How Does AES Perform Symmetric Block Encryption?

The Advanced Encryption Standard (AES) is a symmetric block cipher that encrypts fixed-size blocks of data using a substitution-permutation network. It operates on a 128-bit data block arranged as a 4 by 4 byte matrix called the state, transforming plaintext into ciphertext through multiple rounds of byte substitution, row shifting, column mixing, and round key addition. Depending on the key length, AES executes 10, 12, or 14 rounds to achieve strong confusion and diffusion in classical computing systems.

The Structure of AES and the State Matrix

AES processes plaintext in fixed blocks of \(128\) bits (\(16\) bytes), regardless of whether the secret key is \(128\), \(192\), or \(256\) bits long. Before encryption begins, the \(16\) input bytes \(b_0, b_1, \dots, b_{15}\) are arranged column-wise into a \(4 \times 4\) state matrix \(S\):

\[S = \begin{bmatrix} b_0 & b_4 & b_8 & b_{12} \\ b_1 & b_5 & b_9 & b_{13} \\ b_2 & b_6 & b_{10} & b_{14} \\ b_3 & b_7 & b_{11} & b_{15} \end{bmatrix}\]

The number of encryption rounds \(N_r\) depends on the key size:

  • \(N_r = 10\) for a \(128\)-bit key
  • \(N_r = 12\) for a \(192\)-bit key
  • \(N_r = 14\) for a \(256\)-bit key

Each round applies a sequence of invertible transformations to the state matrix. Unlike Feistel networks, which only modify half of the data block per round, a substitution-permutation network (SPN) transforms the entire \(128\)-bit state in every round.

Key Expansion

Before the rounds begin, the initial secret key is expanded into a key schedule consisting of \(N_r + 1\) round keys, each \(128\) bits (\(16\) bytes) long. The key expansion algorithm uses word rotation, byte substitution via the AES S-box, and round constants (\(\text{Rcon}\)) to ensure that each round key is cryptographically distinct and resistant to related-key attacks.

The Four Round Transformations

AES begins with an initial AddRoundKey step using the first round key. It then executes \(N_r - 1\) standard rounds, each consisting of four operations: SubBytes, ShiftRows, MixColumns, and AddRoundKey. The final round omits MixColumns.

SubBytes

SubBytes is the non-linear substitution layer that provides confusion. Each byte \(s_{i,j}\) in the state matrix is independently replaced using a fixed \(8\)-bit lookup table called the S-box. Mathematically, the S-box computes the multiplicative inverse of the byte in the finite field \(\text{GF}(2^8)\) defined by the irreducible polynomial:

\[m(x) = x^8 + x^4 + x^3 + x + 1\]

The zero byte \(0\text{x}00\) is mapped to itself. This is followed by an affine transformation over \(\text{GF}(2)\) to eliminate algebraic simplicity and protect against linear and differential cryptanalysis.

ShiftRows

ShiftRows is a transposition step that provides diffusion across columns. Each row of the \(4 \times 4\) state matrix is cyclically shifted to the left by an offset equal to its row index \(i \in \{0, 1, 2, 3\}\):

  • Row \(0\) is not shifted (\(0\) bytes).
  • Row \(1\) is shifted left by \(1\) byte.
  • Row \(2\) is shifted left by \(2\) bytes.
  • Row \(3\) is shifted left by \(3\) bytes.

This ensures that bytes from each column are distributed into all four columns before the next step.

MixColumns

MixColumns provides diffusion within each column by treating each \(4\)-byte column as a polynomial over \(\text{GF}(2^8)\) and multiplying it modulo \(x^4 + 1\) by a fixed polynomial. In matrix form, each column \(\mathbf{c} = [c_0, c_1, c_2, c_3]^T\) is transformed into \(\mathbf{c}'\) via:

\[\begin{bmatrix} c'_0 \\ c'_1 \\ c'_2 \\ c'_3 \end{bmatrix} = \begin{bmatrix} 02 & 03 & 01 & 01 \\ 01 & 02 & 03 & 01 \\ 01 & 01 & 02 & 03 \\ 03 & 01 & 01 & 02 \end{bmatrix} \begin{bmatrix} c_0 \\ c_1 \\ c_2 \\ c_3 \end{bmatrix}\]

All additions and multiplications in this matrix product are performed in \(\text{GF}(2^8)\), where addition corresponds to bitwise XOR. Combined with ShiftRows, MixColumns guarantees that after just two rounds, every output byte depends on every input byte.

AddRoundKey

AddRoundKey combines the current state matrix \(S\) with the \(128\)-bit round key \(K_r\) for round \(r\) using a bitwise XOR operation:

\[S' = S \oplus K_r\]

Because XOR is its own inverse, this step is both fast in classical hardware and trivial to reverse during decryption.

Decryption in Classical Computing

Because every transformation in AES is invertible, decryption reverses the encryption process using the inverse operations InvShiftRows, InvSubBytes, InvMixColumns, and AddRoundKey with the round keys applied in reverse order. In classical computing, AES is highly efficient because its operations map directly to byte-level table lookups, bitwise XORs, and dedicated CPU instructions such as AES-NI.