technologybriefs
8:43in productionCh. 1 · A mandate, not a suggestion/ 8:43 · ceiling 15 min
Security · Tech history

Advanced Encryption Standard

Joan Daemen and Vincent Rijmen · 1998

AES is not magic — it is a narrowly specified, government-mandated replacement for broken crypto, and its strength depends entirely on how you implement it.

AES is a narrow, standardised, symmetric cipher mandated by NIST in 2001. It works reliably only when implemented correctly. It solves no problems beyond confidentiality of bulk data under fixed parameters. It demands careful key handling and side-channel mitigation — which it does not provide.

SecurityTech historyCryptographyCybersecurityComputingCryptography across the network →
Chapters & takeaways4
  1. 1:00
    A mandate, not a suggestion

    AES is a US government standard issued in 2001, not an academic proposal or industry consortium effort.

  2. 2:36
    From Rijndael to AES

    Rijndael was co-designed by Daemen and Rijmen; AES is the specific 128-bit-block subset NIST chose from their broader family.

  3. 4:10
    No room for variation

    AES uses fixed 128-bit blocks and three rigid key sizes — no flexibility in block length, no hybrid modes built in.

  4. 5:14
    The end of DES, the start of scrutiny

    DES was obsolete by 1998; AES emerged from a five-year public contest that tested fifteen designs before selecting one.

Worth your time?

Yes. Study the whole thing.

4.5/ 5
What works
  • interoperability
  • resistance to mathematical cryptanalysis
  • standardisation across jurisdictions
What does not
  • solve key distribution
  • prevent side-channel leakage
  • provide authenticity or integrity
Study it if
  • system architects
  • government IT teams
  • developers implementing encryption libraries
Skip it if
  • application developers who assume 'AES' means 'secure'
  • policy makers who treat it as a silver bullet
  • auditors who ignore implementation context
The written brief1 min read

What it is and the problem it solves

AES is a specification for encrypting electronic data. It solves the problem of outdated, breakable encryption in government and commercial systems. It replaces DES, which was published in 1977 and had become insecure.

How it works

AES is a symmetric-key block cipher. It operates on fixed 128-bit blocks of data. It uses the same key for encryption and decryption. It supports three key lengths: 128, 192, or 256 bits. It is a variant of Rijndael selected by NIST from the Rijndael family.

What works

AES remains unbroken in practice when correctly implemented. Its design withstands known cryptanalytic attacks. It is interoperable across hardware and software. It is standardised in FIPS PUB 197 and ISO/IEC 18033-3.

What does not

AES does not solve key management. It does not prevent implementation flaws like timing or power-analysis leaks. It does not replace authentication or integrity checks. It does not encrypt metadata or protect against compromised endpoints.

What it changes

AES replaces DES as the US government’s mandated encryption standard. It establishes a single, interoperable, publicly vetted cipher for federal systems. It shifts cryptographic reliance from a 56-bit key vulnerable to brute force to keys up to 256 bits with no known practical breaks.

Is it worth your time

Yes — if you handle sensitive electronic data and need a standardised, government-validated encryption method. No — if you require asymmetric encryption, variable block sizes, or resistance to side-channel attacks without additional implementation safeguards.

Same field · Security4 of 27
10:52
Unmanned aerial vehicleUAVs are aircraft without onboard pilots. They solve access problems in hazardous or repetitive aerial tasks. Their mechanism relies on remote control or programmed autonomy, enabled by improved electronics and cheaper components. Military adoption was complete by the twenty-first century. Civilian use followed regulatory shifts: UAS terminology formalised in 2005; FAA civilian airspace permission came in 2006; DJI’s 2013 Phantom lowered the consumer barrier. But autonomy remains narrow: Ingenuity flew on Mars (2021–2024), yet no global standard governs lethal AI targeting—the Kargu 2’s 2020 Libya strike exposed that gap. Certification lags: EASA’s 2024 ETSO-C198 basis for Embention’s flight controller is the first of its kind. UAVs change who bears risk—and who decides when a machine may act.
9:20
Cloudflare2009Cloudflare is a reverse-proxy infrastructure service founded in 2009. It improves web performance and blocks DDoS attacks by sitting between users and origin servers. Its global network serves ~21.3% of websites as of January 2026. It uses physical entropy sources—including lava lamps in San Francisco—for cryptographic randomness. It had 162,086 paying customers in Q4 2022. It went public in 2019.
9:19
Military robotMilitary robots are mobile machines—autonomous or remote-controlled—used for transport, surveillance, search-and-rescue, and attack. They reduce human exposure but do not eliminate human responsibility. Full autonomy remains illegal. Their real impact lies in compressing decision cycles and testing the limits of existing law—not in replacing soldiers.
8:50
File Transfer ProtocolAbhay Bhushan · 1971FTP is a foundational but fatally flawed protocol. It delivered interoperable file transfer in 1971, but its reliance on unencrypted channels and rigid two-connection architecture made it unsustainable. It changed how machines shared data — then became the textbook example of inherited insecurity.
Up next in Technology

Chain drive

Hans Renold · 10:54

Chain drives don’t transmit motion—they transmit compromise: torque at the cost of rhythm.

Play nextBack to Security
10:54