Also known as: AES, Rijndael
The Advanced Encryption Standard (AES) is a symmetric block cipher, standardized by NIST as FIPS-197, that encrypts 128-bit blocks under a 128-, 192-, or 256-bit key.1 It was selected in 2000 from the Rijndael design of Joan Daemen and Vincent Rijmen, replacing the aging DES, and is now the dominant cipher for secure digital voice and data worldwide.
How it works
AES is a substitution-permutation network. The 128-bit state is arranged as a 4×4 matrix of bytes, and each round applies four steps:
- SubBytes — a fixed S-box substitutes each byte (nonlinear confusion), built from inversion in the finite field GF(2⁸);
- ShiftRows — cyclically shifts the matrix rows to spread bytes across columns;
- MixColumns — mixes the four bytes of each column by a fixed matrix multiply over GF(2⁸) (together with ShiftRows this provides diffusion);
- AddRoundKey — XORs in a round key derived from the cipher key.
The final round omits MixColumns.2 Decryption runs the inverse steps with the round keys in reverse order. As a symmetric cipher, the same key encrypts and decrypts, so a listener without the key cannot recover the plaintext.
Rounds and the key schedule
The round count scales with key length: 10 rounds for AES-128, 12 for AES-192, and 14 for AES-256. Each round needs its own 128-bit round key, and the key schedule expands the original key into that sequence. It processes the key in 4-byte words, and at word boundaries applies a rotation, the same S-box, and a round constant (Rcon) before XOR-chaining words together. This nonlinear, round-dependent expansion is what stops an attacker who recovers one round key from trivially rolling back to the master key.
Variants — modes of operation
A bare block cipher only transforms one 128-bit block, so real traffic uses AES inside a mode of operation that chains blocks and injects a nonce or initialization vector:
- CTR (counter) and OFB (output feedback) turn AES into a keystream generator: AES encrypts a running counter or feedback register, and the output is XORed with the data. This makes AES behave exactly like a stream cipher, which is ideal for a continuous voice bitstream because it needs no block-boundary padding and errors do not propagate.
- CBC chains each block into the next for bulk data at rest.
- Authenticated modes such as GCM add integrity on top of confidentiality.
P25 and DMR secure voice use the keystream-style modes (CTR/OFB) so a fixed-rate vocoder stream can be encrypted symbol-for-symbol.
In practice — side channels
AES is not broken mathematically; the best key-recovery attacks are only marginally faster than brute force and remain utterly infeasible. Real attacks target implementations instead. Naive lookup-table S-boxes leak key-dependent cache-timing information, so production code uses constant-time implementations or the hardware AES-NI instructions. Power-analysis and fault attacks threaten smart cards and radios physically, which is why secure handhelds store keys in tamper-resistant modules rather than in software.
Relevance to SDR
AES is the encryption a scanner most often runs into and cannot defeat. P25 systems carry AES-256 (often alongside legacy DES) for secure voice, and DMR equipment offers AES options; in both, AES runs in a keystream mode so it behaves like a stream cipher over the audio, re-seeded per transmission by a message indicator. GopherTrunk can detect, follow, and log these encrypted calls — it sees the talkgroup, source, and that the traffic is encrypted — but it cannot decode the voice without the key, which is the entire point of the standard. This is the honest boundary of the project: clear and scrambled traffic decode, keyed AES traffic does not.
Sources
-
Advanced Encryption Standard — Wikipedia, for the Rijndael origin, round structure, key sizes, key schedule, and modes. ↩
-
FIPS-197 (updated) — NIST, the primary standard defining SubBytes, ShiftRows, MixColumns, AddRoundKey, and the key expansion. ↩