Security and usage

The key schedule and why AES resists

AddRoundKey uses a different key for each round. Where do these keys come from, and why has no one ever managed to break AES in practice?

The key schedule

AES does not reuse the master key as is for each round. An algorithm called the key schedule derives, from the master key, a sequence of distinct round keys, one per AddRoundKey.

   master key (128, 192, or 256 bits)
            |
   [ key schedule ]
            |
   +--------+--------+--------+ ... +
   |        |        |             |
  K0       K1       K2    ...     K10
 (before  (round 1) (round 2)   (last
  1st round)                     round)

The process combines byte rotations, passage through the S-box, and XOR with round constants. Result: even if two master keys differ by only one bit, their round keys are completely different. Each round is thus mixed with a key of its own.

The size of the key space

The first line of defense of AES is brutal: the number of possible keys. For AES-128, it is 2^128. This number is difficult to picture:

2^128 = about 3.4 x 10^38
      = 340 282 366 920 938 463 463 374 607 431 768 211 456

Let us put it in perspective with a brute-force attack:

Trial speed	Time to exhaust 2^128
1 billion keys/s	~10^22 years
1,000 billion/s	~10^19 years
The whole Earth computing	far more than the age of the universe

For comparison, the universe is about 1.4 x 10^10 years old. Going through 2^128 keys is physically impossible, whatever the imaginable computing power. And AES-256 offers 2^256 keys, an even incomparably larger number.

No attack better than brute force

One might hope for a flaw in the structure of AES that would avoid going through everything. For more than twenty years, the global cryptographic community has been searching. Result: no practical attack is known. The best theoretical attacks only reduce security by a negligible factor, very far from making AES breakable.

The combination of the multiple rounds, of the confusion (S-box), and of the diffusion (MixColumns) makes the cipher extremely robust: after just a few rounds, the avalanche effect is complete.

AES-NI: fast and secure

Finally, AES is designed to be efficient. Since 2010, most processors integrate dedicated instructions, the AES-NI, which execute the rounds directly in the hardware. This makes AES both very fast (several gigabytes per second) and resistant to certain side-channel attacks, because the duration of the computation no longer depends on the data.

In summary