AES Rijndael Cipher explained as a Flash animation

UPDATE:
The Flash app got rewritten in HTML5! Now it is interactive again, and you can click through it in your own pace:

Thumbs up!

And thank you Enrique Zabala for letting us know.

Original text below:
______________________

NOTE: I DID NOT CREATE THIS FLASH ANIMATION. I ONLY RECORDED THIS VIDEO, IN ORDER TO SAVE IT FOR THE POST-FLASH WORLD.

Many years ago I came across a clickable flash animation that explained how the Rijndael cipher works. And even though Rijndael is pure, complex math, the animated visualizations made the whole process so crystal clear that I had to bend down to the floor afterwards to pick up my dropped jaw.

Since then I know how powerful animated visualizations can be, even (or rather especially) for abstract and/or complex topics.

When I started my Go blog, I knew I had to use animations because they are worth a thousand words. I did the same in my Go videos that you can find over here in my channel, and also in my Go course.

NOTE: The video has no audio part. This is not a bug, the Flash animation simply had no sounds.

(c) Enrique Zabala. License terms: "Both these programs are free of use." (I guess that publishing a video of the animation is covered by these terms.)

[metalalive]

To me, this is by far the clearest explanation on AES algorithm described in very short time. I've been surfing on Google for few days reading a couple of articles, this video can beat most of those lengthy articles.

[thelasttimeitookashowerwas]

read this carefully:
1. we have a predefined matrix for AES which we use for every mix column operation:
02 03 01 01
01 02 03 01
01 01 02 03
03 01 01 02
this is predefined so you gotta remember it.


2. Take the predefined matrix and multiply it with the first word, followed by second, third and fourth word. But, this is not a standard multiplication here, it's something really different. The Galois multiplication of polynomial. Every position in the state matrix is a byte, meaning we have 8 bits in it.
Now we consider the Galois polynomial multiplication in 8.
Thus, we can't have any terms greater than x^7 coz 8 bits are represented as
x^7 + x^6 + x^5 + x^4 + x^3 + x^2 + x^1 + x^0
for any terms that is greater than 8, we reduce it by the Galois irreducible polynomial of 8 bits, that is x^8 + x^4 + x^3 + x^1 +1.


3. Now convert each byte in a word into polynomial form:
for d4 it is 1101 0100 =x^7 + x^6 + x^4 + x^2
multiply it with 02 coz 02 is the first element in the predefined matrix coz that's how you multiply in the normal matrix too...
02=0000 0010=x^1


4. 02*d4=x(x^7 + x^6 + x^4 + x^2)=x^8+x^7+x^5+x^3
Since this is greater than 8 bits we reduce it by the irreducible polynomial...
divide x^8+x^7+x^5+x^3 by x^8 + x^4 + x^3 + x^1 +1 and the remainder is your answer.


5. perform this for the rest 3 values. X-or all of them and the result is your answer for 1st position in the matrix.


6. Perform all these steps until you find the answer.


This is why it is infeasible to decipher anything encrypted with AES manually.

[andreyzice]

it's so crystal clear. I am so astonished as you were when you first saw the animation. So far it's the easiest way to understand and explain things I came across.

[eilis]

this is the best video on the internet. nothing compares to this.

[alizahmemon]

I'd been trying to understand the AES for months... until today. Thank you so much for sharing this animation!

[dpraajz]

My God. In such a short time, such an excellent illustration. Hats off!!!

[jordanjenkins]

Great complement to the written descriptions of AES! Helped me to catch a couple steps that I misunderstood.

[mehdiziazi]

This is the clearest explanation I've found and it turned out to be the shortest 😂

[quanquoctruong]

Holy carp that was a clean, concise and beautiful explanation

[hennadiichmuzh]

Key shedule. Notice, that first round constant (rcon) is (01 00 00 00), then it disappears from yellow table and appears in XOR

[dasnachtgespenst]

I'm not sure whether I'm understanding it correctly or not:
When using a 256 bit key, do I just have to turn each "4 positions earlier" into an "8 positions earlier" and apply the rules at 3:23 to each word that is a multiple of 8 instead of 4? Furthermoe there's obviously a gap between key length and block length, so is each round key basically a derivation of a half of the original key?

I would be happy and thankful if you could help me here. Im pretty confused and the original source "The Design of Rijndael" is incredibly hard to understand for me because of it's abstract nature. :(

[zeyuxie]

Really appreciate for this fantastic animation. 💗

[kinahhalim]

hi, is there any details explanation on how to do the mix column part.step by step
hit the comment button please

Thank you

[imranayari]

I now found the simplest answer to my question, I mean the best out of all my findings. Thanks

[amiteshabhay]

Very nice video. Helped a lot to understand the working of AES.

[NamTran-hbte]

This is the best explanation of AES ever. Thank you.

[robertboran]

This is a very clear explanation of AES Rijndael Cipher but my question is how do you build the S-Box and the RCon tables ? It is somehow random (by design ?) or it has some other algorithm ? Also how do you get the matrix for the Rijndael Galois field ? because my problem is that if you use the same S-Box and Rcon you create a complex pattern of diffusion that can give away information (leak) about the cipher. Also is it possible to add more rounds ? or make the number of rounds change after each plaintext block is processed ? This is great stuff. Very nice job explaining this.

[sarasaber]

that is great. but why is the state block's numbers different by plaintext's numbers before starting subByte step?

[harrypehkonen]

I'm getting the same values, except for the last Round key (10), instead of

d0 c9 e1 b6
14 ee 3f 63
f9 25 0c 0c
a8 89 c8 a6

... I'm getting ...

e6 54 e5 49
13 d6 82 fc
60 4e f1 a4
24 9d 40 ef

Sigh! Thanks for the awesome video! I'm getting closer! :D

[HevaTahir]

excuse me, what if my hexa was e only. is it stays as it is on the Sub Byte s table?