AES Performance


On a Pentium Pro, AES encryption requires 18 clock cycles per byte, equivalent to a throughput of about 11 MB/s for a 200 MHz processor. On a 1.7 GHz Pentium M throughput is about 60 MB/s.


AES algorithm description






AES became effective as a federal government standard on May 26, 2002 after approval by the Secretary of Commerce. AES is included in the ISO/IEC 18033-3 standard. AES is available in many different encryption packages, and is the first publicly accessible and open[vague] cipher approved by the National Security Agency (NSA) for top secret information when used in an NSA approved cryptographic module (see Security of AES, below).





Known attacks

AES has a fairly simple algebraic description.[16] In 2002, a theoretical attack, termed the “XSL attack”, was announced by Nicolas Courtois and Josef Pieprzyk, purporting to show a weakness in the AES algorithm due to its simple description. Since then, other papers have shown that the attack as originally presented is unworkable; see XSL attack on block ciphers.

During the AES process, developers of competing algorithms wrote of Rijndael, “…we are concerned about [its] use…in security-critical applications.”[18] However, in October 2000 at the end of the AES selection process, Bruce Schneier, a developer of the competing algorithm Twofish, wrote that while he thought successful academic attacks on Rijndael would be developed someday, he does not “believe that anyone will ever discover an attack that will allow someone to read Rijndael traffic.”

On July 1, 2009, Bruce Schneier blogged about a related-key attack on the 192-bit and 256-bit versions of AES, discovered by Alex Biryukov and Dmitry Khovratovich, which exploits AES’s somewhat simple key schedule and has a complexity of 2119. In December 2009 it was improved to 299.5. This is a follow-up to an attack discovered earlier in 2009 by Alex Biryukov, Dmitry Khovratovich, and Ivica Nikolić, with a complexity of 296 for one out of every 235 keys. However, related-key attacks are not of concern in any properly designed cryptographic protocol, as properly designed software will not use related-keys.



In July 2010 Vincent Rijmen published an ironic paper on “chosen-key-relations-in-the-middle” attacks on AES-128.

The first key-recovery attacks on full AES were due to Andrey Bogdanov, Dmitry Khovratovich, and Christian Rechberger, and were published in 2011. The attack is a biclique attack and is faster than brute force by a factor of about four. It requires 2126.2 operations to recover an AES-128 key. For AES-192 and AES-256, 2190.2 and 2254.6 operations are needed, respectively. This result has been further improved to 2126.0 for AES-128, 2189.9 for AES-192 and 2254.3 for AES-256, which are the current best results in key recovery attack against AES.

This is a very small gain, as a 126-bit key (instead of 128-bits) would still take billions of years to brute force on current and foreseeable hardware. Also, the authors calculate the best attack using their technique on AES with a 128 bit key requires storing 288 bits of data (which later has been improved to 256 ). That works out to about 38 trillion terabytes of data, which is more than all the data stored on all the computers on the planet. As such this is a theoretical attack that has no practical implication on AES security.




Possible number of key combinations with respect to key size:

Time to crack Cryptographic Key versus Key size

As shown above, even with a supercomputer, it would take 1 billion billion years to crack the 128-bit AES key using brute force attack. This is more than the age of the universe (13.75 billion years). If one were to assume that a computing system existed that could recover a DES key in a second, it would still take that same machine approximately 149 trillion years to crack a 128-bit AES key.

There are more interesting examples. The following snippet is a snapshot of one the technical papers from Seagate titled “128-bit versus 256-bit AES encryption” to explain why 128-bit AES is sufficient to meet future needs.

  • Every person on the planet owns 10 computers.
  • There are 7 billion people on the planet.



What is the best encryption algorithm

It is AES with key 256 bit.

AES is a standard of using the Rijndael cipher, and is the most widely-accepted encryption algorithm. It is not necessarily the most secure mathematically. The only known attacks on it right now are side-channel attacks, but that’s the fault of the implementation or platform you are encrypting on.

The Rijndael cipher was chosen because it seems to be the most performant algorithm in a variety of different systems of all bit sizes tested, and it is also extraordinarily secure. If you have control over your systems, replacing government-standard DES encryption with AES will be a great step.

Other highly-secure ciphers are Twofish, Serpent and RC6.

The following ciphers are outdated and either deprecated in favor of a newer cipher, or are a travesty of computer science: DES, Triple DES, Blowfish, and MARS.

AES is largely considered impervious to all attacks, with the exception of brute force, which attempts to decipher messages using all possible combinations in the 128, 192, or 256-bit cipher. Still, security experts believe that AES will eventually be hailed the de facto standard for encrypting data in the private sector.