AES Encryption Basics: Modes, IVs and Safe Key Handling

What is AES?

The Advanced Encryption Standard (AES) is a widely used symmetric block cipher. Symmetric encryption uses the same secret key to encrypt and decrypt data. AES supports 128-, 192- and 256-bit keys.

Why the mode matters

AES is a block cipher and needs a mode of operation. AES-GCM provides authenticated encryption: it protects confidentiality and checks integrity. CBC and CTR provide confidentiality but do not by themselves authenticate ciphertext; they require a correctly designed authentication construction to resist tampering.

IVs and nonces

AES-GCM requires a unique nonce for each encryption under the same key. Reusing a nonce with the same key can catastrophically undermine security. The nonce is normally stored alongside the ciphertext; it is not a secret key. Follow the tool’s format and never manually reuse a nonce.

Safe handling checklist

For learning and testing, follow these principles.

1. Use a cryptographically secure random key or a strong password-based key derivation process.
2. Never hard-code secret keys into public source code.
3. Use authenticated encryption such as AES-GCM for new designs unless a reviewed protocol requires otherwise.
4. Store keys separately from ciphertext and restrict access.
5. Test decryption and tamper detection, and keep secure backups where appropriate.

Limitations of browser encryption

Browser-side encryption protects data only within the limits of the device, browser and key management. Malware, malicious extensions, weak passwords, insecure storage and accidental key disclosure can defeat it. Do not use a demonstration utility as the sole protection for sensitive production data.