AES is open and, after twenty years, unbroken. So why do Russia, China and other powers build their own ciphers instead of just adopting it?
The full specification of AES is published and available to anyone: it’s written down in an open standard, built into every browser and phone, and explained in textbooks. People have been trying to break it in public for more than twenty years — without success. You’d think it would be the one shared standard for everyone. But no: Russia adopted its own cipher — Kuznyechik, China adopted SM4, and other countries have their own standards too.
If the algorithm is open and in twenty years no one has found a single practical flaw in it, what drives entire states to spend years building their own cipher instead of using the ready-made one? Maybe the "transparency" of AES isn’t so complete after all?
First let’s see why there’s almost nothing to criticize in the math of AES — and then come back to why that doesn’t convince everyone. AES is a substitution-permutation network (SP-network): instead of splitting the block in half like a Feistel network, it keeps the block in a matrix of bytes and transforms the whole thing each round with four layers of operations. So every operation has to be reversible.
The data block is laid out across the cells of a square matrix. In real AES that’s a 4×4 matrix of 16 bytes (128 bits); in the Ludus Lab game it’s a 2×2 matrix of four nibbles (16 bits). Every later step works on the rows and columns of this matrix.
Each byte is replaced by another according to a fixed table — the S-box. This is "confusion": the single non-linear operation in AES. Without it, the whole cipher would collapse into a system of linear equations and could be solved directly.
The rows of the matrix are cyclically shifted, and the columns are mixed together. This is "diffusion": within a couple of rounds, one changed input bit spreads across the whole block. Both operations are linear and reversible.
The state is XORed with this round’s key. The round keys are derived in advance from the shared key by a separate procedure — the key schedule. This is exactly the step you can’t undo without knowing the key.
The layers repeat many times: 10, 12 or 14 rounds depending on the key length. The last round has no MixColumns — it would add nothing to the strength. To decrypt, Bob runs the inverse operations in reverse order — but only if he knows the key.
Every step is reversible — but together they entangle the block with the key so thoroughly that you can’t run it backwards without the key.
The very notions of confusion and diffusion were introduced by Claude Shannon back in 1949: he proposed building a strong cipher from simple substitutions and permutations repeated many times. An early version of IBM’s Lucifer cipher in the early 1970s followed this recipe; the later Lucifer became a Feistel network and turned into DES, while AES went back to the original idea.
AES was chosen with unprecedented openness: from 1997 to 2000 the US standards institute (NIST) ran an international competition — 15 ciphers from around the world and three years of public analysis, with anyone free to hunt for weaknesses. The winner was Rijndael, by the Belgians Joan Daemen and Vincent Rijmen, and in 2001 it became the standard. That’s an honest process and a genuine strength of AES. And yet the openness of the algorithm is not the same as trusting whoever chose it and whoever holds the standard in their hands.
The distrust has roots in history. The NSA once secretly altered the S-boxes of the DES cipher — it later turned out to be for defense against an attack, but twenty years of secrecy bred suspicion. And in 2013 the Dual_EC_DRBG affair surfaced — a NIST-standard random number generator into which the NSA had, it appears, built a backdoor. Nothing of the kind has been found in AES itself — and in fact its S-box is built from an open algebraic rule, not from "magic" numbers. But for a state, "probably clean" is not a strong enough basis on which to entrust a cipher with its secrets.
Hence cryptographic sovereignty: your own cipher, your own regulator, audits by your own experts, and independence from a foreign standard. This doesn’t necessarily mean AES has a backdoor — it means national security isn’t built on trust in a foreign agency.
The de facto world standard of the civilian internet: it encrypts almost all web traffic, Wi-Fi and disks. The regulator is the American NIST.
Open, but under foreign control
The Russian standard GOST R 34.12-2015 — also an SP-network like AES: a 128-bit block, a 256-bit key, 9 rounds plus a final key addition. The regulator is the FSB (TC 26).
Own cipher, own regulator
China’s national cipher (standard GB/T 32907): a 128-bit block and key, 32 rounds. It’s mandatory for many uses inside the country, such as Chinese Wi-Fi (WAPI).
China’s cryptographic sovereignty
And that’s not all: almost every major power has its own block cipher, and what they share is the SP-network scheme itself, on which most modern algorithms are built:
The Ludus Lab interactive demo runs the same operations as the real AES, but on a tiny 16-bit block (a 2×2 matrix, 2 rounds) — so that every step is visible in full. You can:
Both ciphers are substitution-permutation networks, but with different histories and different parameters:
| Parameter | AES | Kuznyechik (GOST R 34.12-2015) |
|---|---|---|
| Country of origin | Belgium / USA (standard) | Russia |
| Year adopted | 2001 | 2015 |
| Architecture | SP-network | SP-network |
| Block size | 128 bits | 128 bits |
| Key length | 128 / 192 / 256 bits | 256 bits |
| Number of rounds | 10 / 12 / 14 | 9 + final key addition |
| How it was chosen | Open international competition | Developed under the regulator |
| Regulator | NIST (USA) | FSB of Russia (TC 26) |
After twenty years of public analysis, the best attacks on AES-128 (such as "biclique") cut the search only to about 2126 instead of 2128 — barely any gain at all. In practice that means there’s no shortcut: all that’s left is trying every key, and that’s impossible.
Even a quantum computer doesn’t save the attacker: Grover’s algorithm only "halves" the strength, turning a 256-bit key into the equivalent of a 128-bit one. That’s why AES-256 is considered resistant even to the quantum threat — and why it’s recommended for long-term protection.
The padlock in the address bar is most often AES-GCM: it encrypts almost all web traffic in TLS
WPA2/WPA3 protect your network with AES-CCM; encryption in popular messengers is built on AES too
BitLocker, FileVault and smartphone storage encryption all use AES; processors speed it up with AES-NI instructions
Now you understand both how AES works and why its openness doesn’t make it the single cipher for everyone: where the math ends, the question of trust and control begins
In the demo you’ll walk 16 bits all the way from plaintext to ciphertext and back — and see why this wall can’t be crossed without the key