Understand AES Encryption

Download  EaseFilter Transparent Encryption SDK Setup File
Download  EaseFilter Transparent Encryption SDK Zip File

The Advanced Encryption Standard (AES), also known by its original name Rijndael, is a specification for the encryption of electronic data established by the U.S. National Institute of Standards and Technology in 2001. The AES encryption is a symmetric block cipher which works on fixed length group of bits, called blocks. An input is taken a certain size, usually 128 bits, the transformation requires a second input, the secret key. The secret key can be of any size depending on the cipher used while AES supports only three different key sizes of 128,192 and 256 bits.

How AES encryption works

AES includes three block ciphers:

1. AES-128 uses a 128-bit key length to encrypt and decrypt a block of messages.
2. AES-192 uses a 192-bit key length to encrypt and decrypt a block of messages.
3. AES-256 uses a 256-bit key length to encrypt and decrypt a block of messages.

Each cipher encrypts and decrypts data in blocks of 128 bits using cryptographic keys of 128, 192 and 256 bits, respectively. There are 10 rounds for 128-bit keys, 12 rounds for 192-bit keys and 14 rounds for 256-bit keys. A round consists of several processing steps that include substitution, transposition and mixing of the input plaintext to transform it into the final output of ciphertext.

The AES encryption algorithm defines numerous transformations that are to be performed on data stored in an array. The first step of the cipher is to put the data into an array, after which the cipher transformations are repeated over multiple encryption rounds. In this operation the plaintext is converted into the ciphertext format using the secret key.

1. KeyExpansion – round keys are derived from the cipher key using the AES key schedule. AES requires a separate 128-bit round key block for each round plus one more.
2. Initial round key addition: AddRoundKey – each byte of the state is combined with a byte of the round key using bitwise XOR.
3. 9, 11 or 13 rounds:
   • SubBytes – a non-linear substitution step where each byte is replaced with another according to a lookup table.
   • ShiftRows – a transposition step where the last three rows of the state are shifted cyclically a certain number of steps.
   • MixColumns – a linear mixing operation which operates on the columns of the state, combining the four bytes in each column.
   • AddRoundKey
4. Final round (making 10, 12 or 14 rounds in total):
   • SubBytes
   • ShiftRows
   • AddRoundKey

Modes of AES Operation

The different modes of operation of block ciphers in AES are configuration methods that allowed to process with large data streams also without the risk of compromising the security provided. Here we provide some existing ways to blur the cipher text as a result the intruder can be avoided to break the cipher. Such modifications are known as Modes of block cipher operations.

Cipher block chaining (CBC)

The CBC (Cipher Block Chaining) mode provides this by using an initialization vector – IV. The IV has the same size as the block that is encrypted. In general, the IV usually is a random number, not a nonce. In CBC mode, each block of plaintext is XORed with the previous ciphertext block before being encrypted. This way, each ciphertext block depends on all plaintext blocks processed up to that point. To make each message unique, an initialization vector must be used in the first block.

Counter (CTR)

CTR mode (CM) is also known as integer counter mode (ICM) and segmented integer counter (SIC) mode. CTR mode was introduced by Whitfield Diffie and Martin Hellman in 1979. Along with CBC, CTR mode is one of two block cipher modes recommended by Niels Ferguson and Bruce Schneier.

Counter mode turns a block cipher into a stream cipher. It generates the next key stream block by encrypting successive values of a "counter". The counter can be any function which produces a sequence which is guaranteed not to repeat for a long time, although an actual increment-by-one counter is the simplest and most popular. 

If the IV/nonce is random, then they can be combined with the counter using any invertible operation (concatenation, addition, or XOR) to produce the actual unique counter block for encryption. In case of a non-random nonce (such as a packet counter), the nonce and counter should be concatenated (e.g., storing the nonce in the upper 64 bits and the counter in the lower 64 bits of a 128-bit counter block).

AES Security

How to encrypt file with AES

Even though there are a lot of encryption libraries in the market, but it is still very complex to develop a reliable transparent on-access file encryption product. The EEFD is a mature commercial encryption SDK. It provides a complete modular framework for the developers even without the driver development experience to build the on-access file encryption software within a day.

EaseFilter Encryption Filter Driver (EEFD) is a file system encryption filter driver. It provides a comprehensive security solution to develop the transparent on-access file level encryption products. The EEFD allows you to encrypt the newly created files transparently. You can authorize the on-access encryption/decryption under the control of client-defined policy. 

The EEFD integrates the Microsoft CNG encryption libraries with AES algorithm. The CNG encryption library supports AES-NI (or the Intel Advanced Encryption Standard New Instructions;  AES-NI). It can achieve greater speeds and / or improved security than otherwise.

The EEFD supports the per process access restriction. It utilizes the Isolation Mini Filter Driver technology to implement two views of the encrypted file to the process. You can setup the whitelist for the authorized processes, they can get the plaintext of the encrypted file, setup the blacklist for the unauthorized processes, they will get the ciphertext of the encrypted file.