AES-256 Encryption Explained: Technical Deep Dive

What is AES?

AES (Advanced Encryption Standard) is a symmetric encryption algorithm adopted by the U.S. government in 2001. It replaced the older DES (Data Encryption Standard) which had become vulnerable to brute-force attacks.

Key Facts:

• Symmetric encryption: Same key encrypts and decrypts data
• Block cipher: Encrypts data in 128-bit blocks
• Three key sizes: AES-128 (10 rounds), AES-192 (12 rounds), AES-256 (14 rounds)
• Fast and efficient: Hardware acceleration available on modern CPUs
• Publicly vetted: Open standard scrutinized by cryptographers worldwide

Why 256-bit Keys?

AES supports three key lengths, but AES-256 offers the highest security:

Performance Impact: AES-256 is only ~40% slower than AES-128, but offers exponentially more security. For most applications, the security benefit vastly outweighs the minimal performance cost.

Why GCM Mode?

Plain AES provides confidentiality (encryption), but not integrity or authenticity. An attacker could modify ciphertext without detection.

AES-GCM (Galois/Counter Mode) adds:

• Authentication: Proves data comes from legitimate sender
• Integrity: Detects any tampering or corruption
• Additional data protection: Can authenticate metadata without encrypting it
• Parallelizable: Fast encryption/decryption on modern hardware

How GCM Works

Counter Mode (CTR): Generates a keystream by encrypting sequential counter values, then XORs with plaintext.

Keystream = AES-256(Key, Counter || Nonce)
Ciphertext = Plaintext ⊕ Keystream

Galois Authentication: Computes an authentication tag using polynomial multiplication in GF(2^128).

Components:

• Key: 256-bit encryption key
• IV/Nonce: 96-bit initialization vector (must be unique per message)
• Additional Authenticated Data (AAD): Optional metadata that is authenticated but not encrypted
• Authentication Tag: 128-bit tag proving authenticity and integrity

The Problem with Direct Password Usage

User passwords are typically:

• Too short (not 256 bits of entropy)
• Non-uniform (not all possible byte values)
• Predictable (common patterns, dictionary words)
• Vulnerable to brute-force if used directly

Solution: Key Derivation Functions (KDFs) transform weak passwords into strong encryption keys.

PBKDF2: Password-Based Key Derivation

PBKDF2 (Password-Based Key Derivation Function 2) is the most widely supported KDF.

How it works:

Key = PBKDF2(
    password,      // User's password
    salt,          // Random 128+ bit value
    iterations,    // 100,000+ recommended
    keyLength,     // 256 bits for AES-256
    hashFunction   // SHA-256 or SHA-512
)

Components:

• Salt: Random value that prevents rainbow table attacks. Must be unique per password, stored with ciphertext.
• Iterations: Number of times the hash function is applied. Higher = slower = more secure. Recommended: 100,000-600,000 for PBKDF2-SHA256.
• Output: Cryptographically strong 256-bit key suitable for AES-256.

Alternative: Argon2 (Modern Best Practice)

Argon2 is the winner of the Password Hashing Competition (2015) and is now recommended over PBKDF2.

Advantages over PBKDF2:

• Memory-hard: Requires significant RAM, making parallel attacks expensive
• Resistant to GPU attacks: Cannot be efficiently accelerated by GPUs
• Configurable: Tune memory, time, and parallelism parameters
• Better security: Specifically designed to resist modern attacks

Note: PBKDF2 remains acceptable and is still widely used due to better browser support.

Browser Implementation (WebCrypto API)

async function encryptData(plaintext, password) {
  // 1. Generate random salt and IV
  const salt = crypto.getRandomValues(new Uint8Array(16));
  const iv = crypto.getRandomValues(new Uint8Array(12));

  // 2. Derive key from password using PBKDF2
  const passwordKey = await crypto.subtle.importKey(
    'raw',
    new TextEncoder().encode(password),
    'PBKDF2',
    false,
    ['deriveBits', 'deriveKey']
  );

  const key = await crypto.subtle.deriveKey(
    {
      name: 'PBKDF2',
      salt: salt,
      iterations: 100000,
      hash: 'SHA-256'
    },
    passwordKey,
    { name: 'AES-GCM', length: 256 },
    false,
    ['encrypt']
  );

  // 3. Encrypt with AES-256-GCM
  const ciphertext = await crypto.subtle.encrypt(
    {
      name: 'AES-GCM',
      iv: iv,
      tagLength: 128
    },
    key,
    new TextEncoder().encode(plaintext)
  );

  // 4. Return salt + iv + ciphertext (all needed for decryption)
  return {
    salt: salt,
    iv: iv,
    ciphertext: new Uint8Array(ciphertext)
  };
}

async function decryptData(encryptedData, password) {
  // 1. Derive same key from password and salt
  const passwordKey = await crypto.subtle.importKey(
    'raw',
    new TextEncoder().encode(password),
    'PBKDF2',
    false,
    ['deriveBits', 'deriveKey']
  );

  const key = await crypto.subtle.deriveKey(
    {
      name: 'PBKDF2',
      salt: encryptedData.salt,
      iterations: 100000,
      hash: 'SHA-256'
    },
    passwordKey,
    { name: 'AES-GCM', length: 256 },
    false,
    ['decrypt']
  );

  // 2. Decrypt with AES-256-GCM
  const plaintext = await crypto.subtle.decrypt(
    {
      name: 'AES-GCM',
      iv: encryptedData.iv,
      tagLength: 128
    },
    key,
    encryptedData.ciphertext
  );

  return new TextDecoder().decode(plaintext);
}

Hardware Acceleration

Modern CPUs include AES-NI (AES New Instructions) that dramatically accelerate AES operations:

Availability: Intel (2010+), AMD (2011+), ARM (2013+), Apple Silicon all support hardware AES acceleration.