AES (Advanced Encryption Standard)

AES (Advanced Encryption Standard) is the symmetric block cipher selected by NIST in 2001 through an open competition to replace DES. It encrypts data using the same secret key for both encryption and decryption, processing data in 128-bit blocks. AES supports key sizes of 128, 192, and 256 bits — longer keys provide greater security margins.

Modes of Operation

AES is a block cipher — it encrypts fixed-size blocks. A mode of operation defines how to apply AES to data of arbitrary length:

Mode	Authentication	IV Needed	Use Case
ECB	No	No	Never use — identical blocks produce identical ciphertext
CBC	No	Yes	Legacy systems; requires separate MAC
GCM	Yes (built-in)	Yes (96-bit)	Recommended — encrypts and authenticates in one pass
CCM	Yes	Yes	Constrained environments (IoT)

Always use AES-256-GCM for new applications. It provides confidentiality and authenticity, detects tampering, and is hardware-accelerated on modern CPUs.

AES-256-GCM in JavaScript

// Encrypt with AES-256-GCM (WebCrypto API)
async function encrypt(plaintext, key) {
  const iv = crypto.getRandomValues(new Uint8Array(12)); // 96-bit nonce
  const data = new TextEncoder().encode(plaintext);
  const ciphertext = await crypto.subtle.encrypt(
    { name: "AES-GCM", iv },
    key,
    data
  );
  return { ciphertext, iv }; // store IV alongside ciphertext
}

async function decrypt({ ciphertext, iv }, key) {
  const plain = await crypto.subtle.decrypt(
    { name: "AES-GCM", iv },
    key,
    ciphertext
  );
  return new TextDecoder().decode(plain);
}

// Generate a 256-bit key
const key = await crypto.subtle.generateKey(
  { name: "AES-GCM", length: 256 },
  true,          // extractable (set false in production if not needed)
  ["encrypt", "decrypt"]
);

Key Rules

• Never reuse an IV with the same key — GCM becomes insecure if the same IV is used twice with the same key. Always generate a fresh random 12-byte IV.
• The IV is not secret — transmit it alongside the ciphertext (prepend it to the ciphertext bytes).
• The authentication tag (included in GCM output) detects any tampering — if verification fails, decryption throws an error.
• AES keys must be truly random — derived from a CSPRNG or a key derivation function like PBKDF2, never from a simple password.

Related Terms

• HMAC — message authentication code (alternative to GCM's built-in auth)
• SHA-256 — hash function often paired with AES
• JWT — tokens that may contain AES-encrypted claims

Tools

• AES Encrypt/Decrypt — encrypt and decrypt text in your browser