Lion Cipher Lab

Implement AES-128 from scratch, and verify it against the FIPS 197 vectors

• Foundations
• Advanced
• ~2 hours
• Free · no account required

Why it matters

AES is the cipher that protects almost everything: HTTPS, Wi-Fi, disk encryption, VPNs, messaging apps. Most people only ever call it from a library. This lab opens it up. You build AES-128 yourself in about 150 lines of plain Python, following the official US standard (FIPS 197), and you compute its famous S-box from first principles instead of copying a table. Then you prove it is right the way professionals do: NIST's worked examples, NIST's validation test vectors, and thousands of random blocks compared against OpenSSL. You also measure the ideas behind the design. You watch one flipped…

What you'll learn

• doing arithmetic in GF(2^8), the 256-element field AES lives in: XOR as addition, xtime and multiplication modulo x^8+x^4+x^3+x+1, inverses as b^254 (and checking {57} x {13} = {fe} from FIPS 197)
• deriving the AES S-box from the multiplicative inverse plus the affine map instead of pasting it, and proving it: 256/256 against FIPS 197 Table 4, 0 fixed points, best linear approximation only 144/256
• implementing key expansion, SubBytes, ShiftRows, MixColumns, AddRoundKey and the full inverse cipher, and matching all 44 key-expansion words of FIPS 197 Appendix A.1 and every round-1 state of Appendix B
• verifying against the NIST AESAVS known-answer tests (7 GFSbox, 21 KeySbox, 128 VarTxt, 128 VarKey) and a seeded differential run against openssl enc -aes-128-ecb -nopad (2000/2000 blocks)
• catching the round-trip trap: a mirrored ShiftRows bug passes 500/500 encrypt-then-decrypt tests and fails the first official vector
• measuring diffusion round by round (one flipped plaintext bit changes 16 bits after round 1 and 64 of 128 after round 2) and showing that without MixColumns AES falls to a 256-block lookup table
• showing on synthetic records why a correct block cipher is not encryption by itself: ECB repeated 593 of 900 blocks and grouped staff by department; CTR hid that but let a ciphertext edit pass silently
• explaining why software table-lookup AES leaks keys through cache timing (Bernstein 2005; Osvik, Shamir, Tromer 2005) and measuring what AES-NI buys (about 24-26x over OpenSSL's own software path, 150,000-190,000x over pure Python)

Steps in this lab

1. What you are building, and the words you need
2. Set up: a terminal, Python, OpenSSL and a lab folder
3. Write AES-128: the field, the S-box, the key schedule, the rounds
4. Check the S-box you derived against FIPS 197, and measure it
5. Verify against the FIPS 197 examples and the NIST AESAVS vectors
6. Differential test against OpenSSL on 2,000 random blocks
7. Plant a bug: the round-trip test passes, the first vector catches it
8. Measure diffusion round by round, with and without MixColumns
9. Break AES without MixColumns with 256 chosen blocks
10. A correct block cipher is still not encryption: ECB leaks, CTR is malleable
11. Why your AES must never ship: speed, AES-NI and cache timing
12. Do it better: how a professional uses and tests AES

Open the full interactive lab →