How to Encrypt with AES

Problem

You need to encrypt data using AES so that only someone with the same key can decrypt it.

Prerequisites

• Understanding of symmetric encryption
• Knowledge of keys and IVs

Steps

1. 1. Generate or obtain a key

   AES supports 128, 192, or 256-bit keys. Generate a cryptographically random key of the chosen size. Never derive a key from a password by simple hashing; use a KDF like PBKDF2 or scrypt instead.

   Input

   256-bit key

   Output

   32 random bytes

2. 2. Generate an IV or nonce

   For modes like CBC and CTR, generate a random 16-byte IV for each encryption. The IV does not need to be secret but must be unique and unpredictable. Reusing an IV with the same key is catastrophic for security.

   Input

   random IV

   Output

   16 random bytes

3. 3. Encrypt and store the IV with the ciphertext

   Encrypt the plaintext using the key, IV, and chosen mode. Store the IV alongside the ciphertext (it is needed for decryption). Use an authenticated mode like GCM to get both confidentiality and integrity.

   Input

   plaintext + key + IV

   Output

   ciphertext + IV + tag

Expected result

Ciphertext that can only be decrypted with the same key and IV, with integrity protection if using GCM.

Common errors

Reusing the same IV with the same key

Generate a fresh random IV for every encryption. Never hardcode or reuse an IV.

Using ECB mode

ECB reveals patterns in the plaintext. Always use CBC, CTR, or preferably GCM for authenticated encryption.

Troubleshooting

• If decryption produces garbage, verify the key, IV, and mode match on both sides.
• If using GCM, ensure the authentication tag is verified before using the decrypted data.

Security limits

• AES is only as secure as its key. Store keys in a secure key store, never in source code or config files.
• This tool runs locally. No key or plaintext is transmitted.