I was looking through some apps to store my passwords in on the App Store when I found one that boasted an "AES 256 bit encryption system". Now that sounds all very good and well, but that doesn't mean anything to me if I don't know what it does and what level of security it actually provides. Can anyone give an explanation as to what it is? Thanks in advance.


Typically if encryption is used, it's proper encryption and the fault is in the implementation. Or if the implementation of the cryptosystem is perfect, there could still be a thousand other things wrong. I'm not sure you're asking the right question when asking whether AES is secure.

If you want to judge whether they know what they are doing, you could ask some technical questions like 'which block cipher mode of operation is used?' and 'what kind of MAC-algorithm do you use?', but it's never a guarantee.

To answer your question: AES is perfectly fine. To my knowledge, there are no known vulnerabilities that break the encryption, if it's used properly (i.e. no ECB mode, a proper IV, etc.).

Edit: In the time I wrote this, you got two downvotes. I'm pretty sure that's because people think "you can just google this," and as for AES itself, they are right. It's just not the right question to ask.

Kudos, though, for pausing to think about it! Too many people just glance over the specs when it sounds complicated and assume it's fine. I'm sorry I can't help more.

  • Good points, and really the critical thing for AES is "how secure is the key" meaning, did they derive the key from a thoroughly random and confidential source (like a long passphrase passed through a good hashing algorithm) – Jeff Meden Apr 26 '16 at 12:52
  • 1
    @Luc people aren't downvoting because OP is asking the wrong question but because the question they are asking is something that can be solved with a simple google search. If they came in here asking something like, "I understand what AES is but I seem to be having trouble understanding why ECB is considered insecure. Would someone be able to break down for me what security concerns there are regarding that encryption mode?" then I'm sure others would be all over it. This is especially true if they try to spell out their misconceptions in the question, showing research effort. – d0nut Apr 26 '16 at 14:43
  • 1
    @luc this question is just laziness. – d0nut Apr 26 '16 at 14:45
  • @lismathwizard "people aren't downvoting OP because he is asking the wrong question" I know, I said "pretty sure it's because you can google this". The "it's not the right question" is additional, and that's why I think it is worth asking and answering: someone is trying to understand this stuff. We could at least attempt answering it properly once and refer future users to this question/answer. I do totally see (and partly agree) with your point though, this question doesn't show much effort on their part. – Luc Apr 26 '16 at 23:01

Not the answer you're looking for? Browse other questions tagged or ask your own question.