content/blog/2018-11-28-aes-encryption.org

  1#+date:        <2018-11-28 Wed 00:00:00>
  2#+title:       AES Encryption: Technical Overview and Operational Guide
  3#+description: Detailed explanation of AES encryption, including key handling, encryption modes, algorithm structure, and implementation considerations for secure data protection.
  4#+slug:        aes-encryption
  5#+filetags:    :encryption:AES:cryptography:
  6
  7* Basic AES
  8
  9If you're not familiar with encryption techniques, [[https://en.wikipedia.org/wiki/Advanced_Encryption_Standard][AES]] is the *Advanced
 10Encryption Standard*. This specification was established by the National
 11Institute of Standards and Technology, sub-selected from the Rijndael family of
 12ciphers (128, 192, and 256 bits) in 2001. Furthering its popularity and status,
 13the US government chose AES as their default encryption method for top-secret
 14data, removing the previous standard which had been in place since 1977.
 15
 16AES has proven to be an extremely safe encryption method, with 7-round and
 178-round attacks making no material improvements since the release of this
 18encryption standard almost two decades ago.
 19
 20#+begin_quote
 21Though many papers have been published on the cryptanalysis of AES, the fastest
 22single-key attacks on round-reduced AES variants [20, 33] so far are only
 23slightly more powerful than those proposed 10 years ago [23,24].
 24
 25- [[http://research.microsoft.com/en-us/projects/cryptanalysis/aesbc.pdf][Bogdonav, et al.]]
 26#+end_quote
 27
 28* How Secure is AES?
 29
 30In theory, AES-256 is non-crackable due to the massive number of combinations
 31that can be produced. However, AES-128 is no longer recommended as a viable
 32implementation to protect important data.
 33
 34A semi-short [[http://www.moserware.com/2009/09/stick-figure-guide-to-advanced.html][comic strip]] from Moserware quickly explains AES for the public to
 35understand. Basically AES encrypts the data by obscuring the relationship
 36between the data and the encrypted data. Additionally, this method spreads the
 37message out. Lastly, the key produced by AES is the secret to decrypting it.
 38Someone may know the method of AES, but without the key, they are powerless.
 39
 40To obscure and spread the data out, AES creates a substitution-permutation
 41network. Wikipedia has a wonderful [[https://upload.wikimedia.org/wikipedia/commons/thumb/c/cd/SubstitutionPermutationNetwork2.png/468px-SubstitutionPermutationNetwork2.png][example of an SP network]] available. This
 42network sends the data through a set of S boxes (using the unique key) to
 43substitute the bits with another block of bits. Then, a P box will permutate, or
 44rearrange, the bits. This is done over and over, with the key being derived from
 45the last round. For AES, the key size specifies the number of transformation
 46rounds: 10, 12, and 14 rounds for 128-bit, 192-bit, and 256-bit keys,
 47respectively.
 48
 49* The Process
 50
 511. *KeyExpansion*: Using [[https://en.m.wikipedia.org/wiki/Advanced_Encryption_Standard][Rijndael's key schedule]], the keys are dynamically
 52   generated.
 532. *AddRoundKey*: Each byte of the data is combined with this key using bitwise
 54   xor.
 553. *SubBytes*: This is followed by the substitution of each byte of data.
 564. *ShiftRows*: Then, the final three rows are shifted a certain number of
 57   steps, dictated by the cipher.
 585. *MixColumns*: After the rows have been shifted, the columns are mixed and
 59   combined.
 60
 61This process does not necessarily stop after one full round. Steps 2 through 5
 62will repeat for the number of rounds specified by the key. However, the final
 63round excludes the MixColumns step. As you can see, this is a fairly complex
 64process. One must have a solid understanding of general mathematic principles to
 65fully understand how the sequence works (and to even attempt to find a
 66weakness).
 67
 68According to research done by Bogdanov et al., it would take billions of years
 69to brute force a 126-bit key with current hardware. Additionally, this brute
 70force attack would require storing 2^{88} bits of data! However, there are a few
 71different attacks that have been used to show vulnerabilities with the use of
 72this technology. Side-channel attacks use inadvertent leaks of data from the
 73hardware or software, which can allow attackers to obtain the key or run
 74programs on a user's hardware.
 75
 76Please note that this is not something you should run out and try to implement
 77in your =Hello, World!= app after only a few hours of research. While AES
 78(basically all encryption methods) is extremely efficient in what it does, it
 79takes a lot of time and patience to understand. If you're looking for something
 80which currently implements AES, check out the [[https://www.bouncycastle.org/documentation.html][Legion of the Bouncy Castle]] for
 81Java implementations of cryptographic algorithms.
 82
 83* Why Does Encryption Matter?
 84
 85There are limitless reasons to enable encryption at-rest or in-transit for
 86various aspects of your digital life. You can research specific examples, such
 87as [[https://arstechnica.com/tech-policy/2018/12/australia-passes-new-law-to-thwart-strong-encryption/][Australia passes new law to thwart strong encryption]]. However, I will simply
 88list a few basic reasons to always enable encryption, where feasible:
 89
 901. Privacy is a human right and is recognized as a national right in some
 91   countries (e.g., [[https://www.law.cornell.edu/wex/fourth_amendment][US Fourth Amendment]]).
 922. "Why not?" Encryption rarely affects performance or speed, so there's usually
 93   not a reason to avoid it in the first place.
 943. Your digital identity and activity (texts, emails, phone calls, online
 95   accounts, etc.) are extremely valuable and can result in terrible
 96   consequences, such as identity theft, if leaked to other parties. Encrypting
 97   this data prevents such leaks from ruining lives.
 984. Wiping or factory-resetting does not actually wipe all data from the storage
 99   device. There are methods to read data from the physical disks/boards inside
100   devices.
1015. Corporations, governments, and other nefarious groups/individuals are
102   actively looking for ways to collect personal information about anyone they
103   can. If someone's data is unencrypted, that person may become a target due to
104   the ease of data collection.
105
106​*Read More:*
107
108- [[http://nvlpubs.nist.gov/nistpubs/FIPS/NIST.FIPS.197.pdf][Federal Information Processing Standards Publication 197]]