<!-- Source: https://web3-lab.annaburd.me/how-cryptography-works/ -->

# How cryptography works

Build an intuitive understanding of key exchange, public-key encryption, digital signatures, block ciphers, and hash functions through interactive examples.

## Asymmetric cryptography

The major problem of symmetric cryptography is key distribution - sending private keys over public channels is unsafe, and meeting in person is obviously not convenient.

Public-key cryptography addresses this using mathematical trapdoor functions: operations that are easy to compute with a public key but infeasible to reverse without a corresponding private key. This allows secure key exchange, encryption, and digital signatures even when the public key is openly shared.

## Symmetric cryptography

Asymmetric cryptography is powerful, but it is comparatively expensive. Real systems usually use it first to exchange a secret or authenticate the parties, then move to symmetric encryption for the actual message data.

That second phase is where symmetric cryptography takes over. Once both sides share the same secret key, they can encrypt large amounts of data much faster than with public-key operations.

Algebraic structures

### Groups

Before finite fields show up in cryptography, the older story starts with polynomial equations. A polynomial like $x^2 - 5x + 6 = 0$ has roots, in this case $2$ and $3$. For quadratics there is a formula for the roots. For cubics and quartics there are formulas too. But for fifth-degree equations, mathematicians kept running into a wall.

Galois looked at the problem from a strange and brilliant angle: instead of trying to stare harder at the roots themselves, ask which ways you can rearrange the roots while preserving all the algebraic relationships between them. Those rearrangements are symmetries of the equation.

That is the important bridge. A symmetry is not just a visual idea; it can be an action. Rotate a square and it still fits itself. Swap certain roots of an equation and the hidden arithmetic still fits. When these actions can be combined, undone, and kept inside the same collection, they form a group.

Group definition

Definition: If $S$ is a set, $\ast$ is a binary operation on $S$, and $e\in S$, then $G=(S,e,\ast)$ is called a group if:

1. $$
   \forall a,b\in S,\ \exists c\in S\text{ such that }a\ast b=c
   $$
   
   Closure. The operation $\ast$ takes elements of the group as inputs and returns another element of the group. It does not produce something outside the set.
2. $$
   (a\ast b)\ast c = a\ast(b\ast c),\quad \forall a,b,c\in S
   $$
   
   Associativity. Parentheses do not change the result. If three elements are combined in the same order, it does not matter which pair is combined first.
3. $$
   a\ast e = a = e\ast a,\quad \forall a\in S
   $$
   
   Identity. Combining any element with $e$ returns the same element, from either side. Such an $e$ is called the identity element or neutral element. For ordinary multiplication, $1$ is the identity because $a\cdot1=a=1\cdot a$.
4. $$
   \begin{aligned}&\forall a\in S,\ \exists a^{-1}\in S\text{ such that}\\ &\quad a\ast a^{-1}=e=a^{-1}\ast a\end{aligned}
   $$
   
   Inverse. Every element has another element that undoes it. Combining an element with its inverse returns the identity $e$, from either side.
5. $$
   a\ast b=b\ast a,\quad \forall a,b\in S
   $$
   
   Commutative (opt). A group is commutative, also named abelian, if changing the order of two elements does not change the result. This is an extra property: not every group has it.

Group examples

Imagine a square on a plane. You can turn it, flip it, or leave it alone, and after each move it still fits exactly back into the same square-shaped place.

Together these eight motions form $D_4$, the symmetry group of a square: four rotations, four flips, and a rule for combining any two moves. Use the buttons to build a sequence, watch the marked square move, and read the table as the record of what happens when one motion follows another.

| apply / state | R0 | R90 | R180 | R270 | H | V | D | D' |
| --- | --- | --- | --- | --- | --- | --- | --- | --- |
| R0 | R0 | R90 | R180 | R270 | H | V | D | D' |
| R90 | R90 | R180 | R270 | R0 | D' | D | H | V |
| R180 | R180 | R270 | R0 | R90 | V | H | D' | D |
| R270 | R270 | R0 | R90 | R180 | D | D' | V | H |
| H | H | D | V | D' | R0 | R180 | R90 | R270 |
| V | V | D' | H | D | R180 | R0 | R270 | R90 |
| D | D | V | D' | H | R270 | R90 | R0 | R180 |
| D' | D' | H | D | V | R90 | R270 | R180 | R0 |

Motions

Sequence

No motions applied yet.

Net effect R0

Now consider the whole integer line. Start on an integer, add another integer, and the result is still somewhere on that same line. This group is $(\mathbb{Z}, +)$: the set of all integers with addition as the operation. The identity element is 0, because adding 0 leaves every integer unchanged.

Integer line

-100-99-98-97-96-95-94-93-92-91-90-89-88-87-86-85-84-83-82-81-80-79-78-77-76-75-74-73-72-71-70-69-68-67-66-65-64-63-62-61-60-59-58-57-56-55-54-53-52-51-50-49-48-47-46-45-44-43-42-41-40-39-38-37-36-35-34-33-32-31-30-29-28-27-26-25-24-23-22-21-20-19-18-17-16-15-14-13-12-11-10-9-8-7-6-5-4-3-2-10123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100

Motions

Sequence

No additions yet.

Current integer 0

Now take the same addition idea and bend it into a 12-hour clock. This circular group is $(\mathbb{Z}_{12}, +)$: adding hours wraps around after 11 and lands back on 0, so the result always stays inside the same twelve positions. The identity element is 0, because adding 0 does not move the marker.

Clock 12

Motions

Sequence

No clock moves yet.

Clock position 0 modulo 12

Permutation groups (shuffling)

Take three objects: A B C. There are six possible rearrangements. Together they form $S_3$, the permutation group on three objects.

The operation is simple: do one shuffle after another. The result is still one of the six rearrangements, every shuffle can be undone, and ABC acts as the identity shuffle. This is the same kind of group Galois studied when he rearranged roots of equations.

| shuffle / state | ABC | ACB | BAC | BCA | CAB | CBA |
| --- | --- | --- | --- | --- | --- | --- |
| ABC | ABC | ACB | BAC | BCA | CAB | CBA |
| ACB | ACB | ABC | BCA | BAC | CBA | CAB |
| BAC | BAC | CAB | ABC | CBA | ACB | BCA |
| BCA | BCA | CBA | ACB | CAB | ABC | BAC |
| CAB | CAB | BAC | CBA | ABC | BCA | ACB |
| CBA | CBA | BCA | CAB | ACB | BAC | ABC |

Shuffles

Sequence

No shuffles yet.

Algebraic structures

### Rings

Groups gave us one operation at a time. A ring introduces a second operation, allowing the same set to support both addition and multiplication in a compatible way.

The integers are the prototype. You can add integers, subtract them, and multiply them, and every result stays inside the integers. Addition behaves symmetrically and reversibly, while multiplication interacts with addition through the distributive laws:

$$
a(b+c)=ab+ac
$$

This combination of two interacting operations is the central idea behind rings.

Historically, rings grew out of attempts to generalize ordinary arithmetic to more complicated settings: polynomial expressions, modular arithmetic, algebraic integers, and eventually finite fields used in modern cryptography.

A ring keeps enough arithmetic structure to talk about equations, divisibility, and factorization, but unlike a field, division is not always possible.

Ring definition

Definition: If $R$ is a non-empty set, $+$ is a binary operation on $R$, and $\cdot$ is a binary operation on $R$, then $(R,+,\cdot)$ is called a ring if:

1. $$
   \begin{aligned}{}+ &: R\times R\to R,\quad (a,b)\mapsto a+b\\ \cdot &: R\times R\to R,\quad (a,b)\mapsto a\cdot b\end{aligned}
   $$
   
   Binary operations. Addition and multiplication each take two elements of $R$ and return an element of $R$.
2. $$
   a+(b+c)=(a+b)+c,\quad \forall a,b,c\in R
   $$
   
   Additive associativity. Parentheses do not change a sum of three elements.
3. $$
   \begin{aligned}&\exists 0\in R\text{ such that}\\ &\quad a+0=a=0+a,\quad \forall a\in R\end{aligned}
   $$
   
   Additive identity. Adding $0$ leaves every element unchanged, from either side.
4. $$
   \begin{aligned}&\forall a\in R,\ \exists\,{-a}\in R\text{ such that}\\ &\quad a+(-a)=0=(-a)+a\end{aligned}
   $$
   
   Additive inverse. Every element has an additive inverse that returns the additive identity $0$ from either side.
5. $$
   a+b=b+a,\quad \forall a,b\in R
   $$
   
   Additive commutativity. Addition ignores order. Together, the previous four addition rules say that $(R,+)$ is an abelian group.
6. $$
   a\cdot(b\cdot c)=(a\cdot b)\cdot c,\quad \forall a,b,c\in R
   $$
   
   Multiplicative associativity. Parentheses do not change a product of three elements.
7. $$
   \begin{aligned}a\cdot(b+c)&=a\cdot b+a\cdot c\\ (a+b)\cdot c&=a\cdot c+b\cdot c,\quad \forall a,b,c\in R\end{aligned}
   $$
   
   Distributivity. Multiplication is compatible with addition from both the left and the right.

This convention does not require a multiplicative identity or commutative multiplication. Those extra properties are named separately as a ring with identity or a commutative ring.

Ring examples

Now consider the whole integer line again. Start on an integer, add another integer, subtract another integer, or multiply by another integer, and the result is still somewhere on that same line. This ring is $(\mathbb{Z}, +, \cdot)$: the set of all integers with addition and multiplication as the operations. The additive identity is 0, because adding 0 leaves every integer unchanged. We start this example at 2.

Division is different. Dividing one integer by another does not necessarily land back on an integer: $3 \div 2 = 1.5$, which is outside $\mathbb{Z}$. That is why the integers form a ring, but not a field.

Integer line

-100-99-98-97-96-95-94-93-92-91-90-89-88-87-86-85-84-83-82-81-80-79-78-77-76-75-74-73-72-71-70-69-68-67-66-65-64-63-62-61-60-59-58-57-56-55-54-53-52-51-50-49-48-47-46-45-44-43-42-41-40-39-38-37-36-35-34-33-32-31-30-29-28-27-26-25-24-23-22-21-20-19-18-17-16-15-14-13-12-11-10-9-8-7-6-5-4-3-2-10123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100

Operations

Sequence

No ring operations yet.

Current integer 2 in $\mathbb{Z}$

Now take the same ring idea and bend it into a 12-hour clock. This ring is $(\mathbb{Z}_{12}, +, \cdot)$: the twelve clock positions with addition and multiplication performed modulo 12. Add, subtract, or multiply, and the result always wraps back into one of the same twelve positions.

Clock 12

Operations

Sequence

No clock ring operations yet.

Clock position 5 modulo 12

Now narrow the integer line to only the even integers. This set is $2\mathbb{Z}$: all integer multiples of 2. Adding, subtracting, or multiplying two even integers always produces another even integer, so the arithmetic stays inside the same set.

The odd positions are not shown below because they are not part of $2\mathbb{Z}$. Since $1$ is not an even integer, $2\mathbb{Z}$ has no multiplicative identity. Some definitions of rings require a ring to have one, and some allow rings without one.

Even integers line

-100-98-96-94-92-90-88-86-84-82-80-78-76-74-72-70-68-66-64-62-60-58-56-54-52-50-48-46-44-42-40-38-36-34-32-30-28-26-24-22-20-18-16-14-12-10-8-6-4-202468101214161820222426283032343638404244464850525456586062646668707274767880828486889092949698100

Operations

Sequence

No even-integer operations yet.

Current even integer 4 in $2\mathbb{Z}$

A polynomial ring extends a familiar number system by introducing a formal variable while keeping all coefficient arithmetic inside the original ring. In $\mathbb{Z}[x]$, every polynomial has integer coefficients, so adding or multiplying polynomials simply combines integers and still produces another polynomial in the same ring.

The variable $x$ acts as a symbolic placeholder rather than a specific number. The structure comes from the coefficients and the rules for combining powers of $x$.

A(x)$x^2-3x+2$

B(x)$2x+1$

Result$\left(x^2-3x+2\right)\cdot\left(2x+1\right)=2x^3-5x^2+x+2$

Polynomials

A(x)B(x)

Operation

Algebraic structures

### Fields

A field is a ring where division works for every non-zero element. You can add, subtract, multiply, and divide without leaving the same set, as long as you never divide by $0$.

That extra reversibility is the key difference from rings like $\mathbb{Z}$. In the integers, $3 \div 2$ leaves the set. In a field, every non-zero element has a multiplicative inverse inside the set, so division can be rewritten as multiplication by that inverse.

Field definition

Definition: If $F$ is a non-empty set, $+$ is a binary operation on $F$, and $\cdot$ is a binary operation on $F$, then $(F,+,\cdot)$ is called a field if:

1. $$
   (F,+,\cdot)\text{ is a commutative ring}
   $$
   
   Ring structure. All ring axioms hold, and multiplication is commutative: $a\cdot b=b\cdot a$ for all $a,b\in F$.
2. $$
   \begin{aligned}&\exists 1_F\in F\text{ with }1_F\neq0\text{ such that}\\ &\quad 1_F\cdot a=a=a\cdot1_F,\quad \forall a\in F\end{aligned}
   $$
   
   Multiplicative identity. The element $1_F$ leaves every element unchanged under multiplication, from either side, and it is different from $0$.
3. $$
   \begin{aligned}&\forall a\in F,\ a\neq0\Rightarrow\exists a^{-1}\in F\text{ such that}\\ &\quad a\cdot a^{-1}=1_F=a^{-1}\cdot a\end{aligned}
   $$
   
   Multiplicative inverse. Every non-zero element has an inverse inside $F$. This is the rule that makes division possible inside the field.

Equivalently, the addition part $(F,+)$ is an abelian group, the non-zero elements of $F$ form an abelian group under multiplication, and multiplication distributes over addition.

Field properties

1. Uniqueness of inverse. If $a\in F$ and $a\neq0$, then the inverse $a^{-1}$ is unique.

$$
\text{Suppose } b,c\in F \text{ are both inverses of } a.
$$

$$
a\cdot b=1_F=b\cdot a \quad \text{and} \quad a\cdot c=1_F=c\cdot a
$$

$$
\begin{aligned}b&=b\cdot1_F\\ &=b\cdot(a\cdot c)\\ &=(b\cdot a)\cdot c\\ &=1_F\cdot c\\ &=c\end{aligned}
$$

So the two supposed inverses are equal. Therefore there cannot be two different inverses of $a$; the inverse is unique.

2. Multiplication by zero. If $a\in F$, then $a\cdot0=0$.

$$
a\cdot0=a\cdot(0+0)=a\cdot0+a\cdot0
$$

$$
\text{Cancel }a\cdot0\text{ from both sides, so }a\cdot0=0.
$$

3. No zero divisors. If $a,b\in F$ and $a\cdot b=0$, then $a=0$ or $b=0$.

Now suppose $a\cdot b=0$. If $a=0$, we are done. If $a\neq0$, then:

$$
\begin{aligned}b&=1_F\cdot b\\ &=(a^{-1}\cdot a)\cdot b\\ &=a^{-1}\cdot(a\cdot b)\\ &=a^{-1}\cdot0\\ &=0\end{aligned}
$$

Therefore a product in a field can be $0$ only when at least one of its factors is $0$.

4. Distinctiveness of sums and products. If $a,b,c\in F$ and $b\neq c$, then adding the same element keeps the results distinct:

$$
a+b\neq a+c
$$

Suppose instead that $a+b=a+c$. Add $-a$ to both sides:

$$
\begin{aligned}(-a)+(a+b)&=(-a)+(a+c)\\ ((-a)+a)+b&=((-a)+a)+c\\ 0+b&=0+c\\ b&=c\end{aligned}
$$

This contradicts $b\neq c$. So $a+b$ and $a+c$ are distinct.

For products, if $a\neq0$ and $b\neq c$, then:

$$
a\cdot b\neq a\cdot c
$$

Suppose instead that $a\cdot b=a\cdot c$. Multiply both sides by $a^{-1}$:

$$
\begin{aligned}a^{-1}\cdot(a\cdot b)&=a^{-1}\cdot(a\cdot c)\\ (a^{-1}\cdot a)\cdot b&=(a^{-1}\cdot a)\cdot c\\ 1_F\cdot b&=1_F\cdot c\\ b&=c\end{aligned}
$$

Again this contradicts $b\neq c$. So multiplying by a non-zero element also preserves distinctness.

Field examples

The rational numbers $\mathbb{Q}$ are all fractions $\frac{p}{q}$ where $p,q\in\mathbb{Z}$ and $q\neq0$. This field is $(\mathbb{Q},+,\cdot)$: adding, subtracting, multiplying, and dividing by a non-zero rational number all stay inside $\mathbb{Q}$.

$$
\left(\frac{3}{4}\right)\div\left(-\frac{5}{6}\right)=-\frac{9}{10}
$$

Rational numbers

A numerator

A denominator

B numerator

B denominator

Operation

The real numbers $\mathbb{R}$ fill the continuous number line. They include rational numbers, numbers like $\sqrt{2}$ and $\pi$, and every decimal point location between them. This field is $(\mathbb{R},+,\cdot)$: adding, subtracting, multiplying, and dividing by a non-zero real number all stay inside $\mathbb{R}$.

$$
\left(1.8\right)\div\left(-4.5\right)=-0.4
$$

Real numbers

Operation

In cryptography, we often work inside finite arithmetic systems instead of the infinite number line. The goal is to keep every operation inside a fixed set while preserving the behavior of addition, multiplication, and division by non-zero elements.

A finite field is simply a field with finitely many elements. It is also called a Galois field, written $\mathrm{GF}(q)$, after [Evariste Galois](https://www.britannica.com/biography/Evariste-Galois), a remarkably influential mathematician who helped lay the foundations of modern algebra before dying at just 20 years old.

$\mathrm{GF}(2)$ is the smallest finite field. It has 2 elements $\{0,1\}$ and arithmetic is performed modulo $2$.

| a + b (mod 2) | 0 | 1 |
| --- | --- | --- |
| 0 | 0 | 1 |
| 1 | 1 | 0 |

| a x b (mod 2) | 0 | 1 |
| --- | --- | --- |
| 0 | 0 | 0 |
| 1 | 0 | 1 |

$\mathrm{GF}(3)$ is a finite field. It has 3 elements $\{0,1,2\}$ and arithmetic is performed modulo $3$.

| a + b (mod 3) | 0 | 1 | 2 |
| --- | --- | --- | --- |
| 0 | 0 | 1 | 2 |
| 1 | 1 | 2 | 0 |
| 2 | 2 | 0 | 1 |

| a x b (mod 3) | 0 | 1 | 2 |
| --- | --- | --- | --- |
| 0 | 0 | 0 | 0 |
| 1 | 0 | 1 | 2 |
| 2 | 0 | 2 | 1 |

$\mathrm{GF}(4)$ cannot be built as four-step clock arithmetic on $0,1,a,b$; watch where the field rules break.

| x + y (mod 4) | 0 | 1 | a | b |
| --- | --- | --- | --- | --- |
| 0 | - | - | - | - |
| 1 | - | - | - | - |
| a | - | - | - | - |
| b | - | - | - | - |

| x * y (mod 4) | 0 | 1 | a | b |
| --- | --- | --- | --- | --- |
| 0 | - | - | - | - |
| 1 | - | - | - | - |
| a | - | - | - | - |
| b | - | - | - | - |

## Conditions to construct a finite field

$$
\mathbb{Z}_n\text{ is a field}\Longleftrightarrow n\text{ is prime}
$$

The integers modulo $n$, $\mathbb{Z}_n=\{0,1,2,\ldots,n-1\}$, form a field if and only if $n$ is prime.We prove the equivalence in two directions.

### If $n$ is prime

Take any non-zero element $a\in\mathbb{Z}_n,\ a\neq0$.

$a\in\mathbb{Z}_n,\quad a\neq0$$\gcd(a,n)=1\quad\text{since }n\text{ is prime}$

$ax+ny=1,\quad x,y\in\mathbb{Z}$from [Bézout's identity](https://web3-lab.annaburd.me/math-behind-key-pairs/#bezout-identity) since $\gcd(a,n)=1$

$ny\equiv0\pmod n$$ax\equiv1\pmod n$

Thus $x$ is a multiplicative inverse of $a$. Every non-zero element has an inverse.

$$
\therefore\ \mathbb{Z}_n\text{ is a field}
$$

### If $n$ is composite

Suppose $n$ is composite, so $n=ab$ with $1<a,b<n$. View $a$ and $b$ as residues in $\mathbb{Z}_n$.

$n = ab$$1 < a < n,\qquad 1 < b < n$$a \not\equiv 0 \pmod n,\qquad b \not\equiv 0 \pmod n$$ab = n \equiv 0 \pmod n$

$a \neq 0,\qquad b \neq 0,\qquad a\cdot b = 0$zero divisors

The elements $a$ and $b$ are zero divisors. That means both are non-zero in $\mathbb{Z}_n$, but their product is zero. A field cannot have this happen because every non-zero element must have an inverse. If $a\cdot b=0$ and $a^{-1}$ existed, multiplying by $a^{-1}$ would force $b=0$.

$$
\therefore\ \mathbb{Z}_n\text{ is not a field}
$$

More generally, a finite field can contain only a prime-power number of elements. Every finite field has size $p^m$ for some prime $p$ and positive integer $m$. Conversely, a finite field exists for every such size.

The fields constructed using integers modulo a prime correspond to the simplest case $m=1$. These are called prime fields. When $m>1$, the construction is no longer just arithmetic modulo $p^m$. The system $\mathbb{Z}_{p^m}=\{0,1,\ldots,p^m-1\}$ contains zero divisors, so it cannot be a field. Indeed, $p\cdot p^{m-1}=p^m\equiv0\pmod{p^m}$ even though both factors are non-zero modulo $p^m$. Therefore finite fields of size $p^m$ for $m>1$ must be constructed in a different way.

$$
\mathrm{GF}(p^m),\quad p\text{ prime},\ m\in\mathbb{Z}_{\ge1}
$$

m=1m>1

### Calculation in prime fields

Elements are the integers $0, 1, \ldots, p-1$.

Add, subtract, and multiply as usual — then reduce modulo $p$.

Division is multiplication by the modular inverse: $a \div b = a \cdot b^{-1} \pmod{p}$, found via the [Extended Euclidean Algorithm](https://web3-lab.annaburd.me/math-behind-key-pairs/#modular-inverse-calculation).

Base prime p

Modulus space (mod 7)

Integers space

$$
3 + 4 = 7 \equiv 0 \pmod{7}
$$

A Feistel network is a block-cipher structure: it encrypts one fixed size block at a time under a shared secret key. DES is the classic Feistel-based block cipher, and the same idea also appears in designs such as Blowfish and Twofish.

Each round applies a simple reversible pattern: one half is modified using a keyed function and XOR, while the other half is just passed through and then the two halves are swapped. Even though the round function itself is not invertible, the use of XOR (which can be undone by applying the same value again) and the swap ensures that every step can be reversed in the opposite order, making the entire construction invertible.

K1=0x4K2=0xBK3=0x3K4=0x9

byte 1 0x4Bbyte 2 0x39

Message

byte 1 0x43

Start with L0=0100 and R0=0011. The block is already split into left and right halves.

Rule: Li = R(i-1) and Ri = L(i-1) XOR F(R(i-1), Ki)

A substitution-permutation network (SPN) keeps the whole block together instead of splitting it in half. Each round applies three operations in order: XOR with a round key (key mixing), substitution through S-boxes (nonlinear confusion), and bit routing through a P-box (diffusion). AES is the most widely deployed SPN cipher.

Confusion makes the key's effect hard to trace from the ciphertext. Diffusion spreads each plaintext bit's influence across many output bits, so a small input change becomes hard to isolate after a few rounds.

Decryption runs the same rounds in reverse. The lookup tables in inverse order and a second XOR with the same key undo the changes.

byte 1 0x4D

Message

byte 1 0xB2

S-box

0000

0001

0010

0011

0100

0101

0110

0111

1000

1001

1010

1011

1100

1101

1110

1111

P-box

The cipher operates on fixed-size blocks (8 bits here). The left nibble is 1011, the right is 0010. Flip any bit above to trace its effect through every stage.

Message = 10110010 (0xB2)

The Advanced Encryption Standard (AES) stands apart from most ciphers in one important way: it was chosen through an open, public competition. In 1997 NIST invited the global cryptographic community to submit candidates for a new federal standard to replace the aging DES. After five years of public evaluation, analysis, and benchmarking, the algorithm [Rijndael](https://en.wikipedia.org/wiki/Advanced_Encryption_Standard)— designed by Belgian cryptographers [Joan Daemen](https://en.wikipedia.org/wiki/Joan_Daemen) and [Vincent Rijmen](https://en.wikipedia.org/wiki/Vincent_Rijmen) — was standardized as AES in 2001. The open process means the cipher has been scrutinized by hundreds of independent researchers, which is a large part of why it is trusted everywhere today.

Like the substitution-permutation network we explored earlier, AES is built from the same core idea: alternate rounds of key mixing, nonlinear substitution, and diffusion. But where our toy SPN operated on a single 8-bit byte with a hand-crafted 16-entry S-box, AES works on a 128-bit block (arranged as a 4×4 matrix of bytes) and derives all of its substitution and mixing values from the mathematics of $\mathrm{GF}(2^8)$ — the finite field of 256 elements. Every byte substitution is a field inversion followed by an affine transform, and the mixing step multiplies columns of the state matrix by fixed polynomials over that same field. The result is a cipher whose security properties do not come from an arbitrary black-box lookup table, but from a deliberate algebraic structure.

128 bits

2B7E151628AED2A6ABF7158809CF4F3C

Message

128 bits

00010203040506070809101112131415

A block cipher encrypts one fixed size block at a time, e.g. 128 bits for AES. A mode of operation defines how the cipher is applied to data of arbitrary length. Different modes make different trade offs: some support parallel processing, some provide authentication, and some require random IVs or nonces to hide repeating patterns.

**Electronic Codebook (ECB)** splits the message into fixed-size blocks and encrypts each block independently with the same key. Conceptually, each ciphertext block is C_i = E_K(P_i).

Same input block - same ciphertext block:

empty bg

->

8f31

edge

->

b674

empty bg

->

8f31

The weakness is that ECB hides each block's contents, but it does not hide when two plaintext blocks are equal. Equal plaintext blocks become equal ciphertext blocks. In image-like data, this means repeated regions can still draw a recognizable outline after encryption. The colors change, but the structure remains visible.

##### Original

##### ECB output

**Cipher Block Chaining (CBC)** mixes each plaintext block with the previous ciphertext block before encryption. The first block uses an initialization vector, or IV, as the previous value. Conceptually, C_i = E_K(P_i xor C_(i-1)), with C_0 = IV.

Same input block + different previous block - different ciphertext block:

empty bg

a91c

->->

->

34a9

edge

34a9

->->

->

e812

empty bg

e812

->->

->

6bc0

empty bg

edge

empty bg

a91c

->

34a9

->

e812

->

6bc0

CBC hides the repeated-block pattern that ECB leaks, but encryption is chained: each block needs the previous ciphertext block first. That makes encryption harder to parallelize. For live data such as streaming video, the chain can add latency and makes independent chunk processing less convenient.

##### Original

##### CBC output

**Counter Mode (CTR)** turns a block cipher into a stream of key material. A nonce is a value used once with a given key. It does not need to be secret, but it must not repeat for that key. CTR combines the nonce with a block counter, encrypts that input, then XORs the encrypted output with the plaintext block. Conceptually, C_i = P_i xor E_K(nonce || i).

Each counter block can be produced independently:

empty bg

nonce

counter 0

->

keystream 1

7ac9

->->

c5f1

edge

nonce

counter 1

->

keystream 2

91de

->->

36a4

empty bg

nonce

counter 2

->

keystream 3

d02b

->->

4e87

CTR output looks patternless when every nonce and counter input is unique, but it is fragile if that uniqueness rule is broken. Reusing the same nonce with the same key repeats the keystream, so comparing ciphertexts can reveal relationships between the original plaintexts. CTR also does not authenticate data: changing a ciphertext bit predictably changes the decrypted plaintext bit.

##### Original

##### CTR output

**Galois/Counter Mode (GCM)** uses counter-mode encryption for confidentiality and adds an authentication tag. The tag covers the ciphertext and optional associated data, or AAD: data that should be authenticated but not encrypted, such as a packet header. A receiver should accept the plaintext only if the tag verifies.

GCM produces ciphertext blocks like CTR, then feeds the ciphertext and AAD into GHASH. GHASH is a fast finite-field hashing step that compresses those values into an authentication value, which becomes part of the final tag:

empty bg

nonce

counter 0

->

keystream 1

a441

->->

59e0

edge

nonce

counter 1

->

keystream 2

2cb7

->->

8d3c

C1, C2, AAD

data to authenticate

->

GHASH

->

auth check

GCM gives both privacy and tamper detection, but the nonce rule is strict. Reusing a nonce with the same key can break confidentiality and can also weaken the authentication tag. GCM is also only useful if the receiver verifies the tag before trusting or using the decrypted plaintext.

AES-GCM is one of the most widely used forms of authenticated encryption in modern protocols.

##### Original

##### GCM output

## Cryptographic hash functions

A cryptographic hash function turns any input into a fixed-length fingerprint. The output is deterministic, fast to compute, and changes completely when the input changes, making hashes ideal for integrity checks.

Hashes are one-way. Given only a hash, it should be infeasible to recover the original input or find another input that produces the same digest. Hashes provide tamper evidence, not secrecy.

See how hashes secure blockchains in the main demo: tweak a block and the downstream hashes break. [Go to the Blockchain Hashing demo](https://web3-lab.annaburd.me/#sha256-hash).