Think of AES as a strict encryption workshop
AES is easier to read as a repeated workshop process. Data enters in fixed-size blocks, then goes through rounds of substitution, shifting, mixing, and key addition.
The plates explain why the data is scrambled in several different ways instead of only being locked once. Each step makes the relationship between plaintext, key, and ciphertext harder to reverse.
Keep the roles separate: AES protects bulk data, the key controls who can unlock it, and post-quantum cryptography changes public-key tasks rather than replacing AES.
AES is the modern answer to practical encryption
The first page begins with a simple security story: plaintext is readable, weak encryption can be broken, and strong encryption turns data into ciphertext that should be useless without the key. AES is the standard tool behind that modern story. It protects data in phones, browsers, storage devices, VPNs, embedded systems, and countless secure products.
AES is a block cipher. It processes a fixed 128-bit data block, which is 16 bytes, and transforms that block through a sequence of well-defined rounds. The cipher key may be 128, 192, or 256 bits, but the block size remains 128 bits. This separation between block size and key size is one of the first details beginners should keep straight.
The Enigma comparison is useful as history, not as an algorithmic analogy. Enigma showed why encrypted communication can shape real-world outcomes, but AES is a modern public standard designed for rigorous analysis and efficient implementation. Its security does not depend on hiding the design; it depends on the key and on the strength of the standardized transformation.
For hardware engineers, the important point is that AES is not a black box. It has a regular state, round structure, byte operations, key schedule, and official test vectors. That makes it suitable for RTL implementation, formal review, certification work, and high-throughput accelerators.
AES prepares the state and the round keys
The second page introduces the AES state. A 128-bit block is arranged as 16 bytes in a 4-by-4 matrix. Many beginner mistakes come from byte order and state mapping, so it is worth treating the state as a real data structure before memorizing formulas.
Key expansion turns the original cipher key into a sequence of round keys. AES-128 uses 10 main rounds plus an initial AddRoundKey step, so the implementation needs enough key material for each stage. The same plaintext block encrypted under a different key should follow a completely different path through the cipher.
SubBytes then replaces each state byte using the S-box. This step is the main source of nonlinearity. Without it, AES would be much closer to a linear transformation, which would be far easier to analyze and attack.
ShiftRows moves bytes horizontally by different offsets. It does not change byte values by itself; it changes where bytes sit in the state. That movement is crucial because the next step, MixColumns, works column by column. ShiftRows makes sure bytes from one column do not stay isolated forever.
In RTL design, this page maps almost directly to module boundaries: key schedule, S-box lookup, state register, row shifter, and control FSM. Good AES hardware begins by making these data movements explicit.
MixColumns creates diffusion across each column
The third page zooms in on MixColumns because it is the AES step that often feels least intuitive. It does not mix bytes randomly. It treats each column as four bytes and multiplies that four-byte vector by a fixed 4-by-4 matrix over the AES finite field.
The result is another four-byte column. Each output byte depends on all four input bytes from the same column. That is diffusion: a change in one byte starts spreading into multiple bytes, and after repeated rounds the influence spreads across the state.
The multiplication symbols in the formula do not mean ordinary integer multiplication. Values such as 02 and 03 are finite-field constants in GF(2^8). In hardware, these operations can be implemented with XOR and conditional reduction logic, which is why AES can be efficient even though the math looks specialized.
A practical way to read this page is to focus on the invariant: same fixed matrix, one column at a time, four input bytes become four output bytes. Once that is clear, the formula becomes a precise recipe instead of a wall of symbols.
AddRoundKey ties every round to the secret key
The fourth page should be read as the final piece of a round. SubBytes adds nonlinearity, ShiftRows relocates bytes, MixColumns diffuses within columns, and AddRoundKey XORs the state with the round key. The XOR may look simple, but it is the step that injects secret key material into the state.
For AES-128, the high-level encryption schedule is: initial AddRoundKey, then nine full rounds of SubBytes, ShiftRows, MixColumns, and AddRoundKey, followed by a final round that omits MixColumns. That missing final MixColumns is not an accident; it is part of the standard structure.
Decryption walks the path back using inverse operations and the proper round keys in reverse order. This is why AES is a reversible keyed permutation: with the correct key schedule, ciphertext returns to plaintext; without it, the output should remain computationally useless.
For implementation, AddRoundKey is usually cheap in gates because it is XOR-heavy. The design questions are more about timing, key availability, state-register placement, and whether the core is iterative, partially unrolled, or fully pipelined.
AES still matters after post-quantum cryptography
The final page connects AES to real systems. AES is widely used for HTTPS/TLS data protection, Wi-Fi security, VPNs, disk encryption, secure storage, mobile applications, firmware protection, and embedded devices. In many systems, public-key cryptography helps authenticate identities or establish a session key, while AES encrypts the bulk data using that session key.
Post-quantum cryptography does not make AES obsolete. Quantum computers mainly threaten widely deployed public-key schemes such as RSA and elliptic-curve cryptography. Symmetric cryptography is affected differently; increasing symmetric security strength, such as using AES-256 where appropriate, remains a common conservative strategy.
The practical architecture is therefore teamwork: PQC for public-key tasks such as key establishment and signatures, and AES for efficient large-volume data encryption. This is why modern security roadmaps discuss hybrid or transition designs rather than simply replacing every cryptographic primitive with a PQC algorithm.
For IC and firmware teams, AES remains worth understanding because it appears in secure boot, storage encryption, authenticated encryption modes, key wrapping, test vectors, certification evidence, and crypto accelerator design. PQC changes the front door of many protocols; AES still protects the rooms inside.
References
- NIST FIPS 197: Advanced Encryption Standard: The official AES specification; NIST's 2023 update modernized the document but made no technical change to the algorithm.
- NIST SP 800-38A: Block Cipher Modes of Operation: Defines common confidentiality modes such as ECB, CBC, CFB, OFB, and CTR for approved block ciphers like AES.
- NIST Post-Quantum Cryptography FIPS approval: Official NIST announcement approving FIPS 203, 204, and 205, useful for understanding why PQC mainly changes public-key tasks while AES remains important for bulk data encryption.
- NIST PQC Standardization Process: NIST project page summarizing the post-quantum standardization process and the published FIPS 203, 204, and 205 standards.
Learning guide
From AES to RTL
Prerequisites
- Binary data and exclusive OR
What I learned
- Recognize the AES state and round structure
- Explain substitution, permutation, mixing, and key addition
- Place AES correctly beside PQC