AES (Advanced Encryption Standard)
AES is the symmetric encryption algorithm used almost everywhere to protect sensitive data, standardised by NIST in 2001 and still the default choice for confidentiality at rest and in transit.
The Advanced Encryption Standard (AES) is a symmetric encryption algorithm used very widely to protect sensitive data and keep information confidential.
It was designed by two Belgian cryptographers, Vincent Rijmen and Joan Daemen, and adopted as a standard by the US National Institute of Standards and Technology (NIST) in 2001, replacing DES, which had become too weak to rely on.
From a security point of view, AES is what protects the confidentiality of data while it is being transmitted or while it sits on a disk.
It is used across a wide range of applications, from securing online communications to protecting data stored on physical devices or in the cloud. The algorithm uses a key to encrypt and decrypt, and its combination of strength and speed is why it became the default.
Its strength comes from its mathematical design, built on algebraic and substitution operations.
AES operates on fixed size blocks of data and supports three key lengths: AES-128, AES-192 and AES-256, of 128, 192 and 256 bits respectively. A longer key means a larger keyspace and a higher security margin.
In plain terms, encryption means taking a block of data and applying a series of transformations and substitutions controlled by the key. The result is a block of ciphertext that can only be usefully decrypted by somebody holding the right key.
Where to read more
NIST, FIPS PUB 197: the official document describing the AES standard, with the technical detail and the specification of the algorithm.
Crypto101: an accessible introduction to cryptographic concepts, including a chapter on AES.
Khan Academy, cryptography: interactive lessons covering the basics, useful for understanding what block ciphers do before reading the specification.
A worked example
A company needs to send confidential information across a network it does not control.
It encrypts the data with AES before transmitting it.
The sender encrypts with an AES-256 key, and the receiver, who holds the matching key, decrypts it and reads the original information.
Without the right key, an attacker who intercepts the traffic gets ciphertext and nothing else.
The part that decides whether this works in practice is not the algorithm, it is key management: where the key lives, who can reach it, and how it is rotated. AES has held up for over two decades. Keys left in a repository have not.