CoChat
Sign Up
Cited by 108Cryptographic Implementations and SecurityCoding theory and cryptographyCryptography and Residue Arithmetic

Advanced Encryption Standard (AES)

Open access
National Institute of Standards and Technology (US)·2023
DOI 10.6028/nist.fips.197-upd1
Open this paper in CoChat — free account

Abstract

In 2000, NIST announced the selection of the Rijndael block cipher family as the winner of the Advanced Encryption Standard (AES) competition. Block ciphers are the foundation for many cryptographic services, especially those that provide assurance of the confidentiality of data. Three members of the Rijndael family are specified in this Standard: AES-128, AES-192, and AES-256. Each of them transforms data in blocks of 128 bits, and the numerical suffix indicates the bit length of the associated cryptographic keys.

AI snapshot

Written from the paper’s full text.

TL;DR

FIPS 197-upd1 specifies the Advanced Encryption Standard (AES), a symmetric block cipher derived from the Rijndael family that NIST selected in 2000, defining three instantiations (AES-128, AES-192, AES-256) with a 128-bit block size. The 2023 update is editorial: it maintains the technical specifications of the original standard while revising text, formatting, and references.

Key findings

  • AES is a symmetric block cipher that encrypts and decrypts data in blocks of 128 bits, using keys of 128, 192, or 256 bits (Nk = 4, 6, 8 words; Nr = 10, 12, 14 rounds, respectively).
  • CIPHER() applies four byte-oriented transformations per round — SUBBYTES(), SHIFTROWS(), MIXCOLUMNS(), and ADDROUNDKEY() — with MIXCOLUMNS() omitted in the final round; the inverse is INVCIPHER(), and an equivalent inverse cipher (EQINVCIPHER()) uses a modified key schedule dw.
  • KEYEXPANSION() generates 4 × (Nr + 1) words from the key, invoking ROTWORD(), SUBWORD(), and ten fixed round constants Rcon[j].
  • The update was based on public comments and analyses of AES security described in NIST IR 8319; the decision was to maintain the technical specifications of the Standard.

Methods

  • Design: a normative specification document, not an empirical study. It defines terms, symbols, and functions; presents finite-field arithmetic in GF(2⁸); and gives pseudocode for CIPHER(), KEYEXPANSION(), INVCIPHER(), EQINVCIPHER(), and KEYEXPANSIONEIC().
  • Data/sample: worked examples in the appendices — key expansion for a 128-bit key (Nk = 4), a 192-bit key (Nk = 6), and a 256-bit key (Nk = 8), plus a step-by-step AES-128 cipher example; example vectors are referenced to a NIST website rather than reproduced.
  • Analysis: mathematical derivation of the transformations (S-box affine transformation, matrix multiplication for MIXCOLUMNS/INVMIXCOLUMNS, multiplicative inverses via b⁻¹ = b²⁵⁴ or the extended Euclidean algorithm).

Limitations

  • Stated: implementation attacks (e.g., side channels such as timing, cache-timing attacks, and fault injection) are outside the scope of the document; suggested implementations explain inner workings but "do not provide protection against various implementation attacks."
  • Stated: the Standard applies to federal information systems but not to national security systems as defined in 44 U.S.C. 3552.
  • Evident from the text: this is a specification rather than a comparative or empirical evaluation, so it reports no performance or security measurements of its own; the security review basis is cited to NIST IR 8319 rather than presented here.

Model-written summary. Check it against the paper before relying on it.

Integrity signals

Registry

Crossref · 10.6028/nist.fips.197-upd1

Cites

6 of 7 references verified0 citation errors · 1 not checkable

Statistics

Nothing to recompute.

Claims the paper makes

0 of 9 cited sources checked · 0 supported · 0 flagged

    • Classified as probably not a substantial claim. 22
    • May combine two claims. 6

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      The first Nk words of the expanded key are the key itself.

      “The frst Nk words of the expanded key are the key itself.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      The block ciphers AES-128, AES-192, and AES-256 differ in three respects: the length of the key; the number of rounds, which determines the size of the required key schedule; and the specification of the recursion within KEYEXPANSION().

      “The block ciphers AES-128, AES-192, and AES-256 differ in three respects: 1) the length of the key; 2) the number of rounds, which determines the size of the required key schedule; and 3) the specifcation of the recursion within KEYEXPANSION().”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      The first and last round keys in dw are the same as in w.

      “The frst and last round keys in dw are the same as in w; the modifcation of the other round keys is described in Lines 19-22.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingreasoning

      For j > 0, the left-most bytes of Rcon[j] may be generated by successively applying XTIMES() to the byte represented by x^{j-1}.

      “Note that for j > 0, these bytes may be generated by successively applying XTIMES() to the byte represented by x j-1 (see Eq. 4.5).”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      ADDROUNDKEY() is its own inverse.

      “ADDROUNDKEY(), described in Section 5.1.4,is its own inverse.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingcitation

      The final round of CIPHER() differs in that the MIXCOLUMNS() transformation is omitted.

      “The frst step (Line 2) is to copy the input into the state array using the conventions from Sec. 3.4.After an initial round key addition (Line 3), the state array is transformed by Nr applications of the round function (Lines 4-12); the fnal round (Lines 10-12) differs in that the MIXCOLUMNS() transformation is omitted.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      Every subsequent word w[i] is generated recursively from the preceding word, w[i -1], and the word Nk positions earlier, w[i -Nk].

      “Every subsequent word w[i] is generated recursively from the preceding word, w[i -1], and the word Nk positions earlier, w[i -Nk], as follows:”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

      Findingown data

      SUBBYTES() is an invertible, non-linear transformation of the state.

      “SUBBYTES() is an invertible, non-linear transformation of the state in which a substitution table, called an S-box, is applied independently to each byte in the state.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits.

      “The AES algorithm is capable of using cryptographic keys of 128, 192, and 256 bits to encrypt and decrypt data in blocks of 128 bits.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

      Findingnone given

      This Standard specifies three instantiations of Rijndael: AES-128, AES-192, and AES-256, where the suffix indicates the bit length of the key, and the block size is 128 bits in each case.

      “This Standard specifes three instantiations of Rijndael: AES-128, AES-192, and AES-256, where the suffx indicates the bit length of the key.The block size (i.e., the length of the data inputs and outputs) is 128 bits in each case.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Findingnone given

      When the loop concludes, i = Nk.

      “When the loop concludes, i = Nk.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

      Findingnone given

      For AES-128, a distinct round constant is called in the generation of each of the 10 round keys; for AES-192 and AES-256, the key expansion routine calls the first eight and seven of these same constants, respectively.

      “For AES-128, a distinct round constant is called in the generation of each of the 10 round keys.For AES-192 and AES-256, the key expansion routine calls the frst eight and seven of these same constants, respectively.”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

      Premisecitation

      In 1997, NIST initiated the Advanced Encryption Standard (AES) development effort and called for the public to submit candidate algorithms for block ciphers.

      “In 1997, NIST initiated the Advanced Encryption Standard (AES) development effort [1] and called for the public to submit candidate algorithms for block ciphers.”
      Quote in the paperNot a substantial claim0 of 1 sources checked
      • cites [1]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

      Interpretationnone given

      Suggested implementations are intended to explain the inner workings of the AES algorithm but do not provide protection against various implementation attacks.

      “Suggested implementations are intended to explain the inner workings of the AES algorithm but do not provide protection against various implementation attacks.”
      Quote in the paperNot a substantial claim
      • Rests on an assumption: A physical implementation may leak key-dependent information through side channels, such as the time taken to perform a computation, or when faults are injected into the computation.
      • Rests on an assumption: When such attacks are non-invasive, they can be effective even when there are mechanisms to detect physical tampering of the device.
      • Rests on an assumption: Cache-timing attacks may affect AES implementations on software platforms that use a cache to accelerate the access to data from main memory.

    • Probably not a substantial claim: may not pass S3 (load-bearing). May combine two claims.

      Premisecitation

      Such considerations are outside of the scope of this document but are taken into account when testing for conformance to the algorithm in this Standard according to the validation program developed by NIST.

      “Such considerations are outside of the scope of this document but are taken into account when testing for conformance to the algorithm in this Standard according to the validation program developed by NIST (see https://nist.gov/cmvp).”
      Quote in the paperNot a substantial claim0 of 1 sources checked
      • cites https://nist.gov/cmvp

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Premisecitation

      When a cryptographic key has been generated appropriately, no restriction is imposed when the resulting key is used for the AES algorithm.

      “When a cryptographic key has been generated appropriately (see NIST Special Publication 800-133, Rev. 2 [6] for guidelines), no restriction is imposed when the resulting key is used for the AES algorithm.”
      Quote in the paperNot a substantial claim0 of 1 sources checked
      • cites NIST Special Publication 800-133, Rev. 2 [6]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Interpretationreasoning

      Several properties of the AES algorithm allow for an alternative specification of the inverse of CIPHER(), called the equivalent inverse cipher.

      “Several properties of the AES algorithm allow for an alternative specifcation of the inverse of CIPHER(), called the equivalent inverse cipher, denoted by EQINVCIPHER().”
      Quote in the paperNot a substantial claim

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Premisecitation

      Rijndael supports additional block sizes and key lengths that are not adopted in this Standard.

      “Rijndael supports additional block sizes and key lengths that are not adopted in this Standard.”
      Quote in the paperNot a substantial claim0 of 2 sources checked
      • cites [2]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

      • cites [3]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Premisecitation

      Public comments and analyses of the security of the AES that are described in NIST IR 8319 were the basis for the decision to maintain the technical specifications of the Standard.

      “Public comments and analyses of the security of the AES that are described in NIST IR 8319 [10] were the basis for the decision to maintain the technical specifcations of the Standard.”
      Quote in the paperNot a substantial claim0 of 1 sources checked
      • cites NIST IR 8319 [10]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Premisecitation

      In 2000, NIST announced the selection of the Rijndael block cipher family as the winner of the AES competition.

      “In 2000, NIST announced the selection of the Rijndael block cipher family as the winner of the Advanced Encryption Standard (AES) competition.”
      • Also stated in: § 1. Introduction · plain
        “In 2000, NIST announced the selection of Rijndael [2,3] for the AES.”
      Quote in the paperNot a substantial claim0 of 2 sources checked
      • cites [2]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

      • cites [3]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Premisecitation

      The original FIPS 197 (November 26, 2001) was reviewed and updated under the auspices of NIST's Crypto Publication Review Board.

      “The original FIPS 197 (November 26, 2001) was reviewed and updated under the auspices of NIST's Crypto Publication Review Board [9].”
      Quote in the paperNot a substantial claim0 of 1 sources checked
      • cites [9]

        Couldn’t be matched to a paper in Crossref, so it can’t be checked.

    • Probably not a substantial claim: may not pass S3 (load-bearing).

      Premisenone given

      The algorithm specified in this Standard may be implemented in software, firmware, hardware, or any combination thereof.

      “The algorithm specifed in this Standard may be implemented in software, frmware, hardware, or any combination thereof.”
      Quote in the paperNot a substantial claim
    22 of 22

    • The paper relies on this without support.

      A physical implementation may leak key-dependent information through side channels, such as the time taken to perform a computation, or when faults are injected into the computation.

      “A physical implementation may leak key-dependent information through side channels, such as the time taken to perform a computation, or when faults are injected into the computation.”

    • The paper relies on this without support.

      When such attacks are non-invasive, they can be effective even when there are mechanisms to detect physical tampering of the device.

      “When such attacks are non-invasive, they can be effective even when there are mechanisms to detect physical tampering of the device.”

    • The paper relies on this without support.

      Cache-timing attacks may affect AES implementations on software platforms that use a cache to accelerate the access to data from main memory.

      “For example, cache-timing attacks may affect AES implementations on software platforms that use a cache to accelerate the access to data from main memory.”
    3 of 3

    Self-check

    Percentages, sums and reported differences re-computed from the paper’s own numbers.

    Each contradiction between two passages listed here was confirmed by an independent check.

    • Change log misidentifies Figure 5 as a display of round constants

      Minor

      The change log says the round constants are displayed in Figure 5, whereas Figure 5 is labeled as an illustration of ADDROUNDKEY(); the round constants are listed under Table 5.

    • Key-expansion pseudocode indexes the key as bytes, but defines it as words

      Minor

      The key is defined as an array of Nk words, yet this assignment takes four indexed elements of key for each single word w[i]. For Nk = 4, the assignment at i = 1 would access key[4..7], beyond the defined four-word key.

    • Change log assigns INVSHIFTROWS to the wrong section

      Minor

      The change log places INVSHIFTROWS() in Section 5.3.2, but its section heading is 5.3.1; Section 5.3.2 is INVSUBBYTES().

    3 of 3

    Cites

    Flagged first, then by citations

    Research works printed but not linked: 1

    1. Michael Artin. Algebra. Pearson Modern Classic. Pearson, second edition, 2017.

    Cited by

    Sorted by citations

    Related

    Authors
    National Institute of Standards and Technology (US)
    Publisher
    National Institute of Standards and Technology (U.S.)
    Published
    2023-05-09
    DOI
    10.6028/nist.fips.197-upd1
    OpenAlex
    W4375934760
    Semantic Scholar
    fb14b92ba8fcec892bc5fc9155764b7a53c33a26
    Cited by
    108
    References
    6
    Citations by year
    2026: 28 · 2025: 32 · 2024: 24 · 2023: 11 · 2022: 4 · 2019: 1 · 2018: 1 · 2014: 3
    Type
    report
    Language
    en
    Open access
    Funders
    National Institute of Standards and Technology
    Topics
    • Physical Sciences › Computer Science › Artificial Intelligence › Cryptographic Implementations and Security
    • Physical Sciences › Computer Science › Artificial Intelligence › Coding theory and cryptography
    • Physical Sciences › Computer Science › Information Systems › Cryptography and Residue Arithmetic
    Keywords
    Advanced Encryption Standard, block cipher, AES-128, AES-192, AES-256, key length, data confidentiality, cryptographic standards

    About these checks

    Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.

    Claims read by deepseek-v4.1-flash under definition version 3 (extract-v3) on 2026-10-20.

    Classified by jev-1.13-20260917 (gold-guideline-v0.2) on 2026-10-20.

    Statistics and arithmetic are recomputed, not judged.

    Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.

    What counts as a claim ›How we measure confidence ›How we check this ›

    Are you an author, or do you see a problem with this page? Request a review