Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I want to write AES from scratch without using the built in libraries of java. I know there are hundreds of AES programs (and websites) out there but I can't seem to find a site that gives me the details I think I would/should need to write my own Java program.

I know that AES has S-boxes like DES has. Were would I look for them? Also, I would like more info on the AES "counter mode".

share|improve this question
Just a note: For productive use, you often want to use existing implementations instead of creating your own, since they probably are better shielded against side-channel attacks, and might also be more efficient (e.g. might use AES-specific instructions on modern processors). For learning about the internal workings it is a good idea to implement it yourself, though. – Paŭlo Ebermann Sep 29 '11 at 23:50
For reference, a Java implementation of FIPS AES can be found in the Bouncy Castle open source project: – Gary Rowe Sep 30 '11 at 15:24
My python implementation of AES is supposed to be very easy to read, and it's got a good few comments. For what it's worth, it might help you or someone else implementing aes: A tip: read this code together with the wikipedia articles on AES. Most of the maths turns out to be really straightforward. – Stefano Palazzo Nov 9 '11 at 9:17
Thanks will do I really want to start learning Python. – Dennis Hayden Nov 10 '11 at 14:46
up vote 10 down vote accepted

The AES standard is reasonably clear, and (theoretically) sufficient to implement the AES itself. For block cipher modes of operation (including counter mode), see NIST Special Publication 800-38A.

share|improve this answer
This is great thanks for your help! – Dennis Hayden Sep 29 '11 at 13:59
Sections 4.2 and 4.3 will take you for quite an elevator ride :) I'm implementing this in higher level Javascript before attempting to do it in raw C for an Arduino project I'm working on. – Matt Borja Apr 9 '15 at 14:18

One thing I would like to add to Thomas's answer: when implementing a cipher, it's useful to have a test vector with the cipher intermediate states (if you get it right the first time, you don't need it; if you get a detail wrong, it makes finding that detail a lot easier).

The document has all those intermediate states (both for the key expansion and the actual block encrypt operations; the decrypt is just a reversal of the encrypt operations, so they don't need to spell it out explicitly).

share|improve this answer
While I do thanks you for the help. Thomas Pornin first link is the same as the one you posted. – Dennis Hayden Sep 29 '11 at 15:42
Oops, I missed that his 'The AES standard' was a link... – poncho Sep 29 '11 at 20:51

In the Rijndael proposal document a clear explanation of the possible implementations is given. It was later completed by D. J. Bernstein ( with further optimizations. However as said before, be careful of the possible side channel attacks which may applied to your implementation.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.