What is AES?

The Advanced Encryption Standard (AES) is a symmetric-key block cipher that encrypts and decrypts data in fixed 128-bit blocks using the same secret key on both ends. Adopted by NIST in 2001, it replaced DES as the U.S. federal encryption standard and is now the default cipher securing IPsec, TLS, and DTLS tunnels worldwide.

Key takeaways

• AES is a symmetric block cipher using the same key to encrypt and decrypt.
• Key sizes are 128, 192, or 256 bits; AES-256 offers the largest margin.
• CBC mode needs a separate hash; GCM combines encryption and integrity.
• AES has no known practical break; strength depends on key size and mode.
• Versa’s IKE, IPsec, TLS, and DTLS transforms all offer AES-based ciphers.

On this page: Why it matters · How it works · Types · AES & Versa · FAQ

Why is AES important?

AES is the encryption the modern internet runs on. It secures VPN tunnels, disk encryption, wireless networks, and nearly every TLS connection that isn’t using a niche cipher – because after two decades of public cryptanalysis it remains unbroken, and it runs fast enough, with hardware acceleration built into nearly every modern processor, to encrypt traffic at line rate.

That combination – proven security plus near-zero overhead – is why AES displaced the proprietary and short-key ciphers before it. It’s mandated or the default in government standards and virtually every VPN, wireless, and TLS specification written since the mid-2000s. Ask what encrypts data at rest or in transit, and the answer is usually AES.

What is AES?

AES is a symmetric-key block cipher: the same secret key encrypts and decrypts, and it processes data in fixed 128-bit blocks rather than as a continuous stream. Internally, it applies a fixed number of transformation rounds – substitution, permutation, mixing, and key-addition steps – derived from the Rijndael design that NIST selected through a public competition and standardized as FIPS 197 in 2001.

The key can be 128, 192, or 256 bits; longer keys add more rounds and a larger search space, at a small computational cost. Because AES only encrypts fixed-size blocks, a mode of operation determines how it handles longer messages and whether it also authenticates the data – the difference between “AES” as an algorithm and the transform a protocol like IPsec or TLS actually configures, such as AES-256-GCM.

Types of AES

Key size defines strength: AES-128 is the default for most deployments; AES-192 sees little real-world use; AES-256 adds margin for high-assurance environments, at a small performance cost.

Mode of operation defines how AES handles multi-block messages. CBC (Cipher Block Chaining) chains each block to the previous block’s ciphertext and requires a separate hash – typically SHA – for integrity, the classic IPsec and TLS pairing. GCM (Galois/Counter Mode) is an authenticated mode: it encrypts and computes an integrity tag in one pass, runs faster on AES-accelerated hardware, and has replaced CBC as the modern default for IPsec and TLS. CTR (Counter Mode) turns AES into a stream cipher and appears in some IPsec ESP transforms, again paired with a separate hash. Legacy ECB (Electronic Codebook) mode, which encrypts blocks independently, is insecure beyond a single block and should not appear in new configurations.

AES & Versa

Versa’s Secure Access Service configuration exposes AES directly wherever tunnel cryptography is set. The IKE Transform for a secure access server or SASE client profile pairs AES 128-bit or 256-bit encryption with a hash – MD5, SHA-1, SHA-256, SHA-384, or SHA-512 – for the key-exchange channel, effectively AES-CBC with a separate MAC. The IPsec (ESP) Transform offers the same AES-CBC pairings plus AES-GCM and AES-CTR modes for the data-plane tunnel that carries traffic.

AES also anchors the TLS and DTLS cipher suites offered for secure access portals and SASE client sessions – for example, TLS-ECDHE-RSA-WITH-AES-256-GCM-SHA384 pairs AES-256-GCM with ECDHE key exchange and SHA-384. These options are consistent across Secure SD-WAN, general secure access, and NGFW-fronted deployments; prefer AES-GCM over AES-CBC where the peer supports it, since GCM removes the separate hashing step and performs better on modern hardware.

Frequently asked questions

What is the difference between AES-128 and AES-256?

AES-128 uses a 128-bit key and 10 rounds; AES-256 uses a 256-bit key and 14 rounds. Both remain unbroken in practice – AES-128 is fast and sufficient for most deployments, while AES-256 adds a larger security margin for high-assurance use cases.

What is the difference between AES-CBC and AES-GCM?

AES-CBC encrypts data but needs a separate hash, like SHA, to verify integrity – two passes over the data. AES-GCM combines encryption and integrity verification in a single pass, making it faster on modern hardware and the preferred mode for new IPsec and TLS deployments.

Has AES ever been broken?

No practical attack breaks full AES at any key size. Theoretical attacks exist against reduced-round variants or flawed implementations, but the algorithm remains secure after two decades of public cryptanalysis – why it remains the default government and industry standard.

What is AES-NI?

AES-NI is a set of CPU instructions, present in nearly all modern processors, that perform AES encryption and decryption directly in hardware. It makes AES far faster than a software implementation, which is why AES-GCM can encrypt traffic at line rate without a noticeable performance cost.

Is AES symmetric or asymmetric encryption?

AES is symmetric: the same secret key encrypts and decrypts. That makes it fast, but both ends must already share the key. Protocols like IKE use asymmetric methods – Diffie-Hellman and certificates – to establish that shared key first, then switch to AES for the actual data.

More on AES

If you want to learn more, these are sources we trust.

Related terms

If you’re reading about AES, these are worth looking at next.