Encryption & Security

What is AES Encryption?

AES — the Advanced Encryption Standard — is the cipher that turns a readable file into scrambled nonsense, and back again, using a single secret key. It is the workhorse of modern encryption: it protects web traffic, disk drives, messaging apps, and the files you store in NDEVR OWL. This is how it works, in plain language.

What
A symmetric block cipher standardized by the U.S. NIST in 2001 (FIPS 197).
Key sizes
128, 192, or 256 bits. NDEVR uses 128-bit and 256-bit keys.
Block size
Always 128 bits (16 bytes), regardless of key size.
Status
No practical attack is known after two decades of public scrutiny.

A Single Shared Key

AES is a symmetric cipher: the same key both locks (encrypts) and unlocks (decrypts) the data. Think of it as a physical padlock where one key closes and opens it. That makes AES extremely fast — modern processors even have dedicated hardware instructions for it — but it raises one hard question: how do you get the key to the right person without anyone else seeing it? That key-sharing problem is solved separately, by public-key cryptography and ECIES.

AES is also a block cipher: it encrypts data 16 bytes at a time. Real files are far larger than 16 bytes, so a mode of operation (below) defines how those blocks are chained together to encrypt a whole file safely.

AES-128 vs AES-256

The number is simply the length of the key in bits. A longer key means more possible keys an attacker would have to try.

Both key sizes provide a large search space when keys are generated randomly. AES-256 adds margin for long-lived data and future cryptanalytic advances. Key size alone does not establish the security of a system: the mode, nonce handling, key derivation and endpoint security matter too.

CBC and GCM Modes

A mode of operation is the recipe for applying AES across many blocks. Two matter here:

  • CBC (Cipher Block Chaining) — mixes each plaintext block with the previous ciphertext block before encryption. It needs an unpredictable initialization vector (IV). CBC provides confidentiality but does not authenticate the ciphertext; it needs a separate integrity mechanism.
  • GCM (Galois/Counter Mode) — provides authenticated encryption. Its authentication tag lets the receiver reject modified ciphertext or authenticated metadata. Its nonce must not repeat under the same key, and the tag must be checked before plaintext is accepted.
★

Why the IV matters

The rules depend on the mode. CBC needs an unpredictable IV; GCM requires nonce uniqueness for each key. Neither value needs to be secret. Random generation must use appropriate sizes and usage limits; a random draw is not an unlimited guarantee against repetition.

Key Strength and Its Limits

AES-256 has 2256 possible keys. Exhaustive search over a uniformly random key is infeasible with current computing resources. But encrypting with a password-derived key does not give a weak password 256 bits of strength: an attacker may only need to try likely passwords. Password stretching and key derivation address that different problem.

In the real world, encryption is almost never broken by attacking AES itself. It is broken by attacking around it — a weak password, a leaked key, a compromised device. That is why how a system manages and shares keys matters as much as the cipher. With client-held decryption keys, OWL's CSD path keeps usable payload keys on authorized endpoints; SSD and other plaintext-processing modes deliberately use a different provider trust boundary.

How NDEVR Uses AES

In NDEVR OWL, CSD files are sealed on an authorized endpoint with AES-256 before upload. With client-held decryption keys, routine storage and transport receive ciphertext and wrapped keys but no provider-usable payload key. Each file gets its own random key; that key is wrapped using ECIES and AES-256-GCM for authorized recipients. User-held recovery preserves the CSD boundary; SSD delivery explicitly trusts the provider. Short-lived access links use AES-128, which keeps link payloads compact while the server validates them before any file data is sent. See OWL Encryption for the full key-sharing flow.

AES-256-GCM also protects OWL’s OWPK v2 account private-key envelope. OPAQUE supplies a client-only export key, and HKDF-SHA256 derives the AES wrapping key from it. Your device opens that envelope before using the account key to unwrap authorized file keys. OPAQUE handles password authentication; AES encrypts the protected data.

References & Further Reading