AES stands for Advanced Encryption Standard (AES) and among many other use models such as the NSA, it is the encryption used by ScreenConnect to protect information between clients and hosts. The principal and requirements for AES were dictated by NIST (National Institute of Standards and Technology), however the ciphers themselves and much of the requirements were provided as part of feedback loop organized by NIST with experts and enthusiasts around the world. NIST had several requirements but the two most critical, that the cipher utilize a 128bit block size and have key sizes of 128, 192, or 256bits.

So why did NIST push for a new method to replace its existing DES cipher? Well that has to do with PC boom in the late 80’s and 90’s and the demand for larger amounts of data to be transferred securely. Some really smart people figured out that with a 64bit encryption that the chances of information leaking out would be very probably if the information packaged under one key exceeded 32GB. Therefore by moving to a 128 bit block length the opportunity for information leakage would not be likely until packets reached 256Exabytes which is considerably more than most people are sending today.

But what about brute force, is there a possibility someone can decipher the AES key? Deciphering an encrypted key is similar to figuring out a combination lock, but with a lot more possible combinations. The math is pretty straight forward but Wikipedia has one of the best examples I have seen to explain why breaking a 128 or 256 bit encryption is difficult to say the least. For our example we will ignore the power consumption of the computer assuming that it is possible for the computer to run long enough to crack the code and for the owner to pay the electricity bill. Instead we will focus on the time required to actually test all the possible combinations, but don’t forget even if they figure out the key they would still need software to apply the key, decipher the packet, and determine if the message makes sense. For a 128bit key all of the 2¹²⁸ possibilities would need to be checked. A device that can check one billion possible keys per second would have to run longer than the universe as theoretically existed in order to get close to cracking the code. That’s a long time in case anyone is keeping score.

Do you remember the shell game? The principal was quite simple; there is an object and three cups.  The owner of the game places the object under one of the three cups and then moves them around in what seems to be very unpredictable pattern.  The player has to watch the cup with the object and then find it when the owner stops moving them around.  Well these street games are not always fair, sometimes the owner cheats and removes the object or hides it through some sleight of hand.  But the principal of the game is about confusing the people watching, very similar to the way ciphers are used today to protect information. 

Claude Shannon in his paper Communication Theory of Secrecy Systems published in 1949 outlined the principals that still govern the general design of encryption systems today, confusion and diffusion.  In Shannon’s paper confusion is the process of making deciphering the ciphertext as difficult as possible unless you have the key.  The process involved replacing each character with a representing character or symbol from a lookup table.  Quite often the lookup tables would be quite elaborate not only taking into account the original character but also the neighboring characters and a host of other variables.  The diffusion would represent the next layer of protection, the redundancy of rearranging the characters and then running the ciphertext (the resulting text after the confusion layer) back through the lookup table a second or third time.  The result was a complex spider web of non-linear links and mathematical substitutions that is nearly impossible to backward engineer without the key. 

Mr. Shannon outlined the basic principals used by banks, government organizations, and little remote support tools like ScreenConnect to encrypt and protect information.  To learn more about Communication Theory of Secrecy Systems or Claude Shannon visit Wikipedia.org which provides a good overview of both and has links to other supporting sites.