Count, While Blocks Stay Fixed
The three variants differ in key length and specified round count, while sharing the same block size. AES with a one-hundred-twenty-eight-bit key uses ten rounds, following its initial key addition to the state. The one-hundred-ninety-two-bit key variant uses twelve rounds, and the two-hundred-fifty-six-bit variant uses fourteen rounds. A larger key space contains more possible values. That increases the number of candidates available to a searching attacker. The specified additional rounds form part of each variant’s design for its intended security margin. This difference does not imply that the smaller standardized variant is automatically broken or unsuitable for ordinary use. AES with a one-hundred-twenty-eight-bit key is widely deployed, while larger options serve requirements calling for their margins. Select the complete scheme according to the system’s requirements, including its mode, authentication, and key management. Exposed secrets or compromised endpoints can undermine protection regardless of how many possible key values exist.
Browsing, Wi-Fi, and Storage
AES Can Protect Different Boundaries
For web browsing, an HTTPS connection can negotiate an AES-based cipher to protect its exchanged traffic. Other supported ciphers also exist, so encryption in a browser does not always mean AES specifically. AES-based configurations of WPA2 and WPA3 protect wireless traffic between the device and its access point. That wireless boundary is one part of the journey, rather than automatic protection through every subsequent network. Legacy configurations can differ, which is why the actual wireless security settings matter alongside the network label. Disk or volume encryption can use AES to protect stored information on a laptop or other device. It helps against theft when the relevant secrets remain protected and the attacker lacks authorized access. An already unlocked system may provide readable information. Encryption at rest therefore does not replace endpoint safeguards. Network protection and storage protection address different copies or stages of data, and can be used together.
Messages, VPNs, and Organizations
AES Is a Building Block Inside Larger Systems
Some end-to-end messaging schemes use AES within their larger design for protecting the content of messages. Those schemes also need appropriate key establishment, authentication, and endpoint safeguards to deliver their intended assurances. VPN configurations can use AES to protect traffic passing through an encrypted tunnel between its participating endpoints. The tunnel still depends on authenticating the peers and maintaining correct configuration around the chosen cipher. Government, banking, and enterprise systems also use AES to protect sensitive stored or transmitted information. Organizational security requirements extend beyond encryption itself. They include policies, access controls, key management, and reliable implementations. Not every messaging or VPN system uses AES, because other suitable cipher choices exist in deployed designs. AES must also be used with an appropriate mode, and authentication where detecting unauthorized changes is required. Its widespread adoption reflects extensive evaluation, while the surrounding system determines what information is actually protected.
Review and Apply
Explain the Design, the Key Sizes, and the Protection Boundary
For the first review question, explain how public challenges supplied evidence about candidate security and practical suitability. For the second, identify AddRoundKey as the transformation that directly combines the state with a round key. The other three round transformations apply fixed rules, though their input state reflects earlier key mixing. For the third, say that ShiftRows repositions bytes cyclically while preserving the value of every individual byte. For the fourth, connect the fourteen-round AES variant with its specified design and intended security margin. Contrast that with the ten rounds of the one-hundred-twenty-eight-bit key variant, without changing either block size. For the final question, describe two concrete boundaries, such as browser traffic and stored information on a disk. Include the conditions that matter: the negotiated configuration, protected keys, and whether the endpoint already permits access. Remember the complete algorithm’s initial key addition and repeated main rounds. Its final round omits MixColumns.
About Ethics in Technology at UPI Study
Ethics in Technology (Computer Science 195) is a self-paced online course of 116 video lessons in 15 chapters, from cybersecurity basics, privacy and surveillance to big data, hacking, malware, network defense, intellectual property, cybercrime, encryption, emerging technology and digital citizenship. It carries a NCCRS credit recommendation for 3 semester credits.
Every lesson transcript is free on pages like this one, and the videos are free with a free UPI Study account. Enrolling adds a practice quiz after each lesson, the graded work and final exam that earn the credit, lifetime access, and an official transcript on completion. UPI Study has helped over 130,000 students with college credits. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Enroll now → Course details Download the syllabus All Computer Science courses
Compare: Cybersecurity vs Ethics in Technology · Which ethics course?
Why take it here
Why students take Ethics in Technology with UPI Study
Where the credit goes
Universities that work with NCCRS
Ethics in Technology carries a NCCRS credit recommendation. These universities work with NCCRS; some are UPI Study's signed partners. ACE and NCCRS have over 2,100 cooperating colleges that will consider accepting credits; the final decision is with the universities.
Thomas Edison State UniversitySigned partner
University of the PeopleSigned partner
Charter Oak State CollegeSigned partner
Strayer UniversitySigned partner
Columbia Southern UniversitySigned partner
Indiana TechSigned partner
Penn StateWorks with NCCRS
Southern New Hampshire UniversityWorks with NCCRS
SUNYWorks with NCCRS
+many more cooperating universitiesFind my college →Find my college → Not listed? Ask Athena in the corner of this page, or book a 15-minute call.
FAQ
Questions students ask us
About The Current Gold Standard in Encryption — How AES Protects Data Worldwide
Why was AES chosen to replace DES?
What happens in each round of AES encryption?
What is the difference between AES-128, AES-192, and AES-256?
Where is AES used in everyday life?
About the Ethics in Technology course
How many college credits is Ethics in Technology?
How much does Ethics in Technology cost and what is included?
Which universities accept UPI Study credits?
How long does Ethics in Technology take?
How are the exams done?
How do my credits reach my college?
Ready for the full course? Earn 3 credits in Ethics in Technology.
116 video lessons, a quiz after each one, and the graded work that earns the credit. Recommended for credit by NCCRS.
3 credits · NCCRSEnroll →